Weekly Threat Digest : 28 JULY to 03 AUGUST 2025

For a detailed threat digest, download the PDF file here

HiveForce Labs has observed a significant surge in cybersecurity threats, underscoring the growing complexity and frequency of cyber incidents. Over the past week, six major attacks were detected, two critical vulnerabilities were actively exploited, and two threat actor groups were closely monitored, reflecting an alarming escalation in malicious activities.

One of the critical vulnerabilities observed was CVE-2025-5394 in the widely used Alone WordPress theme. This flaw allows attackers to upload malicious files without authentication, no login credentials or admin rights required. In another case, the Auto-Color backdoor was deployed by exploiting CVE-2025-31324, a critical flaw in SAP NetWeaver. Meanwhile, the financially motivated group Scattered Spider launched a campaign in mid-2025 targeting VMware vSphere environments, using social engineering to infiltrate Active Directory and then exploiting vCenter and ESXi for credential theft and ransomware deployment.

On the espionage front, Chinese-linked threat actors behind Operation GhostChat and Operation PhantomPrayers intensified surveillance efforts against the Tibetan community. At the same time, the Russian state-sponsored group Secret Blizzard has been targeting diplomats in Moscow through a deceptive tactic: luring victims into downloading a fake antivirus installer, which silently delivers the stealthy ApolloShadow malware. Together, these incidents reflect a growing and global escalation in cyber operations, emphasizing the critical need for proactive, resilient cybersecurity strategies.

These rising threats represent an immediate and global cybersecurity risk.

Subscribe to receive our weekly threat digests and alerts directly in your inbox.