Cisco Talos’ Vulnerability Discovery & Research team recently disclosed three vulnerabilities in Foxit PDF Editor, one in the Epic Games Store, and twenty-one in MedDream PACS..
For Snort coverage that can detect the exploitation of these vulnerabilities, download the latest rule sets fromSnort.org, and our latest Vulnerability Advisories are always posted onTalos Intelligence’s website.
Foxit privilege escalation and use-after-free vulnerabilities
Discovered by KPC of Cisco Talos.
Foxit PDF Editor is a popular PDF handling platform for editing, e-signing, and collaborating on PDF documents. Talos found three vulnerabilities:
TALOS-2025-2275 (CVE-2025-57779) is a privilege escalation vulnerability in the installation of Foxit PDF Editor via the Microsoft Store. A low-privilege user can replace files during the installation process, which may result in elevation of privileges.
TALOS-2025-2277 (CVE-2025-58085) and TALOS-2025-2278 (CVE-2025-59488) are use-after-free vulnerabilities, one in the way Foxit Reader handles a Barcode field object, and one in the way Foxit Reader handles a Text Widget field object. A specially crafted JavaScript code inside a malicious PDF document can trigger these vulnerabilities, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger these vulnerabilities. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
Epic Games local privilege escalation vulnerability
Discovered by KPC of Cisco Talos.
Epic Games Store is a storefront application for purchasing and accessing video games. Talos found TALOS-2025-2279 (CVE-2025-61973), a local privilege escalation vulnerability in the installation of Epic Games Store via the Microsoft Store. A low-privilege user can replace a DLL file during the installation process, which may result in elevation of privileges.
Discovered by Marcin “Icewall” Noga of Cisco Talos.
MedDream PACS server is a medical-integration system for archiving and communicating about DICOM 3.0 compliant images. Talos found 21 reflected cross-site scripting (XSS) vulnerabilities across several functions of MedDream PACS Premium 7.3.6.870. An attacker can provide a specially crafted URL to trigger these vulnerabilities, which can lead to arbitrary JavaScript code execution.
Most SOC teams are overloaded with routine work. Tier 1 & 2 analysts spend too much time validating alerts, moving samples between tools, and chasing missing context. When integrations are weak, investigations slow down, MTTR grows, and SLAs suffer delays. That directly increases operational risk and cost for the business.
ANY.RUN has already helped teams close part of this gap with continuous, high-quality Threat Intelligence Feeds. Now, with the ANY.RUN Sandbox integration for MISP, analysts can go further: enrich alerts with real execution behavior, speed up triage, and use actionable evidence to stop incidents before they have a chance to escalate.
ANY.RUN x MISP: Boost Your Triage & Response
With this integration, analysts can send suspicious files and URLs from MISP straight into the ANY.RUN Sandbox. The integration is deployed through native MISP modules. There is no need to export samples or switch tools. Everything happens inside the analyst’s usual workspace.
MISP “Phishing attempt” event enriched with ANY.RUN Sandbox and phishing-related tags
The analysis uses Automated Interactivity, which means the sandbox behaves like a real user. It clicks, opens files, and waits when needed. This matters because many modern threats stay quiet until they see user activity.
As a result, the sandbox reveals evasive malware that most detection systems miss, giving the SOC earlier and clearer signals.
After execution, the results are automatically returned to MISP, including the verdict, related IOCs, a link to the interactive analysis session, an HTML report, and mapped MITRE ATT&CK techniques and tactics.
MITRE ATT&CK technique (T1082 – System Information Discovery) expanded inside MISP, displaying its description and related metadata
Here’s what your SOC can do with the integration:
Catch evasive threats earlier by triggering delayed or user-driven malware behavior that bypasses traditional detection.
Validate alerts using real execution evidence instead of relying on static indicators.
Lower incident costs: Shorter investigations reduce operational effort per case.
Reduced MTTR: Faster response limits business impact.
Stronger SLA performance: Help MSSPs meet response time and quality commitments.
No extra headcount: Scale SOC performance without growing the team.
Zero integration costs: No need for custom development if MISP is already in use.
Enriched MISP event attributes, including the ANY.RUN verdict, report, & IOC
For MSSPs, the integration helps meet customer SLA requirements by reducing response times, increasing analysis quality, and improving the overall value of managed security services without increasing operational costs.
Expand Threat Coverage in MISP with ANY.RUN TI Feeds
TI Feeds contribute to your company’s proactive defense and help you catch attacks early
ANY.RUN’s Threat Intelligence Feeds continuously deliver verified malicious network IOCs extracted from real attacks observed across more than 15,000 organizations. Indicators come directly from live sandbox executions and are delivered in STIX/TAXII format, ready for use in MISP, SIEM, or SOAR platforms.
The ANY.RUN Sandbox integration turns MISP into a practical investigation tool, not just an IOC repository. Analysts get real behavior, faster verdicts, and better context without changing how they work. TI Feeds add continuous visibility into active attacker infrastructure. Together, these capabilities reduce MTTR, lower analyst workload, and help protect the business more effectively.
ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions trusted by more than 500,000 cybersecurity professionals and 15,000 organizations worldwide.
The platform gives defenders a clear view of real attacker behavior by combining:
Interactive Sandbox: Runs files, URLs, and entire infection chains with automatic user-like activity to reveal tactics hidden from classic detection tools.
Threat Intelligence Lookup: Verified reputation data, history, and related indicators gathered from real attacks.
TI Feeds: Continuous delivery of fresh, confirmed-malicious network indicators in STIX/TAXII format.
Enterprise-grade workflows: API, SDK, SSO, teamwork tools, and privacy-focused private analysis modes for large SOCs and MSSPs.
ANY.RUN helps analysts work faster, strengthen decisions, and investigate advanced threats with clarity and confidence.
FAQ
Do analysts have to download samples before sending them to the sandbox?
