Critical Weekly Cybersecurity & Threat Intelligence – August 29,
The Critical Weekly Cybersecurity & Threat Intelligence Report for August 28, 2025, delivers the latest updates shaping the security operations center (SOC) landscape.
This week, we examine a critical Docker SSRF flaw, an actively exploited Git vulnerability, a high-profile Nissan data breach linked to the Qilin ransomware gang, and the evolving tactics of Storm-0501 threat actors targeting cloud environments.
For SOC teams and security analysts, these developments highlight the urgent need for a proactive cybersecurity strategy that combines network detection and response (NDR), endpoint detection and response (EDR), and behavioural analytics to detect threats and minimize risk.
Our goal is to help organizations strengthen their security monitoring and SOC management capabilities, reduce false positives, and respond effectively to advanced persistent threats (APTs) and other suspicious activities.
Whether you’re managing sensitive data, monitoring network activity, or fine-tuning SOC management tools, this report provides actionable intelligence to support your detection and response efforts and improve your organization’s resilience.
Critical Docker Flaw Allows Host Hijacking (CVE-2025-9074)
A severe flaw in Docker Desktop for Windows and macOS allows attackers to gain control of the host system.
- Severity: CVSS 9.3
- Risk: Unauthorized access, privilege escalation, and potential sensitive data theft
- Action: Update to the latest Docker release immediately
This vulnerability underscores the importance of network detection and response (NDR) and endpoint detection and response (EDR) tools in security operations centres (SOCs). These solutions help detect suspicious activities early and prevent deeper compromise.
Read Docker’s Security Advisory →
Qilin Ransomware Breach Targets Nissan Subsidiary
The Qilin ransomware group claims to have stolen 4 TB of sensitive data from Creative Box Inc. (CBI), a Nissan subsidiary. Stolen data reportedly includes:
- 3D vehicle design models
- Internal reports and financial documents
- VR workflows and photos
Qilin has listed CBI on its dark web extortion portal, threatening to leak stolen data unless ransom demands are met. Nissan confirmed that only CBI systems were impacted, but the incident raises concerns about supply chain security.
For SOC management teams, this event highlights the value of behavioural analytics and advanced security monitoring to detect and stop threat actors before a full-scale data breach occurs.
Git Exploit Actively Used by Threat Actors (CVE-2025-48384)
CISA warns of active exploitation of a Git vulnerability that allows arbitrary code execution.
- Severity: High (CVSS 8.0)
- Impact: Git, GitHub, GitLab, BitBucket, and related open source platforms
- Action: Upgrade to patched versions (v2.43.7–v2.50.1) or avoid cloning untrusted repositories
Including Git in your cybersecurity strategy ensures your development pipeline is resilient to advanced persistent threats (APTs) exploiting this weakness.
Storm-0501 Ransomware Hits Cloud Environments
The Storm-0501 threat actor is now exploiting cloud environments for ransomware campaigns.
Their tactics include:
- Compromising sync accounts for global admin privileges
- Disabling security defences and deleting backups
- Encrypting cloud storage
- Delivering ransom demands via compromised Teams accounts
This approach bypasses many traditional security solutions. SOC teams need network activity monitoring, behavioural analytics, and advanced detection and response tools to detect these suspicious activities and minimize impact.
Read Microsoft’s Threat Report →
Analyst Insights & Key Takeaways
This week’s developments emphasize three critical priorities for security analysts and SOC teams:
- Accelerate patch management
Rapid patching prevents attackers from exploiting vulnerabilities like Docker and Git flaws. - Secure your supply chain
The Nissan breach reinforces the need for third-party risk assessments and vendor monitoring. - Evolve your SOC strategy
The Storm-0501 campaign highlights the importance of integrating EDR, NDR, and behavioural analytics into your SOC management tools to detect and stop evolving threats in cloud environments.
A proactive cybersecurity strategy combining security monitoring with modern detection and response capabilities allows organizations to detect threats faster, reduce false positives, and strengthen defences against advanced persistent threats (APTs).
