Welcome back to Digital Rage. I am Jeff the producer here at Phish Tank Digital.
And today we have our latest threat intelligence brief for the first half of
December. Lots of moving parts here. A big actor is back in the game so let's check
it out. Welcome back to the deep dive. Today we're going to be tearing into a
really critical threat brief. It covers global cyber activity for the first
half of December 2025. And this isn't just a status report. It's a high-stakes
snapshot of very very rapidly changing landscape. It really is. So our mission
really is to give you the shortcut. We need to map these strategic shifts, who is
hitting whom, where those attacks landing, and I think most crucially what's the
universal entry point that just about everyone is exploiting right now. It's an
absolutely essential briefing because I mean in just two weeks the priorities
for major threat actors, they just they fundamentally shifted. If you only look
at the executive summary, there are three core themes that just jump right out.
They define this entire period. Okay let's hear them because the data suggests
this wasn't just you know typical activity. This was a major pivot. First the
sheer force of lock bits returned. They are back in the top five ransom
wear list. And the reentry was well it was immediate and aggressive. It just
confirms that these dismantled groups they don't disappear, they hibernate and
they rebuild and they do it fast. Okay so that's number one. What's the second big
theme? Second we have a total shock in the sector and geographic targeting. And
this was driven by a little known group called Coinbase Cartel. Coinbase Cartel.
I've heard that name pop up. Their sudden rise simultaneously pushed the
United Arab Emirates into the top five target regions globally and it elevated
the construction sector to the number one victim sector. And those two shifts
are intrinsically connected. It signals completely new strategic interests.
That's fascinating because it means we can't just look at the raw numbers. We have
to look at the motivation. So what's the third piece of intelligence? The method.
It's the dominance of a single universal flaw. The react to shell vulnerability.
This one exploit became the skeleton key for nearly every major threat
actor during this period. So if you understand react to shell you understand how
almost all of these attacks happen. Okay let's unpack that then. Let's start with
the shifting power structure among the ransomware groups. The who of this
equation. This is where we see who's really dominating the board. Right. We still
have some heavyweights holding their ground. Clylin for instance absolutely
dominated. They grabbed over a quarter of all disclosed victims. A quarter. Wow.
So that's what 26.5% roughly? About that. Yeah. And Akira also remained a top-tier
actor holding strong at about 13%. So you know these are consistent mature
operations. But the real drama, the major signal here lies in the groups that
surged and the immediate reappearance of lock bit is astonishing. They were
effectively decimated just a few months ago. It speaks volumes about their
resilience, the modular nature of these operations. Lock bit immediately
re-entered the rankings at number three. Number three just like that. Just like
that. Claiming over 6% of the market share. To jump from effectively zero to
number three in two weeks confirms they weren't truly taken down. They just
fragmented, restructured and and aggressively launched new attacks to prove they
were back. That implies they had infrastructures ready to go. So it's less a
rebuild and more of a reboot. It's a reboot exactly. And what are the fast
movers that you know the true newcomers making all the noise? That's where
Coinbase Cartel comes in. I mean Sonobi continued its steady climb, landing at
number four, but the standout jump belongs to Cartel. They vaulted dramatically
from 17th place, completely peripheral all the way into the top five. 17th to
fifth. And that movement was driven almost entirely by aggressive victim
disclosures targeted at very specific industries and locations. Okay, so if
that's the who we have to look at the where and the what because those shifts
are where the strategic intent is really revealed. Let's talk about the
victim sectors. The shift here is it's unprecedented. The construction sector
moved from being the fourth most targeted all the way up to number one. Number one.
Number one. It now accounts for more than 17% of all victims. Financial
services and technology, you know, they remain high targets, but construction on
top is a massive signal. Why construction though? I mean, that's not
traditionally a sector known for massive data hordes, not like tech or
finance. What is that signal about their strategy? It signals a few things. First,
construction relies heavily on tight deadlines and operational technology, OT
integration. That makes them highly susceptible to disruption. Okay, that
makes sense. Second, their IT security maturity is often well, it's lower than the
highly regulated financial or tech sectors. The path of least resistance. Right.