No. The integration sends files/URLs directly from the MISP event to ANY.RUN. Everything stays in the same workflow.
How does Automated Interactivity help?
Some malware won’t run until it sees something that looks like a real human action, opening a document, clicking a dialog, waiting a few seconds, or browsing a link. Automated Interactivity performs those actions, helping expose behavior that static tools or non-interactive sandboxes never trigger.
Does this integration help reduce MTTR?
Yes. Analysts can confirm or dismiss alerts faster because they work with real execution evidence, not just metadata. This speeds up triage, shortens response cycles, and lowers the number of cases that require escalation.
Can MSSPs use this to improve their SLAs?
Yes. Faster verdicts, better evidence, and fewer manual steps mean MSSPs can return higher-quality reports to customers and stay within SLA targets without increasing team size.
Is there any cost to enabling the MISP integration?
The MISP modules are built into the platform and can be enabled without custom development. However, running analyses still requires an active ANY.RUN subscription. Once the account is connected, the integration can be used right away.
How do TI Feeds fit into this workflow?
TI Feeds bring fresh, confirmed-malicious indicators into MISP through STIX/TAXII. They complement sandbox analysis by improving correlation and early detection.
A newly discovered vulnerability named WhisperPair can turn Bluetooth headphones and headsets from many well-known brands into personal tracking beacons — regardless of whether the accessories are currently connected to an iPhone, Android smartphone, or even a laptop. Even though the technology behind this flaw was originally developed by Google for Android devices, the tracking risks are actually much higher for those using vulnerable headsets with other operating systems — like iOS, macOS, Windows, or Linux. For iPhone owners, this is especially concerning.
Connecting Bluetooth headphones to Android smartphones became a whole lot faster when Google rolled out Fast Pair, a technology now used by dozens of accessory manufacturers. To pair a new headset, you just turn it on and hold it near your phone. If your device is relatively modern (produced after 2019), a pop-up appears inviting you to connect and download the accompanying app, if it exists. One tap, and you’re good to go.
Unfortunately, it seems quite a few manufacturers didn’t pay attention to the particulars of this tech when implementing it, and now their accessories can be hijacked by a stranger’s smartphone in seconds — even if the headset isn’t actually in pairing mode. This is the core of the WhisperPair vulnerability, recently discovered by researchers at KU Leuven and recorded as CVE-2025-36911.
The attacking device — which can be a standard smartphone, tablet or laptop — broadcasts Google Fast Pair requests to any Bluetooth devices within a 14-meter radius. As it turns out, a long list of headphones from Sony, JBL, Redmi, Anker, Marshall, Jabra, OnePlus, and even Google itself (the Pixel Buds 2) will respond to these pings even when they aren’t looking to pair. On average, the attack takes just 10 seconds.
Once the headphones are paired, the attacker can do pretty much anything the owner can: listen in through the microphone, blast music, or — in some cases — locate the headset on a map if it supports Google Find Hub. That latter feature, designed strictly for finding lost headphones, creates a perfect opening for stealthy remote tracking. And here’s the twist: it’s actually most dangerous for Apple users and anyone else rocking non-Android hardware.
Remote tracking and the risks for iPhones
When headphones or a headset first shake hands with an Android device via the Fast Pair protocol, an owner key tied to that smartphone’s Google account is tucked away in the accessory’s memory. This info allows the headphones to be found later by leveraging data collected from millions of Android devices. If any random smartphone spots the target device nearby via Bluetooth, it reports its location to the Google servers. This feature — Google Find Hub — is essentially the Android version of Apple’s Find My, and it introduces the same unauthorized tracking risks as a rogue AirTag.
When an attacker hijacks the pairing, their key can be saved as the headset owner’s key — but only if the headset targeted via WhisperPair hasn’t previously been linked to an Android device and has only been used with an iPhone, or other hardware like a laptop with a different OS. Once the headphones are paired, the attacker can stalk their location on a map at their leisure — crucially, anywhere at all (not just within the 14-meter range).
Android users who’ve already used Fast Pair to link their vulnerable headsets are safe from this specific move, since they’re already logged in as the official owners. Everyone else, however, should probably double-check their manufacturer’s documentation to see if they’re in the clear — thankfully, not every device vulnerable to the exploit actually supports Google Find Hub.
How to neutralize the WhisperPair threat
The only truly effective way to fix this bug is to update your headphones’ firmware, provided an update is actually available. You can typically check for and install updates through the headset’s official companion app. The researchers have compiled a list of vulnerable devices on their site, but it’s almost certainly not exhaustive.
After updating the firmware, you absolutely must perform a factory reset to wipe the list of paired devices — including any unwanted guests.
If no firmware update is available and you’re using your headset with iOS, macOS, Windows, or Linux, your only remaining option is to track down an Android smartphone (or find a trusted friend who has one) and use it to reserve the role of the original owner. This will prevent anyone else from adding your headphones to Google Find Hub behind your back.
The update from Google
In January 2026, Google pushed an Android update to patch the vulnerability on the OS side. Unfortunately, the specifics haven’t been made public, so we’re left guessing exactly what they tweaked under the hood. Most likely, updated smartphones will no longer report the location of accessories hijacked via WhisperPair to the Google Find Hub network. But given that not everyone is exactly speedy when it comes to installing Android updates, it’s a safe bet that this type of headset tracking will remain viable for at least another couple of years.
Want to find out how else your gadgets might be spying on you? Check out these posts:
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-01-21 12:06:442026-01-21 12:06:44How to protect yourself from Bluetooth-headset tracking and the WhisperPair attack | Kaspersky official blog
A growing skepticism around JA3 is evident, and quite understandable as well. Public lists are rarely updated, and initiatives like JA3-fingerprints have been effectively frozen since 2021, creating the impression that this is a “yesterday’s technology.”
