Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Sha1-Hulud has burrowed back into our lives, spreading rapidly and causing more destruction than ever. Named after the famous worm from the Dune franchise, this attack is also impacting global organizations. Since its first widescale spread on September 16, 2025, this worm has demonstrated its ability to propagate rapidly with high impact using the following techniques: This variant includes some new behavior, including.

This is the second in our Retail Resilience series. Check out the first article, Cyber Risk in UK Retail: A Golden Quarter Under Threat Threat actors have retail firmly in their sights. High profile breaches across giants, from Cartier, Co-op and Adidas to Marks & Spencer, underscore just how much is at stake. With sprawling customer data, complex supply chains and relentless digital transformation, the sector is a prime target for sophisticated threat groups.

Our intelligence team has uncovered a fresh escalation in state-sponsored cyber espionage targeting enterprise update infrastructure. A critical remote code execution (RCE) vulnerability in Microsoft Windows Server Update Services (WSUS), designated CVE-2025-59287, is now actively exploited by Chinese-linked advanced persistent threat ( APT) groups. These actors leverage the flaw to deploy ShadowPad, a modular backdoor long favored in espionage operations.

On November 24, 2025, researchers identified a renewed supply-chain attack linked to Shai-Hulud malware, revealing that numerous npm packages had been quietly trojanized following the initial wave of malicious activity in September. This second iteration involved compromised versions of popular packages uploaded between November 21, 2025, and November 23, 2025, with additional compromised packages continuing to surface at the time of writing.

Kroll Threat Intelligence is tracking a second wave of ‘Shai-Hulud’ NPM compromises, named as ‘Sha1-Hulud’ (based on the GitHub action name created as well as the public repository description it creates to publish credentials).

On November 24th, 2025, we identified a new supply chain attack in the npm ecosystem, referred to as SHA1-Hulud. We believe this is a second wave of the Shai-Hulud attack, which occurred in September 2025. Snyk will continue monitoring this active incident until it is resolved. Updates on this incident will be on our trust center.

Nov 20, 2025 UK Cyber Security Bill: A Mandate for Resilience Read More Natalie Tischler Nov 18, 2025 GPT‑5 Pulls Ahead on Secure Code While Rivals Stall Read More Natalie Tischler Nov 12, 2025 Beyond Your Code: A Guide to Software Supply Chain Risk Management Read More Natalie Tischler.

A significantly evolved version of the Shai-Hulud malware now tracked as Sha1-Hulud has been discovered with over 800 packages affected, now featuring persistent backdoor capabilities through compromised GitHub Actions runners and enhanced multi-cloud credential harvesting.

Ransomware attacks target your backups before anything else. Recent data shows that two-thirds of organizations faced ransomware in the past two years, with attackers specifically hunting backup infrastructure to eliminate recovery options. Once your backups are gone, you’re left with two choices: Pay up or lose your data permanently.

Ransomware attacks spiked in October 2025, with more than 700 organizations sustaining attacks, according to a new report from Cyfirma. “In October 2025, ransomware activity surged globally, marking a significant resurgence after a period of mid-year stability,” the report says. “Victim counts climbed to 738, driven by renewed campaigns from leading operators and the emergence of several new groups.