The cybersecurity landscape from May 9 to May 16, 2025, was defined by high-profile data breaches, advanced malware campaigns, and pivotal policy shifts. This comprehensive roundup equips information security professionals with critical insights to enhance risk management, threat hunting, and strategic planning.

Major Incidents

1. Coinbase Data Breach

Date Reported: May 11, 2025

Coinbase, a leading cryptocurrency exchange, disclosed a significant breach on May 11, 2025. Cybercriminals bribed overseas support agents to access sensitive customer data, including names, addresses, phone numbers, emails, masked bank account numbers, the last four digits of Social Security numbers, government ID images, and account balances. The attackers demanded a $20 million ransom, which Coinbase refused, choosing to collaborate with law enforcement. Remediation costs are estimated between $180 million and $400 million, with Coinbase reimbursing customers impacted by follow-on social engineering attacks. Less than 1% of its 9.7 million monthly customers were affected, and no passwords, private keys, or Coinbase Prime accounts were compromised.

Implications for Professionals: This incident highlights insider threats, particularly via third-party contractors. Penetration testers should prioritize social engineering simulations, Blue Teams must enhance monitoring for unauthorized access, and Red Teams can target support staff in mock exercises to expose vulnerabilities.

Sources: Reuters, CNBC, The Hacker News

2. CISA and DOGE Engineer’s Device Compromise

Date Reported: May 9, 2025

Kyle Schutt, a software engineer at both the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Government Efficiency (DOGE), had his device compromised by info-stealing malware. His credentials appeared in public leaks since 2023, with the latest reported on May 9, 2025. Schutt’s access to sensitive systems, including FEMA’s financial management system, raises national security concerns. The malware, likely delivered via phishing or trojanized apps, underscores the vulnerability of high-privilege users.

Implications for Professionals: Robust endpoint protection and multi-factor authentication (MFA) are critical for high-privilege users. Purple Teams should simulate malware infections and credential theft, while SOCs prioritize anomaly detection for privileged accounts.

Sources: WinBuzzer, Ars Technica

3. Nucor Cybersecurity Incident

Date Reported: May 14, 2025

Nucor, a major U.S. steel manufacturer, reported a suspected ransomware attack on May 14, 2025. Details remain limited, but the incident reflects a growing trend of ransomware targeting industrial sectors.

Implications for Professionals: Blue Teams should strengthen ransomware detection, focusing on early indicators like lateral movement. Red Teams can simulate ransomware campaigns to test industrial control system (ICS) defenses, and risk managers should review business continuity plans.

Source: SecurityWeek

Data Breaches

4. Nova Scotia Power Data Breach

Date Reported: May 2025

Nova Scotia Power disclosed a cyberattack resulting in the theft of personal and financial information. The full scope is under investigation, emphasizing vulnerabilities in the utility sector.

Implications for Professionals: Penetration testers should assess data handling in critical infrastructure, while incident response teams prepare for rapid containment and notification.

Source: SecurityWeek

5. Australian Human Rights Commission Data Exposure

Date Reported: May 2025

A misconfiguration in the Australian Human Rights Commission’s online complaint form led to unintended data exposure, highlighting risks in data handling practices.

Implications for Professionals: Regular audits of public-facing systems are essential to prevent accidental exposures. Red Teams can test for misconfigurations in web applications.

Source: SecurityWeek

Emerging Threats and Vulnerabilities

6. Malicious Vendor Software

Date Reported: May 16, 2025

Official vendor software downloads were found infected with the XRed backdoor and SnipVex clipbanker malware, posing risks of system compromise through remote access and data theft.

Implications for Professionals: Threat hunters should monitor for indicators of compromise (IOCs) related to XRed and SnipVex. Organizations must rigorously vet third-party software, and Red Teams can simulate supply chain attacks.

Source: Cyware

7. AI-Generated Voice Deepfake Attacks

Date Reported: May 16, 2025

The FBI warned of a surge in AI-generated voice deepfake attacks targeting U.S. government officials since April 2025, using advanced voice cloning for fraud and misinformation.

Implications for Professionals: Blue Teams should implement voice authentication safeguards and train staff on deepfake indicators. Red Teams can incorporate deepfake scenarios into social engineering tests.

Source: Cyware

8. Node.js Security Updates

Date Reported: May 15, 2025

Node.js released critical updates addressing three vulnerabilities (CVE-2025-23166, CVE-2025-23167, CVE-2025-23165) that could crash server processes and disrupt services.

Implications for Professionals: System administrators must apply updates immediately. Penetration testers should scan for unpatched Node.js instances, and SOCs monitor for exploitation attempts.

Source: Cyware

9. Fancy Bear (APT28) Cyber-Espionage Campaign

Date Reported: May 15, 2025

The Russian APT group Fancy Bear (APT28) targeted Ukrainian government, military, and international defense contractors in a cyber-espionage campaign.

Implications for Professionals: Threat intelligence teams should track APT28’s tactics, techniques, and procedures (TTPs). Purple Teams can simulate APT-style attacks to strengthen defenses.

Source: Cyware

10. Malicious NPM Package

Date Reported: May 15, 2025

The NPM package os-info-checker-es6 was identified as malicious, delivering a backdoor to compromised systems, highlighting risks in open-source repositories.

Implications for Professionals: Developers must verify package integrity, and security teams should use software composition analysis tools. Red Teams can test for malicious package exploitation.

