Cyber Briefing: 2025.12.23
Clop extortion, firmware boot flaws, webmail exploits, botnet DDoS, government breaches, cybercrime arrests, and resilience guidance shaped today.
👉 What’s the latest in the cyber world today?
Welcome to Cyber Briefing, the newsletter that informs you about the latest cybersecurity advisories, alerts, incidents and news every weekday.
First time seeing this? Please Subscribe
🚨 Cyber Alerts
1. Clop Hits CentreStack Servers
The Clop ransomware group has launched a widespread extortion campaign specifically targeting organizations that utilize Gladinet CentreStack file servers. By exploiting unpatched vulnerabilities in these systems, the attackers aim to exfiltrate sensitive corporate data and demand significant ransom payments.
2. UEFI Boot Flaw Enables DMA Attacks
Major motherboard manufacturers including ASRock, ASUS, GIGABYTE, and MSI are affected by a firmware flaw that fails to properly enable IOMMU protections during the early boot phase. This vulnerability allows an attacker with physical access to use DMA-capable devices to read or modify system memory before the operating system and its security features can load.
3. Roundcube Bugs Enable Script Attacks
Roundcube Webmail has issued urgent security patches for versions 1.6 and 1.5 LTS to fix two major vulnerabilities. These flaws could allow attackers to steal sensitive data or execute malicious scripts through specially crafted email content.
For more alerts click here!
💥 Cyber Incidents
4. Waymo Halts Service After Outage
A widespread power outage in San Francisco forced Waymo to pause its autonomous ride-hailing operations after several vehicles became stranded in traffic. The service disruption occurred as the blackout disabled critical infrastructure like traffic signals, leading the Alphabet-owned company to suspend rides while coordinating with city officials.
5. Kimwolf Botnet Hits Millions
The Kimwolf Android botnet has compromised more than 1.8 million devices, primarily targeting smart TV boxes to execute massive distributed denial of service attacks. Security researchers discovered the network after observing a massive surge in traffic that briefly pushed its control domains ahead of major global websites in popularity rankings.
6. UK Foreign Office Suffers Cyber Attack
British officials confirmed that the Foreign, Commonwealth and Development Office suffered a cyberattack in October, potentially targeting tens of thousands of visa records. Minister Chris Bryant stated that while the breach is under investigation, the current risk to specific individuals is considered low.
For more incidents click here!
📢 Cyber News
7. DOJ Charges 54 In ATM Jackpotting
The U.S. Department of Justice has indicted 54 individuals linked to the Tren de Aragua gang for orchestrating a multi-million dollar ATM jackpotting conspiracy across the United States. The group allegedly utilized specialized malware to force machines to dispense cash, funneling the stolen funds to support the operations of their designated foreign terrorist organization.
8. Ukrainian Hacker Admits Nefilim Role
A 35-year-old Ukrainian man has pleaded guilty in the United States for his role in the Nefilim ransomware group which targeted multi-million dollar corporations across several continents. Artem Aleksandrovych Stryzhak faces up to a decade in prison after admitting to computer fraud conspiracy following his extradition from Spain.
9. CISA Guide Boosts Stadium Preparedness
The Cybersecurity and Infrastructure Security Agency has introduced a new Venue Guide for Mitigating Dependency Disruptions to help public gathering spaces withstand service failures. This resource offers stadium and arena operators practical strategies to manage risks associated with essential energy, water, communication, and transportation systems.
For more news click here!
📈Cyber Stocks
On Tuesday, 23rd December, cybersecurity stocks traded with mixed outcomes as defensive demand for cloud, identity and perimeter security provided support amid broader market caution. Continued enterprise investment in threat detection, zero-trust architectures and compliance helped anchor the sector, even as tech rotation and profit-taking influenced select names.
Palo Alto Networks closed at 189.49 dollars and moved higher, supported by strategic contract wins and ongoing confidence in its unified AI-driven security platform and cloud security momentum.
Fortinet closed at 81.74 dollars and gained modestly, as steady interest in zero-trust and network-security solutions underpinned the stock despite broader volatility in tech sectors.
Zscaler closed at 232.05 dollars and eased slightly, reflecting light profit-taking after recent moves even though enterprise adoption of cloud-delivered security and zero-trust architectures remained robust.
Check Point Software Technologies closed at 190.73 dollars and moved higher, buoyed by ongoing demand for perimeter and firewall defenses amid persistent global cyber-threat activity.
Okta closed at 90.94 dollars and edged higher, supported by sustained enterprise investment in identity and access management as organisations prioritise protection against identity-centric threats.
💡 Cyber Tip
📱 Downloading cracked software or tools promoted in YouTube videos can silently install loader malware like CountLoader, which opens the door to data theft and full system compromise.
🔐 What You Should Do
Only download software from official vendor websites or trusted app stores
Block the use of pirated or unauthorized software with endpoint and policy controls
Disable or closely monitor scheduled tasks and unusual system binaries like mshta.exe
Keep endpoint security tools updated and review alerts for persistence attempts
⚠️ Why This Matters
Loader malware is often just the first step, giving attackers long-term access to deploy ransomware, steal credentials, or take remote control of systems without immediate detection.
📚 Cyber Book
Cybersecurity Life Skills for Teens by Mark Lynd
That concludes today’s briefing. You can check the top headlines here!
Copyright © 2025CyberMaterial. All Rights Reserved.
Follow CyberMaterial on:
Substack, LinkedIn, Twitter, Reddit, Instagram, Facebook, YouTube, and Medium