Digital Forensics Magazine — 48h News Roundup

Window: 15-12-2025 00:00 to 17-12-2025 00:00 (UTC)

Snapshot Summary

Sector / Section	Headline Highlights	Count
DFIR & Incident Response	Askul ransomware scope confirmed, French ministry response activated	2
Cyber Investigations	Bank-insider collusion exposed, “digital arrest” fraud traced	2
Major Cyber Incidents	SoundCloud breach fallout, ransomware campaigns expanding globally	2
Exploits & Threat Intelligence	Fortinet KEV deadline, Apple WebKit zero-days patched	2
Law Enforcement	Pan-India fraud syndicate dismantled, mass cybercrime arrests	2
Policy	UK resilience bill progresses, MPs targeted via messaging phishing	2
Standards & Compliance	NIST Cyber AI Profile draft, AI-era cybersecurity guidance	2
Consumer App Data Leaks	Pornhub/Mixpanel exposure claimed, childcare CRM database leak	2

Digital Forensics & Incident Response

Askul confirms scale of customer data exposure after October ransomware — Japanese e-commerce and logistics firm Askul confirmed that a ransomware incident detected in October resulted in more than 700,000 records being compromised as the company continued recovery work (17-12-2025) [APAC]. The disclosure strengthens DFIR playbooks around third-party access review, data-minimisation, and breach notification timing while underscoring the value of documenting containment decisions for downstream regulatory and civil claims (Source: SecurityWeek, 17-12-2025).

French interior ministry confirms it was targeted in a major cyberattack — France’s interior ministry said it was targeted in a cyberattack and activated internal response measures while assessing scope and service impacts across affected systems (17-12-2025) [EMEA]. For incident responders, the case highlights the operational importance of resilient communications, rapid triage of privileged access, and evidence-preservation discipline when an attack touches politically sensitive data and national-scale services (Source: Euronews, 17-12-2025).

Cyber Investigations

Delhi police probe alleges bank employees enabled a cyber-fraud cashout pipeline — Investigators in New Delhi said a probe into an account used to move alleged illicit funds uncovered suspected collusion by bank employees who helped fraudsters open and operate mule-style accounts (17-12-2025) [APAC]. The finding matters because insider-assisted onboarding can defeat standard KYC controls, so investigators and compliance teams should prioritise anomaly detection on new-account behaviour, employee access patterns, and rapid account-freeze workflows (Source: Times of India, 17-12-2025).

“Digital arrest” extortion case shows multi-channel social engineering and rapid recovery tactics — Police in Kolhapur described an investigation into a “digital arrest” scam where criminals impersonated police and used video calls plus forged legal artefacts to pressure large transfers, with partial funds recovered after swift escalation (17-12-2025) [APAC]. For cyber investigators, it demonstrates how evidential timelines (calls, payment rails, device logs) and fast bank/cyber-unit coordination can materially improve recovery odds and attribution confidence (Source: Times of India, 17-12-2025).

Major Cyber Incidents

SoundCloud breach impacts millions of user accounts — Music platform SoundCloud reported a security incident affecting user data and account information at scale, prompting customer notifications and security guidance for impacted users (16-12-2025) [AMER]. The incident matters because consumer platforms remain high-value credential and token targets, and security teams should treat identity telemetry, abnormal API access patterns, and forced re-authentication readiness as core resilience controls (Source: SecurityWeek, 16-12-2025).

Researchers flag “Gentlemen” ransomware expansion across manufacturing and healthcare — Analysts described the “Gentlemen” ransomware group as rapidly increasing activity since mid-2025, with reported impacts across multiple regions and industries including manufacturing and healthcare (16-12-2025) [GLOBAL]. This matters operationally because it reinforces the need for sector-specific segmentation, backup isolation, and pre-approved downtime procedures, especially where safety and continuity risks make recovery time objectives non-negotiable (Source: Industrial Cyber, 16-12-2025).

Exploits & Threat Intelligence

CISA adds a newly exploited flaw to the Known Exploited Vulnerabilities (KEV) catalog — CISA added a vulnerability to its KEV catalog based on evidence of active exploitation and set a remediation deadline for affected federal civilian agencies (16-12-2025) [AMER]. The alert matters because KEV additions are a high-signal prioritisation input for patch governance, and defenders should map the affected product footprint, validate exploitability paths, and document compensating controls where patch SLAs cannot be met (Source: CISA, 16-12-2025).

Apple patches WebKit zero-days exploited in “sophisticated” attacks — Apple released fixes for two WebKit zero-day vulnerabilities affecting multiple Apple platforms, noting exploitation in targeted, high-sophistication attacks (16-12-2025) [GLOBAL]. This matters because browser-engine exploitation often bypasses perimeter controls, so organisations should accelerate managed update rollouts, tighten mobile web exposure for high-risk roles, and enrich detection with device posture signals and web content inspection where feasible (Source: TechRadar, 16-12-2025).

