Daily Threat Briefing: Critical React RCE, Aussie Retailers Hit by Ransomware, and Android Zero-Days

Executive Summary

The last 24 hours have seen a significant escalation in web application threats with the disclosure of a critical Remote Code Execution (RCE) vulnerability in the React framework, dubbed "React2Shell". Australian organisations—particularly in the eCommerce and SaaS sectors—are also facing a renewed wave of ransomware activity, with prominent fashion retailers and logistics providers targeted by the INC Ransom and Qilin groups. Simultaneously, mobile security remains a priority as Google patches actively exploited zero-days affecting Android devices.

Here is your daily deep dive into the threat landscape affecting Australian businesses.

1. SaaS & Web Applications: The 'React2Shell' Critical RCE

Sector: SaaS, eCommerce, FinTech, Education
Threat: CVE-2025-55182 (CVSS 10.0)

The most critical development overnight is CVE-2025-55182, a maximum-severity vulnerability affecting React (versions 19.x), the popular JavaScript library used by millions of web applications globally.

• The Vulnerability: Dubbed "React2Shell", this flaw exists in React Server Components (RSC). It allows unauthenticated remote attackers to execute arbitrary code on the server by sending specially crafted HTTP requests.
• Impact: Any Australian SaaS provider, FinTech platform, or modern web app using affected versions of React/Next.js is at immediate risk of full server compromise.
• Status: Proof-of-concept (PoC) exploits are available, and active scanning has been detected. The Australian Cyber Security Centre (ACSC) and other agencies have issued urgent warnings.
• Action: Developers must upgrade to React versions 19.0.1, 19.1.2, or 19.2.1 immediately. Implement WAF rules to block malicious RSC payloads.

2. eCommerce & Logistics: Ransomware Groups Target Aussie Retail

Sector: Retail/eCommerce, Supply Chain
Threat Actors: INC Ransom, Qilin

A concerning spike in ransomware activity has hit the Australian retail supply chain in the last 24 hours.

• INC Ransom Claims: The group has listed Australian fashion retailers Oxford and textile supplier Instyle on their leak site, claiming to have exfiltrated sensitive customer and corporate data. This highlights the ongoing risk to the retail sector during the critical holiday trading period.
• Logistics Under Fire: B dynamic Logistics is currently investigating claims by the Qilin ransomware group regarding a significant breach. As a logistics provider, a disruption here could cascade through the supply chains of multiple Australian businesses relying on their services.
• Observation: These groups are increasingly employing "double extortion" tactics—encrypting systems and threatening to release stolen data to force payment.

3. Mobile & FinTech: Android Zero-Days Exploited in the Wild

Sector: FinTech, General Enterprise, Healthcare
Threat: CVE-2025-48572 & CVE-2025-48633

Google has released emergency patches for two high-severity zero-day vulnerabilities in the Android Framework that are being actively exploited in targeted attacks.

• The Flaws:
  • CVE-2025-48572: An Elevation of Privilege (EoP) vulnerability allowing attackers to gain system-level access.
  • CVE-2025-48633: An Information Disclosure flaw exposing sensitive user data.
• Australian Impact: FinTech apps, crypto wallets, and healthcare applications running on unpatched Android devices are vulnerable. Targeted attacks often focus on high-value individuals (executives, government officials) to steal credentials or financial data.
• Action: Organisations enforcing BYOD (Bring Your Own Device) policies should verify that employee devices are updated to the December 2025 security patch level immediately.

4. Education: University Systems Compromised

Sector: Education/EdTech
Threat: Business Email Compromise (BEC) / Account Takeover

Reports have emerged of a distressing cyber incident affecting an Australian university where compromised email systems were used to send fraudulent notifications to graduates claiming their degrees had been "revoked".

• Analysis: This incident demonstrates how attackers are moving beyond simple data theft to causing psychological distress and reputational chaos. It likely stems from a compromised administrative account or a lack of Multi-Factor Authentication (MFA) on critical communication channels.

5. Government & Critical Infrastructure: Governance and IoT Risks

Sector: Government, IoT, Critical Infrastructure
Threat: Regulatory Action & SCADA Vulnerabilities

• Regulatory Heat: The Office of the Australian Information Commissioner (OAIC) has initiated civil penalty proceedings against major entities (including Optus) for historical breaches, signalling a tougher stance on data governance failures.
• IoT/OT Warning: A new vulnerability in ScadaBR (an open-source SCADA software used in building automation and industrial control) has been added to the Known Exploited Vulnerabilities (KEV) catalog. Organisations using open-source OT tools must audit their exposure to prevent physical infrastructure manipulation.

