“`html

Cyber Pulse: The 5 Critical Threats You Can’t Afford to Miss This Week

The digital threat landscape is accelerating, marked by a dangerous blend of unprecedented scale and deceptive subtlety. This week underscores a dual reality: attackers are launching record-shattering volumetric assaults while simultaneously perfecting the art of the invisible intrusion. From botnets capable of overwhelming global infrastructure to stealthy compromises of developer tools and cloud identities, the perimeter is both everywhere and nowhere. Security teams must now defend against the blunt force of terabits-per-second DDoS attacks and the silent, lateral movement of adversaries who operate like ghosts in the machine. Vigilance requires understanding both extremes.

⚡ AISURU/Kimwolf Botnet Launches Record-Setting 31.4 Tbps DDoS Attack

The AISURU/Kimwolf botnet has set a new, alarming benchmark for distributed denial-of-service (DDoS) attacks, launching a hyper-volumetric assault that peaked at a staggering 31.4 Terabits per second (Tbps). What’s particularly notable is the attack’s blistering duration—a mere 35 seconds—indicating a shift towards “burst” attacks designed to slip past traditional mitigation systems that may rely on longer detection windows. Cloudflare, which mitigated the attack, links this to a growing trend of massive, short-lived HTTP DDoS campaigns in late 2025, suggesting botnet herders are refining their tools for maximum impact with minimal sustained exposure.

This record-breaking event is not an isolated incident but part of a strategic escalation. The move towards hyper-volumetric HTTP floods targets the application layer, which can be more costly and complex to defend than simpler network-layer attacks. The botnet’s ability to generate such immense traffic likely stems from a combination of compromised high-capacity servers (like cloud instances) and vulnerable IoT devices, creating a formidable weaponized network. This attack serves as a stark stress test for the scalability of even the most robust cloud security providers.

Why this matters: This attack redefines the upper limits of DDoS threat potential, pushing infrastructure defenses to their absolute brink. Organizations must ensure their DDoS protection can handle terabit-scale, short-burst attacks, not just prolonged campaigns. Relying solely on on-premises solutions is increasingly untenable.
Read Source

🕵️ ThreatsDay Bulletin: Codespaces RCE, AsyncRAT C2, BYOVD Abuse & More

This week’s threat intelligence reveals a pervasive theme: the quiet, professionalization of intrusion. Instead of flashy exploits, researchers are tracking subtle compromises in developer workflows (like GitHub Codespaces RCE), abuse of remote administration tools, sophisticated cloud identity attacks, and Bring-Your-Own-Vulnerable-Driver (BYOVD) techniques. These methods are chosen for their stealth and operational security, allowing threat actors to embed themselves deeply within environments by exploiting trusted processes and tools.

The aggregation of these “small signals” is more telling than any single headline. It paints a picture of adversaries focusing on the software supply chain, identity as the new perimeter, and living-off-the-land tactics (LOLBins). The initial entry point is becoming less detectable, as attackers blend in with normal administrative and developer activity. The ultimate impact, however—data exfiltration, ransomware deployment, espionage—remains severe, proving that the most dangerous breaches often begin with a whisper, not a bang.

Why this matters: Defense must evolve from hunting for “malware” to detecting anomalous behavior in legitimate tools and user sessions. Security monitoring for DevOps environments, cloud identity auditing, and application allow-listing become critical controls.
Read Source

🤖 The Buyer’s Guide to AI Usage Control

The explosive, organic adoption of AI tools across enterprises has created a massive shadow IT problem. AI is embedded in SaaS platforms, browser extensions, copilots, and countless unsanctioned “shadow” applications, operating far outside the visibility of traditional security controls. Legacy security measures, designed for a pre-AI era, are often blind to the data being sent to and from these AI models, creating ungoverned data exfiltration and compliance risks.

The article argues for a new paradigm: AI Usage Control. This involves implementing security that operates at the point of AI interaction—the browser, the API call, the endpoint—rather than at the network perimeter. Effective control requires understanding context: which AI service is being used, by whom, and what sensitive data is being submitted in prompts. Without this granular visibility and policy enforcement, organizations risk leaking intellectual property, customer data, and strategic secrets directly into third-party AI models.

Why this matters: Uncontrolled AI usage is the next major data leakage vector. Organizations need to urgently develop and enforce AI acceptable use policies, backed by technical controls that can monitor and manage interactions with both sanctioned and unsanctioned AI services.
Read Source

🌐 Infy Hackers Resume Operations with New C2 Servers After Iran Internet Blackout

The Iranian advanced persistent threat (APT) group Infy (aka Prince of Persia) has returned to operations following a nationwide internet blackout in Iran, showcasing both resilience and evolution. The group allowed its previous command-and-control (C2) infrastructure to go dormant during the blackout, a tactical pause likely intended to avoid detection and re-tool. With connectivity restored, they have deployed fresh C2 servers, indicating a well-resourced and patient operation capable of weathering state-imposed disruptions.

This activity highlights how geopolitical events directly influence cyber threat actor behavior. The group’s evolution includes more sophisticated tactics to hide its tracks, suggesting continuous improvement in operational security. The timing of the infrastructure refresh coinciding with the end of the blackout demonstrates a strategic, disciplined approach to campaign management, ensuring their tools remain effective and their persistence is maintained against high-value targets.

Why this matters: Geopolitical tensions have a direct cyber fallout. Organizations associated with sectors of interest to Iranian APTs (government, defense, energy, telecommunications) should be on heightened alert for new phishing campaigns or intrusion attempts following such events, as actors resume operations with updated infrastructure.
Read Source

🔧 Critical n8n Flaw (CVE-2026-25049) Enables System Command Execution

A critical vulnerability (CVSS 9.4) in the popular n8n workflow automation platform has been disclosed, allowing authenticated attackers to execute arbitrary system commands by importing maliciously crafted workflows. The flaw, CVE-2026-25049, is particularly concerning as it represents a regression—it bypasses safeguards implemented to fix a previous, even more severe vulnerability (CVE-2025-68613, CVSS 9.9). This indicates a failure in the initial patch’s completeness and highlights the challenges of secure input sanitization in complex, user-customizable platforms.

n8n’s design, which allows users to import and export workflows as JSON files, becomes the attack vector. Inadequate sanitization of these files lets attackers embed and execute system-level commands. Given that n8n is often used to connect various internal services and APIs, a successful exploit could lead to full compromise of the host server, lateral movement across connected systems, and significant data breach scenarios.

Why this matters: This is a supply chain risk for any organization using n8n for internal automation. It underscores the need for immediate patching of internet-facing n8n instances and a review of all imported workflows. It also serves as a reminder that patches for critical flaws must be thoroughly tested for regression.
Read Source

Key Takeaways for Security Teams:

• Scale Meets Stealth: Prepare for both record-breaking DDoS attacks and near-invisible intrusions targeting identity and developer tools.
• AI is a New Attack Surface: Implement granular usage controls to prevent data leakage through sanctioned and shadow AI applications.
• Geopolitics Drives Cyber Activity: Monitor for renewed APT campaigns following real-world events like state-imposed internet blackouts.
• Patch Regressions Happen: Treat patches for critical vulnerabilities as urgent, but validate they fully address the root cause without introducing new bypasses.
• The Perimeter is Behavioral: Shift detection focus to anomalous use of legitimate tools and cloud identities, as the initial access phase becomes quieter.

“`