ThreatsDay Bulletin: Spyware Alerts, Mirai Strikes, Docker Leaks, ValleyRAT Rootkit — and 20 More Stories

ThreatsDay’s weekly bulletin rounds up a broad mix of threats, from Apple and Google issuing new spyware alerts to Mirai botnet activity and widespread software flaws. A Reuters report notes that Apple and Google sent new spyware notifications to users in nearly 80 countries, though details on targets or attackers were not disclosed. The bulletin highlights a Mirai-related trail, including Broadside’s use of a custom C2 protocol in maritime IoT attacks and a known TBK DVR flaw (CVE-2024-3721) being exploited.

Europol says its GRIMM taskforce has arrested 193 individuals in a six‑month crackdown on violence‑as‑a‑service networks, while New Zealand’s NCSC says around 26,000 Lumma Stealer infections are being publicly alerted. Other notes include that nearly 40 million Log4j downloads in 2025 were still vulnerable, and a GreyNoise finding described a spike of more than 7,000 IP addresses attempting to log into GlobalProtect portals, with the same threat actor linked to subsequent SonicWall scanning.

The roundup also flags notable disclosures on ValleyRAT and other malware campaigns, underscoring how threat actors keep evolving their tools across platforms and regions.