Summary of Recommendations

1. Patch React: Prioritise updating React/Next.js environments to mitigate CVE-2025-55182.
2. Verify Third-Party Risk: Retailers should assess the security posture of their logistics and supply chain partners.
3. Mobile Hygiene: Enforce Android updates across corporate fleets.
4. Review Incident Response: Ensure your crisis communication plan is ready for "reputational sabotage" scenarios like the university email incident.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Ransomware Surge & Critical React Flaw Hits Australian Networks

Executive Summary

The last 24 hours have seen a significant escalation in cyber activity targeting Australian critical infrastructure and commercial sectors. The Australian Cyber Security Centre (ACSC) has issued a critical alert regarding a vulnerability in React Server Components, while ransomware groups have successfully breached targets across the Government, Defence, and FinTech sectors.

Today's briefing analyses these active threats, highlighting a disturbing trend of supply chain compromises and API misconfigurations that are leaving organisations exposed.

---

Sector-Specific Threat Intelligence

🏛️ Government & Defence: Supply Chain Under Siege

The defence supply chain faces renewed scrutiny today following confirmed breaches at IKAD Engineering, a key contractor for Australian naval projects. The J Group ransomware gang claims to have exfiltrated 800GB of sensitive data, including details related to the Hunter Class frigate program. This incident, combined with the Cyber Toufan group leaking data on the ADF’s Redback infantry vehicle, underscores the critical fragility of third-party vendors.

On the local government front, Muswellbrook Shire Council is dealing with the fallout of a SafePay ransomware attack. The threat actors have published 175GB of stolen data after negotiations reportedly stalled, a stark reminder of the "double extortion" tactic where data encryption is merely the opening move.

💸 FinTech: API Misconfigurations & Data Theft

Two significant incidents have rocked the financial sector in the last 24 hours:

1. Austin’s Financial Solutions: The Kairos ransomware group has claimed a major breach, allegedly stealing 147GB of data, including employee passports and payroll records.
2. Vroom by YouX: In a classic case of cloud negligence, a non-password-protected database was discovered exposing thousands of driver’s licences. This breach was not a sophisticated hack but a failure in basic cloud security posture management (CSPM), leaving APIs and data stores publicly accessible.

🏥 Healthcare & EdTech: Targeted Disruptions

The University of NSW (UNSW) has been targeted by hacktivist group RipperSec, which claimed responsibility for a DDoS attack and website defacement on the Physics Department's infrastructure. Meanwhile, in the healthcare sector, the Morpheus ransomware gang is pressuring DBG Health (pharmaceuticals), posting proof-of-compromise data including employee IDs.

---

Vulnerability Watch: Web, Cloud & Mobile

Security teams must prioritise the following vulnerabilities which are either being actively exploited or pose an imminent risk to Australian networks.

• React Server Components (CVE-2025-55182) - Critical Alert

  • Status: Active ACSC Alert (04 Dec 2025).
  • Impact: A critical flaw in React Server Components allows for potential remote code execution (RCE). Given the ubiquity of React in modern web applications, this is a high-priority patch for all SaaS providers and digital platforms.
  • Action: Audit all web applications using React Server Components immediately.

• Oracle WebLogic (CVE-2025-21535) - CVSS 9.8

  • Vector: Unauthenticated RCE via T3/IIOP protocols.
  • Risk: Attackers can take full control of servers without credentials. This is a favoured target for initial access brokers.
  • Mitigation: Block T3/IIOP access externally and apply the January 2025 critical patch update if not already done.

• Android Zero-Days (CVE-2025-48572 & CVE-2025-48633)

  • Status: Exploited in the wild.
  • Impact: Privilege escalation and information disclosure in the Android Framework.
  • Action: Mobile device management (MDM) administrators should enforce immediate OS updates for corporate fleets.

---

Emerging Threats: IoT and AI

• IoT Espionage Risks: Concerns have been raised regarding Chinese-made Yutong electric buses operating in Australian fleets. Reports suggest potential remote access capabilities that could be exploited for surveillance or sabotage, highlighting the need for rigorous IoT network segmentation.
• AI as a Threat Vector: A new report from CyberCX identifies AI not just as a tool for defence, but as a primary driver of threat acceleration. We are seeing "Shadow AI" adoption—where employees use unsanctioned AI tools—creating blind spots that bypass traditional data loss prevention (DLP) controls.

