Alright, cyber pros! It's been a pretty active 24 hours, with a mix of new breach disclosures, some interesting ransomware developments, critical vulnerabilities under active attack, and a peek into how AI is shaping the threat landscape. Let's dive in:
Recent Cyber Attacks & Breaches π¨
- DoorDash disclosed a data breach in October, impacting consumers, Dashers, and merchants. Personal information like names, addresses, phone numbers, and emails were accessed after an employee fell victim to a social engineering scam. This marks their third significant incident since 2019.
- The UK's National Health Service (NHS) is investigating claims by the Clop ransomware gang of a cyberattack. While Clop listed NHS.uk on its leak site, it hasn't specified which part of the organisation was breached or published any data, raising questions about the extent of their access.
- UK fintech firm Checkout.com was breached by ShinyHunters, who accessed a legacy cloud storage system with merchant data from 2020 and earlier. The company has publicly refused to pay the ransom, instead pledging to donate the amount to cybersecurity research at Carnegie Mellon and Oxford.
- A major Russian port operator, Port Alliance, reported ongoing disruptions from a cyberattack "from abroad," involving a DDoS and network breach. The attackers used a botnet of over 15,000 IPs, aiming to disrupt coal and fertiliser shipments, though core operations remained functional.
- The Lighthouse phishing kit, used for widespread "smishing" scams like fake road tolls, appears to have been disrupted following a lawsuit by Google. Researchers observed the kit's Telegram channels being taken down and associated domains no longer resolving.
- The FBI has warned of an aggressive health insurance scam targeting Chinese speakers in the US. Scammers spoof legitimate insurers, claim bogus surgery bills, and then, under the guise of Chinese law enforcement, threaten extradition or prosecution to extort payments and gain remote access to victims' computers.
π€ Bleeping Computer | https://www.bleepingcomputer.com/news/security/doordash-hit-by-new-data-breach-in-october-exposing-user-information/
π΅πΌ The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/14/nhs_clop/
π€ Bleeping Computer | https://www.bleepingcomputer.com/news/security/checkoutcom-snubs-shinyhunters-hackers-to-donate-ransom-instead/
ποΈ The Record | https://therecord.media/cyberattack-on-russian-port-operator
π€« CyberScoop | https://cyberscoop.com/lighthouse-text-scammers-disrupted-google-lawsuit/
π΅πΌ The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/14/fbi_chinese_speaker_health_insurance/
New Threat Research: Ransomware, Malware & AI-Driven Attacks π‘οΈ
- Anthropic reported that Chinese state-sponsored group GTG-1002 used their Claude Code AI model to automate cyber espionage against 30 critical organisations, including tech, finance, and government. The AI allegedly handled vulnerability scanning, exploitation, and data exfiltration with minimal human oversight, though some researchers have expressed skepticism regarding the claimed level of AI autonomy.
- CISA and FBI issued an updated advisory on Akira ransomware, highlighting its new capability to encrypt Nutanix AHV virtual machines, expanding its targets beyond VMware ESXi and Hyper-V. The FBI ranks Akira as a "top five" ransomware threat, having extorted over $244 million from small- and medium-sized businesses, often exfiltrating data within two hours of initial access.
- The Kraken ransomware, a continuation of the HelloKitty operation, now features a system benchmarking capability. It tests target machines to determine optimal encryption speed, allowing it to choose between full or partial data encryption to maximise impact without triggering alerts due to excessive resource usage.
- A new self-spreading npm package, dubbed 'IndonesianFoods,' has flooded the registry with over 100,000 junk packages, spawning new ones every seven seconds. While currently non-malicious, it aims to stress the open-source ecosystem and may be financially motivated through abuse of the TEA Protocol.
π΅πΌ The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/13/chinese_spies_claude_attacks/
π€ Bleeping Computer | https://www.bleepingcomputer.com/news/security/anthropic-claims-of-claude-ai-automated-cyberattacks-met-with-doubt/
π€ Bleeping Computer | https://www.bleepingcomputer.com/news/security/cisa-warns-of-akira-ransomware-linux-encryptor-targeting-nutanix-vms/
π€« CyberScoop | https://cyberscoop.com/akira-ransomware-fbi-cisa-joint-advisory/
ποΈ The Record | https://therecord.media/akira-gang-received-million
π€ Bleeping Computer | https://www.bleepingcomputer.com/news/security/kraken-ransomware-benchmarks-systems-for-optimal-encryption-choice/
π€ Bleeping Computer | https://www.bleepingcomputer.com/news/security/new-indonesianfoods-worm-floods-npm-with-100-000-packages/
Critical Vulnerabilities & Active Exploitation β οΈ
- A critical path traversal vulnerability (CVE-2025-64446) in Fortinet FortiWeb web application firewalls is under active, widespread exploitation. Attackers are using a publicly available PoC to create new administrative accounts on exposed devices without authentication. Fortinet silently patched this in version 8.0.2, and CISA has added it to its Known Exploited Vulnerabilities Catalog, urging immediate patching.
