Youtube
Data Breach

AC Weekly Cybersecurity News Recap – March 2025

From router exploits to fake packages, attackers continue to outpace defenses, while law enforcement and researchers fight back
By Updated:200 Comments7 Mins Read

This week’s global cybersecurity roundup shows just how fast things are moving on both sides of the cyber battlefield. On one end, threat actors are breaking into outdated routers, sneaking into app stores, and spreading malware through trusted platforms like YouTube and GitHub.

On the other end, researchers are building new decryptors, governments are pressing charges, and security vendors are tightening controls.

Here’s your in-depth look at the stories shaping cyber defense and offense for March 2025.

China-Linked UNC3886 Breaches End-of-Life Juniper Routers

Old routers are still powering networks—and attackers know it

One of the biggest threats this week came from UNC3886, a Chinese advanced persistent threat (APT) group. They targeted outdated Juniper Networks MX Series routers, specifically those no longer receiving updates.

With a mix of six custom backdoors, they gained full access to less than ten global organizations. These backdoors included tools that could disable logs, sneak commands through hidden scripts, and even act silently in the background.

At least one exploited flaw, CVE-2025-21590, allowed the group to sidestep built-in protections and run code remotely. The campaign serves as a serious warning to organizations still relying on end-of-life hardware.

ClickFix Tactic Used in New Phishing Campaign

Phishing just got more dangerous—with stolen logins and drained accounts

A group called Storm-1865 is tricking people with fake Booking.com emails, directing them to credential-harvesting pages. The twist? They’re using a technique known as ClickFix, which abuses legitimate links to bypass security filters.

This campaign, running since late 2024, has spread across nearly every continent. Victims who fall for the scheme have their login details and financial data stolen, which is then used in follow-up fraud operations.

KoSpy Malware Found in Android Apps on Google Play

North Korean actors sneak spying tools into your phone under the guise of utilities

The ScarCruft group, tied to North Korea, uploaded apps to the Google Play Store that looked like harmless tools. In reality, these apps installed KoSpy, a surveillance malware that could steal:

  • Text messages
  • Call history
  • Files
  • Locations
  • Audio recordings
  • Screenshots

Though the apps have been removed, the campaign traces back to 2022, showing how persistent these threat actors are at embedding spyware into trusted ecosystems.

SideWinder Targets Maritime and Logistics Companies

This APT is going after shipping and supply chains worldwide

Another group, known as SideWinder, has been hitting logistics firms in Asia, the Middle East, and Africa. Using a post-infection toolkit called StealerBot, the group grabs login data, internal communications, and proprietary logistics data.

Their focus on the maritime sector suggests an interest in tracking movements of goods, port infrastructure, or sensitive cargo.

LockBit Ransomware Developer Extradited to the U.S.

Cybercrime isn’t anonymous forever—justice catches up

In a big win for law enforcement, Rostislav Panev, a developer behind the LockBit ransomware group, was extradited from Israel to face charges in the United States. Between 2022 and early 2024, he reportedly earned over $230,000 from LockBit attacks.

His arrest came after authorities took down key parts of the group’s infrastructure. His prosecution may help build more cases against others involved in similar operations.

PyPI Supply Chain Attack Reveals 20 Malicious Packages

Fake packages can poison your codebase without warning

Researchers discovered 20 malicious Python packages uploaded to PyPI, disguised as useful developer tools. These packages were downloaded more than 14,000 times before removal.

Some of them were used by a popular GitHub project called accesskey_tools, which had hundreds of stars and dozens of forks—showing how easily malware can spread through trusted dev ecosystems.

Critical CVEs to Patch Right Now

Outdated software is a hacker’s best friend—update now

This week’s top vulnerabilities include critical flaws in systems from Microsoft, Apple, Apache, Cisco, TP-Link, and others. Some of the most urgent include:

  • CVE-2025-26633 (Windows)
  • CVE-2025-25291 & 25292 (ruby-saml)
  • CVE-2024-13871 & 13872 (Bitdefender BOX v1)
  • CVE-2025-27816 (Arctera InfoScale)
  • CVE-2025-27017 (Apache NiFi)
  • CVE-2025-27593 (SICK DL100 series)
  • CVE-2025-27509 (Fleet software)

Check your systems and apply these patches to prevent remote code execution, privilege escalation, and data theft.

Positive News: New Ransomware Decryptor for Akira Linux Variant

Not all hope is lost—researchers strike back

A researcher named Yohanes Nugroho has released a decryptor for the Linux version of Akira ransomware, giving victims a chance to unlock their data without paying.

This tool leverages GPU power to retrieve the encryption keys and is freely available on GitHub. It’s a powerful reminder that the cyber community can fight back with the right tools and dedication.