Law Enforcement

Delhi Police dismantle international cyber-fraud syndicate after multi-state raids — Delhi Police said it dismantled an international digital fraud and extortion syndicate, arresting 10 suspects following coordinated raids across multiple Indian states (17-12-2025) [APAC]. The operation matters because it signals increased cross-jurisdiction coordination against fraud infrastructure, which can accelerate takedowns of mule networks and improve evidential chains for victim restitution and subsequent platform disruption (Source: Times of India, 17-12-2025).

“Operation Cyber Vajra Prahar” results in dozens of arrests in Rajasthan crackdown — Jaipur Range police reported 64 arrests during a two-day cybercrime operation focused on identifying and detaining suspected cyber offenders and facilitators (16-12-2025) [APAC]. The enforcement action matters because mass-arrest sweeps often yield seized devices and account linkages that can be leveraged for broader network mapping, infrastructure takedown, and proactive warnings to potential victims (Source: Times of India, 16-12-2025).

Policy

UK Cyber Security and Resilience (NIS) Bill updated as it progresses through Parliament — The UK Parliament’s bill tracker shows the Cyber Security and Resilience (Network and Information Systems) Bill progressing, with an update posted on 16 December as legislative work continues (16-12-2025) [EMEA]. This matters because expanded regulatory scope and enforcement expectations can materially change supplier assurance, incident reporting cadence, and board accountability, so CISOs should begin gap assessments against likely MSP and data-centre obligations (Source: UK Parliament, 16-12-2025).

UK MPs face rising phishing attempts via WhatsApp and Signal — UK parliamentary authorities warned that MPs and officials are seeing increased phishing attacks on messaging apps, with tactics including fake support messages designed to capture codes or prompt malicious QR scans (11-12-2025) [EMEA]. The trend matters because it demonstrates low-friction targeting of high-value identities, reinforcing the need for phishing-resistant MFA, strict device-linking controls, and secure collaboration channels for sensitive communications (Source: The Guardian, 11-12-2025).

Standards & Compliance

NIST publishes a preliminary draft “Cyber AI Profile” for comment — NIST released a preliminary draft Cybersecurity Framework Profile for Artificial Intelligence and announced a follow-on workshop, positioning it as a practical artefact for organisations adopting AI while managing cyber risk (16-12-2025) [AMER]. This matters because profiles translate control intent into implementable practices, enabling governance, assurance, and audit teams to align AI development and procurement with measurable security outcomes and defensible risk acceptance (Source: NIST CSRC, 16-12-2025).

Draft NIST guidelines address cybersecurity strategy in the AI era — NIST published draft guidance intended to help organisations incorporate AI into operations while mitigating emerging cyber risks, including securing AI systems and using AI to strengthen defensive operations (16-12-2025) [AMER]. The guidance matters because it supports consistent control language for policy, vendor due diligence, and compliance narratives, reducing ambiguity when boards and regulators ask how AI changes threat models and assurance requirements (Source: NIST, 16-12-2025).

Consumer App Data Leaks

ShinyHunters claims Pornhub premium-user data theft linked to analytics tooling — A hacking group claiming to be ShinyHunters alleged it stole data tied to Pornhub premium users and threatened release, with the platform attributing impact to a third-party analytics provider while investigations continue (16-12-2025) [AMER]. The incident matters because analytics and telemetry stacks can become high-sensitivity data stores, so consumer platforms should enforce strict vendor minimisation, data retention limits, and contractual security evidence to reduce supply-chain exposure (Source: Reuters, 16-12-2025).

Childcare CRM database exposed online, leaking records linked to family services — Researchers reported a publicly accessible database exposing more than 140,000 records associated with a childcare and early education CRM used for enrolment, parent communications, and lead management (17-12-2025) [AMER]. This matters because data tied to children and families carries elevated safeguarding risk, making rapid containment, regulator-ready breach assessments, and robust access controls on hosted search databases essential for consumer-facing SaaS operators (Source: Cybernews, 17-12-2025).

Editorial Perspective

This cycle underscores a familiar reality: breaches and response work increasingly hinge on identity, third-party telemetry, and operational resilience rather than purely perimeter defence.

Across incidents and investigations, the common denominator is trust breakdown—whether through vendor analytics exposure, insider-enabled fraud rails, or ransomware groups scaling through repeatable tradecraft.

The strongest programmes will treat KEV-driven patch prioritisation, evidence-grade logging, and AI-era control profiles as mutually reinforcing tools for measurable risk reduction and credible post-incident narratives.

Reference Reading

• NIST IR 8596 (Initial Preliminary Draft) — Cybersecurity Profile for AI
• CISA Known Exploited Vulnerabilities (KEV) Catalog
• UK Cyber Security and Resilience (NIS) Bill — Bill Tracker
• EU Cyber Resilience Act — Policy Overview
• Apple WebKit zero-days — Patch context and affected platforms
• Android fiction apps — large-scale exposed records case study

Tags

DFIR, Cybersecurity News, Threat Intelligence, Ransomware, Data Breach, Law Enforcement, Cyber Policy, Compliance, Supply Chain Security, KEV, NIST, AI Security