Tactical Cyberwarfare: Constructing Better Systems

News

SAP Patches Actively Exploited NetWeaver Zero-Day (CVE-2025-31324)

SAP has officially patched a critical deserialization vulnerability (CVE-2025-31324) in NetWeaver that was being actively exploited to drop webshells. If you’re running Visual Composer, patch immediately or disable it—this isn't theoretical; it was a zero-day.

Mirai Botnet Variant Targets Edge Routers for DDoS

A new variation of the Mirai botnet is chewing through default credentials on edge routers and NVRs to launch massive DDoS attacks. Default passwords are still the industry's biggest self-inflicted wound.

Ransomware Groups Pivot to Destroying Cloud Backups

Ransomware groups have shifted from encrypting data to actively targeting and wiping cloud backups to destroy recovery options. Relying on snapshots isn't enough anymore; you need immutable isolation.

Tools

Nuclei Templates Updated for SAP NetWeaver RCE

ProjectDiscovery just pushed a major Nuclei template update specifically for that SAP NetWeaver flaw. If you have unauthenticated scanning in your pipeline, this is how you verify you aren't vulnerable right now.

Analysis

AI-Powered Phishing Scales Social Engineering Attacks

Attackers are using LLMs to generate highly convincing phishing scripts faster than we can block them. The 'human touch' in social engineering is dead; it's all automated scale now.