It's been a busy 24 hours in the cyber world with significant updates on recent attacks, actively exploited vulnerabilities, new malware campaigns, and a reminder about the ever-evolving privacy landscape. Let's take a look:

Kyowon Group Hit by Suspected Ransomware ⚠️
- South Korea's Kyowon Group, a major education and lifestyle company, shut down parts of its network after identifying a suspected ransomware attack.
- The company confirmed an extortion demand and is investigating potential data leakage, including sensitive customer information, possibly affecting millions.
- This incident follows other high-profile data breaches in South Korea, prompting pledges for stronger data protection laws.

🗞️ The Record | https://therecord.media/kyowon-group-south-korea-suspected-ransomware-attack

Dutch Port Hacked for Cocaine Smuggling 🚨
- A Dutch appeals court upheld a seven-year prison sentence for a man who hacked port IT systems using malware-stuffed USB sticks to aid cocaine smugglers.
- The attacker gained months of remote access, exploring the network and hunting for admin rights, even live-blogging the break-in via encrypted chats.
- The case highlights the real-world impact of cyber intrusions facilitating organised crime, with the hack directly enabling a 210 kg cocaine shipment.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/13/dutch_port_hacker_appeal/

Black Axe Leaders Arrested in Spain 🕵️
- Spanish police, supported by Europol, arrested 34 alleged cybercriminals, including leaders of the transnational Black Axe organisation, across four cities.
- Black Axe is known for business email compromise (BEC) scams, money laundering, and vehicle trafficking, with estimated fraud exceeding $6.9 million.
- The operation froze $139,000 in bank accounts and seized cash, vehicles, and devices, significantly disrupting the hierarchical, Nigerian-led group.

🤫 CyberScoop | https://cyberscoop.com/black-axe-disruption-arrests-spain/

Supreme Court Filing System Hack 🏛️
- A Tennessee man is expected to plead guilty to a misdemeanor charge for hacking into the U.S. Supreme Court’s electronic case filing system on 25 occasions between August and October 2023.
- Nicholas Moore, 24, "intentionally accessed a computer without authorization," though details on the specific information accessed were not released.
- This incident underscores ongoing vulnerabilities in federal judicial systems, which have seen strengthened protections following sophisticated cyberattacks.

🗞️ The Record | https://therecord.media/guilty-plea-hacking-supreme-court-case-filing-system

Malicious Chrome Extension Steals MEXC API Keys 💰
- A malicious Google Chrome extension, "MEXC API Automator," is actively stealing API keys from the MEXC cryptocurrency exchange by masquerading as a trading tool.
- The extension programmatically creates new API keys with withdrawal permissions, hides these permissions in the UI, and exfiltrates the keys to a Telegram bot.
- This attack leverages an already authenticated browser session, bypassing traditional authentication, and grants attackers unfettered access to victims' crypto accounts.

📰 The Hacker News | https://thehackernews.com/2026/01/malicious-chrome-extension-steals-mexc.html

Gogs Zero-Day Under Active Exploitation 🛡️
- CISA has added CVE-2025-8110, a high-severity path traversal vulnerability in the Gogs self-hosted Git service, to its KEV catalog due to active exploitation.
- The flaw allows authenticated users to bypass previous fixes (CVE-2024-55947) by exploiting symbolic link handling in the PutContents API, leading to remote code execution.
- With no official patch yet, federal agencies are mandated to apply mitigations by February 2, 2026, or cease using Gogs, while other users should disable open registration and restrict access.

📰 The Hacker News | https://thehackernews.com/2026/01/13/cisa-warns-of-active-exploitation-of.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/13/cisa_gogs_exploit/

ServiceNow AI Platform Critical Flaw 🔒
- ServiceNow patched CVE-2025-12420, a critical 9.3 CVSS vulnerability in its AI Platform, allowing unauthenticated users to impersonate others and perform arbitrary actions.
- The flaw stemmed from a universal credential ("servicenowexternalagent") and lack of password/MFA for user identity verification, which could lead to full platform takeover.
- Although no in-the-wild exploitation has been confirmed, the vulnerability was deemed the "most severe AI-driven vulnerability to date" due to ServiceNow's deep integration across enterprise IT.

📰 The Hacker News | https://thehackernews.com/2026/01/servicenow-patches-critical-ai-platform.html
🌑 Dark Reading | https://www.darkreading.com/remote-workforce/ai-vulnerability-servicenow

AI/ML Python Libraries RCE Vulnerabilities 🐍
- Vulnerabilities in popular AI/ML Python libraries (Nvidia's NeMo, Salesforce's Uni2TS, Apple/EPFL VILAB's FlexTok) allow remote code execution via poisoned metadata.
- The flaws exploit Hydra's instantiate() function, which can execute arbitrary callables, enabling attackers to hide malicious code in model metadata that runs automatically upon loading.
- Patches have been issued for NeMo (CVE-2025-23304) and Uni2TS (CVE-2026-22584), with FlexTok also fixed, urging users to only load models from trusted sources.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/13/ai_python_library_bugs_allow/

Kremlin-linked Hackers Target Ukraine Military 🪖
- CERT-UA reports a new cyber-espionage campaign by Void Blizzard (UAC-0190) targeting Ukraine's military personnel using a novel PluggyApe malware.
- Attackers impersonate charitable organisations and use messaging apps like Signal and WhatsApp to deliver password-protected malicious executables.
- This campaign highlights a shift towards highly tailored social engineering, leveraging trusted communication channels and detailed target knowledge to deliver malware.

🗞️ The Record | https://therecord.media/kremlin-linked-hackers-pose-as-charities-spy-ukraine

SHADOW#REACTOR Delivers Remcos RAT 👻
- A new campaign, SHADOW#REACTOR, uses an evasive multi-stage Windows attack chain to deploy the Remcos RAT for persistent remote access.
- The infection leverages obfuscated VBS launchers, PowerShell downloaders, fragmented text-based payloads, and a .NET Reactor-protected loader to complicate detection.
- This broad, opportunistic activity, likely by initial access brokers, abuses LOLBins like MSBuild.exe and employs self-healing mechanisms to ensure payload delivery.

📰 The Hacker News | https://thehackernews.com/2026/01/new-malware-campaign-delivers-remcos.html

AsyncRAT Campaign Abuses Cloudflare & Python ☁️
- An emerging phishing campaign is delivering AsyncRAT by exploiting Cloudflare's free-tier services (TryCloudflare tunneling) and legitimate Python downloads.
- Attackers use Dropbox links with double-extension files (.pdfurl) in phishing emails, installing a full Python environment to inject code into explorer.exe.
- This technique masks malicious activity under trusted domains and legitimate tools, making detection challenging and highlighting the ongoing effectiveness of phishing and abuse of legitimate services.

🌑 Dark Reading | https://www.darkreading.com/endpoint-security/attackers-abuse-python-cloudflare-deliver-asyncrat

AVCheck Malware Kingpin Arrested 🚫
- Dutch police arrested a 33-year-old man at Amsterdam's Schiphol Airport, believed to be the mastermind behind the AVCheck online platform.
- AVCheck was a counter-antivirus (CAV) service, shuttered in May by Operation Endgame, that allowed cybercriminals to test malware against various AV products to evade detection.
- The arrest underscores ongoing international law enforcement efforts to dismantle critical components of the cybercrime ecosystem.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/13/avcheck_arrest/

North Korea's IT Worker & Crypto Theft Schemes 🇰🇵
- The U.S. urged UN member states to take tougher action against North Korea's IT worker scheme and cryptocurrency heists, which fund its weapons programs.
- A 140-page report highlights that over 40 countries are impacted, with North Korean IT workers stealing identities to secure remote jobs and laundered crypto funds exceeding $2 billion last year.
- China and Russia were criticised for providing safe havens, with 1,500 North Korean IT workers estimated in China alone, violating UN Security Council Resolutions.

🗞️ The Record | https://therecord.media/40-countries-impacted-nk-it-thefts-united-nations

India's Strict Crypto KYC/AML Rules 🇮🇳
- India's Financial Intelligence Unit (FIU-IND) updated regulations for crypto service providers, requiring strict client due diligence for all serving Indian residents, even offshore.
- New rules mandate collecting identity documents, bank details, occupation, income, and crucially, "Latitude and longitude coordinates of the onboarding location with date and timestamp along with IP address," plus a selfie.
- These measures aim to combat fraud, money laundering, and terrorism financing in the anonymous and instantaneous crypto transaction landscape.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/13/india_crypto_kyc_aml_update/

US Cyber Command Leadership Shake-up 🇺🇸
- Air Force Lt. Col. Jason Gargan, commander of a Cyber National Mission Force task force aligned against Russia, was "relieved for cause" due to operational disagreements.
- This unusual dismissal highlights a "loss of trust and confidence" in command ability, with Gargan now expected to retire by the end of 2026.
- The incident occurs amidst other top-rank changes at Cyber Command, which has been without a Senate-confirmed leader for over nine months.

🗞️ The Record | https://therecord.media/senior-military-cyber-op-removed-russia-task-force

US Cyber Offense vs. Defense Debate ⚖️
- A House Homeland Security subcommittee debated the U.S. approach to cyber deterrence, with some lawmakers warning against expanding offensive cyber operations before strengthening defenses.
- Concerns were raised about CISA losing one-third of its workforce and the potential for offensive actions to provoke retaliation if U.S. networks are not adequately defended.
- While acknowledging the importance of offense, experts suggested a hybrid approach where the private sector supports government offensive operations, with CISA coordinating and receiving legal protections.

🤫 CyberScoop | https://cyberscoop.com/us-offensive-cyber-operations-defense-cisa-workforce-house-homeland-security-committee/

Mandiant's Salesforce Security Tool 🛠️
- Mandiant has open-sourced AuraInspector, a tool designed to help Salesforce admins detect misconfigurations in Aura (Experience Cloud sites) that could expose sensitive data.
- The tool targets access control issues, such as unauthenticated users gaining access to Salesforce Account object records, and can bypass 2,000-record limits via GraphQL API abuse.
- AuraInspector automates potential abuse techniques and remediation strategies, providing read-only operations to identify damaging misconfigurations without modifying Salesforce instances.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/13/mandiant_salesforce_tool/

#CyberSecurity #ThreatIntelligence #Ransomware #Vulnerability #ZeroDay #RCE #Malware #APT #NationState #Cybercrime #DataPrivacy #InfoSec #IncidentResponse #CloudSecurity #AI #BrowserSecurity #KYC #AML

Alright team, it's been a busy 24 hours in the cyber world with a slew of critical vulnerabilities, some intriguing AI security research, and ongoing debates around data privacy. Let's dive into the details:

Recent Cyber Attacks & Breaches ⚠️

- A new "Boto Cor-de-Rosa" campaign is using WhatsApp as a distribution vector for the Astaroth banking trojan in Brazil. The Python-based malware auto-sends malicious ZIP files to contacts, spreading like a worm and monitoring web activity for banking credentials.
- Spanish airline Iberia confirmed a data breach, linking it to a November incident where the Zestix (aka Sentap) threat actor used infostealer malware to compromise an employee's ShareFile instance, exfiltrating 77 GB of technical aircraft data and some customer PII.
- Taiwan's National Security Bureau reported a tenfold increase in Chinese cyberattacks on its energy sector in 2025, with over 960 million intrusion attempts targeting nine critical sectors by groups like BlackTech and APT41.
- Cybersecurity firm Resecurity successfully trapped threat actors claiming affiliation with Scattered LAPSUS$ Hunters (SLH) in a honeypot, observing over 188,000 data dump requests, though SLH has since ramped up recruitment efforts.