But most importantly, it signifies an attack on the supply chain. Construction
firms often deal with lucrative government or infrastructure contracts.
Compromising a large construction firm provides a potential bridgehead into
much larger, more difficult targets. So they're hitting the weakest link to get
to the biggest price. Coinbase cartel clearly found a high leverage entry point
there. They did. Geographically, the USA is still the main target, right?
Absorbing nearly half the attacks. It is, yeah, about 48% of disclosed
victims. But the geographical expansion is also a huge story. The United Arab
Emirates has entered the top five victim locations for the first time ever.
They're coming in at nearly 3% of victims globally. And that's not a coincidence
I'm guessing? Not at all. It's a direct consequence of that surge in attacks,
targeting construction and the high value real estate sectors in the UAE. All
driven by Coinbase cartel. Largely. Yes. Canada, the UK, Germany, there's still
consistently high targets. But the UAE's entry shows certain groups are just
following the money regardless of geography. But if we connect all this data,
the who, the what, the where the single most critical detail might not be the
location, but the size of the organization being hit. Right. Tell us about that
breakdown because the numbers here are genuinely shocking. The concentration on
smaller targets is just overwhelming. We define small businesses as organizations
with 500 or fewer employees. Okay. They accounted for a staggering 81.37% of all
victims. And this isn't an arbitrary fluctuation. It's a sharp 9.08% jump from
the prior period. Wow. Over eight out of 10 attacks hit small organizations.
A massive strategic shift. And if we look at the inverse, it really emphasizes
the priority. Large enterprise targeting cell organizations with over 5,000
employees that dropped by over 7.5%. Precisely. This means the adversaries have
made a clear tactical decision. They're prioritizing high volume opportunistic
exploitation. It's just easier. It's easier to hit a thousand small businesses
with weaker security than it is to dedicate resources to one heavily defended
large enterprise. They are maximizing their digital surface area for quick, high
volume returns. Maximizing surface area over maximizing the price value. I
say, which leads us naturally to the how this is where it gets really interesting.
The method of attack all dominated by react to shell and react to shell
provided that flaw ubiquitously. The core vulnerability is the react server
components issue. It's catalogued as CVE 2025 55182. And that comes from Meta's
react framework, which is everywhere. It's everywhere. It allowed the specific
react to shell exploitation framework to execute remote code. So in simple
terms, it was a critical design flaw in a globally used technology that let
attackers tell a server to run their malicious code. And we aren't just talking
about one group using this. The data shows a whole constellation of adversarial
clusters piling onto this flaw. That's the danger of a universal vulnerability.
We track multiple threat clusters, UNC 5174, UNC 6588, UNC 6588 and several
others all showed elevated activity. And for our listeners, UNC stands for
uncategorized ray. So these are new or unverified actors. That's right. And the
fact that all these new and established groups immediately use this one flaw
tells us it was widely shared, easy to use and highly effective. They weren't
just observing. They were focusing on rapid exploitation, broad scanning behavior.
Exactly. When a skeleton key gets passed around, everyone starts trying doors.
And the real world impact is sobering. We know the react to shell flaw was exploited
to breach at least 30 different organizations in this brief window.
30 confirmed breaches. And more concerningly, official confirmation showed at
least 77,000 IP addresses were still vulnerable to this single flaw globally.
It just underscores the severity. Okay, let's shift focus to the trending tools
adversaries you're using that, you know, the tools of the trade beyond the
big ransomware names. We're seeing a highly optimized and diverse toolkit.
It shows groups are focusing on specific functions, not just pure encryption.
So info Steelers for that initial compromise. Crucial for that. Yes. We saw
Isuru, which is highly targeted at extracting browser data and credentials,
the keys to the kingdom. And then there's the emergence of Shai Hulu 2.0.
Great name. It's an updated Steeler with significantly improved evasion
techniques. It's specifically designed to get past modern endpoint detection
and security software. So its real innovation is in its ability to hide.
