Everyone's on the cyber target list
Summary: In this Cisco Talos newsletter, the author describes acting as a rent guarantor and finding that the agent handling his personal and financial dossier did not believe a small organization with a low online profile was a target, though the agent said data is deleted within two weeks of processing. The same edition reports Talos uncovering a new wiper malware called "PathWiper" used against Ukrainian critical infrastructure through a legitimate endpoint administration framework, attributed to a Russia-linked APT actor, and a Chrome zero-day tracked as CVE-2025-5419 with a CVSS score of 8.8 that Google patched out-of-band.
Why it matters: The newsletter's core claim is that many criminals do not discriminate and will compromise anyone, then work out how to make money from the access - so the small firm that assumes it is not a target is exactly the profile an attacker will use. The same issue pairs that with a state-linked wiper against Ukrainian critical infrastructure and an actively exploited Chrome flaw, which is the concrete stake: basic hygiene like prompt updates, endpoint protection, and MFA is the floor, not the finish.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2025-5419
- Related
- CVE-2025-5419: Google Chromium V8 Out-of-Bounds Read and Write Vulnerability Known Exploited Vulnerabilities · Jun 05, 2025