As we move into May 2025, the cybersecurity landscape continues to evolve with notable shifts from April. The rise in sophisticated nation-state attacks, particularly those exploiting cloud environments and SaaS platforms, has intensified, with groups like Void Blizzard and Earth Lamia leveraging advanced phishing and vulnerability exploits. There’s also a marked increase in ransomware and info-stealer campaigns targeting AI users through SEO scams and social ads, a trend that gained traction this month. Additionally, the departure of key CISA leadership has raised concerns about weakened cyber defenses amid growing global threats. This blog post provides a global overview of the latest threats, breaches, and innovations shaping cybersecurity in May 2025.
Major Cybersecurity Threats in May 2025
The following table summarizes key threats reported this month, drawing from trusted sources like The Hacker News, CISA, and MITRE ATT&CK.
|
Threat Name |
Description |
Affected Systems |
Source |
|---|---|---|---|
|
LummaC2 Malware |
Information stealer infiltrating networks to exfiltrate sensitive data. |
Windows-based systems |
FBI & CISA Advisory |
|
Rockwell PowerMonitor 1000 Vulnerabilities |
Three critical vulnerabilities (CVSS 9.8) risking device takeover and remote code execution. |
Industrial control systems |
Industrial Cyber |
|
SAP NetWeaver Exploit (CVE-2025-31324) |
Unauthenticated file upload vulnerability exploited by Earth Lamia for reverse shell access. |
SAP NetWeaver systems |
The Hacker News |
|
ConnectWise Breach |
Suspected nation-state attack targeting ScreenConnect customers. |
ScreenConnect software |
The Hacker News |
|
Fake AI Installers |
Ransomware and info-stealers disguised as ChatGPT and InVideo tools via SEO scams. |
Business IT systems |
The Hacker News |
|
Void Blizzard Phishing |
Credential phishing via fake Microsoft Entra login pages targeting NGOs. |
Cloud environments |
The Hacker News |
|
ViciousTrap Honeypot |
Exploited Cisco flaw (CVE-2023-20118) to hijack 5,300 routers for spying. |
ASUS routers |
The Hacker News |
|
Malicious npm/VS Code Packages |
Over 70 packages delivering sandbox-evasive malware to steal data and crypto. |
Developer environments |
The Hacker News |
|
Ivanti EPMM Flaws |
China-nexus group UNC5221 exploiting CVE-2025-4427 and CVE-2025-4428. |
Ivanti EPMM software |
The Hacker News |
|
Commvault SaaS Attacks |
Threat actors accessed client secrets in Microsoft 365 backup solutions. |
Cloud SaaS platforms |
The Hacker News |
Notable Breaches in May 2025
This table highlights significant breaches reported globally, impacting organizations and critical infrastructure.
|
Organization |
Breach Details |
Impact |
Source |
|---|---|---|---|
|
Lorain County Courts |
Cybersecurity incident shut down Common Pleas Court operations. |
Court services disrupted |
Cleveland.com |
|
Victoria’s Secret |
Website and store services taken offline due to a security incident. |
Retail operations affected |
Bleeping Computer |
|
ConnectWise |
Nation-state actors breached ScreenConnect, affecting a small number of customers. |
Potential data exposure |
The Hacker News |
|
Dutch Police |
Void Blizzard used pass-the-cookie attack to access employee data. |
Work-related contact info stolen |
The Hacker News |
|
Multiple NGOs |
Over 20 NGOs hit by Void Blizzard’s phishing campaign targeting cloud data. |
Sensitive data exfiltrated |
The Hacker News |
|
Asian/Brazilian Orgs |
Earth Lamia exploited SAP and SQL Server flaws since 2023. |
Unauthorized system access |
The Hacker News |
|
ASUS Routers |
9,000 routers compromised by ViciousTrap for a global honeypot network. |
Espionage and surveillance |
The Hacker News |
|
Dior |
Unknown attackers accessed customer data in a cybersecurity incident. |
Customer data breach |
Bleeping Computer |
|
Various SaaS Providers |
CISA warned of attacks targeting cloud apps with default configurations. |
Unauthorized cloud access |
The Hacker News |
|
GitLab AI Assistant |
Indirect prompt injection flaw risked malicious code injection. |
Source code exposure |
The Hacker News |
Cybersecurity Innovations in May 2025
Innovations are critical to staying ahead of cyber threats. Here are the latest advancements reported this month.
|
Innovation |
Description |
Impact |
Source |
|---|---|---|---|
|
Medcrypt Platform Expansion |
Enhanced cybersecurity solutions for medical devices with regulatory support. |
Secure medical tech |
PR Newswire |
|
Post-Quantum Chips |
Decent Cybersecurity unveiled chips to counter quantum computing threats. |
Future-proof encryption |
Investing.com |
|
EU Cybersecurity Regulations |
NIS2, GDPR, and Cyber Resilience Act reshape global standards. |
Enhanced compliance |
ASUS Pressroom |
|
University of Cincinnati Program |
Expanded virtual internships for IT and cybersecurity students. |
Workforce development |
TradingView |
|
Radware Awards |
Recognized Bell Canada and Presidio for innovative cybersecurity solutions. |
Industry excellence |
Security Brief |
|
CrowdStrike Growth |
AI-driven cybersecurity platform sees 43% stock gain in 2025. |
Cloud security leadership |
Yahoo Finance |
|
Palo Alto Networks Acquisition |
Acquired Protect AI for $700 million to bolster AI security. |
Enhanced AI protection |
The Motley Fool |
|
Rapid7 Strategic Investments |
Focus on MDR and Exposure Command for 2025 growth. |
Improved threat detection |
Investing.com |
|
AWS re:Inforce 2025 |
Conference to promote SIEM and SOAR adoption for better threat response. |
Industry collaboration |
Cybersecurity Dive |
|
CISA SaaS Security Guidance |
Recommendations to secure cloud environments against attacks. |
Stronger SaaS defenses |
The Hacker News |
APT Background Summary
Below is a summary of Advanced Persistent Threat (APT) groups mentioned in May 2025 reports, based on MITRE ATT&CK and Malpedia data.
-
Void Blizzard: A Russian-linked APT known for credential phishing and cloud data exfiltration. In May 2025, they targeted over 20 NGOs using fake Microsoft Entra login pages and executed a pass-the-cookie attack on Dutch police systems. Known for sophisticated espionage tactics.
-
Earth Lamia: A China-nexus group active since 2023, exploiting SAP NetWeaver (CVE-2025-31324) and SQL Server vulnerabilities to establish reverse shells. Targets organizations in Asia and Brazil, with updated backdoors using WebSocket communication.
-
UNC5221: Another China-linked APT exploiting Ivanti EPMM flaws (CVE-2025-4427, CVE-2025-4428) across Europe, North America, and Asia-Pacific. Focuses on cyber espionage across multiple sectors.
-
ViciousTrap: Exploited Cisco vulnerabilities (CVE-2023-20118) to compromise 5,300 routers, creating a global honeypot network for espionage. Activity traced to a single IP since March 2025.
Conclusion
May 2025 has underscored the escalating sophistication of cyber threats, from nation-state attacks to AI-targeted malware campaigns. Innovations like post-quantum cryptography and enhanced medical device security offer hope, but the loss of CISA leadership and ongoing breaches highlight the need for vigilance. Stay informed with trusted sources like The Hacker News, CISA, and Cybernews to protect your organization in this dynamic threat landscape.
