Critical Threat Research : The Iranian Cyber War Intensifies!
Comprehensive Threat Exposure Management Platform
For a detailed threat digest, download the pdf file here
December emerged as a particularly volatile period for cybersecurity, underscored by the disclosure of three high-profile “celebrity” vulnerabilities, React2Shell, MongoBleed, and LangGrinch, alongside eleven zero-day flaws. Chief among them was CVE-2025-55182, widely known as React2Shell, a critical unauthenticated remote code execution vulnerability rooted in unsafe deserialization within React Server Components’ Flight protocol. The flaw was weaponized within days of disclosure, with multiple threat actors leveraging it to deploy cryptominers, web shells, and persistent backdoors. The month also saw Google issue an emergency Chrome update, patching three vulnerabilities, including the actively exploited zero-day CVE-2025-14174 in the ANGLE graphics engine.
At the same time, attackers aggressively exploited weaknesses across widely deployed enterprise infrastructure. Two critical Fortinet flaws, CVE-2025-59718 and CVE-2025-59719, enabled unauthenticated bypass of FortiCloud SSO authentication through crafted SAML responses, placing exposed environments at immediate risk. Cisco was also forced to confront a severe zero-day, CVE-2025-20393, affecting AsyncOS in Cisco Secure Email Gateway and Secure Email and Web Manager appliances. Exploitation has been ongoing since late November 2025 and has been attributed to the China-linked APT group UAT-9686, which deployed advanced persistence malware to maintain long-term access.
Beyond vulnerabilities, December highlighted a surge in mature and stealth-driven threat actor campaigns. Iran-aligned MuddyWater resurfaced with a refined cyberespionage operation targeting Israel and Egypt, using spear-phishing lures that directed victims to legitimate file-sharing services to deliver trojanized RMM installers and new tooling such as the Fooder loader and MuddyViper backdoor. In parallel, Russia-origin Operation MoneyMount-ISO continued to spread Phantom infostealer via multi-stage phishing chains abusing ISO files. Silver Fox’s impersonation of India’s Income Tax Department to deploy ValleyRAT further illustrated how trusted platforms and institutions are being weaponized at scale. Collectively, these developments reinforce a stark reality: the threat landscape is becoming faster, stealthier, demanding sustained vigilance and rapid defensive action from organizations worldwide.
Subscribe to receive our weekly threat digests and alerts directly in your inbox.