Recommendations

1. Review Third-Party Access: The IKAD Engineering breach demonstrates that your security is only as strong as your weakest vendor.
2. Lock Down Cloud APIs: The Vroom incident proves that basic misconfigurations are still causing massive data leaks. Automated scanning is essential.
3. Patch React & WebLogic: Do not delay on CVE-2025-55182 or CVE-2025-21535.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Defence Supply Chain Breach, AI RCEs & Critical Telco Fines

As we settle into December, the Australian cyber threat landscape is already heating up. In the last 24 hours, we’ve seen a major breach in the Defence supply chain, significant regulatory action against a local telco for anti-scam failures, and the discovery of a critical vulnerability in a widely used AI inference engine.

For security teams across Healthcare, FinTech, and Government, today’s briefing highlights the critical need for supply chain vigilance and rigorous identity verification.

Top Story: Defence Supply Chain Compromise

Target: IKAD Engineering Sector: Government / Defence Industry Breaking news indicates a significant cyber incident involving IKAD Engineering, a key contractor in the Australian Defence supply chain. Reports suggest that threat actors have breached the organisation's network, exposing potential risks to Australia’s weapons programs and sensitive defence projects.

• Impact: This incident underscores the "soft underbelly" of national security—third-party suppliers. While government agencies harden their own perimeters, adversaries are aggressively targeting smaller contractors with privileged access or sensitive technical data.
• Action: Defence contractors and sub-contractors must immediately review their external attack surface and strictly enforce the Essential Eight maturity levels, particularly regarding remote access and patch management.

Regulatory & FinTech: Southern Phone Fined $2.5m

Sector: Telecommunications / FinTech The Australian Communications and Media Authority (ACMA) has handed down a massive $2.5 million penalty to Southern Phone Company.

• The Issue: An investigation revealed that the telco failed to comply with anti-scam rules on over 160 occasions. Scammers successfully bypassed identity verification processes, allowing them to hijack customer mobile numbers (SIM swapping).
• Why it Matters: For FinTech and banking sectors, this is a critical alert. SIM swapping is a primary vector for defeating SMS-based Two-Factor Authentication (2FA). The failure of a telco to verify identities directly threatens the integrity of financial accounts protected by mobile 2FA.
• Action: FinTechs should accelerate the move away from SMS-based 2FA towards FIDO2 hardware keys or app-based authenticators to mitigate reliance on telco security.

Emerging Tech: Critical AI Remote Code Execution (RCE)

Target: AI Systems / SaaS Providers Vulnerability: vLLM Inference Engine (Versions 0.10.2+) A critical vulnerability has been disclosed in vLLM, a popular high-throughput and memory-efficient LLM serving engine used by many SaaS and AI providers.

• The Threat: Security researchers discovered that attackers can trigger Remote Code Execution (RCE) or crash servers simply by sending malicious prompt embeddings to the Completions API.
• Significance: As Australian organisations rush to deploy private AI models, the security of the underlying inference infrastructure is often overlooked. This flaw allows an attacker to break out of the model sandbox and compromise the host server.
• Action: AI engineering teams must update vLLM immediately and isolate inference servers from critical internal networks.

Infrastructure & Cloud Security

Sector: SaaS / Cloud Two other notable technical threats have emerged in the last 24 hours:

1. HashiCorp Vault Misconfiguration (CVE-2025-13357): A default setting in the Vault Terraform Provider could allow anonymous LDAP binds, potentially exposing secrets and encryption keys. DevOps teams using Terraform to manage Vault must verify their deny_null_bind configurations immediately.
2. GitLab Credential Leaks: New research released yesterday identified over 17,000 exposed credentials (including Google Cloud and OpenAI keys) in public GitLab repositories. Developers are urged to rotate keys and implement automated secret scanning in their CI/CD pipelines.

Sector Watch: Healthcare & IoT

• Healthcare: Following the Point Lonsdale Medical Group incident late last month, the sector remains on high alert. Ransomware groups are actively scanning for unpatched VPN concentrators and RDP endpoints in Australian medical centres.
• IoT: A new Mirai-based botnet, ShadowV2, has been observed exploiting unpatched routers and NAS devices. A critical authentication bypass in ASUS routers (CVE-2025-59366) is currently being weaponised; organisations with remote workforce fleets should ensure home office devices are patched.

