--- title: Threat Intelligence Center - Capstone Technologies Group description: UK defence, energy, and healthcare sectors targeted by coordinated cyber attacks. Critical infrastructure vulnerabilities exposed. Mitigation strategies for… canonical_url: https://captechgroup.com/threat-intelligence-center?start=189 language: en-GB date: 2025-08-13T00:46:48Z notice: This is a machine-friendly version of the page at https://captechgroup.com/threat-intelligence-center?start=189. markdown-tokens: 1300 --- > **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/threat-intelligence-center?start=189. Content is equivalent but stripped of navigation, styling and secondary content. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. [ ![Conceptual image of UK cybersecurity, highlighting threat vectors and data protection in defense networks and critical infrastructure.](https://images.captechgroup.com/cdn-cgi/image/width=515,format=webp,quality=85/threat-intel/fed669976d.jpg) ](https://captechgroup.com/threat-intelligence-center/uk-government-and-defence-networks-face-coordinate-db1286 "UK Government and Defence Networks Face Coordinated Cyber Threats Across Critical Infrastructure") The UK's critical infrastructure sectors—defence, energy, government, healthcare, and telecommunications—are facing a sustained wave of coordinated cyber threats. These attacks exploit gaps in network segmentation, outdated authentication systems, and supply chain vulnerabilities to penetrate sensitive environments. [ ![Conceptual cybersecurity image illustrating threat vectors exposing NGINX servers to unauthorized access and data protection risks.](https://images.captechgroup.com/cdn-cgi/image/width=515,format=webp,quality=85/threat-intel/b8cdbcaa3c.jpg) ](https://captechgroup.com/threat-intelligence-center/mcp-integration-flaw-exposes-nginx-servers-to-unau-77a83f "MCP Integration Flaw Exposes NGINX Servers to Unauthorized Access via Shodan") Security researchers have identified critical flaws in NGINX's Model Context Protocol (MCP) integration that allow attackers to discover and compromise web servers at scale. CVE-2026-27944 and CVE-2026-33032 enable adversaries to use Shodan and similar reconnaissance tools to identify vulnerable NGINX instances running nginx-ui, then exploit the integration flaw to gain unauthorized access. [ ![Cybersecurity image illustrating PowMix botnet threat vectors targeting Czech workforce and credential theft risks.](https://images.captechgroup.com/cdn-cgi/image/width=515,format=webp,quality=85/threat-intel/a40801bce0.jpg) ](https://captechgroup.com/threat-intelligence-center/powmix-botnet-targets-czech-workforce-with-credent-c3dd76 "PowMix Botnet Targets Czech Workforce with Credential Theft") Security researchers have identified PowMix, a botnet actively targeting the Czech workforce through credential harvesting campaigns. This threat exploits common attack vectors to compromise user credentials and establish persistent access to organizational networks. [ ![Conceptual image illustrating cybersecurity threats and data protection against CVE-2025-60710 Windows Task Host vulnerability.](https://images.captechgroup.com/cdn-cgi/image/width=515,format=webp,quality=85/threat-intel/78da930192.jpg) ](https://captechgroup.com/threat-intelligence-center/cve-2025-60710-windows-task-host-vulnerability-exp-28934e "CVE-2025-60710 Windows Task Host Vulnerability Exploited in Active Attacks") The Cybersecurity and Infrastructure Security Agency has identified CVE-2025-60710, a vulnerability in Windows Task Host, as actively exploited in ongoing attacks targeting government agencies. This vulnerability allows attackers to execute code with elevated privileges on affected systems. [ ![Conceptual image illustrating Formbook malware's threat vectors targeting professional services in cybersecurity and data protection.](https://images.captechgroup.com/cdn-cgi/image/width=515,format=webp,quality=85/threat-intel/cf0de26ef1.jpg) ](https://captechgroup.com/threat-intelligence-center/formbook-malware-abuses-msbuild-and-obfuscated-jav-236e73 "Formbook Malware Abuses MSBuild and Obfuscated JavaScript to Target Professional Service Firms") Security researchers have identified a Formbook malware campaign leveraging obfuscated JavaScript, MSBuild.exe, PowerShell, and Windows Script Host to compromise professional service firms. This multi-stage attack chain exploits legitimate Windows tools to evade detection and establish persistence. [ ![Conceptual image illustrating cybersecurity threats from Chrome extensions compromising data protection and digital security.](https://images.captechgroup.com/cdn-cgi/image/width=515,format=webp,quality=85/threat-intel/bf96c91a26.jpg) ](https://captechgroup.com/threat-intelligence-center/over-100-chrome-web-store-extensions-steal-user-ac-8c16ea "Over 100 Chrome Web Store Extensions Steal User Accounts and Data") Researchers have uncovered a large-scale campaign involving more than 100 malicious extensions distributed through the official Chrome Web Store. These extensions employ credential harvesting and data exfiltration techniques to compromise user accounts across email, banking, and productivity platforms. [ ![Conceptual image illustrating cybersecurity threats from n8n automation misuse, highlighting data protection and threat vectors.](https://images.captechgroup.com/cdn-cgi/image/width=515,format=webp,quality=85/threat-intel/86c2e255f4.jpg) ](https://captechgroup.com/threat-intelligence-center/threat-actors-abuse-n8n-workflow-automation-to-dep-8eb623 "Threat Actors Abuse n8n Workflow Automation to Deploy Malware and Steal Data") Security researchers have identified a growing campaign where threat actors are misusing n8n, a popular open-source workflow automation platform, to deploy malware and exfiltrate sensitive data from regulated organizations.