Cyber Intel Brief: Ransomware gangs and zero-day vulnerabilities

Stay up to date the most pressing cyber threats, emerging trends and what they mean for enterprise security, critical infrastructure and global risk.

Executive Summary

Zero-day exploitation continues at accelerated pace with nation-state actors deploying AI-generated deepfakes for social engineering while systematically targeting critical infrastructure through multiple coordinated attack vectors. Critical vulnerabilities are being weaponized within hours of disclosure, challenging traditional patch management paradigms.

The current cybersecurity landscape is marked by escalating threat actor capabilities and coordinated campaigns against critical infrastructure. Microsoft's June 2025 Patch Tuesday addressed 66 vulnerabilities including actively exploited zero-days¹, while nation-state actors like BlueNoroff deployed AI deepfake technology in executive impersonation attacks². Simultaneously, the SimpleHelp RMM exploitation campaign continues affecting utility providers³, and major incidents disrupted Swiss banking infrastructure through third-party compromises⁴. These developments demonstrate the convergence of advanced persistent threats with operational technology targeting, requiring immediate strategic defensive posture adjustments.

TOP STORIES

1. Nation-State Actors Deploy AI Deepfake Technology in Executive Impersonation Campaign

North Korean threat group BlueNoroff executed the first confirmed nation-state use of AI-generated deepfakes, creating fabricated video conferences featuring company executives to distribute custom macOS malware.² Targets received Telegram messages requesting meetings but encountered deepfaked videos of their own senior leadership alongside external participants during the "video call." The attack delivered comprehensive macOS malware including info-stealers, keyloggers, and backdoors with advanced tradecraft including clipboard monitoring and sleep-aware command execution.²

Strategic Impact: This represents the first confirmed operational use of AI deepfakes by a nation-state actor in social engineering attacks, creating new attack vectors that traditional security awareness training does not address. Organizations must implement AI deepfake detection protocols and video call verification procedures.

2. Critical Zero-Day Exploitation Accelerates Against Enterprise Infrastructure

Multiple critical zero-day vulnerabilities were confirmed under active exploitation during the collection period, including CVE-2025-33053 (WebDAV, CVSS 8.8) exploited by Stealth Falcon APT,⁵ CVE-2025-5419 (Chrome V8, CVSS 8.8) exploited in the wild,⁶ and CVE-2025-43200 affecting Apple ecosystem devices. Microsoft's June 2025 Patch Tuesday addressed 66 vulnerabilities including nine critical-severity issues,¹ with CVE-2025-33070 enabling domain administrator privileges through Windows Netlogon attacks.¹

Strategic Impact: Time-to-exploitation following vulnerability disclosure continues to compress, with threat actors maintaining vulnerability research capabilities enabling rapid weaponization. Organizations require enhanced vulnerability management approaches with faster patch deployment timelines for newly disclosed critical vulnerabilities.

3. Coordinated Infrastructure Targeting Campaign Affects Global Financial and Utility Sectors

Swiss banking institutions UBS and Pictet confirmed data breaches through third-party procurement provider Chain IQ affecting 19 organizations total,⁴ while ransomware actors continue exploiting CVE-2024-57727 in SimpleHelp RMM targeting utility billing software providers³. Simultaneously, Chinese-speaking threat actor UAT-6382 exploited municipal infrastructure via Cityworks zero-day,⁷ and coordinated reconnaissance operations used 251 AWS-hosted IP addresses for international scanning campaigns.

Strategic Impact: Critical infrastructure faces compound threats through supply chain attacks, municipal system compromises, and financial sector targeting, demonstrating sophisticated threat actor coordination across multiple domains requiring enhanced third-party risk management and infrastructure protection protocols.

TOP THREATS

Stealth Falcon (FruityArmor)

UAE-linked advanced persistent threat group actively exploiting CVE-2025-33053 WebDAV zero-day in targeted espionage operations against defense sector organizations.⁵ The group employs sophisticated tactics including keyloggers, credential dumpers, and evasion techniques, delivering malware via .url files and executing from WebDAV servers in coordinated cyber espionage campaigns⁵. Previous operations include use of Deadglyph backdoor targeting entities in Qatar and Saudi Arabia, with current campaigns focused on military equipment damage assessment and defense industrial base compromise.⁵

BlueNoroff (North Korea)

North Korean threat group demonstrating advanced technological capabilities through deployment of AI-generated deepfakes in executive impersonation attacks.² The group targets corporate executives through fabricated Zoom calls featuring deepfaked company leadership to distribute custom macOS malware suites.² This technique represents an evolution in nation-state attack methodologies, requiring updates to verification protocols and security awareness programs.²

UAT-6382 (China-Nexus)

Chinese-speaking threat actor actively exploiting municipal infrastructure through Cityworks zero-day vulnerability (CVE-2025-0994) and deploying TetraLoader malware for persistent access.⁷ The group demonstrates sophisticated understanding of municipal system architecture and represents continued Chinese threat actor interest in local government and critical infrastructure compromise, indicating potential preparation for broader coordinated attacks against civilian infrastructure.⁷

TOP TRENDS

AI-Weaponized Social Engineering Evolution

The operational deployment of AI-generated deepfakes by nation-state actors represents a notable development in cybersecurity threats.² BlueNoroff's use of executive deepfakes in video conferences demonstrates the evolution of AI attack capabilities from proof-of-concept to operational deployment.² This trend indicates potential expansion of AI-enhanced social engineering across threat actor ecosystems, challenging traditional human verification methods and requiring defensive technology considerations.

