The Daily Raptor | Market Update
Newsletter Signup: dailyraptor.com

Tuesday, August 19, 2025 Edition

The cyber threat landscape has been especially turbulent this week, with major developments spanning cybercrime prosecutions, state-sponsored espionage, and global supply chain security. Enterprises face a dual reality: Western law enforcement is making strides in holding criminals accountable, while state-linked adversaries are quietly embedding themselves in critical systems.

A high-profile member from Florida, Noah Urban 20, of Scattered Spider—the prolific social engineering and ransomware collective notorious for breaching MGM and Caesars—was sentenced to ten years in prison, exceeding the prosecution’s eight-year request and the defense’s five-year appeal. The ruling underscores the judiciary’s tougher stance against repeat cyber offenders.

In parallel, Orange Belgium disclosed a breach affecting 850,000 customers, with sensitive subscriber details such as SIM card numbers exposed.

While Scattered Spider has not been definitively tied to this attack, industry analysts note the targeting profile is eerily similar. The concern: high-net-worth individuals in the stolen dataset (850k) could become prime SIM-swap victims, evolving into stolen MFA tokens leveraged to compromise large enterprise or financial accounts at scale.

Key Takeaways:

As reported by The Daily Raptor as recently as last week, Chinese cyber-espionage actors remain highly active across North America and Europe. Silk Typhoon has been observed exploiting zero-days to infiltrate managed service providers and IT vendors, embedding themselves in ecosystems that serve as gateways into downstream customers. According to CrowdStrike, the group—tracked as Murky Panda—has also focused on exploiting trusted cloud relationships to compromise enterprise environments via upstream service providers. Their sibling operations, Volt Typhoon and Salt Typhoon, continue to prioritize stealthy, living-off-the-land techniques against telecom and critical infrastructure networks. These activities reflect Beijing’s broader strategy: maintaining persistent access to critical industries while avoiding detection.

Key Takeaways:

The past 10 days have underscored how supply chain compromise is central to both cybercrime and state-sponsored campaigns. UK telecom giant Colt Technology Services admitted that customer data was stolen during a ransomware attack linked to the WarLock gang, with lingering service outages across its hosting and API platforms. Orange Belgium’s breach, while not yet attributed, demonstrates how telecom data could be weaponized for SIM swaps and account takeover—a tactic consistent with groups like Scattered Spider. In parallel, Silk Typhoon’s exploitation of IT vendors highlights how state-sponsored actors are embedding in the supply chain of critical infrastructure providers.

Key Takeaways:

Amid these escalating threats, U.S. state and local governments are warning of widening resource gaps. In a bipartisan letter to Congress, organizations representing mayors, counties, and state CIOs urged the restoration of federal funding for the MS-ISAC, the Multi-State Information Sharing and Analysis Center. MS-ISAC is a cornerstone for defending local schools, hospitals, utilities, and law enforcement agencies against foreign adversaries. In 2024 alone, it helped detect 43,000 potential attacks and blocked 25 billion malicious site connections. Without renewed federal support, leaders warn that smaller and rural communities—already resource-constrained—will face crippling vulnerabilities.

Adding to this concern, new research from Dragos highlights how industrial and supply chain sectors are under historic ransomware pressure. In Q2 2025 alone, Dragos documented 657 ransomware incidents impacting industrial organizations worldwide, with North America bearing more than half (355 incidents). The manufacturing sector was the hardest hit, accounting for nearly two-thirds of all cases, while Industrial Control Systems (ICS) incidents almost doubled compared to the prior quarter. Groups like Qilin—responsible for nearly 1 in 5 industrial breaches—are increasingly professionalized and aligned with nation-state interests, exploiting both direct operational environments and upstream vendors.

Key Takeaways:

End of Week Press Update:

Have a great weekend, Raptor Community!

The DR Team

smb/