However, JA3 fingerprints have not disappeared. Sensors continue to collect them, they appear in reports and threat intelligence interfaces; it’s just that many teams treat them formally, as yet another field in logs without meaningful analysis.
Key Takeaways
JA3 fingerprints represent tool-level pyramid of pain, not disposable indicators like IPs or domains.
Frequency analysis of JA3 hashes can surface new malicious tooling early, before signatures exist.
JA3 can rarely be useful in isolation; context such as SNI, JA3S, URI, and host telemetry is critical.
Threat hunting with JA3 enables analysts to cluster activity across samples, sessions, and campaigns.
Threat Intelligence Lookup operationalizes JA3 by enabling fast pivots from a hash to malware, infrastructure, and TTPs.
JA3 Is Obsolete? That’s Only Half the Truth
Technically, JA3 is straightforward to compute. It is built from TLS ClientHello parameters (version, cipher suites, extensions, supported groups/elliptic curves, EC point formats), forming a JA3 string:
Lists are separated by “-”, fields by “,”, and an MD5 hash is calculated from this string. Unlike an IP, domain, or file hash, JA3 describes a long-term network profile of a tool that tends to repeat across many samples using the same network module.
This places JA3 at the Tools level in the Pyramid of Pain. The paradox is that threat intelligence feeds are often overloaded with “cheap” IOCs (IPs, domains, SHA256 hashes, etc.), while more resilient behavioral indicators like JA3 remain underutilized.
There is, however, a downside: the same JA3 can appear in both legitimate and malicious applications (if they share the same TLS library), and attackers can deliberately mimic the profiles of popular clients — Google Chrome, Firefox, or Edge. Treating JA3 as a classic IOC (“hash → malware family”) without context is therefore risky: without additional data (SNI, URI, JA3S, host information, or session behavior), it can confuse SOC analysts more than help them.
JA3 becomes truly powerful only when it is searchable, pivotable, and enriched with context. This is where ANY.RUN’s Threat Intelligence Lookup can assist SOC and Threat Hunting (TH) teams in turning JA3 from a mere log field into a practical investigation driver: quickly finding related malware samples, pivoting across infrastructure, and validating hypotheses with context. The approach ANY.RUN offers — backed by real-world case studies — is described below.
Applying JA3 in Practice
If a SOC systematically collects JA3 hashes and tracks their frequency, the dynamics of these values become informative on their own. A sudden spike in a previously rare JA3 hash often signals the emergence of a new tool, script, or automated client in the infrastructure. This anomalous growth enables early identification of potentially malicious components even before signatures or full behavioral profiles are available, turning JA3 into an early-warning indicator and a starting point for deeper investigation.
Check JA3 hashes at https://intelligence.any.run
ANY.RUN used a similar methodology to select the JA3 hashes discussed here. We took all the unique analyses from our Sandbox for the past 30 days, grouped them by JA3, and calculated the number of unique malicious and informational (info) analyses for each hash. We then filtered for suspicious JA3 hashes where info- analyses comprised less than 15% of malicious analyses and sorted by the number of unique malicious analyses (descending).
One of the top suspicious JA3 hashes was a85be79f7b569f1df5e6087b69deb493, which is strictly associated with Remcos RAT. Such fingerprints can be used directly in protective tools or for threat hunting without additional context:
Search by ja3 hash in Threat Intelligence Lookup links it to known malware
Note how TI Lookup highlights the threat landscape trends. It builds a real-time snapshot of industries and countries most associated with the threat or indicators you queried. It shows exactly how a given threat or indicator maps to specific sectors and countries, so you see whether it really matters for your business. TI Lookup with the geo & threat landscape functionality is available to all Premium subscription users.
Turn JA3 hashes into investigation leads and cut triage & response time with TI Lookup
Now let’s consider a situation where JA3 is associated with malware, but clarifying context is needed. For example, JA3 hash e7d705a3286e19ea42f587b344ee6865 in the ANY.RUN Sandbox is strictly associated with WannaCry. Yet the hash itself belongs to an old version of TOR.
SOC analysts should still pay attention to this hash and decide whether to add it as an IOC to monitoring tools.
JA3 can also help detect riskware applications — useful for SOC teams if such software is not allowed in the infrastructure. In this example, LogMeIn Rescue remote support tool has been detected:
Now let’s examine a less straightforward case: JA3 hash e69402f870ecf542b4f017b0ed32936a. Here we’ve got numerous info-analyses in absolute terms (though still <15% of malicious ones). We cannot definitively label this as malware, but the example perfectly illustrates how JA3 can be effectively used in threat hunting:
The Connections tab also shows TLS handshake details for interactions with gofile.io and discord.com.
Interactions with gofile.io
Inspecting the HTTP stream reveals both the stolen data and the name of the tool responsible for exfiltration.
Discord data exfiltration
As a result, we’ve expanded the attacker’s TTPs by identifying their exfiltration methods. Other sandbox analysis sessions found by this JA3 hash in ANY.RUN TI Lookup also reveal other exfiltration platforms used by the same tool or its fork, for example:
From these cases, we can conclude that attackers are using the same Go-based utility (or its fork) belonging to the Skuld malware family to exfiltrate data via Discord, Telegram, and GoFile, often first checking the victim’s geolocation via ip-api[.]com.
Conclusion
Threat hunting with JA3 hashes allows SOC teams to expand the context of network threats: from a single suspicious session to a cluster of related activity, a persistent network profile, and recurring communication patterns. Combined with SNI, JA3S, URI, infrastructure indicators, and host telemetry, JA3 helps not only find similar network sessions and accelerate investigations but also confidently link activity to specific malware families and highlight characteristic TTPs, turning fragmented signals into a complete attack picture.
ANY.RUN Threat Intelligence is designed to help with exactly these tasks. Start with checking your JA3 hash in TI Lookup.