Source: Cyware

11. TransferLoader Malware

Date Reported: May 15, 2025

TransferLoader, a versatile malware loader active since February 2025, facilitates various cyberattacks, posing a significant threat across environments.

Implications for Professionals: Threat hunters should identify IOCs for TransferLoader, Blue Teams enhance malware detection, and Red Teams emulate loader-based attacks.

Source: Cyware

12. SAP NetWeaver Vulnerabilities Exploited

Date Reported: May 15, 2025

Multiple threat actors, including ransomware groups and Chinese APTs, exploited SAP NetWeaver vulnerabilities, enabling remote code execution in enterprise systems.

Implications for Professionals: System administrators must prioritize patching SAP systems. Penetration testers should assess SAP NetWeaver deployments, and SOCs monitor for exploitation.

Source: SecurityWeek

13. Earth Ammit Geopolitical Attacks

Date Reported: May 15, 2025

The China-linked Earth Ammit group targeted Taiwan and South Korea’s drone sectors, aiming to disrupt critical industries amid geopolitical tensions.

Implications for Professionals: Threat intelligence teams should monitor Earth Ammit’s TTPs, and Purple Teams simulate targeted attacks in high-tech sectors.

Source: SecurityWeek

Industry Developments

14. Proofpoint Acquires Hornetsecurity

Date Reported: May 15, 2025

Proofpoint acquired Hornetsecurity, a Germany-based Microsoft 365 security provider, signaling consolidation in the cybersecurity market and potential for integrated security solutions.

Implications for Professionals: Security leaders should evaluate impacts on vendor ecosystems, and risk managers assess opportunities for unified security platforms.

Source: SecurityWeek

Policy and Personnel

15. Proposed CISA Funding Reduction

Date Reported: May 13, 2025

A budget proposal from former President Trump suggests a nearly $500 million cut to CISA’s funding, potentially weakening election security and critical infrastructure protection.

Implications for Professionals: Security leaders should advocate for sustained funding and prepare for resource constraints. Threat intelligence teams can monitor policy developments.

Source: X Post by DemocracyDocket

16. CISA Leadership Appointment

Date Reported: May 15, 2025

Marci McCarthy was appointed CISA’s Director of Public Affairs, a role pivotal for shaping communication strategies amid evolving cyber threats.

Implications for Professionals: Engage with CISA’s new leadership for policy updates and public-private collaboration opportunities.

Source: X Post by MarciMcCarthyUS

Summary Table of Key Incidents and Threats

Incident/Threat	Date Reported	Description	Implications
Coinbase Data Breach	May 11, 2025	Bribed contractors leaked customer data; $20M ransom demanded.	Enhance insider threat detection and social engineering defenses.
CISA Engineer Malware	May 9, 2025	Kyle Schutt’s device compromised, credentials leaked.	Strengthen endpoint security and MFA for high-privilege users.
Nucor Ransomware	May 14, 2025	Suspected ransomware attack on steel manufacturer.	Bolster ransomware detection and ICS security.
Malicious Vendor Software	May 16, 2025	XRed backdoor and SnipVex clipbanker in vendor downloads.	Vet third-party software and monitor for IOCs.
AI Deepfake Attacks	May 16, 2025	FBI warns of voice cloning targeting officials.	Implement voice authentication and deepfake training.
Node.js Vulnerabilities	May 15, 2025	Critical updates for server-crashing vulnerabilities.	Apply patches and scan for unpatched instances.
Fancy Bear Campaign	May 15, 2025	APT28 targets Ukraine and defense contractors.	Track APT TTPs and simulate nation-state attacks.
Malicious NPM Package	May 15, 2025	os-info-checker-es6 delivers backdoor.	Verify package integrity and use software composition analysis.
TransferLoader Malware	May 15, 2025	New loader facilitates cyberattacks.	Enhance malware detection and emulate loader attacks.
SAP NetWeaver Exploits	May 15, 2025	Ransomware and APTs exploit vulnerabilities.	Patch SAP systems and monitor for exploitation.
Earth Ammit Attacks	May 15, 2025	China-linked group targets drone sectors in Taiwan and South Korea.	Monitor geopolitical threats and simulate targeted attacks.

Recommendations for Information Security Professionals

• Penetration Testing: Prioritize social engineering, supply chain, and misconfiguration tests to address vulnerabilities exposed in recent incidents.
• Threat Hunting: Focus on IOCs for XRed, SnipVex, TransferLoader, and APT28, leveraging threat intelligence for advanced threat detection.
• Incident Response: Prepare for ransomware and data breach scenarios with rapid containment and communication plans.
• Patch Management: Urgently apply Node.js and SAP NetWeaver patches to mitigate active exploitation risks.
• Policy Advocacy: Oppose CISA funding cuts, emphasizing the need for national cyber resilience.

This brief offers a snapshot of the week’s critical cybersecurity developments, empowering professionals with actionable insights to fortify defenses and navigate evolving threats.

Key Citations

• Coinbase Cyberattack Costs Up to $400M
• Coinbase Hackers Bribed Staff for Data
• Coinbase Agents Bribed, Data Leaked
• CISA Engineer Credentials Leaked Online
• DOGE Engineer’s Malware Infection
• SecurityWeek Cybersecurity News
• Cyware Cyber Security Articles
• CISA Funding Cut Proposal
• CISA Public Affairs Appointment