Global Cyber Pulse: 29 May 2025

Global Cyber Pulse
May 29, 2025 | Cybersecurity

By Ashwani Mishra, Editor-Technology, 63SATS Cybertech

In a surge of global cyber threats, industries and governments faced intense attacks this week. India’s strict new CCTV cybersecurity rules rattled major manufacturers, while the Czech Republic blamed China’s APT31 for hacking its Foreign Ministry. LexisNexis reported a data breach affecting 364,000 people, and Cork Protocol lost $12 million in a crypto heist.

Meanwhile, the “Dark Partner” group ran fake VPN, AI, and crypto download sites to spread malware and steal funds, and Google warned of Vietnam-based hackers using fake AI video generators and social media ads to infect millions with infostealers. The cyber risk landscape keeps escalating.

CCTV Giants Clash with India Over Tough Cybersecurity Rules

According to Business Today, global and local CCTV makers are pushing back against India’s strict new cybersecurity policy, which now mandates that all internet-connected surveillance cameras pass government lab testing before sale. Effective April 9, the rules may require access to source code and factory audits.

Major brands like China’s Hikvision, South Korea’s Hanwha, Motorola Solutions, and India’s CP Plus are impacted. Indian regulators insist the rules are vital to protect national surveillance systems, citing concerns over espionage and foreign intelligence laws.

Czech Republic Blames China’s APT31 for Foreign Ministry Cyberattack

On May 28, Czech officials publicly accused China of sponsoring a cyberespionage campaign targeting the Czech Ministry of Foreign Affairs. The attack, attributed to the Chinese APT31 group, began in 2022 and reportedly hit one of the Ministry’s unclassified networks, part of Czech critical infrastructure. The investigation involved four national agencies, including the BIS and Military Intelligence.

Authorities have not confirmed the extent of the breach, but the accusation marks a serious diplomatic escalation between Prague and Beijing.

LexisNexis Breach Exposes Data of 364,000 Individuals

LexisNexis Risk Solutions disclosed a data breach potentially compromising names, Social Security numbers, driver’s licenses, and contact details of over 364,000 people. According to a Maine state filing, the breach stemmed from unauthorized access through a third-party software platform.

Although the attack happened on December 25, 2024, LexisNexis only discovered it on April 1, 2025. The firm has since launched an investigation, alerted law enforcement, and begun notifying affected individuals. Data exposed varies by person.

Hackers Drain $12M from Cork Protocol in DeFi Cyber Heist

Decentralized finance platform Cork Protocol has confirmed a $12 million cryptocurrency theft following a security breach on May 28. Co-founder Phil Fogel stated that the incident specifically impacted the wstETH:weETH market, prompting the company to immediately pause all trading activity across its platform.

In a public statement, Cork assured users it is actively investigating the breach and coordinating with partners to resolve the situation. No other markets were affected, and updates are expected as the investigation unfolds.

Google Warns: Vietnam Hackers Use Fake AI Video Tools to Spread Malware

Google warns that Vietnam-based hackers, identified as UNC6032, are using fake AI video generator sites to spread malware and infostealers. Backed by thousands of deceptive social media ads, these fraudulent sites mimic popular tools like Luma AI and Canva Dream Lab.

Mandiant researchers have tracked the campaign since November, noting it has already reached millions of users worldwide.

Dark Partner Hackers Run Global Crypto Theft Scheme Using Fake Software Sites

The “Dark Partner” hacking group is running a global crypto theft campaign using fake AI, VPN, and crypto software download sites. Masquerading as trusted apps, these cloned sites deliver malware like Poseiden (macOS) and Lumma (Windows) to steal cryptocurrency, credentials, and private keys.

On Windows, they even use legitimate-looking digital certificates, including for the PayDay Loader, to disguise malicious builds.