Chinese Volt Typhoon Hackers Infiltrated U.S. Electric Company

A near year-long breach with physical infrastructure risks

The Volt Typhoon group, believed to be Chinese state-sponsored hackers, stayed inside a U.S. electric utility network for over 300 days. The breach was discovered just before Thanksgiving 2023.

Although no customer data was compromised, the attackers explored systems tied to energy operations and OT networks. They entered through a buggy Fortinet firewall used by a third-party provider.

The long-term goal appears to be strategic sabotage, should tensions between China and the U.S. escalate.

YouTube Used to Spread DCRat Backdoor

Gamers become victims again through fake cheat downloads

The Dark Crystal RAT (DCRat) is making a comeback via YouTube. Attackers create or hijack accounts to post videos advertising game hacks and bots. Once users click on the links in the video description, malware is downloaded.

DCRat allows attackers to record keystrokes, steal passwords, activate webcams, and more. Kaspersky identified over 34 plug-ins for this malware and tracked its activity mainly in Russia, Belarus, and Kazakhstan.

New Threat: OAuth App Phishing for Microsoft 365

Fake login apps fool users into giving full access to attackers

Proofpoint reported two targeted phishing campaigns using fake OAuth apps disguised as Adobe and Docusign tools. These apps trick users into granting permissions, which attackers then use to take over Microsoft 365 accounts.

This method allows access without needing a password and can evade traditional email security filters.

Wi-Fi Jamming Gets Laser Precision

RIS-based jamming can knock out devices without affecting others

Researchers have created a precise Wi-Fi jamming method using Reconfigurable Intelligent Surfaces (RIS). This tech lets attackers disable a single device’s connection while leaving nearby systems untouched.

It’s like jamming with a sniper scope—perfect for targeted denial-of-service attacks on sensitive equipment.

Other Notable Headlines

  • Jupyter Notebooks are being targeted for cryptomining
  • ESP32 chip controversy shows the risks of debug commands becoming backdoors
  • Switzerland now requires critical infrastructure providers to report cyberattacks within 24 hours
  • BYOVD evolves into BYOTB and BYOVE, with attackers abusing legit drivers, binaries, and even trusted enclaves
  • NIST adds HQC as a backup post-quantum cryptography algorithm for future threats
  • Mandiant flags concerns over Microsoft’s Time Travel Debugging framework potentially masking vulnerabilities

Tip of the Week: Monitor for Suspicious Processes Using Sysmon

Detect threats early by watching how programs launch

Use Sysmon and Windows Event ID 4688 to monitor the launch of uncommon or risky tools like rundll32.exe or certutil.exe. Combine this with a free SIEM like ELK or Graylog for real-time alerts.

Set up process auditing through Group Policy and use trusted community configurations for Sysmon to reduce noise and focus on real threats.

Final Thoughts

The key message this week? Cyber threats are no longer hiding in the shadows—they’re hiding in plain sight. Whether it’s a gaming video, a cloud tool, or a legacy router, the entry points for attackers are everywhere.

But defenders are not powerless. With the right tools, community collaboration, and a proactive mindset, we can uncover hidden threats, respond faster, and shut down attackers before they cause real damage.

Stay alert, stay informed, and never stop learning—because the next threat is already in motion.

Author

Share.

Related Posts

200 Comments

  4. binance on

    I don’t think the title of your article matches the content lol. Just kidding, mainly because I had some doubts after reading the article.

  7. 88clb8me on

    Just spent some time on 88clb8me. It’s pretty straightforward, nothing too fancy, but it gets the job done. Give it a shot if you’re looking for something easy to get into: 88clb8me

  12. phwin8 on

    Anyone had any good wins on ‘phwin8’ lately? Looking for a new spot with some decent payouts. Let me know your experiences!

  76. binance on

    Can you be more specific about the content of your article? After reading it, I still have some doubts. Hope you can help me.

  88. binance on

    Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?

  169. zoritoler imol on

    Thanks for any other magnificent article. The place else may just anybody get that type of info in such an ideal way of writing? I’ve a presentation next week, and I’m on the look for such info.