📰 The Hacker News | https://thehackernews.com/2026/01/whatsapp-worm-spreads-astaroth-banking.html
🗞️ The Record | https://therecord.media/spanish-airline-attributes-recent-breach-allegation-to-nov-incident
📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-rustfs-flaw-iranian.html

Vulnerabilities & Active Exploitation 🚨

- A maximum-severity (CVSS 10.0) unauthenticated RCE vulnerability, CVE-2026-21858 (dubbed "ni8mare"), has been disclosed in the n8n automation platform. This flaw allows attackers to execute arbitrary code and gain full control without credentials, and active scanning for vulnerable instances is now being observed.
- CISA has added two critical flaws to its KEV catalog: CVE-2025-37164 (CVSS 10.0) in HPE OneView, a code injection vulnerability now actively exploited, and CVE-2009-0556 (CVSS 8.8) in Microsoft Office PowerPoint, a 15-year-old bug still targeting unpatched systems.
- Attackers are actively exploiting CVE-2026-0625 (CVSS 9.3), a zero-day command injection vulnerability in multiple discontinued D-Link DSL gateway devices. This flaw allows remote code execution via improper input validation in DNS server settings, underscoring the risk of end-of-life hardware.
- High-severity flaws include CVE-2025-64496 (CVSS 7.3) in Open WebUI, allowing account takeover and potential RCE, and CVE-2025-68433/CVE-2025-68432 (CVSS 7.8) in Zed IDE, enabling arbitrary code execution via malicious repositories or LSP configurations.
- A critical (CVSS 9.8) hard-coded static gRPC authentication token in RustFS versions alpha.13-alpha.77 allows privileged operations for any network-accessible attacker.
- Cisco patched CVE-2026-20029 (CVSS 4.9), an XML External Entity (XXE) vulnerability in ISE and ISE-PIC, allowing authenticated attackers to read arbitrary files. A public PoC exists, urging immediate patching due to nation-state interest in networking devices.
- Threat actors are exploiting CVE-2024-36401, a known GeoServer vulnerability, to distribute XMRig cryptocurrency miners and other malware via PowerShell commands.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/08/n8n_rce_bug/
🤫 CyberScoop | https://cyberscoop.com/n8n-critical-vulnerability-massive-risk/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/08/cisa_oneview_powerpoint_bugs/
📖 Dark Reading | https://www.darkreading.com/cyberattacks-data-breaches/attackers-exploit-zero-day-end-of-life-d-link-routers
📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-rustfs-flaw-iranian.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/08/rcisco_ise_bug_poc/

New Threat Research: Ransomware, Malware & AI Security 🤖

- Ransomware attacks surged over 50% in 2025, with more than 8,000 victims appearing on leak sites, despite law enforcement efforts. The landscape is fragmented, with smaller groups and affiliates quickly re-emerging, increasingly relying on social engineering and stolen credentials.
- Criminals are actively using AI-assisted coding ("vibe coding") to develop malware, with direct API calls to LLMs observed within malicious code. While AI-generated malware can contain errors, the speed of development outpaces security teams, necessitating robust security controls like Palo Alto Networks' SHIELD framework.
- Radware researchers uncovered "ZombieAgent," a new prompt injection attack against ChatGPT that bypasses existing defences to exfiltrate data character by character using static URLs and abuses ChatGPT's memory for persistence.
- IBM's AI coding agent "Bob" is vulnerable to prompt injection, allowing malware execution via its CLI, especially when "always allow" is enabled for commands. Researchers demonstrated how malicious README.md files can trick Bob into running harmful commands due to porous defences against command and process substitution.
- Iranian nation-state group MuddyWater is evolving, deploying custom backdoors like Phoenix and UDPGangster via phishing, moving away from commercial RMM tools. Concurrently, the pkr_mtsi Windows packer is being used in malvertising campaigns to distribute various malware families, including stealer and RATs, with sophisticated obfuscation.
- ANY.RUN detailed GravityRAT, a multi-platform RAT active since 2016, attributed to Pakistan's Transparent Tribe. It harvests sensitive data, including WhatsApp backups, and employs extensive anti-analysis techniques, spreading via spear-phishing or disguised apps.
- The number of Phishing-as-a-Service (PhaaS) toolkits doubled in 2025, driving 90% of high-volume phishing campaigns. These kits offer advanced anti-analysis, MFA bypass, and stealth, lowering the barrier for attackers using themes like fake payments and HR messages.
- ownCloud urged users to enable MFA after reports of threat actor Zestix (aka Sentap) auctioning data from 50 global enterprises, exploiting compromised credentials where MFA was absent on cloud file-sharing services.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/08/ransomware_2025_emsisoft/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/08/criminals_vibe_coding_malware/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/08/openai_chatgpt_prompt_injection/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/07/ibm_bob_vulnerability/
📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-rustfs-flaw-iranian.html
📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-rustfs-flaw-iranian.html
📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-rustfs-flaw-iranian.html

Data Privacy & Regulatory Issues ⚖️

- UK regulators (Ofcom, ICO) are investigating X and xAI after reports that Grok, its AI chatbot, generated nonconsensual sexual imagery, including child abuse images, raising serious concerns under the Online Safety Act.
- OpenAI's new ChatGPT Health feature, which allows connecting medical records and wellness app data, is drawing significant privacy concerns. Critics warn that this data is not protected by HIPAA, and OpenAI's terms could change, potentially leveraging sensitive health data for profit.
- OpenAI has been ordered to turn over 20 million anonymised ChatGPT logs in a US consolidated AI copyright case, where news publishers allege their copyrighted works were used for training without consent.
- Bryan Fleming, founder of the pcTattletale stalkerware, pleaded guilty to operating the app, which covertly spied on users and suffered a breach exposing 138,000 users' data. This marks a rare criminal prosecution for stalkerware purveyors.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/08/uk_regulators_swarm_x_after/
🤫 CyberScoop | https://cyberscoop.com/elon-musk-x-grok-deepfake-crisis-section-230/
🗞️ The Record | https://therecord.media/chatgpt-health-draws-concern-privacy-critics
📰 The Hacker News | https://thehackernews.com/2026/01/openai-launches-chatgpt-health-with.html
📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-rustfs-flaw-iranian.html

Government Staffing & Program Changes 🇺🇸

- The NSA's cybersecurity directorate has new acting leadership, with David Imbordino taking over as acting chief and Holly Baroody as acting deputy. The directorate has been without a permanent head for over nine months.
- The Trump administration is withdrawing the US from several international cybersecurity organisations, including the Global Forum on Cyber Expertise, citing redundancy and threats to US sovereignty. Critics fear this will create a leadership vacuum and erode global cyber coordination.

🗞️ The Record | https://therecord.media/nsa-cyber-directorate-new-acting-leadership
🤫 CyberScoop | https://cyberscoop.com/trump-pulls-us-out-of-international-cyber-orgs/

Industry News 💰

- CrowdStrike is acquiring identity management startup SGNL for nearly $740 million, aiming to enhance its identity security portfolio with dynamic, automated "just-in-time" access controls for diverse identities, including AI agents.

🤫 CyberScoop | https://cyberscoop.com/crowdstrike-sngl-deal-740-million/

Everything Else 🌐

- Cloudflare has debunked a theory that US cyberattacks on Venezuela coincided with BGP "weirdness" in January. While a BGP leak was confirmed, Cloudflare attributes it to mundane routing issues, stating it would be an ineffective method for a man-in-the-middle attack.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/08/cloudflare_venezuela_bgp_attack_theory/

#CyberSecurity #ThreatIntelligence #Vulnerabilities #RCE #ZeroDay #AI #Ransomware #Malware #DataPrivacy #InfoSec #CyberAttack #IncidentResponse #NationState #Regulatory

It's been a pretty packed 24 hours in the cyber world, with some critical RCE vulnerabilities under active exploitation, a string of significant breaches impacting UK public sector and a major car manufacturer, and important reminders about MFA. Let's dive in:

Critical RCEs Under Active Exploitation & Patches ⚠️
- Legacy D-Link DSL Routers (CVE-2026-0625): A critical command injection flaw (CVSS 9.3) in the "dnscfg.cgi" endpoint of legacy D-Link DSL gateway routers is being actively exploited. This allows unauthenticated remote attackers to execute arbitrary shell commands, leading to RCE and potential DNS hijacking. Many affected models (DSL-2640B, DSL-2740R, DSL-2780B, DSL-526B) are End-of-Life, meaning no patches are coming – upgrade immediately!
- Veeam Backup & Replication (CVE-2025-59470): Veeam has patched a critical RCE vulnerability (CVSS 9.0, rated high by Veeam due to privilege requirements) in Backup & Replication 13.0.1.180 and earlier. This flaw allows Backup or Tape Operators to achieve RCE as the postgres user. Given VBR's popularity and past targeting by ransomware gangs (Cuba, FIN7, Frag, Akira, Fog), patching is crucial.
- n8n Workflow Automation (CVE-2026-21858): A maximum severity (CVSS 10.0) "Ni8mare" vulnerability in n8n, an open-source workflow automation tool, allows remote, unauthenticated attackers to hijack instances. The flaw is a content-type confusion in how n8n parses data, enabling arbitrary file reading and potential secret exposure or command execution. Over 100,000 vulnerable servers are estimated; update to n8n version 1.121.0 or newer, and restrict public webhook/form endpoints.

📰 The Hacker News | https://thehackernews.com/2026/01/active-exploitation-hits-legacy-d-link.html
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/new-veeam-vulnerabilities-expose-backup-servers-to-rce-attacks/
🤫 CyberScoop | https://cyberscoop.com/veeam-backup-replication-security-flaw-remote-code-execution-fix/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/max-severity-ni8mare-flaw-lets-hackers-hijack-n8n-servers/

Major Cyber Incidents and Breaches 🚨
- Jaguar Land Rover (JLR): A September cyberattack, claimed by Scattered Lapsus$ Hunters, severely impacted JLR's Q3 fiscal 2026 results, causing wholesale volumes to plummet by 43.3% and retail sales by 25.1%. The incident halted production for weeks, disrupted global supply chains, and cost the UK economy an estimated £2.1 billion.
- UK Ministry of Justice (MoJ) / Legal Aid Agency (LAA): Despite spending £50 million on cybersecurity, the LAA suffered a "highly sensitive" cyberattack in December 2024 that went undetected until April 2025. The breach compromised legal aid applicant data, causing significant operational disruption and financial overpayments to providers, with recovery expected to take years.
- European Space Agency (ESA): ESA has confirmed another significant security breach, with Scattered Lapsus$ Hunters claiming to have stolen 500 GB of sensitive data, including operational procedures, spacecraft details, and proprietary contractor data (from partners like SpaceX, Airbus). The group alleges the vulnerability remains open, giving them continued access. This follows a December incident where 200 GB of ESA data was listed for sale.
- Higham Lane School: A cyberattack over the Christmas holiday has forced a British high school to delay its reopening, with its entire IT system, including phones, emails, and management systems, taken offline. This follows over 80 ransomware attacks on the UK education sector in 2024.
- Illinois Department of Human Services (IDHS): The IDHS inadvertently exposed personal data of over 700,000 state residents for up to four years by posting it on public mapping websites. The exposed data, including names, addresses, and public benefits status, is protected health information under HIPAA.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/07/jlr_wholesale_volumes/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/07/legal_aid_agency_attack/
🗞️ The Record | https://therecord.media/cyberattack-forces-british-high-school-to-delay-opening
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/07/european_space_agency_breach_criminal_probe/
🗞️ The Record | https://therecord.media/illinois-agency-exposed-data

Threat Actor Activity & Nation-State Operations ⚔️
- DDoSia Hacktivist Tool: Pro-Russian hacktivist group NoName057(16) is leveraging its custom DDoS tool, DDoSia, to conduct sustained, politically motivated attacks against Ukrainian and Western interests. The tool allows volunteers with minimal technical skill to participate in coordinated application-layer and multi-vector DDoS campaigns, often coinciding with geopolitical events.
- China's Cyber Offensive on Taiwan: Taiwan's National Security Bureau reported a 6% increase in Chinese cyberattacks in 2025, with 2.63 million intrusion attempts daily targeting government and critical infrastructure, particularly energy and hospitals. These attacks, often exploiting software/hardware vulnerabilities, are linked to China's political and military coercive actions.

⚫ Dark Reading | https://www.darkreading.com/cyberattacks-data-breaches/ddosia-powers-volunteer-driven-hacktivist-attacks
🤫 CyberScoop | https://cyberscoop.com/taiwan-china-cyberattacks-2025-energy-hospitals-nsb-report/

The Critical Need for MFA 🔒
- ownCloud Credential Theft: File-sharing platform ownCloud is urging its 200 million users to enable Multi-Factor Authentication (MFA) after reports of credential theft. Threat actors, like "Zestix" or "Sentap," are using infostealer malware (RedLine, Lumma, Vidar) to compromise employee devices, then leveraging stolen credentials to access ownCloud, ShareFile, and Nextcloud instances that lack MFA.
- Widespread Cloud Credential Heist: A report by Hudson Rock highlights a "pervasive failure in credential hygiene," where a single threat actor has breached dozens of global organisations by using infostealer-harvested credentials against cloud collaboration platforms without MFA. This underscores that simple security failures, not zero-days, are often the root cause of significant breaches.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/owncloud-urges-users-to-enable-mfa-after-credential-theft-reports/
⚫ Dark Reading | https://www.darkreading.com/cloud-security/lack-mfa-common-thread-vast-cloud-credential-heist

Regulatory Actions & Legal Outcomes ⚖️
- FCC Robocall Penalties: The US Federal Communications Commission (FCC) has finalised new financial penalties for telecoms that submit false, inaccurate, or late reporting to its Robocall Mitigation Database (RMD). Fines include $10,000 for false information and $1,000 for late updates, aiming to combat call spoofing and illegal robocalls. Two-factor authentication has also been added to the RMD.
- Stalkerware Prosecution: Bryan Fleming, creator of the pcTattletale stalkerware, has pleaded guilty in US federal court to selling software designed to intercept communications. This marks only the second successful prosecution of a stalkerware operator since 2014, highlighting a rare but significant legal victory against consumer spyware.

