SENTINEL INTELLIGENCE PROTOCOL · TLP:WHITE · AUTHORIZED DISTRIBUTION ONLY

BREAKING

CRITICAL · CVE-2025-7731 actively exploited in Fortinet FortiGate — CISA Emergency Directive 25-04 issued — patch immediately◆APT28 attributed to coordinated attacks on European energy grid infrastructure — NATO cyber alliance emergency session convened◆New Windows CLFS kernel zero-day exploited in targeted campaigns against defense contractors — patch in KB5040528◆FBI: $4.73B lost to cybercrime in FY2024 — ransomware primary vector for critical infrastructure attacks for third consecutive year◆Joint FBI-Europol operation dismantles 403,000-node HYDRUS botnet across 47 countries — three arrests confirmed◆Cloudflare reports 412% surge in DDoS amplification attacks targeting financial services sector Q1 2025◆Salt Typhoon remains active in U.S. telecommunications networks — Senate Intelligence Committee briefed on scope◆CRITICAL · CVE-2025-7731 actively exploited in Fortinet FortiGate — CISA Emergency Directive 25-04 issued — patch immediately◆APT28 attributed to coordinated attacks on European energy grid infrastructure — NATO cyber alliance emergency session convened◆New Windows CLFS kernel zero-day exploited in targeted campaigns against defense contractors — patch in KB5040528◆FBI: $4.73B lost to cybercrime in FY2024 — ransomware primary vector for critical infrastructure attacks for third consecutive year◆Joint FBI-Europol operation dismantles 403,000-node HYDRUS botnet across 47 countries — three arrests confirmed◆Cloudflare reports 412% surge in DDoS amplification attacks targeting financial services sector Q1 2025◆Salt Typhoon remains active in U.S. telecommunications networks — Senate Intelligence Committee briefed on scope◆

HOME/THREAT INTELLIGENCE

INTELLIGENCE CATEGORY

Threat Intelligence

3 BRIEFS INDEXED

THREAT INTELLIGENCEHIGH

APT41 Deploys Novel PhantomStrike Ransomware in Coordinated Healthcare Sector Campaign

China-nexus threat group APT41 has pivoted to double-extortion ransomware operations targeting hospital networks across six countries, deploying a previously unseen payload researchers are calling PhantomStrike.

Lena Kirchberg·2025-06-09

ANALYSISANALYSIS

Anatomy of a Supply Chain Intrusion: Tracking the Lazarus Group's 18-Month Operation

An exclusive deep-dive investigation into a sophisticated software supply chain campaign attributed to North Korea's Lazarus Group that compromised 47 downstream organizations through a single poisoned open-source dependency.

Ingrid Solberg·2025-06-07

THREAT INTELLIGENCEHIGH

Kimsuky Threat Group Integrates LLM-Generated Content Into Spear-Phishing Infrastructure

North Korean intelligence cyber unit Kimsuky has been observed using large language model-generated lures that pass human editorial review, dramatically improving social engineering success rates against academic and policy targets.

Farouk Adeyemi·2025-06-06