The year 2025 concludes with critical insights into coordinated threat actor operations targeting critical infrastructure sectors. Qilin and UAT-9686 orchestrated widespread Win.Worm.Coinminer distribution campaigns, leveraging CVE-2025-59718 and CVE-2025-59719 to compromise systems in automotive, government, and manufacturing industries.

Security researchers have identified a sophisticated attack campaign that exploits AI language models including Grok and ChatGPT to facilitate malware distribution. This ClickFix-style attack leverages AMOS malware and osascript execution to compromise systems at scale. The threat actors use AI-generated social engineering content to increase success rates while automating delivery mechanisms.

Security researchers have identified a significant campaign exploiting compromised IAM credentials to conduct large-scale cryptocurrency mining operations across AWS environments. Attackers gain access through credential compromise, then abuse cloud resources for illicit crypto mining, resulting in substantial financial losses and infrastructure degradation.

FreePBX has released security patches addressing four critical vulnerabilities that could allow attackers to execute arbitrary code on affected systems. These flaws include SQL injection attacks, arbitrary file upload capabilities, and authentication type bypass mechanisms. The vulnerabilities span multiple components and require immediate attention from organizations running FreePBX deployments.