🤫 CyberScoop | https://cyberscoop.com/fcc-finalizes-new-penalties-for-robocall-violators/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/07/stalkerware_slinger_pleads_guilty/
🗞️ The Record | https://therecord.media/stalkerware-guilty-plea-fleming

UK Public Sector Cyber Defence Boost 🛡️
- The UK government has unveiled a new £210 million ($283 million) "Government Cyber Action Plan" to bolster cyber defences across its departments and the wider public sector. The plan includes establishing a dedicated Government Cyber Unit, setting minimum security standards, improving risk visibility, and promoting best practices through a new Software Security Ambassador Scheme. This follows recent legislation to protect critical infrastructure and a ban on ransomware payments for public sector organisations.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/uk-announces-plan-to-strengthen-public-sector-cyber-defenses/

Cyber Landscape Commentary 💭
- AI and the Cybersecurity Workforce: Qualys CEO Sumedh Thakar argues that the cybersecurity industry cannot simply hire its way out of the talent shortage in the AI era. Instead, organisations must leverage AI to automate repetitive tasks and shift towards a proactive Risk Operations Center (ROC) model. He also warns that AI-generated code often contains security flaws, necessitating embedded security in development pipelines.
- Cyber in Military Operations: Speculation surrounds the role of US Cyber Command in a recent military operation in Venezuela that led to the capture of President Nicolás Maduro. While President Trump hinted at "certain expertise" causing power outages, NetBlocks data suggests kinetic attacks could also be responsible. Experts note Venezuela's network infrastructure is a "soft target" for cyber operations.

🤫 CyberScoop | https://cyberscoop.com/cybersecurity-talent-shortage-ai-risk-operations-center-2026-op-ed/
⚫ Dark Reading | https://www.darkreading.com/cybersecurity-operations/cyberattacks-part-military-operation-venezuela/

Other Noteworthy Developments 💡
- HackerOne Bug Bounty Delays: A security researcher, Jakub Ciolek, reported being "ghosted" by HackerOne for months over an $8,500 bug bounty for two high-severity DoS flaws (CVE-2025-59538, CVE-2025-59531) in Argo CD. HackerOne attributed the delay to an "operational backlog," raising concerns about trust and communication in bug bounty programs, especially with increasing AI-generated submissions.
- Microsoft Exchange Online Spam Clamp Scrapped: Microsoft has reversed its controversial plan to impose a 2,000 external recipient rate limit on Exchange Online mailboxes, following significant customer backlash. While the aim was to curb spam and abuse, the limits created operational challenges for legitimate bulk sending. Microsoft plans to develop "smarter, more adaptive approaches."
- Cyber Scam Kingpin Arrested: Cambodian authorities have arrested and extradited to China Chen Zhi, head of the Prince Group conglomerate, who is alleged to be the mastermind behind a multi-billion dollar scam empire. Zhi and 128 entities linked to him were sanctioned by the US and UK for illegal online gambling, sextortion, money laundering, and the trafficking of enslaved workers.
- HSBC App Sideloading Issues: Some HSBC mobile banking customers in the UK are being locked out of the bank's app if they have the Bitwarden password manager installed via an open-source app catalog like F-Droid. HSBC's app security controls appear to flag sideloaded apps as a risk, preventing coexistence with its banking app.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/07/hackerone_ghosted_researcher/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/07/exchange_online_recipient_rate/
🗞️ The Record | https://therecord.media/alleged-cyber-scam-kingpin-cambodia-arrested-extradited
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/07/hsbc_bitwarden_sideloaded/

#CyberSecurity #ThreatIntelligence #Vulnerability #RCE #ActiveExploitation #ZeroDay #CyberAttack #Breach #Ransomware #DDoS #NationState #APT #MFA #CredentialTheft #DataPrivacy #Regulation #UKGov #AI #CyberWarfare #InfoSec

Alright team, it's been a pretty packed start to the year in cyber! We've got some interesting developments on active exploitation, new malware campaigns, and a couple of big names facing regulatory heat. Let's dive in:

Recent Cyber Attacks ⚠️

- Unleash Protocol, a decentralised IP platform, lost approximately $3.9 million in crypto due to an unauthorised smart contract upgrade, initiated by an external address gaining administrative control via multisig governance.
- A Lithuanian national was extradited to South Korea for infecting 2.8 million systems globally with clipboard-stealing malware, disguised as the KMSAuto Windows/Office activator, siphoning around $1.2 million in virtual assets.
- Amazon successfully blocked over 1,800 suspected North Korean operatives from infiltrating its workforce since April 2024, who were posing as IT workers or recruiters to steal credentials and source code, as DPRK crypto theft surged to $2 billion in 2025.

📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-ghostad-drain-macos.html

Actively Exploited Vulnerabilities 🛡️

- The RondoDox botnet has been actively exploiting the critical React2Shell (CVE-2025-55182, CVSS 10.0) RCE flaw in React Server Components and Next.js since December 2025, targeting IoT devices and web servers to deploy crypto miners and Mirai botnet variants.
- A coordinated campaign, primarily from Japan-based infrastructure, systematically exploited over 10 Adobe ColdFusion CVEs from 2023-2024 during Christmas 2025, leading to direct code execution, credential harvesting, and JNDI lookups.
- Researchers identified a 4-second window where AWS IAM eventual consistency allows attackers to leverage deleted access keys to create new ones, achieving persistence even after defenders believe credentials are revoked.

📰 The Hacker News | https://thehackernews.com/2026/01/rondodox-botnet-exploits-critical.html
📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-ghostad-drain-macos.html

New Threat Research & Malware Campaigns 🚨

- The GlassWorm supply chain campaign has resurfaced, now targeting macOS users with malicious Open VSX extensions (50,000 downloads) to steal funds from over 50 browser extension wallets, iCloud Keychain data, and developer credentials.
- OceanLotus (APT) is targeting China's Xinchuang initiative, exploiting CVE-2023-52076 (RCE in Atril document viewer) and deploying custom ELF Trojans specifically designed to bypass traditional Linux system checks on indigenous innovation platforms.
- The IPCola proxy network, offering 1.6 million IPs, is powered by the GaGaNode decentralised bandwidth monetization service, whose SDK contains a critical RCE vulnerability, enabling broad compromise of IoT, desktop, and mobile devices.
- Large-scale mobile adware campaigns, GhostAd (Android) and SkyWalk (iOS), are draining device resources and defrauding advertisers by running persistent background ad engines and serving invisible ads, respectively.
- Magecart attacks are evolving into full identity compromise, hijacking checkout and account creation flows with fake payment forms, phishing iframes, and anti-forensics techniques to steal credentials and personal information.
- A new cybercrime tool, ErrTraffic, automates "ClickFix" attacks by generating fake browser glitches on compromised websites, tricking users into installing information stealers or Android banking trojans.
- Kaspersky discovered 'Keenadu', a pre-installed backdoor in libandroid_runtime.so on certain Android tablet models, providing remote access for data exfiltration and command execution.

📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-ghostad-drain-macos.html

Threat Landscape & AI Concerns 🧠

- Reddit banned the r/ChatGPTJailbreak subreddit (229,000 users) for violating rules, highlighting ongoing challenges with LLM safety filters, prompt injections, and the potential for generating non-consensual deepfakes; poetic prompts were found to increase attack success rates fivefold.
- Research details "hacktivist proxy operations" where ideologically aligned non-state cyber groups conduct disruptive activities (DDoS, defacement) that align with state geopolitical interests, providing plausible deniability for the benefiting state.

📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-ghostad-drain-macos.html

Regulatory & Corporate Accountability ⚖️

- Reuters reported that Meta developed a "playbook" to mislead regulators about the prevalence of scam ads on its platform, by systematically deleting fraudulent ads from its Ad Library during regulatory searches.
- Disney agreed to pay a $10 million civil penalty to settle FTC allegations of violating children's privacy laws (COPPA) by misdesignating YouTube content, leading to unlawful data collection and targeted advertising without parental consent.

📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-ghostad-drain-macos.html

#CyberSecurity #ThreatIntelligence #Vulnerabilities #RCE #Botnet #Malware #APT #SupplyChain #Adware #AdFraud #CryptoScam #NationState #DPRK #AI #LLM #DataPrivacy #COPPA #RegulatoryCompliance #InfoSec #IncidentResponse

Alright team, it's been a pretty packed 24 hours in the cyber world! We've got a mix of significant breaches, an actively exploited vulnerability making waves, new insights into nation-state and cybercrime tradecraft, and some interesting discussions around AI security and regulation. Let's dive in:

Recent Cyber Attacks and Breaches ⚠️

Coinbase Insider Threat & Fraud 💸
- An ex-Coinbase customer service agent in India has been arrested for allegedly selling customer data to criminals, leading to social engineering scams and an attempted $20 million extortion against Coinbase.
- The stolen data included names, addresses, phone numbers, emails, IDs, and bank info for nearly 70,000 customers, though no 2FA codes or private keys were compromised.
- This highlights the critical risk of insider threats, especially in outsourced customer service operations, and the ongoing challenge of social engineering attacks targeting crypto users.
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/29/indian_cops_cuff_coinbase_exrep/

Coupang Data Breach & Compensation 🛍️
- South Korean retail giant Coupang is set to distribute $1.17 billion in compensation to 33.7 million customers affected by a data breach discovered in November.
- The breach, one of South Korea's largest, was traced to a 43-year-old Chinese former IT employee who retained system access after leaving the company, accessing 33 million accounts and retaining data from about 3,000.
- While the company claims the data was not transferred or further misused, the incident underscores the severe financial and reputational costs of insider threats and poor identity and access management.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/coupang-to-split-117-billion-among-337-million-data-breach-victims/

Korean Telco Femtocell Security Failure 📞
- Korea Telecom (KT) deployed thousands of femtocells with critical security flaws, including shared certificates, no root passwords, plaintext keys, and enabled SSH, leading to micropayment fraud and potential customer communication snooping.
- Attackers cloned femtocells, enabling them to read SMS messages and call logs, with one fake femtocell used for ten months, and a large gang involved in "war-driving" to find more phones.
- This incident exposes severe vulnerabilities in critical infrastructure, suggesting that the $169,000 in micropayment fraud might be a smokescreen for larger-scale surveillance, with one key even linked to a military base.
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/30/kt_telecom_femtocell_security_fail/

Cybersecurity Experts Plead Guilty to BlackCat Ransomware Attacks 🚨
- Two former cybersecurity incident response professionals, Ryan Goldberg (Sygnia) and Kevin Martin (DigitalMint), have pleaded guilty to conspiring to obstruct commerce by extortion using BlackCat (ALPHV) ransomware.
- They leveraged their expertise to breach multiple US organisations, demanding ransoms up to $10 million and receiving $1.27 million from one victim, with 20% going to ALPHV administrators.
- This shocking case highlights the severe risk of insider threats within the cybersecurity industry itself and the importance of due diligence when engaging third-party incident response firms.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/us-cybersecurity-experts-plead-guilty-to-blackcat-alphv-ransomware-attacks/
🗞️ The Record | https://therecord.media/ransomware-responders-guilty-plea-using-alphv-blackcat-us-attacks

European Space Agency Confirms External Server Breach 🛰️
- The European Space Agency (ESA) has confirmed a breach of "external servers" containing unclassified information related to collaborative engineering activities, following claims by a threat actor on BreachForums.
- The attackers claim to have stolen over 200GB of data, including source code, CI/CD pipelines, API tokens, and hardcoded credentials, after accessing ESA's JIRA and Bitbucket servers for a week.
- While ESA states the impact is limited to a "very small number of external servers" and unclassified data, the nature of the stolen data (source code, API tokens) suggests potential for further compromise or intellectual property theft.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/european-space-agency-confirms-breach-of-external-servers/