A single query reveals associated malware families, exfiltration channels, dropped files, and related network activity. This dramatically accelerates pivoting, hypothesis validation, and threat hunting. For any SOC or Threat Hunting team looking to detect attacker tools earlier and more reliably, TI Lookup’s JA3 search capability is an indispensable daily solution.
About ANY.RUN
ANY.RUN provides interactive malware analysis and threat intelligence solutions used by 15,000 SOC teams to investigate threats and verify alerts. They enable analysts to observe real attacker behavior in controlled environments and access context from live attacks. The services support both hands-on investigation and automated workflows and integrates with SIEM, SOAR, and EDR tools commonly used in security operations.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-01-21 08:06:392026-01-21 08:06:39From Forgotten Tool to Powerful Pivot: Using JA3 to Expose Attackers’ Infrastructure
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-01-21 06:06:392026-01-21 06:06:39Old habits die hard: 2025’s most common passwords were as predictable as ever
Hacktivists moved well beyond their traditional DDoS attacks and website defacements in 2025, increasingly targeting industrial control systems (ICS), ransomware, breaches, and data leaks, as their sophistication and alignment with nation-state interests grew.
That was one of the conclusions in Cyble’s exhaustive new 2025 Threat Landscape report, from which this blog was adapted.
Looking ahead to 2026 and beyond, Cyble expects critical infrastructure attacks by hacktivists to continue to grow, increasing use of custom tools by hacktivists, and deepening alignment between nation-state interests and hacktivists.
ICS Attacks by Hacktivists Surge
Between December 2024 and December 2025, several hacktivist groups increased their focus on ICS and operational technology (OT) attacks. Z-Pentest was the most active actor, conducting repeated intrusions against a wide range of industrial technologies. Dark Engine (Infrastructure Destruction Squad) and Sector 16 persistently targeted ICS, primarily exposing Human Machine Interfaces (HMI).
A secondary tier of groups, including Golden Falcon Team, NoName057 (16), TwoNet, RipperSec, and Inteid, also claimed to have conducted recurrent ICS-disrupting attacks, albeit on a smaller scale.
HMI and web-based Supervisory Control and Data Acquisition (SCADA) interfaces were the most frequently targeted systems, followed by a limited number of Virtual Network Computing (VNC) compromises, which posed the greatest operational risks to several industries.
Building Management System (BMS) platforms and Internet of Things (IoT) or edge-layer controllers were also targeted in increasing numbers, reflecting the broader exploitation of weakly secured IoT interfaces.
Europe remained the primary region affected by pro-Russian hacktivist groups, with sustained targeting of Spain, Italy, the Czech Republic, France, Poland, and Ukraine contributing to the highest concentration of ICS-related intrusions.
The Intersection of State Interests and Hacktivism
State-aligned hacktivist activity remained persistent throughout 2025. Operation Eastwood (14–17 July) disrupted NoName057(16)’s DDoS infrastructure, prompting swift retaliatory attacks from the hacktivist group. The group rapidly rebuilt capacity and resumed operations against Ukraine, the EU, and NATO, underscoring the resilience of state-directed ecosystems.
U.S. indictments and sanctions further exposed alleged structured cooperation between Russian intelligence services and pro-Kremlin hacktivist fronts. The Justice Department detailed GRU-backed financing and tasking of the Cyber Army of Russia Reborn (CARR), as well as the state-sanctioned development of NoName057(16)’s DDoSia platform.
Z-Pentest, identified as part of the same CARR ecosystem and attributed to GRU, continued targeting EU and NATO critical infrastructure, reinforcing the convergence of activist personas, state mandates, and operational doctrine.
Pro-Ukrainian hacktivist groups, though not formally state-directed, conducted sustained, destructive operations against networks linked to the Russian military. The BO Team and the Ukrainian Cyber Alliance conducted several data destruction and wiper attacks, encrypting key Russian businesses and state machinery. Ukrainian actors repeatedly stated that exfiltrated datasets were passed to national intelligence services.
Hacktivist groups Cyber Partisans BY (Belarus) and Silent Crow claimed a year-long Tier-0 compromise of Aeroflot’s IT environment, allegedly exfiltrating more than 20TB of data, sabotaging thousands of servers, and disrupting core airline systems, a breach that Russia’s General Prosecutor confirmed caused significant operational outages and flight cancellations.
Research into BQT.Lock (BaqiyatLock) suggests a plausible ideological alignment with Hezbollah, as evidenced by narrative framing and targeting posture. However, no verifiable technical evidence has confirmed a direct organizational link.
Cyb3r Av3ngers, associated with the Islamic Revolutionary Guard Corps (IRGC), struck critical infrastructure assets, including electrical networks and water utilities in Israel, the United States, and Ireland. After being banned on Telegram, the group resurfaced under the alias Mr. Soul Team.
Tooling and capability development by hacktivist groups also grew significantly in 2025. Observed activities have included:
Notable growth in custom tool creation (e.g., BQT Locker and associated utilities), including the adoption of ransomware as a hacktivist mechanism.
Actors are increasingly using AI-generated text and imagery for propaganda and spreading misinformation and disinformation.
Tool promotion and marketing is becoming an emerging driver fueling hacktivism.
Hacktivist Sightings Surged 51% in 2025
In 2025, hacktivism evolved into a globally coordinated threat, closely tracking geopolitical flashpoints. Armed conflicts, elections, trade disputes, and diplomatic crises fueled intensified campaigns against state institutions and critical infrastructure, with hacktivist groups weaponizing cyber-insurgency to advance their propaganda agendas.
Pro-Ukrainian, pro-Palestinian, pro-Iranian, and other nationalist groups launched ideologically driven campaigns tied to the Russia-Ukraine War, the Israel-Hamas conflict, Iran-Israel tensions, South Asian tensions, and the Thailand-Cambodia border crisis. Domestic political unrest in the Philippines and Nepal triggered sustained attacks on government institutions.
