Oct 21, 2025

The cyber front is shifting fast, Digital Defenders.

Ransomware rules, “safe” code breaks Windows, Adobe scrambles, and North Korea hides malware on the blockchain. Even open source is under fire—this week’s intel shows no system is untouchable.

Here’s what you need to know:

Zero-Day Download

Microsoft Finds Ransomware Dominates 2025 Cyberattack Landscape

Ransomware and extortion have overtaken espionage as the primary drivers of cyberattacks, according to Microsoft’s 2025 Digital Defense Report.

Microsoft found 52% of attacks were financially driven versus 4% for espionage. Identity attacks are up 32% and 97% of identity attacks are tied to passwords.

Microsoft Finds Ransomware Dominates 2025 Cyberattack Landscape

Source: Matthew Manuel/Unsplash

Microsoft reported phishing-resistant MFA blocks over 99% of credential attacks, but many legacy systems still lack support.

Prioritize phishing-resistant MFA (e.g., FIDO2, passkeys) and identity monitoring before attackers “log in” with stolen credentials instead of breaking in.

Windows Kernel Crashed By Rust-Safe Code

Check Point researchers found a Rust-based Windows kernel component intended for safety instead caused repeatable blue screens on fully patched Windows 11 systems.

The flaw, caused by malformed EMF/EMF+ metafiles triggering out-of-bounds errors in the Rust-based GDI module, led to SYSTEM_SERVICE_EXCEPTION crashes.

Although Microsoft has patched it, the issue remains a notable DoS risk, underscoring the tradeoff between memory safety and system resilience.

Immediately patch to OS Build 26100.4202 or later, block EMF/EMF+ files in communication channels, and sandbox all untrusted graphic content to prevent domain-wide downtime.

CISA Flags Critical Adobe Forms Vulnerability

CISA warned of a critical Adobe Experience Manager (AEM) Forms flaw allowing unauthenticated arbitrary code execution.

CVE-2025-54253 affects AEM Forms on Java EE, posing risks to government, healthcare, and financial organizations, with potential for data theft, ransomware, or full network compromise.

Adobe has released a patch for the vulnerability.

Patch AEM Forms promptly, enforce MFA and least privilege, segment networks, monitor continuously, audit configurations, and maintain secure offline backups with tested incident response plans.

Share this newsletter!

Pulse Check

Third-Party App Security Check: How tight is your Adobe game?

🛡️ Locked Down – Patched, restricted, and closely watched.

🕰️ Reactive – Patch on alert, little ongoing oversight.

🎯 Wide Open – Third-party apps run unchecked.

Yesterday's Pulse Check Results

Code Security Check: How secure is your organization’s source code?

Security Tools You Can Use

Slash cyber response time before the next breach hits. Join Lansweeper on Oct. 21.
One team’s IT nightmare became their breakthrough — thanks to Freshworks.
Your next breach won’t wait. See which cybersecurity software can stop it before it starts.

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

North Korea Turns to Blockchain for Stealth Malware Delivery

Google’s Threat Intelligence Group (GTIG) uncovered a North Korean campaign using blockchain to conceal and deliver malware.

The DPRK-linked group UNC5342 uses EtherHiding to embed malicious JavaScript in blockchain smart contracts, gaining persistence and anonymity for data and crypto theft.

North Korea Turns to Blockchain for Stealth Malware Delivery

Source: Choudhary/Unsplash

This is an ongoing campaign in the wild.

Treat blockchain activity as a threat surface and limit risky downloads, enforce MFA, and work with threat intel teams to monitor suspicious smart contracts and APIs.

Open Source Malware Skyrockets 140% in Q3 2025

Open source malware spiked 140% in Q3, with Sonatype identifying over 34,000 new malicious packages across npm, PyPI, and Hugging Face.

Attackers are embedding AI-powered payloads into trusted dependencies, blurring the line between legitimate and malicious code. Campaigns like Shai-Hulud and recent npm hijacks show how easily supply chains can be weaponized, affecting projects with billions of downloads.

With credential theft and stealth tactics on the rise, open source ecosystems are now prime targets for threat actors.

Use automated dependency scanning, signed package verification, and AI-driven SCA to block untrusted or compromised packages before they reach your CI/CD pipeline.

FROM OUR PARTNERS:

A CISO's 100-Day Guide to Security Validation

Jumpstart your security journey: CISOs get a field-tested 100-day roadmap to validate risk, implement CTEM, and lead with proof.

Learn More

Security Tip of the Day

Stay Ahead of Ransomware in 2025

Ransomware remains a top cyber threat of 2025, driving over half of all global attacks.

With AI-powered automation and identity theft fueling faster, stealthier infections, even minor lapses in patching or access control can cascade into full-blown business shutdowns. Now’s the time to harden your ransomware defenses.

Source: Giphy

How to strengthen your ransomware defenses:

Strengthen identity and access security: Enforce phishing-resistant MFA, strict access controls, and regular user training to block credential-based attacks and reduce insider risk.
Fortify networks and endpoints: Apply zero-trust segmentation, automate patching, and use EDR to detect, isolate, and contain ransomware or other intrusions before they spread.
Ensure resilience and rapid recovery: Maintain immutable, offline backups to enable fast restoration of operations and minimize downtime after an attack.

Ransomware defense isn’t just about prevention—it’s about resilience. Combining layered controls, smart automation, and user vigilance creates a defense posture that can minimize downtime.

Meet Our Writer:

Ken Underhill

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.