← Back to the blog

Technology

Cyber & AI Weekly - September 22nd

Get the latest news with Cyber & AI Weekly by StrongestLayer.

September 22, 2025

Gabrielle Letain-Mathieu

3 mins

Table of Content

Subscribe to our newsletter

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

AI & Cyber Weekly - September 22, 2025

AI & Cyber Weekly: Critical Infrastructure Under Siege

KillSec Healthcare Ransomware, AI-Powered Fraud Explosion, and Microsoft's Global Phishing Takedown

September 22, 2025 | By Gabrielle from StrongestLayer

Executive Summary

This week's cybersecurity landscape reveals a coordinated escalation in AI-powered attacks targeting critical infrastructure, with healthcare organizations bearing the brunt of sophisticated ransomware campaigns. The emergence of KillSec ransomware represents a new threat paradigm, combining rudimentary cloud exploitation techniques with advanced encryption routines to devastating effect [3].

Simultaneously, Microsoft and Cloudflare's joint operation to dismantle the Raccoon0365 phishing-as-a-service infrastructure demonstrates the scale of modern cybercriminal enterprises, with over $100,000 in cryptocurrency revenue and 5,000 stolen credentials across 94 countries [4]. This coordinated takedown, coupled with CrowdStrike's strategic acquisition of AI security firm Pangea, signals the cybersecurity industry's aggressive pivot toward AI-enhanced defense capabilities [5].

2,300 US Organizations Targeted

20 US Hospitals Breached

850 Telegram Members

15K+ French Companies Affected by NIS2

Critical Zero-Day Intelligence

KillSec Ransomware: Healthcare Under Attack

The KillSec ransomware strain has rapidly emerged as a formidable threat targeting healthcare IT infrastructures, first observed in early September 2025 with devastating impact across Latin America [3].

KillSec Ransomware - Healthcare Sector Targeting

34GB EXFILTRATED

Within a week of its appearance, KillSec has impacted over a dozen healthcare entities, exfiltrating more than 34 GB of data including unredacted patient images, laboratory results, and records related to minors [3]. The group's data leak site on TOR has showcased high-profile exfiltrations, confirming their willingness to publicly shame victims.

Technical Analysis: KillSec operators leverage compromised software supply chain relationships and unpatched web applications or misconfigured cloud storage to deploy payloads at scale. The malware propagates through internal networks via legitimate administrative protocols including WinRM and RDP.

Encryption Method: Multi-stage encryption process using a lightweight loader that invokes custom-built AES-256 encryption routine, with unique import hashing and unusual manipulation of Advapi32.dll library for antivirus evasion.

AI-Powered Sign-Up Fraud Epidemic

Cybercriminals are increasingly leveraging artificial intelligence to automate and scale fraudulent account creation, targeting financial services and e-commerce platforms with unprecedented sophistication [7].

AI-Enhanced Fraud Automation Scaling Rapidly

AI POWERED

The deployment of AI-powered fraud tools enables cybercriminals to bypass traditional detection mechanisms through dynamic behavioral patterns and sophisticated CAPTCHA solving [7]. These automated systems can generate thousands of fraudulent accounts per hour while maintaining low detection rates.

Attack Methodology: AI algorithms analyze successful sign-up patterns to replicate legitimate user behavior, while machine learning models adapt to evade fraud detection systems in real-time.

Enterprise Impact: Financial institutions and online services face escalating costs from fraudulent accounts, while traditional rule-based detection systems prove inadequate against AI-driven attacks.

FileFileX Attack Vector Analysis

Security researchers have identified a novel attack methodology dubbed "FileFileX" that exploits file processing vulnerabilities to achieve persistent system access [8].

FileFileX Attack Vector - File Processing Exploitation

INNOVATIVE

The FileFileX attack vector demonstrates sophisticated exploitation of file processing workflows, enabling attackers to embed malicious payloads within seemingly benign document formats [8]. This technique bypasses traditional content inspection and achieves code execution through trusted file handling processes.

Technical Details: Attackers manipulate file metadata and structure to trigger vulnerabilities in parsing engines, achieving remote code execution without user awareness.

Detection Challenges: The attack method exploits legitimate file processing functionality, making detection extremely difficult through conventional signature-based or heuristic analysis.

Human Risk Management & Ransomware Intelligence

Microsoft-Cloudflare Coordinated Takedown

Microsoft and Cloudflare executed a coordinated operation to dismantle Raccoon0365, a major phishing-as-a-service operation that had powered attacks on healthcare organizations worldwide [4][6].

Raccoon0365 Phishing-as-a-Service Infrastructure Dismantled

338 DOMAINS

Microsoft seized 338 of Raccoon0365's web domains after obtaining federal court permission, disrupting a sophisticated phishing operation that generated over $100,000 in cryptocurrency revenue [4]. The service sold subscription-based phishing kits targeting Microsoft 365 credentials across 94 countries.

Operation Scale: Hackers used Raccoon0365 phishing kits to steal approximately 5,000 credentials from users in 94 different countries since July 2024, with 850+ members on the operation's Telegram channel.

Healthcare Impact: The phishing operation significantly impacted US healthcare organizations, with attacks leading to ransomware deployment at 20 American hospitals through sophisticated social engineering tactics.

Ransomware Financial Impact Analysis

New analysis reveals evolving ransomware economics, with organizations increasingly refusing to pay extortion demands while individual incident costs continue climbing [1].