Cyble recorded a 51% increase in hacktivist sightings in 2025, from 700,000 in 2024 to 1.06 million in 2025, with the bulk of activity focused on Asia and Europe (chart below).
Pro-Russian state-aligned hacktivists and pro-Palestinian, anti-Israel collectives continued to be the primary drivers of hacktivist activity throughout 2025, shaping the operational tempo and geopolitical focus of the threat landscape.
Alongside these dominant ecosystems, Cyble observed a marked increase in operations by Kurdish hacktivist groups and emerging Cambodian clusters, both of which conducted campaigns closely aligned with regional strategic interests.
Below are some of the major hacktivist groups of 2025:
India, Ukraine, and Israel were the countries most impacted by hacktivist activity in 2025 (country breakdown below).
Among global regions targeted, Europe and NATO faced a sustained pro-Russian campaign marked by coordinated DDoS attacks, data leaks, and escalating ICS intrusions against NATO and EU member states. Government & LEA, Energy & Utilities, Manufacturing, and Transportation were consistent targets.
In the Middle East, Israel remains the principal target amid the Gaza conflict-related escalation, Iran-Israel confrontation, and Yemen-Saudi hostilities. Saudi Arabia, UAE, Egypt, Jordan, Iraq, Syria, and Yemen faced sustained DDoS attacks, defacements, data leaks, and illicit access to exposed ICS assets from ideologically aligned coalitions operating across the region.
In South Asia, India-Pakistan and India-Bangladesh tensions fueled high-volume, ideologically framed offensives, peaking around political flashpoints and militant incidents. Activity concentrated on Government & LEA, BFSI, Telecommunication, and Education.
In Southeast Asia, border tensions and domestic unrest shaped a fragmented but active theatre: Thailand-Cambodia conflicts triggered reciprocal DDoS and defacements; Indonesia & Malaysia incidents stemmed from political and social disputes; the Philippines saw attacks linked to internal instability; and Taiwan emerged as a recurring target for pro-Russian actors.
Below are some of the major hacktivist campaigns of 2025:
Most Impacted Industries and Sectors
2025 witnessed a marked expansion of hacktivist focus across multiple industries. Government & LEA, Energy & Utilities, Education, IT & ITES, Transportation & Logistics, and Manufacturing experienced the most pronounced growth in targeting, driving the year’s overall increase in operational activity.
The dataset also reveals a broadened attack surface, with several new or significantly expanded categories, including Agriculture & Livestock, Food & Beverages, Hospitality, Construction, Automotive, and Real Estate.
Government & LEA was the most impacted sector by a wide margin, followed by Energy & Utilities (chart below).
The Evolution of Hacktivism
Hacktivism has evolved into a geopolitically charged, ICS-focused threat, continuing to exploit exposed OT environments and increasingly weaponizing ransomware as a protest mechanism.
In 2026, hacktivists and cybercriminals will increasingly target exposed HMI/SCADA systems and VNC takeovers, aided by public PoCs and automated scanning templates, creating ripple effects across the energy, water, transportation, and healthcare sectors.
Hacktivists and state actors will increasingly employ financially motivated tactics and appearances. State actors in Iran, Russia, and North Korea will increasingly adopt RaaS platforms to fund operations and maintain plausible deniability. Critical infrastructure attacks in Taiwan, the Baltic states, and South Korea will appear financially motivated while serving geopolitical objectives, complicating attribution and response.
Critical assets should be isolated from the Internet wherever possible, and operational technology (OT) and IT networks should be segmented and protected with Zero Trust access controls. Vulnerability management, along with network and endpoint monitoring and hardening, is another critical cybersecurity best practice.
Cyble’s comprehensive attack surface management solutions can help by scanning network and cloud assets for exposures and prioritizing fixes, in addition to monitoring for leaked credentials and other early warning signs of major cyberattacks. Get a free external threat profile for your organization today.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-01-20 12:06:352026-01-20 12:06:35Critical Infrastructure Attacks Became Routine for Hacktivists in 2025
Summarizing the past year’s threat landscape based on activity observed in ANY.RUN’s Interactive Sandbox, this annual report provides insights into the most detected malware types, families, TTPs, and phishing threats of 2025.
Threat activity surged, with total sandbox sessions up 72% and malicious detections growing proportionally, reflecting increased frequency and depth of analysis among SOCs.
Stealers and RATs maintain dominance, tripling in activity compared to 2024.
Lumma and XWorm led malware family rankings, highlighting sustained reliance and mature and adaptable malicious ecosystems.
Phishing, driven by MFA-bypassing PhaaS kits like Tycoon 2FA and EvilProxy, evolved into an advanced malicious vector.
Widespread TTPs shifted toward stealth and trust abuse, with root certificate installation as the most detected technique of the year.
Summary
2025 Sandbox activity summary
Total
6,891,075
Malicious
1,401,910
Suspicious
430,223
IOCs
3,807,063,591
In 2025, ANY.RUN experienced significant growth alongside a rise in malicious activity. The numbers reflect a substantial growth of deep investigations and the detections of evasive threats facilitated by Interactive Sandbox:
6.8 million sandbox sessions were launched — +72.2% compared to 2024.
The number of malicious samples grew by a similar number: 77.3%. This shows that the overall sandbox activity and malicious detections grow proportionally.
Suspicious samples more than doubled and rose from 211,517 in 2024 to 430,223 in 2025.
The total number of IOCs collected by ANY.RUN’s global community: 3.8 billion, nearly 2 billion more than the year before.
As investigation volume and behavioral visibility increase, 15K+ security teams gain earlier detection, richer context, and faster response capabilities with ANY.RUN.
Interactive Sandbox helps them ensure a strong, enterprise-grade defense system by enabling:
Early Detection: Minimize risks to safeguard your infrastructure and reputation with 36% higher detection rates.
Higher Efficiency & ROI: Cut MTTR by 21 minutes to power quicker incident resolution.
