Do Son Check Point reveals Sicarii ransomware is a Russian false flag operation. Despite Israeli branding, the group relies on machine-translated Hebrew.
AES-GCM
A critical Ruby JWE vulnerability (CVE-2025-54887, CVSS 9.1) allows attackers to bypass authentication tag validation in AES-GCM, potentially leading to data decryption and integrity loss.
Chihuahua Stealer uses stealthy PowerShell loaders, CNG AES-GCM encryption, and .NET memory injection to exfiltrate browser and crypto wallet data.