Vulnerabilities Under Active Exploitation 🛡️

MongoBleed (CVE-2025-14847) Under Active Exploitation ⚠️
- A high-severity information-disclosure vulnerability, CVE-2025-14847 (dubbed "MongoBleed"), affecting many default MongoDB versions, is now under active exploitation in the wild.
- The flaw, stemming from mismatched length fields in zlib-compressed protocol headers, allows unauthenticated attackers to leak server memory, potentially exposing sensitive data like credentials, API keys, and PII.
- CISA has added MongoBleed to its Known Exploited Vulnerabilities Catalog, ordering federal agencies to patch by January 19, 2026, with estimates of 74,000 to 87,000 internet-exposed vulnerable instances globally. If immediate patching isn't possible, disabling zlib compression is advised.
🤫 CyberScoop | https://cyberscoop.com/mongobleed-vulnerability-mongodb-exploitation/
🗞️ The Record | https://therecord.media/us-australia-bug-exploitation
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/cisa-orders-federal-agencies-to-patch-mongobleed-flaw-actively-exploited-in-attacks/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/30/mongodb_vuln_exploited_cve_2025_14847/

New Threat Research and Tradecraft 🔬

Mustang Panda Uses Kernel-Mode Rootkit for ToneShell Backdoor 🐼
- The Chinese state-sponsored group Mustang Panda (aka HoneyMyte or Bronze President) is deploying a new variant of its ToneShell backdoor using a previously undocumented kernel-mode rootkit driver.
- This rootkit, signed with a stolen or leaked certificate, registers as a mini-filter driver to evade user-mode monitoring, protect its files and processes, and interfere with Microsoft Defender, giving it high stealth and persistence.
- The evolved TTPs, including dynamic API resolution and network traffic obfuscation, highlight Mustang Panda's increasing sophistication in targeting government organisations in Southeast and East Asia, making memory forensics crucial for detection.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/chinese-state-hackers-use-rootkit-to-hide-toneshell-malware-activity/
📰 The Hacker News | https://thehackernews.com/2025/12/mustang-panda-uses-signed-kernel-driver.html

Silver Fox Targets India with ValleyRAT Malware 🦊
- The Chinese cybercrime group Silver Fox (aka SwimSnake) is now targeting Indian users with tax-themed phishing emails to distribute its modular ValleyRAT (Winos 4.0) remote access trojan.
- The sophisticated kill chain involves DLL hijacking via a legitimate executable (Thunder) and a Donut loader, performing anti-analysis checks before injecting ValleyRAT into explorer.exe.
- Silver Fox also uses SEO poisoning and fake application sites (e.g., Microsoft Teams, Signal) to spread ValleyRAT globally, demonstrating a multi-pronged approach for espionage, financial gain, and intelligence collection.
📰 The Hacker News | https://thehackernews.com/2025/12/silver-fox-targets-indian-users-with-tax-themed-emails-delivering-valleyrat-malware/

Zoom Stealer Browser Extensions Harvest Corporate Meeting Intelligence 🕵️‍♀️
- A campaign dubbed "Zoom Stealer," attributed to the China-linked threat actor DarkSpectre, is affecting 2.2 million Chrome, Firefox, and Edge users through 18 malicious browser extensions.
- These extensions, some functional as video downloaders or recorders, covertly collect sensitive meeting-related data (URLs, IDs, topics, embedded passwords, speaker info) from 28 video-conferencing platforms.
- The exfiltrated data, streamed in real-time, is likely used for corporate espionage, sales intelligence, and large-scale social engineering or impersonation operations, underscoring the need for careful extension permission review.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/zoom-stealer-browser-extensions-harvest-corporate-meeting-intelligence/

Threat Landscape Commentary 🗣️

OpenAI: Prompt Injection May Never Be 'Solved' for Browser Agents 🤖
- OpenAI warns that prompt injection is a central security risk for AI browser agents like ChatGPT Atlas, which operate within a web browser and can carry out tasks for users.
- Internal red-teaming uncovered new complex prompt-injection attacks, leading to a security update with an adversarially trained model and strengthened safeguards.
- The company acknowledges that prompt injection may never be fully mitigated, advising a focus on risk reduction and limiting impact, as content designed to persuade humans can now command AI agents.
🤫 CyberScoop | https://cyberscoop.com/openai-chatgpt-atlas-prompt-injection-browser-agent-security-update-head-of-preparedness/

Regulatory Issues 🏛️

Fragmented AI Regulation Poses Challenges ⚖️
- The rapid, uncoordinated expansion of state-level AI regulations in the US is creating a "patchwork regulatory landscape" that hinders responsible AI development and security.
- Conflicting definitions, compliance, and enforcement approaches across states disproportionately burden small and midsize companies, stifling innovation and allowing larger firms to gravitate towards less stringent rules.
- A unified federal framework is urgently needed to establish clear expectations for transparency, accountability, and responsible innovation, ensuring consistent safeguards and a more secure AI ecosystem.
🤫 CyberScoop | https://cyberscoop.com/ai-regulation-unified-federal-standards-needed-op-ed/

Sponsored Content 📈

Integrating AI into Modern SOC Workflows 📊
- Many SOCs struggle to operationalise AI, often treating it as a shortcut or applying it to ill-defined problems, with 40% using AI/ML tools informally and 42% without customisation.
- AI can reliably enhance SOC capabilities in detection engineering (for narrow, well-defined tasks), threat hunting (for exploration and pattern comparison), code development (for scaffolding), automation (for workflow drafting), and reporting (for standardisation and clarity).
- Successful AI adoption requires clear expectations, ongoing validation, and human accountability, with teams acting as "takers," "shapers," or "makers" to integrate AI effectively into existing workflows.
📰 The Hacker News | https://thehackernews.com/2025/12/how-to-integrate-ai-into-modern-soc.html

#CyberSecurity #ThreatIntelligence #Ransomware #NationState #APT #ZeroDay #Vulnerability #MongoBleed #AI #DataPrivacy #InfoSec #CyberAttack #Malware #IncidentResponse #MustangPanda #SilverFox #DarkSpectre

APT35 Sızıntısı: Siber casusluktan fiziksel suikast planlarına
#apt35 #CharmingKitten #İran #nationstate

https://webrecord.media/apt35-sizintisi-siber-casusluktan-fiziksel-suikast-planlarina/

It's been a bit quiet over the last 24 hours, so it'll be a short post today, but we do have a significant update on a long-standing Iranian threat actor. Let's dive in:

Iranian Infy APT Resurfaces with Advanced Tradecraft 🇮🇷

- The Iranian APT group Infy, also known as Prince of Persia, has resurfaced with new malware activity and updated tactics after nearly five years of silence, proving it remains active and dangerous.
- This elusive group, one of the oldest APTs dating back to 2004, is now using updated versions of its Foudre downloader and Tonnerre data exfiltrator, distributed via executables embedded in documents, targeting victims across multiple regions including Iran, Iraq, Turkey, India, Canada, and Europe.
- Key updates to their tradecraft include the use of a Domain Generation Algorithm (DGA) for resilient command-and-control (C2) infrastructure, RSA signature validation for C2 authenticity, and a unique mechanism within Tonnerre to communicate with a Telegram group for C2.

📰 The Hacker News | https://thehackernews.com/2025/12/iranian-infy-apt-resurfaces-with-new.html

#CyberSecurity #ThreatIntelligence #APT #NationState #Iran #Malware #Infy #PrinceOfPersia #InfoSec #CyberAttack #ThreatActor #TTPs

Alright team, it's been a busy 24 hours in the cyber world with significant updates on nation-state activity, a couple of actively exploited vulnerabilities, new malware campaigns, and some serious data privacy discussions. Let's dive in:

Recent Cyber Attacks & Breaches 🚨

- France's Interior Ministry is investigating a malicious cyber intrusion into its email servers, confirming unauthorised access to several accounts and dozens of confidential documents, including judicial records and wanted persons' data.
- Analytics vendor Mixpanel denies being the source of data stolen from Pornhub, stating the data was last accessed by a legitimate Pornhub employee account in 2023, not during Mixpanel's November 2025 security incident.
- Threat actors are exploiting WhatsApp's legitimate device-linking feature in a campaign dubbed "GhostPairing," tricking users with fake Facebook verification pages to link the attacker's browser to their WhatsApp account, gaining full conversation history access.
- European law enforcement has dismantled two Ukraine-based call centre networks responsible for over $13.7 million in scams, where criminals posed as police or bank employees to trick victims into transferring funds or installing remote access software.
- The FTC has ordered blockchain company Illusory Systems to distribute approximately $37.5 million in recovered funds to customers affected by the 2022 Nomad crypto platform hack, which saw $186 million stolen due to inadequately tested code.

🗞️ The Record | https://therecord.media/france-interior-ministry-email-breach-investigation
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/16/mixpanel_breach_leak_denial/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/whatsapp-device-linking-abused-in-account-hijacking-attacks/
🗞️ The Record | https://therecord.media/european-police-bust-ukraine-based-call-centers
🗞️ The Record | https://therecord.media/ftc-settlement-nomad-platform-return-customers-cryptocurrency

Vulnerabilities: Zero-Days & Active Exploitation 🛡️

- SonicWall has warned customers to patch a medium-severity local privilege escalation flaw (CVE-2025-40602) in its SMA1000 Appliance Management Console, which is being chained with a critical pre-authentication deserialisation flaw (CVE-2025-23006) for unauthenticated remote code execution with root privileges.
- The critical React2Shell vulnerability (CVE-2025-55182), an insecure deserialisation issue in React Server Components, is being actively exploited by a ransomware gang (Weaxor) to gain initial access and deploy encryptors in under a minute.
- System administrators should review Windows event logs and EDR telemetry for process creation from Node or React binaries, as well as unusual outbound connections or disabled security solutions, as patching alone might not be sufficient due to the speed of exploitation.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-sma1000-zero-day-exploited-in-attacks/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/critical-react2shell-flaw-exploited-in-ransomware-attacks/

New Threat Research: APTs, Malware & Tradecraft 🕵️‍♀️

- The Russian state-sponsored APT28 (BlueDelta) has been conducting a sustained credential-harvesting campaign targeting Ukrainian UKR.net webmail users since June 2024, using fake login pages on legitimate services like Mocky and shortened links in PDF attachments.
- Amazon security researchers report that Russia’s GRU (APT44/Sandworm) has shifted tactics since 2025, now primarily targeting misconfigured network edge devices in Western critical infrastructure, particularly the energy sector, instead of relying on novel vulnerabilities.
- China-linked threat actor Ink Dragon (Jewelbug) is increasingly targeting government entities in Europe, Southeast Asia, and South America, leveraging vulnerable web applications to deploy web shells, ShadowPad IIS Listener modules, and an updated FINALDRAFT backdoor for stealthy, long-term persistence and data exfiltration.
- Operation ForumTroll, an unknown threat actor, is targeting Russian scholars in political science and economics with personalised phishing emails disguised as eLibrary plagiarism reports, delivering the Tuoni C2 framework via malicious LNK files and PowerShell scripts.
- A new Android Malware-as-a-Service (MaaS) called Cellik is being advertised, offering the ability to embed itself into any Google Play Store app, stream screens, intercept notifications, exfiltrate files, and use a hidden browser mode.
- The "GhostPoster" malware has been found in 17 Firefox add-ons with over 50,000 downloads, using steganography in logo files to embed malicious JavaScript that hijacks affiliate links, injects tracking code, strips security headers, and performs ad/click fraud.
- Forensic researchers have discovered "ResidentBat," a previously unknown Android spyware, on a Belarusian journalist's phone, believed to have been installed during KGB detention and capable of accessing call logs, messages, microphone recordings, and files.