Smarter Decision-Making: Flexible solutions enhance visibility into threats for insights-driven action.
The upper part of the most active malware types chart closely resembles that of 2024. The top four most detected threats remained unchanged, underscoring the long-term impact and growth in activity of Stealer and RAT (their intensity grew 3x), Loader (2.5x) and Ransomware (2x) malware.
Other types have seen notable growth, too. Particularly dramatic increases are seen in Backdoor and Adware attacks. This points to an ongoing trend towards persistent access, credential theft, and multi-stage malware campaigns as opposed to short-spanned attacks.
A new addition to the list is Botnet with 21K+ detections that secured fifth place for this malware type.
From 2024 to 2025, most recurring malware families at least doubled in activity, as indicated by ANY.RUN’s statistics.
XWormthat led the ranking in 2024 was detected 4.3x times more often in 2025. Despite the sharp growth, it moved a place down and gave way to Lumma, this year’s leader, which grew from 12K to 31K+ detections.
Third and fourth places are taken by AsyncRATand Remcos: both doubled in activity and were detected roughly 16K times.
A notable 3x growth in activity is seen in Snakethreats, which occupied sixth place with 13,556 total detections.
Quasarand Vidarfamilies newly entered the top list, signaling renewed RAT and stealer diversification.
You can browse Threat Intelligence Lookup for further insights into threats relevant for you country or industry. For that, use requests like:
Phishing remained a key initial infection and credential-harvesting method throughout 2025. In ANY.RUN’s Interactive Sandbox, phishing-related activity was detected 541,225 times.
Among key APT groups, Storm-1747 dominated the list consistently from Q1 through Q4, accounting for a total of 92,147 detections.
TA569 held second position from quarter to quarter as well, with 11K detections overall.
The dominance of these actors over the months highlights the superiority of these groups on the threat landscape, which allows them to take up a disproportionately large share of phishing operations.
The year’s top three is concluded by Storm-1575 with significantly fewer detections than the chart’s leaders, emphasizing the gap between the leading actors and other groups.
Phishing Kits
Kit
Total Detections
Tycoon2FA
107,125
EvilProxy
37,524
Sneaky2FA
15,546
Mamba2FA
13,582
WikiKit
5,132
Tycoon2FAand EvilProxyreigned among most detected phishing kits throughout the year. Their total number of detections: 107,125 and 37,524 respectively, underscoring a clear dominance of phishing-as-a-service (PhaaS) platforms capable of bypassing multi-factor authentication at scale.
Third place is taken by Sneaky2FA, another threat that has shown steady growth from quarter to quarter, reflecting focus on session hijacking and interception of credentials in real time.
The top five in 2025 phishing threats is rounded out by Mamba2FAand WikiKit, with roughly 13.5K and 5K total detections respectively.
These figures prove that phishing has evolved into a large-scale threat built around MFA abuse, modular tooling, and reusable infrastructures.
Live threat intelligence impacts the key performance metrics
You can ensure eraly threat detection of phishing threats like Tycoon2FA, EvilProxy, and more with Threat Intelligence Feeds delivering 99% unique threat data directly into your SIEM and other security solutions.
Refine Detection and Response: Indicators like IPs, URLs, and domains are enriched with threat context, making it possible to power your SOC for proactive defense.
Mitigate Breach Risks: 15,000 companies contribute to TI Feeds data in real time, instantly expanding your threat coverage and visibility to helps you stay ahead.
3x Performance Rates: Filtered, noise-free indicators safely delivered via STIX/TAXII beat alert fatigue and enforce early detection.
TI Feeds provides fresh data from 15,000 organizations
99% unique threat intel for your SOC Catch attacks early to protect your business
The list of top protectors and packers used by attackers during 2025 remained mostly stable throughout the year, reflecting continued reliance on established obfuscation tools.
The ultimate leader is UPX with a significant gap from other packers secured by 45K+ detections.
It’s followed by NETReactor with 24K+ detections and Themidawith 16K+, both commonly leveraged to protect commodity malware and evade static analysis.
TOP TTPs
Top MITRE ATT&CK TTPs 2025
Rank
TTP ID
Name
Total Detections
1
1553.004
Subvert Trust Controls: Install Root Certificate
385,915
2
1036.003
Masquerading: Rename Legitimate Utilities
304,926
3
1059.003
Command and Scripting Interpreter: Windows Command Shell
257,253
4
1497.003
Virtualization/Sandbox Evasion: Time Based Checks
255,303
5
1059.001
Command and Scripting Interpreter: PowerShell
235,402
6
1547.001
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
172,330
7
1053.005
Scheduled Task/Job: Scheduled Task
158,154
8
1569.002
System Services: Service Execution
111,354
9
1036.005
Masquerading: Match Legitimate Name or Location
108,328
10
1218.011
System Binary Proxy Execution: Rundll32
72,162
Among widespread TTPs, a new 2025 leader is T1553.004 – Subvert Trust Controls: Install Root Certificate with 385K+ detections. This technique didn’t appear on the list a year before, signaling a shift toward TLS interception, traffic inspection, and deep trust abuse.
Second place is taken by T1036.003 – Masquerading: Rename Legitimate Utilities. This TTP moved two places up with a 2.4x growth in total detections.
Other recurring TTPs like T1059.003 – Command and Scripting Interpreter: Windows Command Shell and T1497.003 – Virtualization/Sandbox Evasion: Time-Based Checks also experienced drastic increases in activity, confirming a rise in evasive behavior and the use of reliable execution methods, especially in phishing-delivered malware.
Key Security Insights for Businesses in 2026
Credential theft remains the primary risk: Stealers and RATs tripled year over year, making identity compromise the fastest path to enterprise intrusion.
Phishing is now an access operation, not a one-off attack: MFA-bypassing PhaaS kits enable scalable, repeatable breaches targeting employees at all levels.
