CTI status
As of:
Last pipeline run:
Source reliability
Information credibility
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Microsoft attributes the ConnectWise supply-chain attack to a Chinese state actor using automated AI agents (ARTEX) and applying the same techniques globally against other organizations.
The collaboration of two state-backed groups in a purely destructive attack on a grain logistics company shows that Sandworm shares its wiper capabilities with partners and deliberately targets food-industry supply chains.
The use of an AI agent framework in a state-sponsored supply chain attack on ConnectWise Cloud Backup demonstrates the increasing automation of state cyber operations.
The report shows that North Korean state actors can infiltrate companies through IT-worker schemes and supply-chain access, and that U.S. authorities have disrupted the operation's infrastructure.
APT41 is reviving a known UEFI bootkit technique through a Secure Boot flaw that has been patched for years, demonstrating that boot-level persistence still works without an updated Secure Boot database (Windows UEFI CA 2023).
The flaw resides in Photoshop's PDF parsing and can be exploited via a crafted PDF file, which puts the document-based attack vector at the forefront.
ZDI reports no active exploitation; relevance stems from direct exposure of Adobe Photoshop and a CVSS score of 7.8 with required user interaction.
The incident shows that compromised credentials from a backup/MSP provider can serve as an entry point into Microsoft 365 tenants, demonstrating supply-chain risks beyond classic software vulnerabilities.
CISA publishes an ICS advisory on a Siemens SIMATIC S7-1500 CPU without listing CVE IDs, so the concrete scope of the vulnerability remains unclear.
The advisory highlights the attack surface of the integrated web servers in SIMATIC S7 controllers without providing specific CVE or patch information.
The CISA advisory on Siemens WinCC does not list any CVE IDs, so severity and exploitability remain unclear.