April 2025 TRU Intelligence Briefing On-Demand

Join eSentire’s Threat Response Unit (TRU) as they share new research-driven observations of malware, notable vulnerabilities, threat actor groups, and cyber activity affecting the threat landscape.

During the April Threat Intelligence Briefing, TRU reviewed:

• Tycoon2FA: Insights on observations, detection coverage, and mitigation recommendations for the Tycoon2FA Phishing-as-a-Service kit.
• What the PhaaS - A Look at Top AiTM Services Leveraged in Attacks: An overview of recent trends in a surge of AiTM attacks in 2025 as well as a discussion around capabilities of Tycoon2FA, Mamba2FA and Sneaky2FA including how they intercept and replay authentication data to compromise accounts. The TRU team will also provide some insight into infrastructure used by these services and their customers.
• Threat Landscape: Malware recently observed by eSentire’s SOC (RansomHub, Koi Loader, Rhadamanthys Stealer) and notable vulnerabilities (CVE-2025-2825 CrushFTP, CVE-2025-24813 Apache, CVE-2025-29927 Next.js).
• A brief geopolitical update on recent activity attributed to North Korean threat actors.

This webinar also included a live Q&A.