Google's AI tool finds bugs, Europol disrupts hacktivist group, SquidLoader targets Hong Kong

Summary

Cyber Security Headlines – July 17, 2025

Hosted by CISO Series | Release Date: July 17, 2025

The latest episode of Cyber Security Headlines by CISO Series, hosted by Sarah Lane, delves into significant developments in the information security landscape. This detailed summary captures the key topics discussed, enriched with notable quotes and organized for clarity.

---

1. Google's AI Tool Big Sleep Blocks Critical Vulnerabilities

Google's AI Breakthrough in Cyber Defense

Google has made headlines with its AI-powered tool, Big Sleep, which has successfully identified and neutralized a critical SQLite vulnerability. Sarah Lane highlights:

"Google says its AI agent Big Sleep discovered and thwarted a critical SQLite vulnerability before hackers could exploit it, marking what it claims is the first time AI has actively blocked a zero day attack in the wild." (00:07)

Developed in collaboration with Project Zero and DeepMind, Big Sleep has been instrumental in securing open-source projects since its debut in November. The tool has identified multiple real-world bugs, showcasing the potential of AI in proactive cybersecurity measures.

---

2. Chrome Security Update Addresses Sandbox Escape Zero Day

Enhancing Browser Security Against Advanced Threats

In response to emerging threats, Google released a critical security update for Chrome, addressing approximately half a dozen vulnerabilities. Notably, one high-severity vulnerability allowed attackers to escape the browser's sandbox protection. Sarah Lane explains:

"That exploit is being used by attackers to escape the browser's sandbox protection, using specially crafted HTML pages to execute arbitrary code within the browser's GPU process." (00:07)

This update underscores Google's commitment to fortifying its browser against sophisticated cyber-attacks, ensuring safer user experiences.

---

3. Escalation of Chinese Cyber Attacks on U.S. Targets

Rising Threats from China's Cyber Sector

The Washington Post reports a significant increase in Chinese cyber-attacks targeting the U.S., with incidents more than doubling since 2023. Key points include:

• Attribution to Chinese Firms: Indictments and leaked files link firms such as Shanghai Power Rock and I soon to the Chinese government, facilitating large-scale intrusions through zero-day exploits.

• Impact on U.S. Infrastructure: Groups like Salt Typhoon and Silk Typhoon have infiltrated U.S. infrastructure, including media and defense systems.

• Expert Confirmation: Security firms CrowdStrike, Mandiant, and SISA confirm the escalating threats posed by these cyber activities.

Sarah Lane summarizes:

"US officials have seen Chinese cyber attacks more than double since 2023." (00:07)

This surge highlights the pressing need for enhanced cybersecurity measures to defend against state-sponsored threats.

---

4. Europol Disrupts Pro-Russian Hacktivist Group No Name 15716

Operation Eastwood Takes Down DDoS Group

Europol, in collaboration with authorities from 12 countries, successfully disrupted the pro-Russian DDoS group No Name 15716 through Operation Eastwood. Key outcomes include:

• Targeted Infrastructure: The group targeted over 100 servers, primarily hitting European infrastructure supporting Ukraine.

• Arrests and Warnings: Two suspects were arrested, with authorities issuing seven arrest warrants and warning approximately 1,100 participants.

• Group Activity: Active since 2022, No Name 15716 utilized Telegram and volunteer-run tools to carry out their attacks.

Sarah Lane notes:

"Europol and 12 countries disrupted the pro Russian DDoS group no Name 15716... arresting two suspects." (00:07)

This operation marks a significant achievement in combatting hacktivist activities and safeguarding critical infrastructure.

---

5. UK Retailer Co-Op Cyber Attack Exposes 6.5 Million Member Records

Data Breach Highlights Vulnerabilities in Retail Sector

The UK retailer Co-Op confirmed a devastating cyber attack in April that resulted in the theft of 6.5 million member records. Key details include:

• Ransomware Blocked: Although ransomware was blocked before deployment, attackers managed to exfiltrate member data.

• Tracking and Impact: Co-Op believes the attackers' movements were fully tracked, and no financial data was compromised.

