Brief #121: Apple Memory Integrity, HybridPetya UEFI Bypass, npm Packages Compromised

Happy Sunday!

The renewable energy transition is turning into a cybersecurity nightmare for European utilities, with attacks jumping 586% last year alone - seems like going green comes with some unexpected red flags.

In this week's brief:

• HybridPetya ransomware surfaces with UEFI Secure Boot bypass capabilities, marking the fourth bootkit of its kind we've seen
• Hexstrike-AI drops as a game-changing framework that lets threat actors orchestrate 150+ AI agents to exploit targets in under 10 minutes
• Web3 white hats are making millions from bug bounties while traditional cybersecurity salaries look increasingly modest in comparison

A quick note before we dive in.

Industry News

HybridPetya: New Ransomware Discovered With UEFI Secure Boot Bypass Capabilities

• ESET Research discovered a new ransomware called HybridPetya that mimics Petya/NotPetya but adds the ability to compromise UEFI-based systems by installing a malicious EFI application onto the EFI System Partition.

• One HybridPetya variant exploits CVE-2024-7344 to bypass UEFI Secure Boot on outdated systems, representing at least the fourth known example of a UEFI bootkit with Secure Boot bypass functionality.

• Unlike NotPetya (which caused over $10 billion in damages), HybridPetya functions as actual ransomware rather than being purely destructive, as the encryption key can be recovered from victim's personal installation key.

Popular npm Packages Including Debug And Chalk Compromised With Crypto-Stealing Malware

• On September 8th, 2023, attackers compromised 18 highly popular npm packages (including debug and chalk) with combined weekly downloads exceeding 2 billion by using phishing emails to target maintainers.

• The malicious code silently intercepts web3/crypto transactions in the browser, manipulating wallet interactions by rewriting payment destinations to attacker-controlled addresses without visible indicators to victims.

• The maintainer was compromised through a phishing email from "support@npmjs.help" (a recently registered domain), and attackers deployed sophisticated code that hooks into browser functions like fetch, XMLHttpRequest, and wallet APIs to silently alter transaction data.

Apple Introduces Memory Integrity Enforcement To Combat Mercenary Spyware Attacks

• Apple has launched Memory Integrity Enforcement (MIE), a comprehensive memory safety defense built into iPhone 17 and iPhone Air that combines secure memory allocators with Enhanced Memory Tagging Extension (EMTE) to prevent exploitation of memory corruption vulnerabilities.

• MIE is specifically designed to disrupt mercenary spyware attacks that exploit memory safety vulnerabilities, making exploit chains significantly more expensive and difficult to develop and maintain.

• The technology includes Tag Confidentiality Enforcement to protect against side-channel and speculative-execution attacks, and is available to third-party app developers through Xcode's Enhanced Security settings.

Leadership Insights

European Energy Sector Faces Surge in Cyberattacks as Renewable Transition Creates New Vulnerabilities

• The transition to renewable energy has dramatically increased the attack surface of European power infrastructure, with successful cyberattacks on UK utility companies alone surging by 586% in 2023, while Finnish utilities report daily attacks and Danish energy companies experienced the largest cyberattack in the country's history.

• Nation-state actors, particularly those linked to the Russian government, have intensified attacks following the Ukraine invasion, with renewable infrastructure being particularly vulnerable – evidenced by incidents targeting wind farms in Germany, hydroelectric plants in France, and green energy firms across multiple countries.

• Energy sector organizations face significant challenges in strengthening their cybersecurity posture, including high infrastructure upgrade costs, understaffed security teams, inconsistent regulations, and decentralized infrastructure, though comprehensive security awareness training has been shown to reduce phishing vulnerability rates from 47.8% to just 4% in large energy companies.

Ransomware Trends for 2025: From Risk to Resilience

• The percentage of companies impacted by at least one ransomware attack resulting in encryption or data exfiltration decreased from 75% to 69% compared to 2024, showing improved organizational preparation and increased law enforcement takedowns of major threat groups.

• Despite the decline of larger ransomware groups due to law enforcement actions, smaller groups and "lone wolf" actors continue to proliferate, with reduced dwell time (under 24 hours) and increased focus on data exfiltration rather than encryption.

• Organizations demonstrating better resilience implemented key technical elements in their playbooks, including backup verification strategies, immutable storage, and pre-defined chains of command, while 89% of attacked organizations had their backup repositories targeted by threat actors.

Netwrix Report Shows Cloud Security Incidents Increasingly Identity-Focused as AI Adoption Grows

• 77% of organizations now operate in hybrid IT environments with cloud workloads increasing to 49% in 2025, while security incidents requiring dedicated response affected 51% of surveyed companies, with phishing remaining the most common threat.

• Cloud security incidents have become more identity-focused, with user/admin account compromise rising dramatically from 16% in 2020 to 46% in 2025, while targeted attacks on on-premises infrastructure increased from 19% in 2023 to 28% in 2025.

• 60% of organizations are leveraging AI tools, with 37% forced to adjust their security approach due to AI-driven threats, while financial damage from security incidents is increasing – 75% of respondents reported financial impact, up from 60% in 2024.

Career Development

Cybersecurity Professionals Share Perspectives on Imposter Syndrome and Knowledge Gaps

• Cybersecurity professionals, including those with 20+ years of experience, acknowledge they don't know everything and still feel like imposters sometimes, emphasizing the importance of continuous learning rather than mastery of all domains.

• Industry veterans recommend specializing in one area deeply while acquiring decent knowledge in others, and building relationships with experts in different domains to create valuable professional networks.