Better it stealing, better it hiding. What about remote access,
establishing that long term presence? We track two significant remote access
Trojans or Rats. Etherat is a very lightweight option used for quick remote
control and data theft. But Valaratt is the modular option, specifically used in
long term espionage campaigns. And they're still innovating on distribution and
mobile too, right? Targeting that massive consumer surface area.
Absolutely. We have glass worm, which acts as a worm like loader, spreading
quickly across internal networks. And on the mobile front, droid lock is critical.
This is Android malware used for device locking and extortion.
It basically mirrors desktop ransomware tactics, but for your phone.
And while React 2 Shell dominated the volume,
specialized attackers are certainly not ignoring other high profile targets.
We're still seeing attacks on new flaws in Chromium, Apple, Android, Windows.
Correct. While React was a headline, other vulnerabilities demanded immediate
patching. We saw elevated targeting of WinRarer, specifically CVE 2025,
621, the mapping software geo server and critical flaws in enterprise
solutions like ArrayOS AG. So it's a very wide range of targets?
A very wide range. It confirms that while broad opportunistic flaws like
React 2 Shell capture the volume, specialized groups are still hitting
specific high value software products, which I think raises the ultimate question.
How do these cold hard statistics, the 81% target rate, the CVE numbers,
how do they actually translate into high impact events for organizations?
We saw several major real world incidents reported during this period that
clearly connect to these trends. It's hard to ignore the headline that
contractors were accused of wiping 96 US government databases.
That event alone just demonstrates the severe consequence of insider
threat and unchecked access. And the supply chain risk is just exploding.
The data shows over 10,000 docker hub images were found leaking credentials
and off keys. That shows how easily one small exposed component can
compromise an entire ecosystem. The financial sector impact was also major.
The Marquit data breach hit over 74 US banks and credit unions.
It's that ripple effect we talked about. Compromise one processor and you compromise dozens of
smaller institutions. And finally, the sheer scale of social engineering was just.
It was illustrated by the shady panda malicious browser extension campaign.
It got over 4 million installs. 4 million. Another example of targeting
massive volume over prestige. Right. It wasn't all grim news though.
I mean law enforcement regulators did manage to push back, which is always crucial context.
They did. We saw regulatory oversight with the EU finding X 140 million dollars
over deceptive blue check marks. That's a serious attention being paid to platform integrity.
Also police forces successfully took down the crypto mixer, cryptocurrency mixing service,
disrupting a vital money laundering tool. And the major vendors responded, which is essential
defense. Yes, urgent patches were issued by major players like Fortinet, Yvonne T and SAP to address
critical flaws. That rapid patching is the essential countermeasure against the kind of opportunistic
exploitation we saw with react to show. So let's summarize what we've learned from this deep dive.
The knowledge we walk away with confirms the ransomware hierarchy is shifting rapidly,
with lock bits forceful return. The geography of targeting is expanding, notably into the UAE,
linked directly to that construction sector surge. And the vulnerability of the moment,
react to show is driving a volume-based strategy across a whole array of different threat groups.
But the truly critical takeaway, I think, for anyone preparing for the future,
is the clear signal of operational priority. That dramatic nearly 10% jump in targeting small
businesses means the adversary strategy is now ruthlessly optimized for high volume
opportunistic exploitation. They're looking for the path of least resistance across the
widest possible field. So here's the thought I want to leave you with. Given that over 81% of observed
attacks hit organizations with 500 or fewer employees and groups are using broad scanning for flaws
like react to show, what does security look like but volume? Not prestige is the main metric for
attack success. Does this mean cybersecurity is now less about protecting high value targets
and more about successfully exploiting sheer digital surface area? Something even more
than you think about securing your own digital perimeter. Thanks for diving vehicles. See you next time.
Reach out to us at jbuyer.com for comments and questions. Follow us at buyer company on social media
and if you'd be so kind, please rate and review us in your podcast app.