Daily Briefing for 08.26.25

At a glance.

• Cyberattack disrupts Nevada state government services.
• CISA warns of actively exploited Git vulnerability.
• Chinese cyberespionage campaign targets diplomats in Southeast Asia.
• Attackers can inject malicious AI prompts into downscaled images.

Cyberattack disrupts Nevada state government services.

A cyberattack on Sunday morning disrupted Nevada state websites and phone lines, the Record reports. Nevada governor Joe Lombardo said in a statement that the government is "using temporary routing and operational workarounds to maintain public access where it is feasible." As of this morning, the state's website was still down, and Nevada's government offices are closed today. Emergency services remain available.

The government doesn't believe personal information was compromised, though the investigation is ongoing.

CISA warns of actively exploited Git vulnerability.

The US Cybersecurity and Infrastructure Security Agency (CISA) warned yesterday that attackers are exploiting a high-severity Git vulnerability (CVE-2025-48384) that can lead to remote code execution. The Git project patched the flaw on July 8th, and a proof-of-concept exploit was released several days later.

CISA has ordered Federal civilian agencies to patch the flaw by September 15th, and all other organizations are advised to follow suit.

Chinese cyberespionage campaign targets diplomats in Southeast Asia

Google's Threat Intelligence Group has published a report on a Chinese cyberespionage campaign targeting diplomats in Southeast Asia. Google attributes the campaign to UNC6384, a threat actor associated with the PRC-sponsored group Mustang Panda.

Google states, "The campaign hijacks target web traffic, using a captive portal redirect, to deliver a digitally signed downloader that GTIG tracks as STATICPLUGIN. This ultimately led to the in-memory deployment of the backdoor SOGU.SEC (also known as PlugX). This multi-stage attack chain leverages advanced social engineering including valid code signing certificates, an adversary-in-the-middle (AitM) attack, and indirect execution techniques to evade detection."

Attackers can inject malicious AI prompts into downscaled images.

Researchers from Trail of Bits have discovered an attack technique that can lead to data theft by injecting malicious prompts into downscaled images processed by AI systems, BleepingComputer reports. The researchers explain, "By delivering a multi-modal prompt injection not visible to the user, we achieved data exfiltration on systems including the Google Gemini CLI. This attack works because AI systems often scale down large images before sending them to the model: when scaled, these images can reveal prompt injections that are not visible at full resolution."