Recent Ivanti EPMM attacks leveraging CVE-2025-4427 and CVE-2025-4428 have exposed critical vulnerabilities in enterprise mobility management infrastructure. The FRP threat vector is actively targeting financial services, UK government agencies, hospitals, and telecommunications providers.

The year 2025 concludes with critical insights into coordinated threat actor operations targeting critical infrastructure sectors. Qilin and UAT-9686 orchestrated widespread Win.Worm.Coinminer distribution campaigns, leveraging CVE-2025-59718 and CVE-2025-59719 to compromise systems in automotive, government, and manufacturing industries.

Security researchers have identified a sophisticated attack campaign that exploits AI language models including Grok and ChatGPT to facilitate malware distribution. This ClickFix-style attack leverages AMOS malware and osascript execution to compromise systems at scale. The threat actors use AI-generated social engineering content to increase success rates while automating delivery mechanisms.