Storm Watch | Cyber Podcast | 2025’s Biggest Cybersecurity Threats EXPOSED: Zero-Day Attacks, Chinese Hackers & Enterprise Breaches
Summary: A China-aligned APT group called TheWizards is using a tool called Spellbinder to abuse IPv6 stateless address autoconfiguration for adversary-in-the-middle attacks, hijacking software update mechanisms for Chinese applications such as Sogou Pinyin and Tencent QQ to deliver the modular WizardNet backdoor. Google's 2024 zero-day exploitation analysis reports a drop in total zero-days exploited year over year but finds nearly half now target enterprise systems and network appliances, with Microsoft, Ivanti, Palo Alto Networks, and Cisco among the most targeted vendors.
Bottom line: Nearly half of exploited zero-days now land on enterprise systems and network appliances from Microsoft, Ivanti, Palo Alto Networks, and Cisco - the infrastructure defenders rely on to see attacks at all. GreyNoise also reports a spike in scanning for Ivanti Connect Secure VPNs and crawling of Git configuration files, where exposure can leak credentials and entire codebases.
Read the original at GreyNoise Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026