Google Confronts AI Misuse, Trump Halts China Trade Restrictions, Disney Faces $2.7M Penalty
Cybersecurity Threats Evolve with Increased Use of AI by Adversaries
A recent report by Google’s Threat Intelligence Group (GTIG) highlights the growing trend of threat actors leveraging artificial intelligence (AI) for malicious purposes. In the fourth quarter of 2025, GTIG observed a significant increase in AI-powered attacks, including model extraction attacks and experimentation with new techniques. The group successfully disrupted many of these attempts, but the findings underscore the need for organizations to stay vigilant in the face of evolving threats.
AI-powered Attacks on the Rise
One notable trend is the use of AI to probe models like Gemini via APIs to extract capabilities. This technique, known as distillation, allows attackers to refine their tactics and improve the effectiveness of their attacks. As AI becomes more prevalent in cybersecurity, it is essential for defenders to stay ahead of the curve and develop strategies to counter these emerging threats.
CISA Highlights Challenges in Authenticating OT Communications
The Cybersecurity and Infrastructure Security Agency (CISA) has published a resource examining the key obstacles to authenticating operational technology (OT) communications. The report emphasizes the need for improved authentication protocols to prevent unauthorized access to critical infrastructure systems.
EPA Identifies Vulnerabilities in Public Water Systems
The US Environmental Protection Agency (EPA) has announced the discovery of vulnerabilities in 277 community water systems across the country. These vulnerabilities could be exploited by threat actors, highlighting the need for increased cybersecurity measures to protect critical infrastructure.
DoD Employee Indicted for Role in Multimillion-Dollar Scam Scheme
A Department of Defense employee, Samuel D. Marcus, has been indicted for allegedly serving as a money mule and laundering millions of dollars on behalf of Nigerian fraudsters. The charges stem from his role in receiving and transferring illicit funds obtained through romance scams, business email compromise (BEC), and other online frauds.
California Fines Disney $2.75 Million for CCPA Violations
The state of California has fined Disney $2.75 million for multiple violations of the California Consumer Privacy Act (CCPA). The settlement stems from Disney’s failure to properly process consumer opt-out requests for the sale of personal information and to provide accurate privacy notices.
Trend Micro Introduces Threat Attribution Framework
Trend Micro has developed a new threat attribution framework that applies consistent naming conventions and structured analysis to reduce speculation in cybersecurity reporting. The framework categorizes threat actors into six groups based on their motivations: Earth for espionage, Water for financially motivated operations, Fire for destructive or disruptive actors, Wind for hacktivists, Aether for unknown motivation, and Void for mixed motivation.
US Delays China Tech Restrictions
The Trump administration has paused a proposed ban on domestic sales of TP-Link routers and restrictions on China Telecom’s US operations and data center equipment sales. The delay is intended to avoid escalating tensions with Beijing before an April deadline.
CISA Highlights 2025 Achievements in Critical Infrastructure Protection
CISA has released its 2025 Year in Review, detailing efforts to enhance security and resilience across critical infrastructure sectors. The report emphasizes progress in areas such as vulnerability management, incident response coordination, threat information sharing, and partnerships to address evolving cyber and physical risks.
Supply Chain Flaw Exposes Access to 200 Airports Worldwide
Researchers have discovered a critical vulnerability in a widely used aviation software platform that granted unauthorized access to sensitive systems at approximately 200 airports across multiple countries. The issue stemmed from a supply chain compromise involving exposed credentials and misconfigured access controls in a third-party vendor’s application.
About Author
English