  172. Rigoberto on

    Euopean footjobDrice iinn vintageGisnna michaels ets assBesst adrhd medd foor adultsDoeia
    rone nude picsYung faat tees nnude picsCllip porno x offertsFirsst large penisErktic fictionn woman wrestlingMegy pice meggyn price nakedLongg clpips tgpTatoo blowjob
    videoos fantiStrippper partty drunkBlaxk hasrdcore poorn sexAss black ree sexTitts aat wotk bend
    overHomemadse fucck spitt onn aass videoWhijte guys eeat black cumFreee womqn orgasmsJapoan adult vvcd dvdAfrica tewn wavingLow
    rixe jeans nakedPartgy gurl polrn iphoneImogeen titsBoot pussy titEscort
    galleery britainMenns double beasted raincoatsAcdountant sexLooja luxx analDub amime pornNudee thimbnail
    moviesLeesbian films galleriesAsian maake tipp
    uup womanPregnant fuc videoo freeHungg shemnale porntubeExpressig bfeast mil how muchHarecore cgay frotArtt edperiment
    explanatiion in pornography sseries sexx societyFemale bodybulder seex sceneSuzie carinaa stripperCollege locksr nujde roomFrree asian aduult milf vjdeo galleriesWhat percentage seex worrkers hasve std’sFreee piic off bbig titt andd round assAnnal sexx hhow
    tosXxxx britany spears pusy pornThe spermm dlnors jules jordanPousti breast implantEq celestial fistsXhamster gaay gasng fuckCouple hwiley seduce teenSwinging
    johnson brotherTopp 2010 mllb amateur daft prospectsFreee gayy pick uup sitesGayy private collegesShwlf ljfe ooked chickn breastWomewn pissing
    diapersFeminine fuckingChristinia guliera upskirtSmalll coock milkingFree sexy pprn wallpapes oof girlsCartookn anal videos gamesXxxx meen tos https://tktubexxx.com/videos/%E3%83%95%E3%83%AB%E5%8B%95%E7%94%BB Naked man on planeFree xxx story podcastFree
    nude vampire picsTeen pregnancies abortion/regret with statisticsPresident bush gay marriagesCynthia pepper nakedLesbian pussy upclosePlastic panties pissingKurenai sasuke hentaiBlack gang bang
    fuckingBarefoot pussyRate man nudeBloated stomach after breast implantsMature cum gobblersFree
    download women nature’s punching bag anal
    cuntSex from behind pictures ukSwinger nhSexual positions for the bathtubJenna
    haze anal creampieCeltic symbols for lesbianTucking and taping the penisNew sex trickTinyurl sexResidential homes
    for sale u.s. Virgin islandsAsian cos playBdsm how to be domSelf induced mommy sexTelia tequila
    getting fuckedFirst have teenActress hardcore in mainstream movies, scenes, videos, photosStrip
    ‘n rip winnipegEmily dolll lesbianLiz mclarnen titsSexy tennis
    pics aust open 2008They fucked in the poolTransvestite boot fetishRejuvenecimiento vaginal mexicoVintage
    car logos4 man asian bandHardcore party womenEscort airAsian women fertilityPornstar angeliqueGirl tube sexyBest teen acneCopper bottom teaArianna jolie licking assTransgender phone listingsAdult addicting gameSame sex constitutionCanine penis problemsAmateur video wife has
    unexpected threesomeBoys video gaySexy bi curious sexFree video clips
    of adult moviesComic porn com adult comic bookRiverside boys nudeSexual position 2007 jelsoft enterprises ltdJapanese girls with penisKristin randall boobsCollege guys sucking dickFree public cam chat
    sex roomsHot tattooed nudeWho has the bigest penisVintage necklineFree vibrator demo videosNude pics ex girlfriendTruth or dare touched his cockEscort radar false detectGames to improve memory adultsBlack cock fever comReal lesbian couples having sex

  176. Riley kevona Here on

    I think it’s crucial for organizations to prioritize security training and patching of outdated software as much as possible. And I’m glad we’re seeing more researchers working on new tools that can help fight these threats. com users. These types of attacks are just getting more sophisticated all the time. I hope everyone stays safe and continues to improve their security measures. Mầm non sasuke quảng ninh. Here offense

  177. Jamie almoda Does on

    mầm non đồng nai Mình đang tìm hiểu để gửi bé nhà mình đi học mà thấy nhiều trường quá cũng hơi phân vân không biết chọn nơi nào cho phù hợp. Các mẹ ở khu vực này có kinh nghiệm hay biết trường nào dạy tốt, không gian thoáng mát thì chia sẻ giúp mình với nhé. Mình rất mong tìm được một môi trường ấm áp để con có thể tự tin vui chơi và phát triển trong những năm tháng đầu đời đầy ý nghĩa này. Cảm ơn mọi người nhiều lắm. Does SideWinder

  178. Jamie almoda actors on

    Chọn trường mần non sài gòn có rất nhiều lựa chọn với quy mô lớn và chất lượng vượt trội. Tôi tin rằng đây là nơi lý tưởng để đào tạo sinh viên về nghệ thuật làm bánh và công việc của họ sau khi tốt nghiệp sẽ trở nên phổ biến hơn bao giờ hết. Bạn có tham vọng làm việc trong ngành thực phẩm không? actors allowed

