Chrome Enterprise Premium delivers always-on browser protection, policy enforcement, and centralized control to eliminate manual updates and reduce security risks.

Welcome to another _secpro!

As we step out into another week of cybersecurity-related shenanigans, it's important to remember some perspective and how we frame the constant threat of the adversary. It's easy to become doom-and-gloom about the possibilities of every getting away from the constant worry of "the next big disaster". There's no magic fix for that, obviously, but we can take our time, gather our resources, and build plans and processes that cut the adversary off. As a part of that, tackling the problem of social engineering is one of the more challenging difficulties to tackle...

That's why we're back into social engineering this week and, this time, we're exploring how the adversary moves in the age of AI. If you've missed our other investigations, then check them out here, here, here, here, and here.

If you want more, you know what you need to do: sign up to the premium and get access to everything we have on offer. Click the link above to visit our Substack and sign up there!

Cheers!
Austin Miller
Editor-in-Chief

In their latest research, Unit 42 explains that many social engineering attacks don’t need advanced hacking tools. Instead, they work because of three main weaknesses: low detection coverage, alert fatigue, and organisational failures.

Patch Tuesday: Microsoft fixes actively exploited Windows kernel vulnerability (Help Net Security): Microsoft patched 63 vulnerabilities in its November 2025 update, including CVE-2025-62215, a race-condition in the Windows Kernel that allows elevation to SYSTEM and has seen in-the-wild exploitation.

Amazon pins Cisco, Citrix zero-day attacks to APT group (CyberScoop / Amazon): Amazon’s Threat Intelligence team reported a sophisticated APT exploiting CVE-2025-20337 (Cisco ISE) and CVE-2025-5777 (Citrix Bleed 2) to deploy custom, in-memory malware.

Exploiting Data Structures for Bypassing and Crashing Anti-Malware Solutions via Telemetry Complexity Attacks: Researchers describe a new class of attack — Telemetry Complexity Attacks (TCAs) — which overwhelm anti-malware telemetry pipelines (e.g., JSON serializers, DB backends) by generating deeply nested or oversized data, causing denial-of-analysis (DoA). They tested this on 12 platforms, finding several failures and even assigned CVEs (e.g., CVE-2025-61301, CVE-2025-61303).

CYFIRMA Weekly Intelligence: “PureRAT” trending: The research unit reports that “PureRAT” is highly active, noting a phishing campaign targeting the hospitality sector using WhatsApp and booking systems to deliver the RAT, focused on credential theft and exfiltration.

Sophisticated threat actor targeting zero-day flaws in Cisco ISE & Citrix: The campaign exploited two zero-days to inject a custom web shell into Cisco ISE and run memory read attacks on Citrix NetScaler, suggesting a high-skill, likely state-aligned actor.

Operation Endgame Dismantles Rhadamanthys, Venom RAT, and Elysium Botnet: Technical breakdown of the takedown — over 1,025 servers seized, 20 domains taken down, and the arrest of a key suspect associated with VenomRAT; also warns that victims may still harbor residual malware.

The Reality of Full-Time Bug Bounty Hunting: Daniel Kelley reflects on what it’s really like to do bug bounty hunting as a full-time job: the unstable income, the pressure to constantly find bugs, and the trade-offs between freelancing and more stable security work.

5 Key Factors to Consider When Purchasing an Automated Code Remediation Tool: Kelley breaks down what security teams should look for when buying automated code remediation tools — including accuracy, integration, usability, and how well the tool handles real-world code complexity.

Not Getting Incentives Right Can Kill a Security Initiative: Ross Haleliuk argues that many security failures stem not from technical problems, but from misaligned incentives: different teams (developers, ops, execs) have conflicting priorities, which undermines security investments.

AI Doesn’t Make It Much Easier to Build Security Startups: In a contrarian view, Haleliuk suggests that while AI is hyped-up as a game changer for security startups, the real challenge remains in product-market fit, recruiting top engineering talent, and building defensible IP — not just “add AI.”

Ransomware 3.0: Self-Composing and LLM-Orchestrated (Md Raz, Meet Udeshi, P. V. Sai Charan, Prashanth Krishnamurthy, Farshad Khorrami, Ramesh Karri): This paper introduces a proof-of-concept ransomware (“Ransomware 3.0”) that uses Large Language Models (LLMs) to autonomously carry out all phases of a ransomware attack. Rather than relying on static, hard-coded malicious logic, payloads are dynamically synthesized at runtime based on prompts embedded in the binary. The LLM orchestrator handles reconnaissance, payload generation, adaptation to the execution environment, and even crafts personalized ransom notes — all without human intervention. The authors evaluate the approach across environments (e.g., personal, enterprise, embedded) and analyze behavioral signals and telemetry to better understand detection and defense implications.

Adaptive Cybersecurity: Dynamically Retrainable Firewalls for Real-Time Network Protection (Sina Ahmadi): This paper proposes a new kind of firewall that uses machine learning to continuously retrain itself in real time, adapting to evolving network threats. Unlike traditional firewalls built on static rules, this system uses reinforcement learning, continual learning, and micro-service architectures to dynamically update its threat model. The research discusses trade-offs around latency, computational cost, data privacy, and integration with architectures like Zero Trust.

Artificial Intelligence and Machine Learning in Cybersecurity: A Deep Dive into State-of-the-Art Techniques and Future Paradigms: This is a thorough review of how AI and ML are currently being used in cybersecurity — covering intrusion detection, malware classification, behavioral analysis, threat intelligence, etc. It also identifies emerging paradigms, gaps, and future research directions, particularly around explainability, adversarial robustness, and real-time deployment.

A Comprehensive Scientometric Study of Research Trends in Cybersecurity from 2000 to 2024 Using Biblioshiny and VOSviewer: This paper maps out the evolution of cybersecurity research over nearly 25 years by using scientometric tools (Biblioshiny, VOSviewer). It identifies key trends, influential papers, collaboration networks, and shifting research hotspots. The study is helpful for understanding where the field has come from and which areas are now accelerating (e.g., ML, cloud security, privacy).

Advancing Cybersecurity Through Machine Learning: A Scientometric Analysis of Global Research Trends and Influential Contributions: This scientometric analysis focuses specifically on ML in cybersecurity, tracking publication trends, geographic distribution, influential works, and major contributing authors and institutions. It provides a quantitative picture of how ML-driven cybersecurity research has grown, and where it may be headed.

QORE: Quantum Secure 5G / B5G Core (Vipin Rathi, Lakshya Chopra, Rudraksh Rawal, Nitin Rajput, Shiva Valia, Madhav Aggarwal, Aditya Gairola): This forward-looking paper proposes a quantum-resistant 5G (and beyond) core architecture by integrating standardised post-quantum cryptography (PQC) algorithms—specifically lattice-based schemes (ML-KEM, ML-DSA)—into 5G core network functions and mobile devices. They also propose a hybrid configuration that supports both classical and post-quantum primitives to ease migration, and they provide performance evaluation showing that their design meets the low-latency and high-throughput needs of carrier-grade networks.

Copyright (C) 2025 Packt Publishing. All rights reserved. 

Our mailing address is: 

Packt Publishing, Grosvenor House, 

11 St Paul's Square, Birmingham, 

West Midlands, B3 1RB, United Kingdom 

Want to change how you receive these emails? 

You can update your preferences or unsubscribe.