• Even senior managers with extensive backgrounds regularly seek input on basic issues, validating that asking questions and considering different perspectives are strengths rather than weaknesses in the cybersecurity field.

Cybersecurity Professionals Discuss Widespread Burnout Issues in the Industry

• Industry professionals report experiencing burnout faster in cybersecurity than in previous roles, citing unrealistic expectations to "know everything" and maintain composure during incidents as key contributors to mental strain.

• A 20-year security director offered counterpoint advice, suggesting burnout often comes from self-imposed pressure rather than external demands, and that setting firm boundaries between work and personal life actually accelerated their career growth.

• Multiple commenters recommended specific coping strategies including scheduled exercise, refusing to work after hours, pursuing non-technical hobbies, and prioritizing work-life balance over higher compensation to combat the unique pressures of cybersecurity roles.

Web3 White Hats Earn Millions, Dwarfing Traditional Cybersecurity Salaries

• Top Web3 ethical hackers are earning millions uncovering DeFi vulnerabilities, with Immunefi having facilitated over $120 million in bounty payouts and created 30 millionaires through their platform.

• The largest single payout was $10 million for discovering a fatal flaw in Wormhole's crosschain bridge, while bridges remain the most lucrative targets due to their complexity and vast sums they secure.

• Despite overall security improvements, crypto-related hacks and scams reached $163 million in August 2025, with the majority coming from a $91 million social engineering scam targeting a Bitcoiner and a $50 million breach of Turkish exchange Btcturk.

AI & Security

2025 Survey Reveals Time To Automation As Critical Security Metric

• Survey of 1,000 security professionals shows 45% of organizations took up to three months to implement their most recent automation initiative, creating significant security gaps as threat actors can move in seconds.

• AI-driven security automation is shifting from task execution to decision execution, with over half of surveyed organizations using AI to take actions like isolating devices and blocking access based on behavioral context.

• Security team structures are evolving as analysts move into oversight roles while engineers build automations tied to compliance requirements, with some organizations forming centralized automation teams for comprehensive governance.

GitHub Study Reveals API Security Dominates Agentic AI Vulnerabilities

• Analysis of 2,869 GitHub security issues for Agentic AI repositories revealed that 65% (1,858) were API-related, demonstrating the inseparability of agent security and API security.

• The most common vulnerability was CWE-937 (Use of Unmaintained 3rd Party Components), followed by CWE-20 (Improper Input Validation) and CWE-400 (Uncontrolled Resource Consumption).

• The average time to close a security issue was 42 days, but 25% (716) of issues remain unresolved, with the longest resolution time reaching 3.5 years.

Hexstrike-AI: LLM Orchestration Driving Real-World Zero-Day Exploits

• Newly released framework called Hexstrike-AI provides threat actors with an orchestration "brain" that can direct more than 150 specialized AI agents to autonomously scan, exploit, and persist inside targets.

• Within hours of its release, dark web chatter shows threat actors attempting to use Hexstrike-AI against recent Citrix zero-day CVEs, reducing exploitation time from days to under 10 minutes.

• The framework represents a paradigm shift where AI orchestration can weaponize vulnerabilities quickly and at scale, requiring defenders to adopt adaptive detection, integrate AI-driven defense, and shorten patch cycles.

Market Updates

Koi Raises $38M Series A to Build Enterprise Software Checkpoint

• Cybersecurity startup Koi has secured $38M in Series A funding led by Battery and Team8 to develop a centralized layer providing visibility, risk analysis, and policy enforcement for self-installed software on enterprise endpoints.

• The company was founded by Unit 8200 veterans after discovering a major security gap in VSCode, where they created a fake theme extension that harvested developers' source code and machine details, infecting over 300 organizations within a week.

• Koi's Supply Chain Gateway platform already protects more than 500,000 endpoints worldwide and has achieved seven-figure revenue in just eight months of operation.

UltraViolet Cyber Acquires Black Duck's Application Security Testing Services Business

• UltraViolet Cyber has acquired Black Duck's AST services business, expanding its capabilities in penetration testing, red teaming, threat modeling, and secure software development consulting for both commercial and federal clients.

• This strategic acquisition addresses growing challenges in AI-generated code security and positions UltraViolet to help organizations identify risks earlier in the development lifecycle across multi-cloud workloads and DevSecOps pipelines.

• The deal includes a commercial partnership where Black Duck customers will continue receiving application security testing services while gaining access to UltraViolet's broader offensive and defensive security capabilities.

F5 Paying $180M to Acquire CalypsoAI to Boost AI Enterprise Security Offerings

• Seattle-based security giant F5 will acquire CalypsoAI for $180 million, primarily financed with cash, to enhance their generative AI security capabilities for enterprise customers.

• Founded in 2018, CalypsoAI provides real-time threat defense and data security products for AI workloads, having raised $23 million from backers including Paladin Capital Group and Lockheed Martin Ventures.

• This acquisition continues F5's buying spree, following their recent purchases of cybersecurity startup Fletch in June and observability company MantisNet in August.

Tools

Silo for Research

A web isolation platform that enables secure, anonymous digital investigations across the surface, deep, and dark web while protecting users from malware and preventing identity exposure.

Symbiotic Security

An IDE-integrated AI security solution that detects, remediates, and educates about code vulnerabilities in real-time as developers write code.

TrojAI

TrojAI is an AI security platform that detects vulnerabilities in AI models and defends against attacks on AI applications.

If you found this newsletter useful, I'd really appreciate if you could forward it to your community and share your feedback below!

P.S. I am working with select B2B companies on the exact challenges covered above. Calendar link here if you'd like to chat.

Talk to you in the next one.

Best,

Nikoloz