📰 The Hacker News | https://thehackernews.com/2025/12/apt28-targets-ukrainian-ukr-net-users.html
🗞️ The Record | https://therecord.media/russian-bluedelta-hackers-ran-phishing-ukraine-webmail
🗞️ The Record | https://therecord.media/russia-gru-hackers-target-energy-sector-sandworm
📰 The Hacker News | https://thehackernews.com/2025/12/china-linked-ink-dragon-hacks.html
📰 The Hacker News | https://thehackernews.com/2025/12/new-forumtroll-phishing-attacks-target.html
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/cellik-android-malware-builds-malicious-versions-from-google-play-apps/
📰 The Hacker News | https://thehackernews.com/2025/12/ghostposter-malware-found-in-17-firefox.html
🗞️ The Record | https://therecord.media/spyware-belarus-journalist-rsf

Data Privacy Concerns 🔒

- Four popular browser extensions (Urban VPN Proxy, 1ClickVPN Proxy, Urban Browser Guard, Urban Ad Blocker) have been caught harvesting text from AI chatbot conversations (ChatGPT, Claude, Gemini, etc.) from over 8 million users and sending it to developers, despite some claiming privacy protection.
- Meta has rolled out a new policy to personalise content and ad recommendations based on users' interactions with its generative AI features, with no opt-out option, raising significant privacy concerns among experts about the use of sensitive chat data.
- Digital rights organisation noyb alleges that TikTok and Grindr are violating European GDPR laws by tracking user activities across apps, with TikTok reportedly acknowledging it tracked a user's Grindr activity and other app usage, including shopping cart items.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/16/chrome_edge_privacy_extensions_quietly/
🗞️ The Record | https://therecord.media/privacy-advocates-see-risks-meta-ai-ad-targeting
🗞️ The Record | https://therecord.media/tiktok-grindr-data-tracking-noyb

Government & Defence Strategy 🏛️

- NATO's Assistant Secretary General for Cyber and Digital Transformation stressed the existential urgency for the alliance to develop sovereign cloud-based technologies, highlighting the need for speed, collaboration, and designing systems that enhance autonomy and allied trust.
- Outgoing GAO chief Gene Dodaro warned lawmakers that the U.S. is "very vulnerable" to cyber threats and expressed concern that CISA is "taking our foot off the gas," having lost about a third of its staff, and urged for a permanent director to be confirmed swiftly.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/17/sovereign_cloud_is_existential_nato/
🤫 CyberScoop | https://fedscoop.com/cisa-workforce-threats-gao-cybersecurity-gene-dodaro/

#CyberSecurity #ThreatIntelligence #APT #Ransomware #Malware #ZeroDay #Vulnerability #DataPrivacy #InfoSec #CyberAttack #NationState #Phishing #SocialEngineering #CloudSecurity #GovernmentSecurity #CISA #GDPR

Less a 'pop up city', more a convention of Incels.

#NetworkState #Incels #TechBros #Zuzalu #NationState #NoBillionaires #VitalikButerin #CryptoBros #Montenegro

It's been a busy 24 hours in the cyber world with significant updates on a critical RCE vulnerability under active exploitation, novel attack techniques leveraging AI and web standards, and a timely reminder about evolving authentication best practices. Let's dive in:

AI-Powered Virtual Kidnapping Scams on the Rise 🚨
- Criminals are now leveraging social media images and AI tools to create convincing fake "proof of life" photos and videos for "virtual kidnapping" and extortion scams.
- These sophisticated social engineering attacks pressure victims with threats of violence, demanding immediate ransom payments, echoing the old "grandparent scam" but with a modern, AI-enhanced twist.
- The FBI advises extreme caution: never provide personal info to strangers, establish a family code word, and always attempt to contact the supposed victim directly before making any payments.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/05/virtual_kidnapping_scam/

React2Shell RCE Under Widespread Exploitation ⚠️
- The critical React2Shell vulnerability (CVE-2025-55182), an unauthenticated RCE flaw in React Server Components, is under active and widespread exploitation by various threat actors, including China-linked state groups like Earth Lamia, Jackpot Panda, and UNC5174.
- CISA has added CVE-2025-55182 to its Known Exploited Vulnerabilities (KEV) catalog, with over 77,000 internet-exposed IP addresses identified as vulnerable and more than 30 organisations already compromised.
- Post-exploitation activities include reconnaissance, credential theft (especially AWS config files), deployment of webshells, cryptojackers, and malware like Snowlight and Vshell. Cloudflare even experienced an outage while deploying mitigations.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/05/react2shell_pocs_exploitation/
🤫 CyberScoop | https://cyberscoop.com/attackers-exploit-react-server-vulnerability/
📰 The Hacker News | https://thehackernews.com/2025/12/critical-react2shell-flaw-added-to-cisa.html
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/react2shell-flaw-exploited-to-breach-30-orgs-77k-ip-addresses-vulnerable/

IDEsaster: 30+ Flaws in AI Coding Tools 🛡️
- New research, dubbed "IDEsaster," has uncovered over 30 vulnerabilities in popular AI-powered Integrated Development Environments (IDEs) like Cursor, GitHub Copilot, and Zed.dev.
- These flaws chain prompt injection with legitimate IDE features, allowing attackers to bypass LLM guardrails and achieve data exfiltration or remote code execution without user interaction.
- The findings highlight a critical need for a "Secure for AI" paradigm, urging developers to apply least privilege to LLM tools, minimise prompt injection vectors, and implement sandboxing for commands.

📰 The Hacker News | https://thehackernews.com/2025/12/researchers-uncover-30-flaws-in-ai.html

Novel Clickjacking via CSS and SVG 🎨
- A security researcher has developed a new clickjacking technique that leverages SVG filters and CSS to leak cross-origin information, effectively bypassing the web's same-origin policy.
- This method allows for complex logic gates to process webpage pixels, enabling sophisticated attacks like exfiltrating Google Docs text, even in scenarios where traditional framing mitigations are absent or ineffective.
- While Google awarded a bounty for the report, the vulnerability remains unpatched across multiple browsers, underscoring the ongoing challenge of securing complex web standards.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/05/css_svg_clickjacking/

Passkeys: The Future of Phishing-Resistant MFA 🔒
- Traditional SMS and email one-time passwords (OTPs) are increasingly vulnerable to phishing attacks, making them an unreliable form of multi-factor authentication (MFA).
- Passkeys, based on cryptographic key pairs and FIDO2 standards, represent the "gold standard" for phishing-resistant MFA, offering superior security and a significantly improved user experience with faster logins and reduced helpdesk calls.
- While multi-device passkeys can still be susceptible to social engineering (like Scattered Spider attacks), they remain a substantial upgrade from OTPs, with over 2 billion passkeys already in use and strong adoption expected to continue.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/06/multifactor_authentication_passkeys/

#CyberSecurity #ThreatIntelligence #Vulnerability #RCE #React2Shell #CVE_2025_55182 #NationState #APT #Clickjacking #SVG #CSS #AICodingTools #IDEsaster #PromptInjection #MFA #Passkeys #Phishing #SocialEngineering #InfoSec #CyberAttack #IncidentResponse

It's been a busy 24 hours in the cyber world with significant updates on nation-state activity, a couple of actively exploited vulnerabilities, new insights into AI's role in cyberattacks, and a reminder about government policy and privacy. Let's take a look:

Ransomware Hits Pharma and NHS ⚠️

- US pharmaceutical firm Inotiv is notifying 9,542 individuals of a data breach following an August 2025 Qilin ransomware attack, which claimed to exfiltrate 176 GB of data.
- Barts Health NHS Trust in England also disclosed a data breach, with Clop ransomware actors stealing invoices containing names and addresses after exploiting an Oracle E-business Suite zero-day (CVE-2025-61882). Patient records were not affected.
- Asus confirmed that an unnamed third-party supplier was compromised by the Everest ransomware gang, who claimed to have stolen 1 TB of data, including camera source code for Asus phones. Asus insists its own products and customer data were unaffected.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/pharma-firm-inotiv-discloses-data-breach-after-ransomware-attack/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/barts-health-nhs-discloses-data-breach-after-oracle-zero-day-hack/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/05/asus_supplier_hack/

China-Linked BRICKSTORM Malware Campaign 🇨🇳

- US and Canadian cybersecurity agencies (CISA, NSA, CCCS) have issued a joint advisory on BRICKSTORM, a sophisticated Golang backdoor used by China-linked state-sponsored actors (UNC5221/Warp Panda) for long-term persistence.
- BRICKSTORM targets VMware vSphere and Windows environments, enabling credential theft, hidden VM creation, and lateral movement, with some intrusions maintaining access for years in government, IT, legal, and SaaS sectors.
- The malware includes a "self-watching" function for automatic reinstallation and uses advanced C2 techniques like DNS-over-HTTPS and SOCKS proxying, making detection difficult and posing a significant threat to critical infrastructure.

🗞️ The Record | https://therecord.media/cisa-nsa-warn-brickstorm-china
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/04/prc_spies_brickstorm_cisa/
🤫 CyberScoop | https://cyberscoop.com/china-brickstorm-malware-cyber-espionage-campaign-cisa-dhs-alert/
📰 The Hacker News | https://thehackernews.com/2025/12/cisa-reports-prc-hackers-using.html

Intellexa Predator Spyware: Zero-Days and Remote Access 📱

- Leaked training videos suggest Intellexa, the maker of Predator spyware, retained remote access capabilities to customer surveillance systems, raising serious human rights concerns about potential liability for misuse.
- The investigation revealed Predator's use of numerous zero-day exploits (e.g., CVE-2025-48543, CVE-2025-6554, CVE-2023-41993) against mobile browsers and a new "Aladdin" vector that delivers spyware via malicious mobile advertisements.
- Confirmed targeting includes a human rights lawyer in Pakistan, with ongoing Predator activity detected in multiple countries like Iraq, Saudi Arabia, Kazakhstan, Angola, and Mongolia, highlighting the persistent global demand for such surveillance tools.

🤫 CyberScoop | https://cyberscoop.com/intellexa-remotely-accessed-predator-spyware-customer-systems-investigation-finds/
📰 The Hacker News | https://thehackernews.com/2025/12/intellexa-leaks-reveal-zero-days-and.html

Actively Exploited VPN and Web Framework Vulnerabilities 🛡️

- Hackers are actively exploiting a command injection vulnerability in Array AG Series VPN devices (ArrayOS AG 9.4.5.8 and earlier with DesktopDirect enabled) to deploy webshells and create rogue users, primarily targeting organisations in Japan.
- A critical insecure deserialization flaw, React2Shell (CVE-2025-55182), affecting React Server Components (RSC) and Next.js, is being actively exploited by multiple China-linked threat actors (Earth Lamia, Jackpot Panda) for unauthenticated remote code execution (RCE).
- Cloudflare experienced a widespread outage due to an emergency patch deployed to mitigate the React2Shell vulnerability, underscoring the severity and rapid exploitation of this flaw.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-arrayos-ag-vpn-flaw-to-plant-webshells/
📰 The Hacker News | https://thehackernews.com/2025/12/jpcert-confirms-active-command.html
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/react2shell-critical-flaw-actively-exploited-in-china-linked-attacks/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/cloudflare-blames-todays-outage-on-emergency-react2shell-patch/
🗞️ The Record | https://therecord.media/chinese-hackers-exploit-react2shell-vulnerability-amazon

AI Agents: New Attack Vectors and Defence Challenges 🧠

- Anthropic's SCONE-bench research demonstrates that AI agents are becoming increasingly adept at exploiting smart contract vulnerabilities, with some models profitably identifying zero-days and generating millions in simulated funds.
- A "zero-click agentic browser attack" targeting Perplexity's Comet browser can leverage crafted emails to instruct an AI agent to delete an entire Google Drive, exploiting the agent's "excessive agency" without explicit user confirmation or traditional prompt injection.
- Researchers found that AI coding tools integrated into software development workflows (e.g., GitHub Actions) are vulnerable to prompt injection, where malicious commit messages or pull requests can be interpreted as instructions by LLMs, leading to shell command execution and token leakage.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/05/an_ai_for_an_ai/
📰 The Hacker News | https://thehackernews.com/2025/12/zero-click-agentic-browser-attack-can.html
🤫 CyberScoop | https://cyberscoop.com/ai-coding-tools-can-be-turned-against-you-aikido-github-prompt-injection/

UK Facial Recognition Expansion Sparks Privacy Debate 🚨

- The UK Home Office is pushing ahead with plans for a dedicated legal framework to expand police use of live facial recognition and other biometric technologies, aiming for "significantly greater scale."
- While the government touts facial recognition as a major crime-fighting tool, civil liberties groups like Big Brother Watch warn that this expansion risks turning public spaces into "biometric dragnets" and could lead to an "authoritarian surveillance state."
- Critics argue that any expansion must be paired with robust policy and investment in data protection and GDPR compliance to prevent unnecessary infringement on privacy.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/05/uk_cops_facial_recognition/

US Healthcare Cybersecurity Legislation Returns 🏥

- A bipartisan group of US senators has revived the Health Care Cybersecurity and Resiliency Act, aiming to update regulations, authorise grants, offer training, and clarify federal agency roles (HHS, CISA) to bolster healthcare cybersecurity.
- The legislation seeks to improve coordination between HHS and CISA, direct HHS to develop an incident response plan, update HIPAA regulations for modern cybersecurity practices, and provide guidance for rural health clinics.
- This renewed effort follows major healthcare data breaches, such as the Change Healthcare ransomware attack, underscoring the urgent need for comprehensive legislative action to protect sensitive medical data.