• Arrests: Four suspects linked to the attacks on UK retailers were arrested and released on bail.

• Security Implications: Officials emphasize the incident as a stark reminder of the necessity for robust cyber defenses across critical infrastructure.

Sarah Lane explains:

"The incident underscores the need for stronger cyber defenses across critical infrastructure." (00:07)

This breach exposes the persistent threats faced by the retail sector and the critical importance of comprehensive security strategies.

---

6. SquidLoader Malware Campaign Targets Hong Kong Financial Sector

Sophisticated Malware Targets Financial Institutions

Researchers from Trellix have identified a new malware campaign employing SquidLoader to target Hong Kong's financial institutions. Significant aspects of the campaign include:

• Malware Deployment: Uses Cobalt Strike Beacon and effectively evades most detection tools.

• Infection Strategy: Initiates with spear-phishing emails containing disguised executables, followed by a multi-stage infection incorporating advanced anti-analysis techniques.

• Geographical Spread: Related activities are also emerging in Singapore and Australia.

Sarah Lane details:

"A new malware campaign using Squid Loader is targeting financial institutions in Hong Kong..." (00:07)

This campaign highlights the evolving tactics of cybercriminals targeting the financial sector with sophisticated malware.

---

7. Overstep Rootkit Exploited in SonicWall SMA Device Attacks

Persistent Threats Through Compromised Network Devices

A threat actor identified as UNC6148 is deploying the stealthy Overstep rootkit on SonicWall SMA100 devices by exploiting both suspected zero-day and known vulnerabilities. Key points include:

• Malware Capabilities: Modifies the device's boot process, conceals itself with advanced anti-forensic features, and installs Cobalt Strike or Abyss ransomware.

• Attack Objectives: Includes log wiping, credential theft, and establishing long-term persistence, often linked to data extortion and previous ransomware incidents.

• Device Targeting: Specifically attacks end-of-life SonicWall SMA devices to gain persistent access and steal credentials.

Sarah Lane reports:

"The malware modifies the device's boot process, hides itself with advanced anti forensic features and installs Cobalt Strike or Abyss ransomware." (00:07)

This incident underscores the vulnerability of network devices and the necessity for regular updates and robust security measures.

---

8. Europol Dismantles Disk Station Ransomware Gang Targeting NAS Devices

Law Enforcement Success Against Ransomware

In a significant law enforcement victory, Europol led an international operation to dismantle the Disk Station Ransomware Gang, a Romanian group targeting Synology NAS devices since 2021. Highlights include:

• Attack Methodology: The gang encrypted corporate data and demanded ransoms up to hundreds of thousands of dollars, causing severe disruptions to businesses.

• Arrest Details: A 44-year-old man was arrested in Romania after forensic and blockchain investigations linked him to the attacks.

Sarah Lane summarizes:

"An international law enforcement operation led by Europol dismantled the Disk Station Ransomware Gang... A 44 year old man was arrested in Romania." (00:07)

This operation demonstrates the effectiveness of international cooperation in combating ransomware threats and bringing perpetrators to justice.

---

Looking Ahead: Defense In Depth Episode

Sarah Lane concludes the episode by inviting listeners to explore their new episode of Defense In Depth, focusing on current cybersecurity trends essential for advancing security practices and business operations. She encourages engagement and feedback from the audience:

"Where should we be paying the most attention to drive the security practice and and the business forward? That's what we'll be digging into in our new episode of Defense In Depth." (00:07)

Listeners are directed to cisoseries.com for more insights and to share their thoughts.

---

Stay Informed

For comprehensive coverage of these headlines and more, subscribe to Cyber Security Headlines available every weekday on your preferred podcast platform or visit cisoseries.com.

---

This summary is based on the transcript provided and aims to encapsulate the essential discussions and insights from the podcast episode.

Transcript

[A]

From the CISO series. It's Cybersecurity Headlines.