- ASUS has released firmware updates for several DSL series routers (DSL-AC51, DSL-N16, DSL-AC750) to fix a critical authentication bypass flaw (CVE-2025-59367). This vulnerability allows remote, unauthenticated attackers to gain full control. Users unable to update should disable internet-facing services like remote access, port forwarding, and VPN server.
- Researchers discovered critical Remote Code Execution (RCE) vulnerabilities in major AI inference engines from Meta (Llama), Nvidia (TensorRT-LLM), Microsoft (Sarathi-Serve), and open-source projects like vLLM and SGLang. These "ShadowMQ" flaws stem from insecure deserialization of data via ZeroMQ and Python's pickle module, often due to code reuse, potentially allowing arbitrary code execution.
- Kubernetes maintainers have decided to retire Ingress NGINX by March 2026 due to persistent security flaws and maintenance challenges. This popular ingress controller, found in around 6,000 implementations, has been problematic, with serious vulnerabilities allowing cluster takeover identified as recently as March 2025. Admins should plan migration to alternatives.
π€ Bleeping Computer | https://www.bleepingcomputer.com/news/security/fortiweb-flaw-with-public-poc-actively-exploited-to-create-admin-users/
π΅πΌ The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/14/fortinet_active_exploit_cve_2025_64446/
π€ Bleeping Computer | https://www.bleepingcomputer.com/news/security/asus-warns-of-critical-auth-bypass-flaw-in-dsl-series-routers/
π¨ The Hacker News | https://thehackernews.com/2025/11/researchers-find-serious-ai-bugs.html
π΅πΌ The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/14/nginx_retirement/
Threat Landscape Commentary π
- The retail industry is facing a growing cybersecurity crisis, with breaches costing millions and eroding customer trust. The core issue isn't just about more technology, but a lack of executive-level cybersecurity leadership and a failure to treat cyber as a core strategic priority.
- The National Retail Federation (NRF) is urged to establish a dedicated cybersecurity talent incubator. This program would develop executive-ready leaders who understand both technical threats and the specific operational pressures retailers face, bridging the gap between academic expertise and industry needs.
- The initiative would offer six-month programs for graduates and modular training for junior roles, with placements across the NRF's network, aiming to foster a sector-wide mindset shift towards long-term strategic investment in cybersecurity talent.
π€« CyberScoop | https://cyberscoop.com/retail-cybersecurity-crisis-nrf-leadership-talent-pipeline-op-ed/
Regulatory Issues & Data Privacy π
- Google has backpedaled on its controversial Android developer verification rules following widespread backlash from users and developers. Originally intended to block malware from sideloaded apps, the revised rules will now offer options for limited app distribution without full verification and an "advanced flow" for power users to sideload unverified apps with warnings.
- The initial plan was criticised for potentially consolidating power and threatening open ecosystems like F-Droid.
- The revised verification process will open for early access in November 2025, with a phased global rollout of mandatory verification starting in September 2026 for specific regions.
π€ Bleeping Computer | https://www.bleepingcomputer.com/news/google/google-backpedals-on-new-android-developer-registration-rules/
Government Actions Against Cybercrime ποΈ
- US federal authorities have established a new "Scam Center Strike Force" to combat Chinese cryptocurrency scam networks, often known as "pig butchering" or "romance baiting." These scams defraud Americans of nearly $10 billion annually, with operators often working from criminal compounds in Southeast Asia.
- The strike force focuses on tracing and seizing illicit crypto funds, already recovering over $401 million and initiating forfeiture for an additional $80 million. They also coordinate with international partners and have sanctioned groups and firms linked to these operations.
- A suspected Russian hacker, potentially Aleksey Lukashev (a GRU officer wanted by the FBI for 2016 US election interference), has been detained in Phuket, Thailand, at the request of the US. He faces possible extradition on cybercrime charges, with Thai police seizing laptops, phones, and digital wallets.
- The Justice Department announced five guilty pleas related to North Korea's long-running IT worker scam, which defrauded 136 US companies of $2.2 million and involved 18 stolen US identities. The DOJ also seized over $15 million in cryptocurrency from North Korean facilitators, linked to APT38 (Lazarus Group) and several major crypto thefts in 2023.
π€ Bleeping Computer | https://www.bleepingcomputer.com/news/security/us-announces-new-strike-force-targeting-chinese-crypto-scammers/
ποΈ The Record | https://therecord.media/russian-hacker-detained-thailand-possible-us-extradition
ποΈ The Record | https://therecord.media/multiple-us-nationals-guilty-pleas-north-korean-it-worker-scams
#CyberSecurity #ThreatIntelligence #Ransomware #Malware #Vulnerability #ActiveExploitation #ZeroDay #AI #NationState #DataBreach #Cybercrime #InfoSec #IncidentResponse #SupplyChainSecurity #CloudSecurity