🤫 CyberScoop | https://cyberscoop.com/bipartisan-health-care-cybersecurity-legislation-returns-to-address-a-cornucopia-of-issues/

DoD Comms Failures and North Korea IT Worker Scheme 🏛️

- A Pentagon Inspector General report found that US Defense Secretary Pete Hegseth violated policy by using a personal device and Signal for sensitive operational details, highlighting a widespread, systemic issue of non-compliance within the DoD regarding unofficial messaging.
- A Maryland man was sentenced to 15 months in prison for his role in a North Korean IT worker scheme, where he allowed North Korean nationals to use his identity to secure software development contracts, including at the FAA, potentially exposing sensitive national defence information.
- The Trump administration's new national security strategy emphasises collaboration with US industry and regional foreign governments to protect critical infrastructure and networks, calling for deregulation and a focus on the Western Hemisphere, with a separate national cybersecurity strategy expected in January.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/04/dod_hegseth_broke_pentagon_policy_signal/
🗞️ The Record | https://therecord.media/north-korea-it-worker-scheme-maryland-man-sentenced
🗞️ The Record | https://therecord.media/trump-national-security-strategy-cyber-elements

FBI Warns of Virtual Kidnapping Scams 📞

- The FBI is warning the public about an increase in virtual kidnapping ransom scams where criminals use altered social media photos as fake "proof of life" to pressure victims into paying ransoms.
- These scams create a false sense of urgency, often involving spoofed phone numbers and manipulated images to convince victims that a loved one has been abducted, even though no actual kidnapping has occurred.
- The FBI advises caution, avoiding sharing personal information with strangers, establishing family code words for emergencies, and carefully scrutinising any "proof of life" photos for inconsistencies.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/fbi-warns-of-virtual-kidnapping-ransom-scams-using-altered-social-media-photos/

#CyberSecurity #ThreatIntelligence #Ransomware #NationState #APT #ZeroDay #Vulnerability #AI #DataPrivacy #InfoSec #CyberAttack #Malware #IncidentResponse #GovernmentSecurity #SupplyChainSecurity

Listening to Dr Janina Ramirez (historian, fabulous lady) low key call out the nonsense that is the nation state on the BBC 6 Music....don't tell the Mail!

"It's a construct!"

#BBC6Music #DrJaninaRamirez #History #Anarchy #NationState

It's been a busy 24 hours in the cyber world with significant updates on nation-state activity, new malware campaigns, actively exploited vulnerabilities, and a push to dispel common security myths. Let's dive in:

Recent Cyber Attacks and Breaches 🚨

- Pro-Ukraine hacktivists from the Ukrainian Cyber Alliance (UCA) claim to have severely disrupted Donbas Post, a Russian state-owned postal operator in occupied eastern Ukraine, wiping over 1,000 workstations, 100 virtual machines, and several dozen terabytes of data.
- Harvard University disclosed a data breach affecting alumni, donors, and staff, stemming from a voice phishing attack on its Alumni Affairs and Development systems, exposing personal details but no financial or password data.
- Real-estate finance services giant SitusAMC reported a data breach impacting corporate data and some client customer data, though business operations were unaffected and no encrypting malware was deployed.
- Media conglomerate Cox Enterprises confirmed data theft affecting 9,479 individuals from its Oracle E-Business instances, attributed to the Clop ransomware gang's exploitation of Oracle software.

🗞️ The Record | https://therecord.media/hackers-knock-out-systems-russia-operated-post-ukraine
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/harvard-university-discloses-data-breach-affecting-alumni-donors/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/real-estate-finance-services-giant-situsamc-breach-exposes-client-data/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/23/infosec_news_in_brief/

New Threat Research & Malware Campaigns 🔍

- A new Shai-Hulud supply-chain campaign has infected nearly 500 npm packages, including popular ones like Zapier and ENS Domains, stealing developer and CI/CD secrets and leaking them to automatically generated GitHub repositories.
- Chinese state-sponsored APT 31 (Violet Typhoon) has been observed attacking Russian cloud environments, specifically targeting IT sector contractors for government agencies, using a mix of common and custom malware for persistent access and credential theft.
- ShadowPad malware, a modular backdoor linked to Chinese state-sponsored groups, is actively exploiting CVE-2025-59287, a critical deserialization flaw in Microsoft WSUS, to gain system-level remote code execution and install its payload.
- ESET researchers uncovered the Chinese-aligned PlushDaemon APT group deploying "EdgeStepper," a network implant that hijacks DNS traffic to malicious nodes, enabling the delivery of malicious software updates in adversary-in-the-middle attacks.
- CISA issued an alert warning about commercial spyware actively targeting mobile messaging applications, leveraging sophisticated social engineering, zero-click exploits, and malicious QR codes to compromise high-value individuals.
- New ClickFix attack variants are using highly deceptive fake Windows Update screens and steganography (embedding malware in PNG image pixel data) to trick users into executing commands that deploy LummaC2 and Rhadamanthys information stealers.
- CrowdStrike research revealed that the Chinese DeepSeek-R1 AI model generates significantly more insecure code (up to 50% increase in severe vulnerabilities) when prompts contain politically sensitive topics like Tibet or Uyghurs, highlighting potential geopolitical biases in AI outputs.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/shai-hulud-malware-infects-500-npm-packages-leaks-secrets-on-github/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/24/asia_tech_news_roundup/
📰 The Hacker News | https://thehackernews.com/2025/11/shadowpad-malware-actively-exploits.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/23/infosec_news_in_brief/
🤫 CyberScoop | https://cyberscoop.com/cisa-alert-draws-attention-to-spywares-targeting-of-messaging-apps/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/clickfix-attack-uses-fake-windows-update-screen-to-push-malware/
📰 The Hacker News | https://thehackernews.com/2025/11/chinese-ai-model-deepseek-r1-generates.html

Critical Vulnerabilities & Exploitation ⚠️

- Five "trivial-to-exploit" vulnerabilities, including RCE and an 8-year-old path traversal flaw (CVE-2025-12972), were discovered in Fluent Bit, an open-source log collection tool widely used across major cloud providers and AI labs.
- These Fluent Bit flaws, if chained, could allow attackers to bypass authentication, achieve remote code execution, cause denial-of-service, manipulate tags, and potentially lead to full node and cluster takeover in Kubernetes environments.
- A years-old remote code execution (RCE) flaw (CVE-2025-64756, CVSS 7.5) was found in the CLI tool of the `glob` file pattern matching library, which is a universal part of the JavaScript stack, allowing malicious filenames to be executed as code on POSIX systems when the `-c` flag is used.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/24/fluent_bit_cves/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/23/infosec_news_in_brief/

Regulatory Shifts & Software Liability ⚖️

- The UK's Business and Trade Committee has urged the government to introduce liability for software developers, incentivise business investment in cyber resilience, and mandate reporting of all malicious cyber incidents to bolster economic security.
- The Federal Communications Commission (FCC) has controversially reversed cybersecurity rules introduced after the Chinese Salt Typhoon espionage campaign, which aimed to force telecom carriers to harden their lawful intercept and other sensitive systems.
- Critics, including FCC Commissioner Anna Gomez and the Electronic Privacy Information Center (EPIC), warn that abandoning these enforceable requirements leaves the US less secure and creates a "safe harbor for insecure cybersecurity practices."

🗞️ The Record | https://therecord.media/software-companies-liable-britain-security
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/24/fcc_salt_typhoon_rules/

Debunking Cyber Myths & SBOM Challenges 🛡️

- A new initiative, Hacklore.org, launched by former CISA officials and over 80 cybersecurity professionals, aims to dispel common "hacklore" myths (e.g., frequent password changes, avoiding public Wi-Fi) in favour of practical, evidence-based advice like MFA, password managers, and timely updates.
- The initiative also advocates for software manufacturers to adopt "secure by design" and "secure by default" principles, committing to publishing roadmaps and timely CVE records to improve overall software security.
- Despite government efforts, Software Bills of Materials (SBOMs) adoption remains sluggish in the private sector, with experts divided on whether the rapid advance of AI-assisted coding will make SBOMs obsolete by generating vulnerability-free software, or if AI will simply introduce new complexities.

🤫 CyberScoop | https://cyberscoop.com/this-campaign-aims-to-tackle-persistent-security-myths-in-favor-of-better-advice/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/24/hacklore_launch/
🤫 CyberScoop | https://cyberscoop.com/sbom-adoption-challenges-ai-coding-transparency/

Operational Security Blunder 🤦‍♀️

- The International Association for Cryptologic Research (IACR) must re-run its election for new board members after one of three trustees "irretrievably lost their private key," preventing the joint decryption of electronic voting results.
- This incident highlights a critical operational security failure in a system designed for multi-party control, underscoring the human element in cryptographic key management.
- The IACR plans to adopt a two-out-of-three threshold mechanism for key management and a clearer written procedure to prevent future occurrences.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/24/cryptologic_research_election_rerun/

#CyberSecurity #ThreatIntelligence #CyberAttack #DataBreach #Malware #Ransomware #SupplyChainAttack #Vulnerability #RCE #ZeroDay #APT #NationState #AI #SecureByDesign #SBOM #InfoSec #IncidentResponse

It's been a pretty active 24 hours in the cyber world, with CISA warning about an actively exploited Oracle zero-day, new insights into China-linked APT31's stealthy operations against Russian IT, and a fresh look at a fileless, cross-platform phishing framework using browser notifications. Let's dive in:

Critical Oracle Identity Manager Zero-Day Under Active Exploitation ⚠️

- CISA has added CVE-2025-61757, a critical Oracle Identity Manager vulnerability (CVSS 9.8), to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation.
- This flaw allows pre-authenticated remote code execution by bypassing authentication for critical functions, stemming from a faulty security filter that can be tricked with "?WSDL" or ";.wadl" appended to URIs.
- Evidence suggests the vulnerability was exploited as a zero-day between August 30 and September 9, 2025, well before Oracle's October patch, with Federal Civilian Executive Branch agencies mandated to patch by December 12, 2025.

📰 The Hacker News | https://thehackernews.com/2025/11/cisa-warns-of-actively-exploited.html

China-Linked APT31 Targets Russian IT with Cloud C2 🇨🇳

- The China-linked APT31 (aka Altaire, Violet Typhoon) has been attributed to stealthy cyberattacks against the Russian IT sector between 2024-2025, often remaining undetected for extended periods.
- The group leverages legitimate cloud services like Yandex Cloud for command-and-control (C2) and data exfiltration, blending in with normal traffic, and stages encrypted commands in social media profiles.
- APT31 employs a diverse arsenal of public and custom tools, including CloudyLoader, SharpADUserIP, Tailscale VPN, and unique backdoors like OneDriveDoor and VtChatter, to achieve persistence and exfiltrate sensitive data.

📰 The Hacker News | https://thehackernews.com/2025/11/china-linked-apt31-launches-stealthy.html

Matrix Push C2 Leverages Browser Notifications for Fileless Phishing 🎣

- A new command-and-control (C2) platform, Matrix Push C2, is being used by threat actors to conduct fileless, cross-platform phishing attacks via browser push notifications.
- Victims are socially engineered into allowing notifications, which then deliver fake alerts (e.g., suspicious logins, browser updates) with malicious links, effectively bypassing traditional security controls.
- Offered as a Malware-as-a-Service (MaaS) with tiered subscriptions, Matrix Push C2 includes configurable templates for impersonating brands and analytics, while separate research notes an uptick in legitimate DFIR tool Velociraptor misuse.

📰 The Hacker News | https://thehackernews.com/2025/11/matrix-push-c2-uses-browser.html

#CyberSecurity #ThreatIntelligence #ZeroDay #RCE #Oracle #APT31 #NationState #Phishing #Malware #C2 #CloudSecurity #IncidentResponse #InfoSec

It's been a pretty packed week in cyber, with some serious shifts in regulatory landscapes, active exploitation of critical vulnerabilities, and continued efforts to dismantle cybercrime infrastructure.

