MSP cybersecurity news digest, June 24, 2025

Acronis and other researchers report multiple active cyber incidents: the Shadow Vector campaign uses spear-phishing SVG decoys to deliver AsyncRAT/Remcos and in-memory loaders targeting Colombian users; North Korea-linked BlueNoroff employed deepfake Zoom calls to deliver macOS malware; Chain IQ and Australian MSP Vertel were hit in ransomware incidents with data exfiltration claims; Scania and health provider Episource suffered data breaches (Episource impacting ~5.4M individuals); and the Silver Fox APT targeted Taiwanese organizations with RATs and DLL side‑loading—overall demonstrating sophisticated, multi-stage attacks that weaponize social engineering and legitimate cloud services.