Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Despite growing investments and advances in cybersecurity, incidents and data breaches continue to increase year over year. From the continuous uptick of vulnerabilities to the rapidly expanding human attack surface, it’s clear that as new risk points appear, threat actors are right there, ready to take action.

Since at least February 2025, Arctic Wolf has observed Interlock Remote Access Trojan (RAT) being deployed via social engineering techniques. Recently, The DFIR Report published a technical analysis of the Interlock RAT being delivered via a social engineering technique dubbed “FileFix.” The name FileFix is derived from its similarity to the previously documented ClickFix technique using fake CAPTCHA pages.

Arctic Wolf has recently observed a widespread phishing campaign targeting multiple organizations by abusing Microsoft 365’s Direct Send feature—a feature designed for internal email delivery without requiring authentication. Threat actors can identify valid domains and recipients, then send spoofed emails that appear to originate from internal domains—often impersonating the user themself—without needing credentials or access to the tenant.

Organizational perimeters have transformed. From IoT devices and cloud infrastructure to APIs and microservices, today’s perimeters bear little resemblance to those of even the recent past — and one result of these transformations are organizations’ vastly expanded attack surfaces. Additionally, the adoption of hybrid work has imposed new requirements and introduced new challenges that influence perimeter architecture and tooling.

Arctic Wolf Customer, Proof-of-concept exploit code is now available for a high-severity arbitrary file write vulnerability in Git, which poses a risk to developers who regularly work with third-party code. If Git is used in your environment, we recommend reviewing this security bulletin and taking immediate steps to mitigate the risk.

On July 8, 2025, Fortinet released fixes for a critical vulnerability in FortiWeb that could allow an unauthenticated threat actor to execute SQL commands via crafted HTTP or HTTPS requests, tracked as CVE-2025-25257. The flaw lies in the Graphical User Interface (GUI) component and stems from improper neutralization of special elements used in SQL statements. The vulnerability was discovered by a security researcher and responsibly disclosed to Fortinet.

On July 10, 2025, a technical article was published by Huntress revealing that a maximum severity remote code execution vulnerability in Wing FTP Server, CVE-2025-47812, had been actively exploited by threat actors as early as July 1, 2025. Details of the vulnerability had originally been published on June 30, 2025, providing a comprehensive breakdown of the flaw and how to exploit it.

Looking back at the early 2024 data breach at Change Healthcare — a provider of revenue and payment cycle management that connects payers, providers, and patients within the U.S. healthcare system — one key detail stands out: Initial access into the healthcare system’s network was much easier due to a lack of multi-factor authentication (MFA).

While it’s easy to look at the modern threat landscape as a cat-and-mouse game between sophisticated threat actors utilizing high-tech methods to hack their way into valuable systems, the reality can be far less dramatic, albeit equally as precarious.