Cybersecurity Decrypted #38: June 19 2025

Caitlin Harris Laura Iannini
Caitlin Harris, Laura Iannini Last updated on Jun 24, 2025

In the headlines this week:

  • 🛍️ Notorious retail attacker begins targeting insurance companies
  • 🚔 Leading dark web marketplace busted
  • 🪲 Journalists’ data exposed in major cyberattack

Prefer to get your news on-the-go? You can listen to this briefing on the Decrypted Podcast.

Our Partners

Proofpoint Logo

This issue is sponsored by Proofpoint

Want more stories like this? Subscribe to our Decrypted newsletter.

This field is for validation purposes and should be left unchanged.

📰 Headlines

  • Scattered Spider expands its web: The APT that has been targeting UK and US retailers has begun targeting major US insurance companies, according to Google Threat Intelligence Group. 🔗
  • Dark web marketplace busted: Europol has taken down Archetyp Market, one of the longest-running dark web drug marketplaces. The multi-year operation resulted in a major arrest and the seizure of $9 million in assets. 🔗
  • Email sting targets journalists: A cyberattack on the Washington Post has resulted in several journalists’ Microsoft email accounts being compromised. The attack targeted those covering international security and economic policy. 🔗

📡 Threat Watch

  • New variants of WormGPT tool emerge: The new variants of the hacking tool commonly used to generate malicious code are being powered by commercial AI models, including xAI’s Grok and Mistral AI’s Mixtral. 🔗
  • Predatory Sparrow targets Iranian bank: The Israeli APT group claims that the attack was in retaliation for Bank Sepah’s alleged role in financing Iranian missile and military nuclear programs. Iran has since throttled their own internet speeds in an attempt to prevent further attacks. 🔗
  • SimpleHelp flaws exploited by ransomware: Threat actors are targeting unpatched SimpleHelp RMM instances to carry out double extortion attacks against customers of an unnamed utility billing software provider. CISA urges immediate patching and warns against paying ransoms. 🔗

🤝 From Our Partners

Industry Leading Email Security From Proofpoint

proofpoint+banner

Proofpoint gives you protection and visibility for your greatest asset and security risk, your people. We deliver the most effective tools available to protect against the threats that target people, to protect the information they create and access, and to protect the users themselves.

Our cybersecurity and compliance solutions span email, social media, the web, networks, and cloud platforms, including Microsoft Office 365. We also have strategic technology integrations with the industry’s best security providers. This helps you better protect your people, data and brand.

Download the data sheet to learn more.

🚨 Industry News

  • Proofpoint and Wiz partner up: By integrating Proofpoint’s DSPM offering into Wiz’s CNAPP, the two companies will provide customers with greater visibility, contextual insights, and more control over their sensitive data in the cloud. 🔗
  • Coralogix raises $115m in Series E funding: The full-stack observability provider will use the funds to automate and extend the value of its observability tools. 🔗
  • OpenAI releases OpenAI for Government: As part of a $200m contract with the US government, OpenAI says the new initiative will help the DoD “transform its administrative operations and support proactive cyber defense.” 🔗

🌎 In other news…

  • Wiz acquisition faces antitrust review: The DoJ has opened an antitrust review into Google’s planned acquisition of Wiz, in order to assess whether the $32b deal would harm competition in the cybersecurity market. 🔗
  •  23andMe faces hefty fine: The genetic testing provider has been fines ÂŁ2.31m ($3.12m) by the UK ICO following a data breach in 2023. The breach compromised customers’ genotype data, health reports, and personal information. 🔗
  • Terrible timing: 100,000 tax accounts in the UK have been suspended following a widespread phishing campaign costing taxpayers ÂŁ47m. The news broke in the middle of a committee session where new HMRC boss JP Marks was questioned by MPs for the first time. 🔗

🎙️ The Expert Insights Podcast

  • Game Changers: Zama’s VP of Corporate Development, Ghazi Ben Amor, talks through the company’s revolutionary approach to data security that enables users to manipulate encrypted data—without having to decrypt it first.
  • The profitability of ransomware: Christiaan Beek, Sr Director of Threat Analytics at Rapid7, answers the question of why ransomware still exists in 2025. Listen here.
  • The AI arms race: Deepen Desai, Chief Security Officer at Zscaler, discusses whether we as an industry are prepared for the rise of AI-driven cyberattacks. Listen here.

🔍 Expert Insights: Latest From Us

Don’t miss this week’s round of interviews & insights with cybersecurity experts and thought leaders.

That’s all for this week! 👋

How did you find this newsletter? Please send us any feedback to help us improve. Thanks for your support.

Expert Insights’ Cybersecurity Resources