December 2025 – Page 34

North Korea-linked Actors Exploit React2Shell to Deploy New EtherRAT Malware

Threat actors with ties to North Korea have likely become the latest to exploit the recently disclosed critical security React2Shell flaw in React Server Components (RSC) to deliver a previously undocumented remote access trojan dubbed EtherRAT.
“EtherRAT leverages Ethereum smart contracts for command-and-control (C2) resolution, deploys five independent Linux persistence mechanisms, and

Prime Security Raises $20 Million to Build Agentic Security Architect

Prime Security, which offers an AI-powered platform to help security teams detect, prioritize, and mitigate risks at the software design phase, today announced a $20M Series A funding round. Founded in 2023 and headquartered in New York with offices in Tel Aviv, the company has developed what it calls an “Agentic Security Architect” that autonomously conducts […]

The post Prime Security Raises $20 Million to Build Agentic Security Architect appeared first on SecurityWeek.

Ivanti warns of critical Endpoint Manager code execution flaw

American IT software company Ivanti warned customers today to patch a newly disclosed vulnerability in its Endpoint Manager (EPM) solution that could allow attackers to execute code remotely. […]

Maintaining enterprise IT hygiene using Wazuh SIEM/XDR

Poor IT hygiene, such as unused accounts, outdated software, and risky extensions, creates hidden exposure in your infrastructure. Wazuh, the open-source XDR and SIEM, shows how continuous inventory monitoring across endpoints helps teams spot drift and tighten security. […]

Spain arrests teen who stole 64 million personal data records

The National Police in Spain have arrested a suspected 19-year-old hacker in Barcelona, for allegedly stealing and attempting to sell 64 million records obtained from breaches at nine companies. […]

Webinar Today: Inside the First 72 hours of a Cyber Event

Learn how GRC and SOC teams can turn shared threat intelligence into faster action, clearer communication, and stronger organizational resilience.

The post Webinar Today: Inside the First 72 hours of a Cyber Event appeared first on SecurityWeek.

Four Threat Clusters Using CastleLoader as GrayBravo Expands Its Malware Service Infrastructure

Four distinct threat activity clusters have been observed leveraging a malware loader known as CastleLoader, strengthening the previous assessment that the tool is offered to other threat actors under a malware-as-a-service (MaaS) model.
The threat actor behind CastleLoader has been assigned the name GrayBravo by Recorded Future’s Insikt Group, which was previously tracking it as TAG-150.

Month: December 2025