Nation-State Actors Breach F5 Networks Stealing BIG-IP Source Code; AI Phishing Effectiveness Skyrockets

Further analysis of the NCSC's report emphasizes that supply chain vulnerabilities are a critical factor behind the doubling of nationally significant cyberattacks. Experts, including Simon Colvin of Pinsent Masons, point to third-party service providers like IT helpdesks and MSPs as common gateways for attackers to breach core business systems. A September 2025 survey by Cips supports this, revealing that 29% of procurement managers reported a supply chain partner had been attacked recently. This highlights a systemic risk, expanding the attack surface and necessitating enhanced vendor risk management, principle of least privilege, and network segmentation for mitigation.

The Black Fog Q3 2025 report update reveals an estimated 1,510 unreported ransomware attacks, significantly expanding the known scope of the threat. It highlights that manufacturing and services are the most impacted overall when considering these non-disclosed incidents. Additionally, the report details that ransomware gangs stole an average of 527.65 GB of data per victim and listed 449 victims on data leak sites. A concerning lack of transparency is noted, with 71% of victim notifications failing to specify the incident's root cause, complicating threat intelligence efforts. The update also provides specific D3FEND mappings for detection and mitigation strategies.

Clop ransomware has claimed Envoy Air, an American Airlines subsidiary, as a new victim in its ongoing campaign targeting Oracle E-Business Suite (EBS) vulnerabilities. The attack, likely exploiting flaws like CVE-2023-21931, resulted in the exfiltration of business information and commercial contacts. Envoy Air confirmed no sensitive customer or personal data was compromised. This incident confirms the broader impact of Clop's Oracle EBS campaign, which was previously mentioned, and highlights the group's continued focus on exploiting enterprise software.