Persistence outweighs speed: Growth in backdoors, scheduled tasks, and autostart techniques shows attackers prioritize long-term access over quick impact.
Trust abuse is a top concern: Root certificate installation emerged as the most detected technique, enabling traffic interception and stealthy control.
Fewer actors, greater impact: A small number of mature threat groups drove a disproportionate share of phishing and malware activity.
Behavioral visibility is critical: The scale and sophistication of 2025 threats highlight the need for interactive analysis and fresh threat intelligence in 2026.
ANY.RUN brings business impact through unified workflow
Understanding what happened is the first step to knowing what to do next. This report is built on threat intelligence gathered from millions of real investigations conducted by 15,000+ SOC teams worldwide throughout 2025. For actionable insights, high-quality threat data, and in-depth, dynamic analysis available in your security system 24/7, integrate ANY.RUN:
Scalable Efficiency: Save time and resouces on manual triage and unneccessary escalations with analysts focused on high-impact work.
Risk Mitigation: SOC teams expose evasive threats in minutes, gaining real-time behavioral visibility investigate faster.
Smart Response: Each investigation is enriched with historical context from millions of prior analyses, delivering broader coverage and significantly more actionable indicators.
Make your business attack-ready
Detect 90% of threats in under 60 seconds with ANY.RUN
Overall, 2025 was marked by strong growth in investigation activity, increased malware sophistication, and a clear shift toward persistence, evasion, and trust abuse among threat actors, underscoring the need for continuous monitoring and proactive threat analysis.
About ANY.RUN
ANY.RUN builds advanced solutions for malware analysis and threat hunting. Its interactive malware analysis sandbox is trusted by 600,000+ cybersecurity professionals worldwide, enabling hands-on investigation of threats targeting Windows, Linux, and Android environments with real-time behavioral visibility.
Threat Intelligence Lookup and Threat Intelligence Feeds help security teams quickly identify indicators of compromise, enrich alerts with context, and investigate incidents at early stages. This empowers analysts to gain actionable insights, uncover stealthy threats, and strengthen their overall security posture.
It is ANY.RUN’s annual analysis of global malware activity in 2025, based on millions of sandbox investigations and billions of collected indicators.
What data is this report based on?
The report is derived from activity in ANY.RUN’s Interactive Sandbox, reflecting real-world investigations conducted by security teams, researchers, and SOCs worldwide.
What were the most important threats in 2025?
Stealers, RATs, and phishing campaigns—especially those using MFA-bypassing phishing kits—were the most prevalent and impactful threats.
Why is phishing such a major concern for enterprises?
Phishing evolved into a scalable access mechanism in 2025, enabling attackers to bypass MFA, harvest sessions, and gain persistent access to corporate environments.
How did attacker techniques change in 2025?
Attackers increasingly relied on stealth, persistence, and trust abuse, including masquerading, sandbox evasion, and root certificate installation.
What does this mean for organizations in 2026?
Enterprises should prioritize behavioral detection, continuous monitoring, and fresh threat intelligence to detect evasive and persistent threats early.
How can ANY.RUN help security teams respond to these threats?
ANY.RUN’s Interactive Sandbox and threat intelligence solutions enable hands-on analysis, early detection, and faster response to modern, evasive attacks.
Millions of IT systems — some of them industrial and IoT — may start behaving unpredictably on January 19. Potential failures include: glitches in processing card payments; false alarms from security systems; incorrect operation of medical equipment; failures in automated lighting, heating, and water supply systems; and many more less serious types of errors. The catch is — it will happen on January 19, 2038. Not that that’s a reason to relax — the time left to prepare may already be insufficient. The cause of this mass of problems will be an overflow in the integers storing date and time. While the root cause of the error is simple and clear, fixing it will require extensive and systematic efforts on every level — from governments and international bodies and down to organizations and private individuals.
The unwritten standard of the Unix epoch
The Unix epoch is the timekeeping system adopted by Unix operating systems, which became popular across the entire IT industry. It counts the seconds from 00:00:00 UTC on January 1, 1970, which is considered the zero point. Any given moment in time is represented as the number of seconds that have passed since that date. For dates before 1970, negative values are used. This approach was chosen by Unix developers for its simplicity — instead of storing the year, month, day, and time separately, only a single number is needed. This facilitates operations like sorting or calculating the interval between dates. Today, the Unix epoch is used far beyond Unix systems: in databases, programming languages, network protocols, and in smartphones running iOS and Android.
The Y2K38 time bomb
Initially, when Unix was developed, a decision was made to store time as a 32-bit signed integer. This allowed for representing a date range from roughly 1901 to 2038. The problem is that on January 19, 2038, at 03:14:07 UTC, this number will reach its maximum value (2,147,483,647 seconds) and overflow, becoming negative, and causing computers to “teleport” from January 2038 back to December 13, 1901. In some cases, however, shorter “time travel” might happen — to point zero, which is the year 1970.
This event, known as the “year 2038 problem”, “Epochalypse”, or “Y2K38”, could lead to failures in systems that still use 32-bit time representation — from POS terminals, embedded systems, and routers, to automobiles and industrial equipment. Modern systems solve this problem by using 64 bits to store time. This extends the date range to hundreds of billions of years into the future. However, millions of devices with 32-bit dates are still in operation, and will require updating or replacement before “day Y” arrives.
In this context, 32 and 64 bits refer specifically to the date storage format. Just because an operating system or processor is 32-bit or 64-bit, it doesn’t automatically mean it stores the date in its “native” bit format. Furthermore, many applications store dates in completely different ways, and might be immune to the Y2K38 problem, regardless of their bitness.
In cases where there’s no need to handle dates before 1970, the date is stored as an unsigned 32-bit integer. This type of number can represent dates from 1970 to 2106, so the problem will arrive in the more distant future.