Conclusion

Today's events serve as a stark reminder that compliance and configuration management are just as critical as advanced threat detection. Whether it's a misconfigured Terraform provider, a lapse in identity checks at a telco, or an unpatched AI engine, basic hygiene failures continue to offer adversaries the easiest path to compromise.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Australia – 02 December 2025

Executive Summary

The last 24 hours have seen a significant surge in ransomware activity and critical infrastructure targeting across Australia. The Australian Cyber Security Centre (ACSC) and industry watchdogs have issued multiple alerts regarding active exploitation of network edge devices. Prominent threat actors, including KillSec, Space Bears, and RipperSec, have claimed successful breaches against Australian targets in the Government, FinTech, and Education sectors.

Organisations are urged to prioritise patching critical vulnerabilities in Cisco and Microsoft infrastructure immediately, as threat actors are weaponising these flaws for initial access.

---

Sector-Specific Threat Intelligence

Government & Public Sector

• Muswellbrook Shire Council Data Leak: Following a ransomware incident last month, the SafePay ransomware gang has reportedly published 175GB of stolen data. This highlights the persistent risk of "double extortion" where backups alone are insufficient to prevent data exposure.
• Legal Practice Board of Western Australia: Investigations into the May cyber incident continue, with reports indicating the Dire Wolf group may have re-published sensitive datasets on the dark web despite previous takedown efforts.

FinTech & Financial Services

• Austin’s Financial Solutions Breach: The Kairos ransomware group has claimed responsibility for a significant breach of the NSW-based wealth management firm, allegedly exfiltrating 147GB of sensitive financial data, including employee passports and payroll records.
• Vroom by YouX (API/Cloud Exposure): A critical lapse in cloud security was identified involving a non-password-protected database belonging to the FinTech lender. This exposure left thousands of driver’s licences and PII records vulnerable—a stark reminder of the dangers of API misconfigurations and improper access controls in cloud environments.

Education (EdTech)

• University of NSW Targeted: The hacktivist group RipperSec has claimed a distributed denial-of-service (DDoS) and potential defacement attack on the university’s physics department website. Educational institutions remain a prime target for politically motivated disruption.

Healthcare & Community Services

• Christian Community Aid Ransomware: The Space Bears ransomware gang has listed this community support organisation as a victim. With the healthcare sector already under strain, attacks on support services can have devastating downstream effects on vulnerable community members.

SaaS & Technology Providers

• Hexicor Breach: The KillSec ransomware gang has targeted IT services provider Hexicor, stealing client folders and security data (hashed passwords). This supply chain attack poses a risk to Hexicor's downstream clients, emphasising the need for rigorous third-party risk management.

---

Critical Vulnerabilities & Exploits (CVEs)

Penetration testers and defenders must be aware of the following vulnerabilities actively being exploited in the Australian wild:

1. Cisco ASA & FTD (CVE-2025-20333 & CVE-2025-20363):

   • Severity: Critical (CVSS 9.8)
   • Impact: Remote Code Execution (RCE) and unauthorised access.
   • Status: The ACSC warns that threat actors are chaining these vulnerabilities to bypass authentication on VPN web servers. Immediate patching of edge firewalls is mandatory.

2. Microsoft WSUS (CVE-2025-59287):

   • Severity: Critical
   • Impact: A vulnerability in the Windows Server Update Service allows attackers to compromise internal update mechanisms. This is a high-priority patch for enterprise environments.

3. SonicWall SSL VPN (CVE-2024-40766):

   • Status: continued active exploitation by the Akira ransomware group. Despite being an older CVE, unpatched devices remain a primary entry point for ransomware operators in Australia.

---

Strategic Recommendations

• Audit External Attack Surface: Immediately verify that no development databases or APIs are exposed to the public internet without authentication (as seen in the Vroom incident).
• Patch Edge Devices: Prioritise Cisco and SonicWall VPN/Firewall updates.
• Adversary Simulation: With groups like KillSec and Kairos bypassing traditional defences, organisations should conduct red teaming exercises to test their resilience against modern ransomware TTPs (Tactics, Techniques, and Procedures).

Contact us for a quote for penetration testing service or adversary simulation.