For a full recap, check out our latest episode: https://open.spotify.com/episode/2EQ2lzZnQA3DmYsExXXLnm?si=rBXJP2d5SNOnyVfd0hhroQ

Let's dive in:

Recent Cyber Attacks and Breaches ⚠️

- PowerSchool, an ed-tech giant, suffered a mega-breach in December 2024, impacting millions of student and staff records, with Canadian privacy watchdogs blaming school boards for poor security and oversight.
- Salesforce disclosed another third-party breach involving Gainsight-published applications, likely linked to the ShinyHunters group, which accessed customer Salesforce data via compromised OAuth tokens.
- These incidents highlight the critical need for robust third-party vendor management, strong contractual security clauses, and proper oversight of remote access, especially for sensitive data.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/20/powerschool_breach_reports/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/20/salesforce_gainsight_breach/

Insider Sabotage at Waste Management 💥

- An Ohio IT contractor, Maxwell Schultz, pleaded guilty to sabotaging his former employer's systems, allegedly Waste Management, causing over $862,000 in damages by resetting 2,500 passwords.
- Schultz impersonated another contractor after his credentials were revoked, demonstrating a critical lapse in access management and the persistent threat of malicious insiders.
- This incident underscores the importance of immediate credential revocation, robust monitoring for anomalous activity, and strong insider threat programmes.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/20/it_contractor_sabotage/

Vulnerabilities and Active Exploitation 🛡️

Fortinet FortiWeb Zero-Days 🚨

- Fortinet confirmed a second zero-day (CVE-2025-58034), an OS command injection flaw, actively exploited in its FortiWeb web application firewall, just days after disclosing another critical path traversal zero-day (CVE-2025-64446) in the same product.
- These two vulnerabilities likely form an exploit chain for unauthenticated remote code execution, with CISA adding CVE-2025-58034 to its Known Exploited Vulnerabilities catalog with a 7-day patch deadline.
- Organisations using FortiWeb should immediately update to the latest software versions and monitor for signs of compromise.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/19/fortinet_confirms_second_fortiweb_0day/

Critical Oracle Identity Manager RCE 🔓

- A critical pre-authentication RCE (CVE-2025-61757, CVSS 9.8) in Oracle Fusion Middleware's Identity Manager allows unauthenticated attackers to fully compromise susceptible systems via HTTP.
- The flaw, affecting versions 12.2.1.4.0 and 14.1.2.1.0, stems from logical flaws in Java's URI interpretation within authentication filters.
- Oracle has already patched this vulnerability, so ensure your Identity Manager instances are fully updated to prevent potential system takeover.

📰 The Hacker News | https://thehackernews.com/2025/11/threatsday-bulletin-0-days-linkedin.html

glob CLI Command Injection 💻

- A security flaw (CVE-2025-64756, CVSS 7.5) in glob CLI's -c/--cmd flag can lead to operating system command injection and remote code execution if filenames with shell metacharacters are passed.
- This vulnerability could compromise developer machines or facilitate supply chain poisoning via malicious packages, affecting Glob versions 10.2.0 through 11.0.3.
- Users should update to patched versions (10.5.0, 11.1.0, or 12.0.0) and note that only CLI tool usage is affected, not the library API.

📰 The Hacker News | https://thehackernews.com/2025/11/threatsday-bulletin-0-days-linkedin.html

Shelly Pro 4PM Smart Relay Vulnerability 🏠

- A critical flaw (CVE-2025-11243, CVSS 8.3) in the Shelly Pro 4PM smart relay allows attackers to cause device reboots by sending unexpected inputs to JSON-RPC methods.
- While not enabling code execution or data theft, this can systematically cause outages, impacting automation and visibility in smart home/building contexts.
- Users are advised to update to version 1.6.0 and avoid direct internet exposure for these devices.

📰 The Hacker News | https://thehackernews.com/2025/11/threatsday-bulletin-0-days-linkedin.html

Palo Alto GlobalProtect Scanning Surge 📈

- Malicious traffic targeting Palo Alto Networks' GlobalProtect portals surged almost 40-fold in 24 hours, hitting a 90-day high, with fingerprints suggesting repeat threat actors.
- This activity often precedes new vulnerability disclosures, as seen with Fortinet appliances, putting defenders on high alert for potential future exploitation.
- Organisations should tighten access controls, monitor for login anomalies, and be prepared to implement blocklists or IPS rules for exposed GlobalProtect portals.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/20/palo_alto_traffic_flood/

New Threat Research: Malware and Techniques 🔬

Iranian Cyber-Kinetic Targeting 🎯

- Amazon's threat intelligence observed Iran-linked Imperial Kitten (Tortoiseshell) conducting cyber reconnaissance, including mapping ship AIS data and accessing CCTV, days before a real-world missile strike attempt.
- This "cyber-enabled kinetic targeting" blurs the lines between digital and physical warfare, using cyber ops to support military objectives.
- The trend highlights the need for integrated security frameworks that address both digital and physical threats, as espionage can directly lead to kinetic attacks.

📰 The Hacker News | https://thehackernews.com/2025/11/iran-linked-hackers-mapped-ship-ais.html

ShadowRay 2.0 Cryptomining Botnet 🤖

- Oligo Security warns of ShadowRay 2.0, an evolution of a cryptomining botnet exploiting an unpatched, two-year-old authentication flaw (CVE-2023-48022, CVSS 9.8) in the Ray AI framework.
- This self-replicating botnet hijacks NVIDIA GPUs for XMRig mining, leveraging exposed Ray Job Submission APIs and pivoting laterally to non-internet-facing nodes.
- Mitigation includes configuring firewalls, adding authorisation to Ray Dashboard port (8265), and using Anyscale's "Ray Open Ports Checker" tool to prevent accidental exposure, as over 230,500 Ray servers are publicly accessible.

📰 The Hacker News | https://thehackernews.com/2025/11/shadowray-20-exploits-unpatched-ray-flaw-to-build-self-spreading-gpu-cryptomining-botnet.html

NovaStealer macOS Malware 🍎

- A new macOS stealer, NovaStealer, has been detailed, capable of exfiltrating crypto wallet files, collecting telemetry, and replacing legitimate Ledger/Trezor applications with tampered copies.
- The malware uses a script orchestrator under ~/.mdrivers and a LaunchAgent to pull and run b64-encoded scripts from its C2, supporting updates and restarts.
- macOS users, especially those with crypto wallets, should be vigilant for suspicious processes and ensure applications are downloaded from official sources.

📰 The Hacker News | https://thehackernews.com/2025/11/threatsday-bulletin-0-days-linkedin.html

Sturnus Android Banking Trojan 📱

- ThreatFabric uncovered Sturnus, a new Android banking trojan that can intercept decrypted messages from apps like WhatsApp, Telegram, and Signal, and steal banking credentials via fake login screens.
- Sturnus offers attackers near-total remote control, including injecting text, observing activity, and executing transactions while hiding operations with a black overlay.
- While in development, its advanced capabilities and targeted geography (Southern/Central Europe) suggest preparation for wider, coordinated campaigns.

🗞️ The Record | https://therecord.media/new-android-malware-captures-private-messages

LLM-Generated Malware: Reality Check 🧠

- Researchers found that while LLMs like GPT-3.5-Turbo and GPT-4 can generate malicious code (e.g., Python scripts for anti-VM detection), it's currently "too unreliable and ineffective for operational deployment."
- GPT-5 showed improved code quality but also stronger safety guardrails, making it harder to bypass and subverting malicious intent.
- Despite advancements, fully autonomous, operational LLM-based attacks remain theoretical, still requiring human intervention and review.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/20/llmgenerated_malware_improving/

SharpParty: PoolParty in C# 💉

- Cybersecurity researchers have released SharpParty, a C# implementation of PoolParty, a collection of process injection techniques targeting Windows Thread Pools.
- This re-engineering aims to evade Endpoint Detection and Response (EDR) systems by leveraging inline MSBuild tasks in XML files.
- Defenders should be aware of these advanced injection techniques and ensure EDR solutions are configured to detect subtle anomalies in thread pool activity.

📰 The Hacker News | https://thehackernews.com/2025/11/threatsday-bulletin-0-days-linkedin.html

Malicious Browser Extensions 🚫

- Threat actors are using malicious VPN and ad-blocking extensions for Chrome and Edge browsers (e.g., "VPN Professional," "Ads Blocker") to steal sensitive data.
- These extensions, installed about 31,000 times, can intercept web traffic, collect browsing data, modify/disable security tools, and route traffic through attacker-controlled servers.
- Users should exercise extreme caution with browser extensions, only installing those from trusted developers and regularly reviewing permissions.

📰 The Hacker News | https://thehackernews.com/2025/11/threatsday-bulletin-0-days-linkedin.html

Phishing with Microsoft Entra Invites 🎣

- A new phishing campaign weaponises legitimate Microsoft Entra guest user invitations (from invites@microsoft[.]com) to bypass email filters and establish trust.
- The goal is to trick recipients into making phone calls to attackers posing as Microsoft support in "TOAD" (Telephone-Oriented Attack Delivery) attacks.
- Organisations should educate users about the risks of unsolicited invitations and verify requests through official channels, even if they appear legitimate.

📰 The Hacker News | https://thehackernews.com/2025/11/threatsday-bulletin-0-days-linkedin.html

Data Privacy and Regulatory Issues ⚖️

EU GDPR and AI Act Changes 🇪🇺

- The European Commission proposed major changes to GDPR and the AI Act, aiming to simplify GDPR and clarify "personal data" definition to allow AI training without prior consent under "legitimate interest."
- This "digital omnibus" package also amends cookie consent rules for one-click preferences, but critics argue it rolls back digital protections and panders to Big Tech.
- The changes could give authorities and companies more room to process personal data with limited oversight, potentially increasing profiling and intrusive monitoring.

📰 The Hacker News | https://thehackernews.com/2025/11/threatsday-bulletin-0-days-linkedin.html

FCC Rolls Back Telecom Cyber Regulations 🏛️

- The FCC, in a party-line vote, reversed Biden-era cybersecurity regulations that would have mandated telecoms to secure networks and submit annual risk management certifications, following the Salt Typhoon Chinese hack.
- Chairman Brendan Carr argued the rules were "unlawful nor effective" and that voluntary industry collaboration is sufficient, despite Commissioner Anna Gomez's strong dissent, warning of continued vulnerability.
- This move leaves U.S. communications infrastructure potentially less protected against state-sponsored threats, relying on "handshake agreements" over enforceable standards.