Differences from the year 2000 problem
The infamous year 2000 problem (Y2K) from the late 20th century was similar in that systems storing the year as two digits could mistake the new date for the year 1900. Both experts and the media feared a digital apocalypse, but in the end there were just numerous isolated manifestations that didn’t lead to global catastrophic failures.
The key difference between Y2K38 and Y2K is the scale of digitization in our lives. The number of systems that will need updating is way higher than the number of computers in the 20th century, and the count of daily tasks and processes managed by computers is beyond calculation. Meanwhile, the Y2K38 problem has already been, or will soon be, fixed in regular computers and operating systems with simple software updates. However, the microcomputers that manage air conditioners, elevators, pumps, door locks, and factory assembly lines could very well chug along for the next decade with outdated, Y2K38-vulnerable software versions.
Potential problems of the Epochalypse
The date’s rolling over to 1901 or 1970 will impact different systems in different ways. In some cases, like a lighting system programmed to turn on every day at 7pm, it might go completely unnoticed. In other systems that rely on complete and accurate timestamps, a full failure could occur — for example, in the year 2000, payment terminals and public transport turnstiles stopped working. Comical cases are also possible, like issuing a birth certificate with a date in 1901. Far worse would be the failure of critical systems, such as a complete shutdown of a heating system, or the failure of a bone marrow analysis system in a hospital.
Cryptography holds a special place in the Epochalypse. Another crucial difference between 2038 and 2000 is the ubiquitous use of encryption and digital signatures to protect all communications. Security certificates generally fail verification if the device’s date is incorrect. This means a vulnerable device would be cut off from most communications — even if its core business applications don’t have any code that incorrectly handles the date.
Unfortunately, the full spectrum of consequences can only be determined through controlled testing of all systems, with separate analysis of a potential cascade of failures.
The malicious exploitation of Y2K38
IT and InfoSec teams should treat Y2K38 not as a simple software bug, but as a vulnerability that can lead to various failures, including denial of service. In some cases, it can even be exploited by malicious actors. To do this, they need the ability to manipulate the time on the targeted system. This is possible in at least two scenarios:
Interfering with NTP protocol data by feeding the attacked system a fake time server
Spoofing the GPS signal — if the system relies on satellite time
Exploitation of this error is most likely in OT and IoT systems, where vulnerabilities are traditionally slow to be patched, and the consequences of a failure can be far more substantial.
An example of an easily exploitable vulnerability related to time counting is CVE-2025-55068 (CVSSv3 8.2, CVSSv4 base 8.8) in Dover ProGauge MagLink LX4 automatic fuel-tank gauge consoles. Time manipulation can cause a denial of service at the gas station, and block access to the device’s web management panel. This defect earned its own CISA advisory.
The current status of Y2K38 mitigation
The foundation for solving the Y2K38 problem has been successfully laid in major operating systems. The Linux kernel added support for 64-bit time even on 32-bit architectures starting with version 5.6 in 2020, and 64-bit Linux was always protected from this issue. The BSD family, macOS, and iOS use 64-bit time on all modern devices. All versions of Windows released in the 21st century aren’t susceptible to Y2K38.
The situation at the data storage and application level is far more complex. Modern file systems like ZFS, F2FS, NTFS, and ReFS were designed with 64-bit timestamps, while older systems like ext2 and ext3 remain vulnerable. Ext4 and XFS require specific flags to be enabled (extended inode for ext4, and bigtime for XFS), and might need offline conversion of existing filesystems. In the NFSv2 and NFSv3 protocols, the outdated time storage format persists. It’s a similar patchwork landscape in databases: the TIMESTAMP type in MySQL is fundamentally limited to the year 2038, and requires migration to DATETIME, while the standard timestamp types in PostgreSQL are safe. For applications written in C, pathways have been created to use 64-bit time on 32-bit architectures, but all projects require recompilation. Languages like Java, Python, and Go typically use types that avoid the overflow, but the safety of compiled projects depends on whether they interact with vulnerable libraries written in C.
A massive number of 32-bit systems, embedded devices, and applications remain vulnerable until they’re rebuilt and tested, and then have updates installed by all their users.
Various organizations and enthusiasts are trying to systematize information on this, but their efforts are fragmented. Consequently, there’s no “common Y2K38 vulnerability database” out there (1, 2, 3, 4, 5).
Approaches to fixing Y2K38
The methodologies created for prioritizing and fixing vulnerabilities are directly applicable to the year 2038 problem. The key challenge will be that no tool today can create an exhaustive list of vulnerable software and hardware. Therefore, it’s essential to update inventory of corporate IT assets, ensure that inventory is enriched with detailed information on firmware and installed software, and then systematically investigate the vulnerability question.
The list can be prioritized based on the criticality of business systems and the data on the technology stack each system is built on. The next steps are: studying the vendor’s support portal, making direct inquiries to hardware and software manufacturers about their Y2K38 status, and, as a last resort, verification through testing.
When testing corporate systems, it’s critical to take special precautions:
Never test production systems.
Create a data backup immediately before the test.
Isolate the system being tested from communications so it can’t confuse other systems in the organization.
If changing the date uses NTP or GPS, ensure the 2038 test signals cannot reach other systems.
After testing, set the systems back to the correct time, and thoroughly document all observed system behaviors.
If a system is found to be vulnerable to Y2K38, a fixing timeline should be requested from the vendor. If a fix is impossible, plan a migration; fortunately, the time we have left still allows for updating even fairly complex and expensive systems.
The most important thing in tackling Y2K38 is not to think of it as a distant future problem whose solution can easily wait another five to eight years. It’s highly likely that we already have insufficient time to completely eradicate the defect. However, within an organization and its technology fleet, careful planning and a systematic approach to solving the problem will allow to actually make it in time.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-01-19 18:06:382026-01-19 18:06:38What is the “year 2038 problem”, and how can businesses fix it?