2025 Ransomware Trends Evolution

H1 2025

Overall ransomware claims fell 53% compared to 2024, but average cost per incident rose 17% to $1.18 million

Payment Rates

Only 14% of ransomware claims involved known extortion payments in early 2025, down from 22% in 2024

Attack Evolution

Trend toward double and triple extortion, with attackers demanding payment to unlock systems and prevent data release

Jaguar Land Rover: Extended Production Impact

Jaguar Land Rover's cyberattack continues to disrupt global manufacturing operations, with production shutdown extended for another week as recovery efforts persist [10].

1,000+

Vehicles/Day Impact

Countries Affected

3+ Weeks

Ongoing Disruption

Multiple

Supplier Impact

AI-Enabled Attacks & Strategic Intelligence

AI-Powered Hotel Guest Cyberattacks Escalate Globally

Kaspersky has discovered a wave of artificial intelligence-powered cyberattacks targeting hotel guests worldwide, putting payment and personal data at significant risk [5].

VenomRAT Targets Hotel Systems Across Multiple Countries

AI POWERED

The campaign was first detected in Brazil but has expanded to hotels in Argentina, Bolivia, Chile, Costa Rica, Mexico, and Spain [5]. Attackers send AI-generated phishing emails disguised as reservation requests or job applications directly to hotel staff, deploying VenomRAT malware once employees interact with the messages.

Attack Methodology: Cybercriminals leverage AI to create convincing phishing emails that appear to originate from legitimate websites with Portuguese-language themes, making detection extremely difficult for average users.

Data at Risk: Successful breaches expose sensitive guest information including credit card details, passport scans, and personal data, leading to potential financial loss and identity theft across the hospitality sector.

Luxury Retail Supply Chain Compromises

Cybercriminals have successfully infiltrated luxury retail supply chains, targeting high-value merchandise and customer data across premium brand networks [16].

Luxury Retail Supply Chain Attacks Escalate

SUPPLY CHAIN

Advanced persistent threat groups are exploiting vulnerabilities in luxury retail supply chain infrastructure, targeting both merchandise and sensitive customer information [16]. The attacks leverage sophisticated social engineering and compromised vendor relationships to infiltrate premium brand networks.

Attack Methodology: Threat actors use AI-enhanced reconnaissance to identify high-value targets within luxury retail ecosystems, focusing on suppliers, distributors, and customer management systems.

Financial Impact: Compromised luxury retail supply chains result in significant revenue losses through merchandise theft, brand reputation damage, and regulatory compliance violations affecting premium market positioning.

French Cybersecurity Landscape Transformation

New research reveals how AI threats and stricter regulations are fundamentally reshaping France's cybersecurity market, with over 15,000 French businesses now subject to enhanced compliance requirements [2].

French enterprises are adapting to a more complex security landscape driven by EU regulations including the NIS2 directive and AI Act becoming French law [2]. Companies are increasingly seeking integrated security platforms for unified threat visibility and centralized defense oversight.

UK-US AI Partnership: Europe's Largest AI Factory

The UK government has signed a partnership with the US to deliver Europe's largest AI factory, representing a significant investment in AI infrastructure and cybersecurity capabilities [9].

CISO Strategic Perspectives

AI Security Investment Imperative

The convergence of AI-powered attacks, regulatory compliance requirements, and infrastructure targeting creates unprecedented challenges requiring immediate strategic response from security leaders [2][7].

CISO Challenge: AI Threat Evolution Outpaces Traditional Defenses

STRATEGIC

Organizations face a critical inflection point where traditional signature-based detection proves inadequate against AI-enhanced attacks like KillSec ransomware and Raccoon0365 phishing operations [3][4]. CISOs must prioritize AI-powered defense capabilities while managing complex regulatory landscapes.

Investment Priorities: Security budgets increasingly focus on unified platforms combining AI-powered detection, automated response, and compliance management rather than point solutions.

Skill Gap Challenge: French enterprises report continuing deficits in cybersecurity talent, leading many to rely on technical security service providers for AI-enhanced capabilities and centralized platform management [2].

NIST Cybersecurity Workforce Development

NIST has awarded more than $3 million to support cybersecurity workforce development initiatives, addressing critical talent shortages in AI security and threat response [15].

Weekly Threat Landscape Summary

This week's developments underscore a fundamental shift in the cybersecurity threat landscape, where AI-powered attacks target critical infrastructure with unprecedented sophistication. The KillSec ransomware campaign demonstrates how threat actors combine simple exploitation techniques with advanced encryption and data theft capabilities, while the Raccoon0365 takedown reveals the industrial scale of modern cybercriminal operations.

The coordinated response from Microsoft and Cloudflare, coupled with strategic acquisitions like CrowdStrike's purchase of Pangea, signals the industry's recognition that traditional security approaches prove inadequate against AI-enhanced threats. Organizations must urgently invest in AI-powered defense capabilities while navigating increasingly complex regulatory requirements across multiple jurisdictions.

Healthcare organizations face particular vulnerability, with KillSec's targeting of medical infrastructure and Raccoon0365's hospital breaches highlighting the sector's attractive combination of valuable data, critical operations, and often inadequate security controls. The extended production impact at Jaguar Land Rover demonstrates how cyberattacks increasingly disrupt global supply chains and manufacturing operations.

"The weaponization of AI in cybercriminal operations has reached a tipping point where defensive strategies must fundamentally evolve. Organizations that fail to invest in AI-powered security capabilities will find themselves increasingly vulnerable to threats that traditional tools cannot detect or prevent."

— StrongestLayer Threat Intelligence Analysis