Monthly Threat Digest: February 2025

For a detailed threat digest, download the pdf file here

Summary

February saw the cybersecurity world on high alert after the discovery of eleven zero-day vulnerabilities. Among them, CVE-2025-1094, a critical SQL injection flaw in PostgreSQL’s interactive tool psql, stood out. Meanwhile, the Silk Typhoon threat group actively exploited CVE-2024-12356 and CVE-2024-12686 for reconnaissance and data exfiltration.

At the same time, ransomware surged, with aggressive variants like Lynx, RA World, Vgod, NailaoLocker, and Ghost ransomware claiming new victims. As ransomware tactics grow more sophisticated, organizations must bolster defenses with strong backup and disaster recovery strategies.

Meanwhile, North Korean threat actors launched the Ferret malware, targeting job seekers and developers through the “Contagious Interview” campaign, using fake software installations to compromise systems. A large-scale malware operation, “StaryDobry,” has been spreading trojanized versions of cracked games such as Garry’s Mod, BeamNG.drive, and Dyson Sphere Program to unsuspecting players, delivering the XMRig cryptominer. The GitVenom campaign is also on the rise, deploying malware through fake GitHub repositories, aiming at developers and cryptocurrency users.

In parallel, Salt Typhoon, a Chinese state-sponsored group, has been infiltrating U.S. telecommunications providers with a stealthy custom tool, JumbledPath, to monitor network traffic and extract sensitive data. In many cases, attackers leveraged legitimate credentials to gain access, though one instance likely involved the exploitation of a known Cisco vulnerability. As cyber threats escalate, staying vigilant and proactive is more critical than ever. Organizations must continuously adapt to the evolving landscape to defend against emerging risks.

Subscribe to keep up on a weekly basis with our weekly threat digests and newsletters.