Critical Infrastructure Supply Chain Convergence

Multiple coordinated attacks against critical infrastructure through supply chain vectors demonstrate sophisticated threat actor coordination across financial, utility, and municipal sectors.3,4,7 The Swiss banking third-party breach affecting 19 organizations,⁴ ongoing SimpleHelp RMM exploitation targeting utility providers,³ and municipal infrastructure compromise through Cityworks vulnerabilities⁷ indicate systematic targeting of infrastructure dependencies. This convergence requires enhanced third-party risk assessment and supply chain security protocols.

Zero-Day Weaponization Timeline Compression

Analysis reveals continued reduction in time-to-exploitation following vulnerability disclosure, with established threat groups maintaining vulnerability research capabilities enabling rapid weaponization.1,5,6 Microsoft's June 2025 Patch Tuesday vulnerabilities, Chrome V8 engine exploits, and WebDAV zero-days demonstrate continued threat actor adaptation to disclosed vulnerabilities. Organizations face ongoing challenges to traditional patch management timelines requiring accelerated defensive measures for internet-facing systems.

VULNERABILITIES

Critical Patches Released This Month (June 2025)

High-Priority Unpatched Vulnerabilities

RECOMMENDATIONS

Immediate Actions (0-24 Hours)

1. Deploy Emergency Patches: Implement Microsoft June 2025 zero-day patches (CVE-2025-33053, CVE-2025-33070, CVE-2025-33071) across all Windows environments with priority focus on domain controllers and internet-facing systems.1,5
2. Update Browser Infrastructure: Deploy Chrome updates to version 137.0.7151.68+ across all enterprise browsers and implement automatic update policies for Chromium-based applications.⁶
3. Implement AI Deepfake Detection: Establish video call verification protocols requiring multi-factor authentication for executive meetings and implement suspicious meeting request escalation procedures.²
4. Isolate Vulnerable Systems: Immediately audit and isolate SimpleHelp RMM instances from critical network segments while implementing enhanced monitoring for Cityworks platform deployments.3,7

Short-Term Actions (1-7 Days)

1. Comprehensive Vulnerability Assessment: Conduct organization-wide scans for all CISA KEV catalog entries added in June 2025 with emphasis on zero-day indicators and exploitation patterns.
2. Enhanced Third-Party Risk Assessment: Review and strengthen vendor security requirements focusing on critical infrastructure software providers and supply chain dependencies.
3. AI Security Awareness Update: Deploy updated security awareness training addressing AI deepfake threats and establishing video conference verification protocols for executive communications.
4. Municipal Infrastructure Security Review: For organizations with municipal contracts or infrastructure dependencies, conduct security assessments of Cityworks and similar municipal software platforms.

REFERENCES

1. Cybersecurity and Infrastructure Security Agency. (2025, June 11). June 2025 security updates. Microsoft Security Response Center. https://msrc.microsoft.com/update-guide/en-us/releaseNote/2025-jun
2. Toulas, B. (2025, June 18). North Korean hackers deepfake execs in Zoom call to spread Mac malware. BleepingComputer. https://www.bleepingcomputer.com/news/security/north-korean-hackers-deepfake-execs-in-zoom-call-to-spread-mac-malware/
3. Cybersecurity and Infrastructure Security Agency. (2025, June 12). Ransomware actors exploit unpatched SimpleHelp remote monitoring and management to compromise utility billing software provider (AA25-163A). https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a
4. Reuters. (2025, June 18). UBS and Pictet report data leak after cyber attack on provider, client data unaffected. https://www.reuters.com/sustainability/boards-policy-regulation/ubs-reports-data-leak-after-cyber-attack-provider-client-data-unaffected-2025-06-18/
5. Gofman, A., & Driker, D. (2025, June). WebDAV zero-day discovery and attribution. Check Point Research. https://research.checkpoint.com/2025/stealth-falcon-zero-day/
6. Google LLC. (2025, June 3). Stable channel update for desktop. Chrome Releases. https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html
7. Cisco Talos Intelligence. (2025, June). UAT-6382 exploits Cityworks zero-day vulnerability to deliver malware. https://blog.talosintelligence.com/uat-6382-exploits-cityworks-vulnerability/