Offense Scaling: AI Phishing, Backup Kill Switches, and Edge Botnets

Tools

Nuclei Templates Updated for SAP NetWeaver RCE (CVE-2025-31324)

Projectdiscovery's Nuclei scanner just updated its templates to cover the recently patched SAP NetWeaver RCE. If you're running SAP in production, scanning with these is currently the fastest way to verify exposure before an attacker finds it.

News

AI-Powered Phishing Shifts from Content to Pretexting

Attackers are weaponizing AI to churn out unique pretexts at machine speed, meaning common sense filters and signatures are becoming less effective. Security awareness training needs a serious upgrade or automation, because the humans behind these emails are already replaced by bots.

Ransomware Groups Are Targeting Cloud Backups First

This is a critical tactical shift in ransomware execution. By blowing up the backups first, attackers are removing your ability to restore and forcing negotiation, which means air-gapped or immutable storage is no longer optional.

New Botnet Variant SolidEdge Turns Routers and NVRs into DDoS Soldiers

A new Mirai variant is chewing through unpatched routers and NVRs to scale up DDoS capacity. It is a good reminder to update the unglamorous edge hardware on your network; those devices are likely already compromised.

SAP NetWeaver RCE Patched, but Clock is Ticking

The patch is here but the scores are sky high. Patching SAP environments is notoriously slow, making this a prime target for automated exploitation this weekend.