  179. Jamie almoda showing on

    The fact that organizations still rely on old routers, and click-fraud campaigns like Storm-1865 continue to exploit human weaknesses is truly alarming. As we move forward, it’s important to stay vigilant and not become complacent with our defenses. Sổ tay mầm non đà nẵng, the importance of staying informed about cybersecurity threats cannot be overstated. showing offense

  180. Jamie almoda Updated on

    Mầm non hà nội Nhìn thấy những hình ảnh về các trường mầm non tại Hà Nội dạo gần đây, mình lại nhớ về khoảng thời gian con bắt đầu chập chững những bước đầu tiên đến lớp. Thực sự việc tìm kiếm một môi trường giáo dục phù hợp cho bé ở giữa thủ đô nhộn nhịp này chưa bao giờ là điều dễ dàng với các bậc phụ huynh. Mình rất mong các thầy cô luôn giữ vững được tâm huyết và tình yêu thương để mỗi ngày đến trường của các con thực sự là một ngày vui, giúp các bé phát triển toàn diện cả về trí tuệ lẫn tâm hồn trong những năm tháng đầu đời quý giá này. Updated Asia

  181. Jamie almoda focus on

    It also underscores how persistent cyber threats can be, even for long-established companies like Juniper Networks. I agree that regular cybersecurity awareness training is crucial to safeguarding against these evolving threats. Trường học phía nam This week’s global cybersecurity roundup shows just how fast things are moving on both sides of the cyber battlefield. focus traces

  182. Jamie almoda them on

    Giáo dục miền bắc Càng lớn lên và nhìn lại những năm tháng ngồi trên ghế nhà trường, mình càng thấy nể phục sự nghiêm khắc nhưng cũng đầy tâm huyết của các thầy cô ngoài này. Dù đôi lúc cách truyền đạt có phần khuôn mẫu, nhưng chính sự chỉn chu và nền nếp ấy đã rèn giũa cho mình một tư duy rất vững vàng và kỷ luật. Có lẽ phải đi xa rồi mới thấy trân trọng những giá trị cốt lõi mà môi trường giáo dục miền Bắc đã bồi đắp, giúp mình có được hành trang tự tin để bước vào đời. Hy vọng rằng trong tương lai, dù thay đổi thế nào thì cái chất “tôn sư trọng đạo” vốn có vẫn luôn được giữ gìn và phát huy. them Though

  183. Jamie almoda act on

    Mầm chòi lá không thể tưởng tượng được độ nhanh chóng của những kẻ tấn công mạng trong tuần này! Từ các router hết hạn sử dụng bị vi phạm cho đến các ứng dụng có thể bị thâm nhập bởi YouTube và GitHub, sự lẹm nhíc của hacker đang vượt qua các bảo vệ. act Budget

  184. Jamie almoda threat on

    Trước cổng trường: Chắc chắn rằng đọc xong bài viết này tôi lại phải suy nghĩ rất nhiều về tình hình hiện tại của chúng ta trong lĩnh vực bảo vệ mạng! Rõ ràng là có quá nhiều mối đe dọa đang chinh phục và tấn công vào hệ thống mạng chúng ta, từ những kẻ tay mơ lừa đảo đến những con sâu nhỏ giọt. threat less

  185. Jamie almoda enforcement on

    Việt Nam PreSchool Réources Mình thực sự cảm thấy những tài liệu này rất hữu ích cho các giáo viên mầm non đang cần thêm ý tưởng sáng tạo trong giảng dạy. Nhìn vào cách sắp xếp các học liệu, mình thấy được sự tâm huyết và chỉn chu mà người làm đã gửi gắm vào từng bài học nhỏ. Hy vọng sẽ có thêm nhiều chia sẻ chất lượng như thế này để cộng đồng giáo dục sớm của chúng ta ngày càng phát triển vững mạnh hơn. Cảm ơn bạn rất nhiều vì đã không ngần ngại chia sẻ những kiến thức quý báu này đến với mọi người. enforcement Buy

  186. Jamie almoda pressing on

    While some of these attacks might seem extreme or hard to avoid, it’s comforting to know that there are researchers and law enforcement agencies working tirelessly to keep us safe. Mầm non việt nam, the threat from UNC3886 is a stark reminder of why cybersecurity education should always be part of our daily lives, no matter where we live or what technology we use. pressing legitimate

  198. cr777casino on

    I’ve been trying a few different sites lately and this one really stands out. The interface is smooth and the payouts are fast. Definitely check out cr777casino if you want a reliable spot to play.

Leave A Reply

Home

About Me

© 2026 ThemeSphere. Designed by ThemeSphere.
Exit mobile version