Top stories.
- Intelligence agencies warn of Russian hacktivists targeting critical infrastructure.
- North Korean threat actors target React2Shell.
- IBM fixes over a hundred vulnerabilities.
Intelligence agencies warn of Russian hacktivists targeting critical infrastructure.
The US intelligence community and its international partners from thirteen countries have issued an advisory warning of pro-Russian hacktivist groups targeting critical infrastructure. The threat actors, including the Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), and Sector16, are "capitalizing on the widespread prevalence of accessible VNC devices to execute attacks against critical infrastructure entities, resulting in varying degrees of impact, including physical damage." The hackers are targeting water and wastewater systems, food and agriculture entities, and the energy sector.
The advisory notes, "These groups have limited capabilities, frequently misunderstanding the processes they aim to disrupt. Their apparent low level of technical knowledge results in haphazard attacks where actors intend to cause physical damage but cannot accurately anticipate actual impact. Despite these limitations, the authoring organizations have observed these groups willfully cause actual harm to vulnerable critical infrastructure."
North Korean threat actors target React2Shell.
Sysdig warns that North Korean threat actors are using new malware in attacks targeting the recently disclosed React2Shell vulnerability (CVE-2025-55182) affecting React Server Components, SC Media reports. The malware, dubbed "EtherRAT," uses "Ethereum smart contracts for command-and-control (C2) resolution, deploys five independent Linux persistence mechanisms, and downloads its own Node.js runtime from nodejs.org."
The researchers explain, "EtherRAT represents a significant evolution in React2Shell exploitation, moving beyond opportunistic cryptomining and credential theft toward persistent, stealthy access designed for long-term operations. The combination of blockchain-based C2, aggressive multi-vector persistence, and a payload update mechanism demonstrates a level of sophistication not previously observed in React2Shell payloads."
IBM fixes over a hundred vulnerabilities.
IBM has issued fixes for more than 100 vulnerabilities across its products, most of which affected third-party dependencies, SecurityWeek reports. The company patched six critical flaws in Storage Defender, one critical vulnerability in IBM Guardium Data Protection's implementation of the Apache Tomcat server, and another critical bug in the form-data library used in Maximo Application Suite.
Other less-severe flaws were fixed in Content Collector, DataPower Operations Dashboard, License Metric Tool, Planning Analytics, Watsonx Subscription, InfoSphere Information Server, StreamSets, and Db2 for Linux, UNIX, and Windows.