[B]

These are the CyberSecurity headlines for July 17, 2025. I'm Sarah Lane. Google says Big Sleep AI tool found bug hackers planned to use Google says its AI agent Big Sleep discovered and thwarted a critical SQLite vulnerability before hackers could exploit it, marking what it claims is the first time AI has actively blocked a zero day attack in the wild. The tool was developed with Project Zero and DeepMind and found multiple real world bugs since its November debut and is now being used to secure open source projects. Google fixes actively exploited Sandbox Escape Zero day in Chrome. Google also released a security update for Chrome that addresses around a half dozen vulnerabilities and including one with a high severity rating. That exploit is being used by attackers to escape the browser's sandbox protection, using specially crafted HTML pages to execute arbitrary code within the browser's GPU process. China's cyber sector amplifies Beijing's hacking of US Targets the Washington Post reports that US officials have seen Chinese cyber attacks more than double since 2023. Indictments and leaked files tie firms like Shanghai, Power Rock and I soon to China's government letting large scale intrusions exist through zero days sold across agencies. Groups like Salt Typhoon and Silk typhoon have penetrated U.S. infrastructure, media and defense systems with CrowdStrike, Mandiant and SISA all confirming escalating threats. Europol disrupts Pro Russian no Name 15716 DDoS hacktivist group Europol and 12 countries disrupted the pro Russian DDoS group no Name 15716 in Operation Eastwood, targeting over 100 servers and arresting two suspects. The group appears to have been active since 2022 and used Telegram and volunteer run tools to attack European infrastructure supporting Ukraine. Authorities warned 1,100 participants and and issued seven arrest warrants as well. Huge thanks to our sponsor ThreatLocker. ThreatLocker is a global leader in zero trust endpoint security, offering cybersecurity controls to protect businesses from zero day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit threatlocker.com CISO that's threatlocker.com CISO Retailer Co op attackers snatched all 6.5 million member records the UK retailer Co op confirmed that all 6.5 million member records were stolen in an April cyber attack attributed to Scattered Spider. Though ransomware was blocked before deployment, Co Op believes the attackers movements were fully tracked and that no financial data was affected. Four suspects tied to attacks on UK retailers were arrested and released on bail. Officials warn the incident underscores the need for stronger cyber defenses across critical infrastructure. Squidloader malware campaign targets Hong Kong financial sector Researchers from Trellix say a new malware campaign using Squid Loader is targeting financial institutions in Hong Kong, deploying Cobalt Strike Beacon and evading most detection tools. The attack starts with spear phishing emails containing disguised executables, followed by a multi stage infection with extensive anti analysis techniques. Related activity is also thought to be spreading to Singapore and Australia. SonicWall SMA devices hacked with overstep rootkit tied to ransomware A threat actor tracked as UNC6148 is deploying a stealthy rootkit called Overstep on end of life. SonicWall SMA100 devices exploiting suspected zero day and known vulnerabilities to gain persistent access and steal credentials. Google's Threat Intelligence group says the malware modifies the device's boot process, hides itself with advanced anti forensic features and installs Cobalt Strike or Abyss ransomware. The campaign includes log wiping, credential theft and long term persistence with ties to data extortion and prior ransomware incidents. Police dismantle Disk Station ransomware gang targeting NAS devices Arrest suspected ringleader an international law enforcement operation led by Europol dismantled the Disk Station Ransomware Gang, a Romanian group that had been targeting Synology NAS devices since 2021. Under multiple Aliase, the attackers encrypted corporate data and demanded ransoms up to hundreds of thousands of dollars, often severely disrupting businesses. A 44 year old man was arrested in Romania following forensic and blockchain investigations linking him to the attacks. We are awash in technologies, ideas and processes. So much to look at and so much to learn. Where should we be paying the most attention to drive the security practice and and the business forward? That's what we'll be digging into in our new episode of Defense In Depth. It just dropped today, so look for what are the cybersecurity trends we need to follow? Wherever you get your podcasts or head on over to cisoseries.com and if you have thoughts on the news from today or about the show in general, be sure to reach out to [e-mail] we would love to hear from you. I'm Sarah Lane reporting for the CISO series and we'll talk to you next time.

[A]

Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.