Monthly Threat Briefing: Australia – November 2025

As we approach the holiday season, the Australian cyber threat landscape has intensified, with November 2025 marking a significant surge in ransomware activity and sophisticated supply chain attacks. The Australian Signals Directorate (ASD) and private sector intelligence indicate that threat actors are increasingly capitalising on reduced staffing levels during weekends and public holidays, a trend expected to escalate as we head into December.

This month’s briefing analyses critical incidents and emerging vulnerabilities across key sectors, highlighting the urgent need for robust defence mechanisms in web applications, cloud environments, and AI systems.

Sector-Specific Threat Intelligence

Healthcare

The healthcare sector remains a primary target for extortion. In November, the Point Lonsdale Medical Group in Victoria confirmed a cyber attack resulting in the unauthorised access of personal information. This incident follows a broader trend of ransomware groups, such as INC Ransom, aggressively targeting medical centres and allied health providers. The critical nature of patient data makes these organisations prime targets for "double extortion" tactics, where attackers encrypt data and threaten to release it publicly.

Education & EdTech

Western Sydney University continues to manage the fallout from a major data breach revealed recently, which exposed sensitive data including tax file numbers, payroll figures, and health information. Forensic investigation suggests the unauthorised access occurred between June and September 2025, but the repercussions are currently being felt across the sector. This highlights the persistent persistence of threat actors within academic networks, often undetected for months.

Government

State-sponsored espionage remains a top concern. On 24 November 2025, federal parliamentarians and staff at Parliament House were issued a strict warning to disable Wi-Fi and Bluetooth on their devices during a high-profile visit by a foreign delegation. This precautionary measure underscores the heightened risk of close-access technical attacks and data interception targeting government officials.

Additionally, the Crisis24 OnSolve CodeRED platform, used by emergency services, faced disruptions due to a cyber attack claimed by the INC ransomware gang. This attack on critical emergency notification infrastructure demonstrates the willingness of cybercriminals to endanger public safety for financial gain.

SaaS & AI Systems

November saw a notable incident involving OpenAI and analytics provider Mixpanel. OpenAI severed ties with the vendor after a security lapse exposed non-content data associated with some API users, such as email addresses and organisation IDs. While no chat logs or API keys were compromised, this incident serves as a stark reminder of third-party supply chain risks in the AI ecosystem.

Furthermore, a breach at customer success platform Gainsight reportedly impacted Salesforce customer tokens, forcing companies to rotate credentials rapidly. For SaaS providers, these events highlight the fragility of trust in interconnected cloud ecosystems.

FinTech

The Australian Cyber Security Centre (ACSC) issued alerts this month regarding scammers impersonating police to target cryptocurrency users. These sophisticated social engineering campaigns aim to steal seed phrases and wallet funds. Financial institutions are also grappling with a rise in AI-driven fraud, where deepfake voice technology is used to bypass biometric authentication in phone banking.

IoT & Automotive

Vulnerabilities in connected vehicles took centre stage with the disclosure of a flaw in Subaru’s Starlink multimedia technology (CVE-2025-xxxx), which could potentially allow third parties to access user accounts. As vehicles become increasingly software-defined, the attack surface for IoT significantly expands, necessitating rigorous penetration testing of embedded systems and APIs.

Vulnerability Spotlight: Exploited & Critical CVEs

Organisations should prioritise patching the following vulnerabilities, which have been active or critical in November 2025:

• Oracle Identity Manager (CVE-2025-61757): A critical pre-authentication Remote Code Execution (RCE) vulnerability. Security researchers have observed this being exploited as a zero-day. Immediate patching is required for all identity governance implementations.
• Microsoft WSUS (CVE-2025-59287): A critical flaw in Windows Server Update Services allows attackers to intercept and manipulate updates. This is particularly dangerous for enterprise environments relying on internal update servers.
• Node-forge (CVE-2025-12816): A high-severity vulnerability in this popular JavaScript cryptography library can allow attackers to bypass signature verifications. Developers using this package in their web applications must upgrade immediately to prevent cryptographic bypass attacks.

Strategic Recommendations

As we enter the holiday period, Australian organisations must assume that "off-hours" are target hours. We recommend:

1. ** enforcing 24/7 monitoring** or managed detection and response (MDR) coverage during the holidays.
2. Reviewing third-party access auditing, especially for SaaS integrations (like the OpenAI/Mixpanel case).
3. Conducting adversary simulation to test resilience against ransomware encryption and data exfiltration tactics.

Contact us for a quote for penetration testing service or adversary simulation.