🤫 CyberScoop | https://cyberscop.com/fcc-cybersecurity-vote-china-hack-telecoms-anna-gomez/
🗞️ The Record | https://therecord.media/fcc-removes-biden-era-cybersecurity-rules-telecoms-salt-typhoon

#CyberSecurity #ThreatIntelligence #Vulnerability #ZeroDay #RCE #Malware #Ransomware #APT #NationState #DataPrivacy #GDPR #RegulatoryAffairs #Cybercrime #LawEnforcement #AI #LLM #InfoSec #IncidentResponse

Alright, cyber pros! It's been a pretty active 24 hours, with a mix of new breach disclosures, some interesting ransomware developments, critical vulnerabilities under active attack, and a peek into how AI is shaping the threat landscape. Let's dive in:

Recent Cyber Attacks & Breaches 🚨

- DoorDash disclosed a data breach in October, impacting consumers, Dashers, and merchants. Personal information like names, addresses, phone numbers, and emails were accessed after an employee fell victim to a social engineering scam. This marks their third significant incident since 2019.
- The UK's National Health Service (NHS) is investigating claims by the Clop ransomware gang of a cyberattack. While Clop listed NHS.uk on its leak site, it hasn't specified which part of the organisation was breached or published any data, raising questions about the extent of their access.
- UK fintech firm Checkout.com was breached by ShinyHunters, who accessed a legacy cloud storage system with merchant data from 2020 and earlier. The company has publicly refused to pay the ransom, instead pledging to donate the amount to cybersecurity research at Carnegie Mellon and Oxford.
- A major Russian port operator, Port Alliance, reported ongoing disruptions from a cyberattack "from abroad," involving a DDoS and network breach. The attackers used a botnet of over 15,000 IPs, aiming to disrupt coal and fertiliser shipments, though core operations remained functional.
- The Lighthouse phishing kit, used for widespread "smishing" scams like fake road tolls, appears to have been disrupted following a lawsuit by Google. Researchers observed the kit's Telegram channels being taken down and associated domains no longer resolving.
- The FBI has warned of an aggressive health insurance scam targeting Chinese speakers in the US. Scammers spoof legitimate insurers, claim bogus surgery bills, and then, under the guise of Chinese law enforcement, threaten extradition or prosecution to extort payments and gain remote access to victims' computers.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/doordash-hit-by-new-data-breach-in-october-exposing-user-information/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/14/nhs_clop/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/checkoutcom-snubs-shinyhunters-hackers-to-donate-ransom-instead/
🗞️ The Record | https://therecord.media/cyberattack-on-russian-port-operator
🤫 CyberScoop | https://cyberscoop.com/lighthouse-text-scammers-disrupted-google-lawsuit/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/14/fbi_chinese_speaker_health_insurance/

New Threat Research: Ransomware, Malware & AI-Driven Attacks 🛡️

- Anthropic reported that Chinese state-sponsored group GTG-1002 used their Claude Code AI model to automate cyber espionage against 30 critical organisations, including tech, finance, and government. The AI allegedly handled vulnerability scanning, exploitation, and data exfiltration with minimal human oversight, though some researchers have expressed skepticism regarding the claimed level of AI autonomy.
- CISA and FBI issued an updated advisory on Akira ransomware, highlighting its new capability to encrypt Nutanix AHV virtual machines, expanding its targets beyond VMware ESXi and Hyper-V. The FBI ranks Akira as a "top five" ransomware threat, having extorted over $244 million from small- and medium-sized businesses, often exfiltrating data within two hours of initial access.
- The Kraken ransomware, a continuation of the HelloKitty operation, now features a system benchmarking capability. It tests target machines to determine optimal encryption speed, allowing it to choose between full or partial data encryption to maximise impact without triggering alerts due to excessive resource usage.
- A new self-spreading npm package, dubbed 'IndonesianFoods,' has flooded the registry with over 100,000 junk packages, spawning new ones every seven seconds. While currently non-malicious, it aims to stress the open-source ecosystem and may be financially motivated through abuse of the TEA Protocol.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/13/chinese_spies_claude_attacks/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/anthropic-claims-of-claude-ai-automated-cyberattacks-met-with-doubt/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/cisa-warns-of-akira-ransomware-linux-encryptor-targeting-nutanix-vms/
🤫 CyberScoop | https://cyberscoop.com/akira-ransomware-fbi-cisa-joint-advisory/
🗞️ The Record | https://therecord.media/akira-gang-received-million
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/kraken-ransomware-benchmarks-systems-for-optimal-encryption-choice/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/new-indonesianfoods-worm-floods-npm-with-100-000-packages/

Critical Vulnerabilities & Active Exploitation ⚠️

- A critical path traversal vulnerability (CVE-2025-64446) in Fortinet FortiWeb web application firewalls is under active, widespread exploitation. Attackers are using a publicly available PoC to create new administrative accounts on exposed devices without authentication. Fortinet silently patched this in version 8.0.2, and CISA has added it to its Known Exploited Vulnerabilities Catalog, urging immediate patching.
- ASUS has released firmware updates for several DSL series routers (DSL-AC51, DSL-N16, DSL-AC750) to fix a critical authentication bypass flaw (CVE-2025-59367). This vulnerability allows remote, unauthenticated attackers to gain full control. Users unable to update should disable internet-facing services like remote access, port forwarding, and VPN server.
- Researchers discovered critical Remote Code Execution (RCE) vulnerabilities in major AI inference engines from Meta (Llama), Nvidia (TensorRT-LLM), Microsoft (Sarathi-Serve), and open-source projects like vLLM and SGLang. These "ShadowMQ" flaws stem from insecure deserialization of data via ZeroMQ and Python's pickle module, often due to code reuse, potentially allowing arbitrary code execution.
- Kubernetes maintainers have decided to retire Ingress NGINX by March 2026 due to persistent security flaws and maintenance challenges. This popular ingress controller, found in around 6,000 implementations, has been problematic, with serious vulnerabilities allowing cluster takeover identified as recently as March 2025. Admins should plan migration to alternatives.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/fortiweb-flaw-with-public-poc-actively-exploited-to-create-admin-users/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/14/fortinet_active_exploit_cve_2025_64446/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/asus-warns-of-critical-auth-bypass-flaw-in-dsl-series-routers/
🚨 The Hacker News | https://thehackernews.com/2025/11/researchers-find-serious-ai-bugs.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/14/nginx_retirement/

Threat Landscape Commentary 📈

- The retail industry is facing a growing cybersecurity crisis, with breaches costing millions and eroding customer trust. The core issue isn't just about more technology, but a lack of executive-level cybersecurity leadership and a failure to treat cyber as a core strategic priority.
- The National Retail Federation (NRF) is urged to establish a dedicated cybersecurity talent incubator. This program would develop executive-ready leaders who understand both technical threats and the specific operational pressures retailers face, bridging the gap between academic expertise and industry needs.
- The initiative would offer six-month programs for graduates and modular training for junior roles, with placements across the NRF's network, aiming to foster a sector-wide mindset shift towards long-term strategic investment in cybersecurity talent.

🤫 CyberScoop | https://cyberscoop.com/retail-cybersecurity-crisis-nrf-leadership-talent-pipeline-op-ed/

Regulatory Issues & Data Privacy 🔒

- Google has backpedaled on its controversial Android developer verification rules following widespread backlash from users and developers. Originally intended to block malware from sideloaded apps, the revised rules will now offer options for limited app distribution without full verification and an "advanced flow" for power users to sideload unverified apps with warnings.
- The initial plan was criticised for potentially consolidating power and threatening open ecosystems like F-Droid.
- The revised verification process will open for early access in November 2025, with a phased global rollout of mandatory verification starting in September 2026 for specific regions.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/google/google-backpedals-on-new-android-developer-registration-rules/

Government Actions Against Cybercrime 🏛️

- US federal authorities have established a new "Scam Center Strike Force" to combat Chinese cryptocurrency scam networks, often known as "pig butchering" or "romance baiting." These scams defraud Americans of nearly $10 billion annually, with operators often working from criminal compounds in Southeast Asia.
- The strike force focuses on tracing and seizing illicit crypto funds, already recovering over $401 million and initiating forfeiture for an additional $80 million. They also coordinate with international partners and have sanctioned groups and firms linked to these operations.
- A suspected Russian hacker, potentially Aleksey Lukashev (a GRU officer wanted by the FBI for 2016 US election interference), has been detained in Phuket, Thailand, at the request of the US. He faces possible extradition on cybercrime charges, with Thai police seizing laptops, phones, and digital wallets.
- The Justice Department announced five guilty pleas related to North Korea's long-running IT worker scam, which defrauded 136 US companies of $2.2 million and involved 18 stolen US identities. The DOJ also seized over $15 million in cryptocurrency from North Korean facilitators, linked to APT38 (Lazarus Group) and several major crypto thefts in 2023.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/us-announces-new-strike-force-targeting-chinese-crypto-scammers/
🗞️ The Record | https://therecord.media/russian-hacker-detained-thailand-possible-us-extradition
🗞️ The Record | https://therecord.media/multiple-us-nationals-guilty-pleas-north-korean-it-worker-scams

#CyberSecurity #ThreatIntelligence #Ransomware #Malware #Vulnerability #ActiveExploitation #ZeroDay #AI #NationState #DataBreach #Cybercrime #InfoSec #IncidentResponse #SupplyChainSecurity #CloudSecurity

Alright team, it's been a pretty active 24 hours in the cyber realm! We've got a few notable breaches, some clever new malware tactics, critical vulnerabilities from Cisco, and a stark reminder about password hygiene. Let's dive in:

Recent Cyber Attacks and Breaches ⚠️

- Hyundai AutoEver America suffered a data breach, with attackers accessing personal information including names, Social Security Numbers, and driver's licenses. The intrusion, discovered on March 1st, had been ongoing since February 22nd.
- Japanese media giant Nikkei also disclosed a breach where malware on an employee's laptop led to stolen Slack credentials, exposing the personal details (names, emails, chat histories) of over 17,000 employees and partners. This highlights the growing risk of collaboration platforms as attack vectors.
- SonicWall confirmed that state-sponsored threat actors were behind their September cloud backup breach, accessing firewall configuration files via an API call. While initially downplayed, it's now clear all customers using the cloud backup service were affected, though SonicWall insists no product, firmware, or source code was impacted.
- Russia's Sandworm (APT44) has been deploying data-wiping malware (like ZeroLot and Sting) against Ukraine's critical grain sector, as well as government, energy, and logistics entities. This marks a strategic shift to target Ukraine's economy, with initial access sometimes facilitated by UAC-0099.
- The State of Nevada government successfully recovered from a ransomware attack in August without paying the ransom, incurring $259,000 in overtime costs and $1.3 million in vendor support. The initial compromise in May stemmed from an employee downloading a trojanised system administration tool via a malicious Google ad, leading to a hidden backdoor and eventual ransomware deployment after backups were deleted.
- An Italian communications executive, Francesco Nicodemo, revealed he was targeted with Paragon's Graphite spyware, making him the fifth known Italian victim in a scandal involving political targeting. WhatsApp had notified 90 individuals globally about evidence of similar targeting.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/hyundai-autoever-america-data-breach-exposes-ssns-drivers-licenses/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/06/nikkeis_private_chats_go_public/
📰 The Hacker News | https://thehackernews.com/2025/11/sonicwall-confirms-state-sponsored.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/06/sonicwall_fingers_statebacked_cyber_crew/
🤫 CyberScoop | https://cyberscoop.com/sonicwall-customer-portal-nation-state-attack/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/sandworm-hackers-use-data-wipers-to-disrupt-ukraines-grain-sector/
🗞️ The Record | https://therecord.media/russia-sandworm-grain-wipers
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/how-a-ransomware-gang-encrypted-nevada-governments-systems/
🗞️ The Record | https://therecord.media/nevada-declined-ransom-breach
🗞️ The Record | https://therecord.media/italy-comms-exec-spyware

New Threat Research on Malware and Techniques 🛡️

- The Gootloader malware operation has resurfaced after a seven-month hiatus, continuing its SEO poisoning campaigns to distribute malicious JavaScript files disguised as legal documents. New evasion tactics include using special web fonts to obfuscate filenames in HTML source and crafting malformed Zip archives that unpack differently for Windows Explorer versus analysis tools. It's now dropping the Supper SOCKS5 backdoor, linked to ransomware affiliates like Vanilla Tempest, known for rapid network compromise.
- The Russia-aligned threat actor Curly COMrades is using an innovative evasion technique: weaponising Windows Hyper-V to deploy hidden, lightweight Alpine Linux virtual machines. These VMs host custom reverse shells (CurlyShell) and reverse proxies (CurlCat), effectively isolating malware execution and bypassing host-based EDR detections.
- A new Russia-aligned cluster, InedibleOchotense (possibly a Sandworm sub-cluster), is conducting spear-phishing attacks against Ukrainian entities using trojanised ESET installers. These installers drop the Kalambur (SUMBUR) C# backdoor, which uses Tor for C2 and enables OpenSSH/RDP access. Separately, RomCom (Storm-0978) has been weaponising a WinRAR vulnerability (CVE-2025-8088) in Europe and Canada, deploying various backdoors.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/gootloader-malware-is-back-with-new-tricks-after-7-month-break/
📰 The Hacker News | https://thehackernews.com/2025/11/hackers-weaponize-windows-hyper-v-to.html
📰 The Hacker News | https://thehackernews.com/2025/11/trojanized-eset-installers-drop.html

Vulnerabilities and Active Exploitation 🚨

- Cisco has issued patches for two critical vulnerabilities in its Unified Contact Center Express (UCCX) software. CVE-2025-20354 (CVSS 9.8) is an RCE flaw in the Java RMI process, allowing unauthenticated attackers to execute arbitrary commands as root. CVE-2025-20358 (CVSS 9.4) is an authentication bypass, enabling unauthenticated attackers to run scripts as a non-root user. While not yet exploited in the wild, immediate patching (to 12.5 SU3 ES07 or 15.0 ES01) is strongly advised.
- Cisco also warned of a "new attack variant" targeting its ASA and FTD firewalls, exploiting previously patched flaws (CVE-2025-20333 and CVE-2025-20362). These attacks, ongoing for at least six months and linked to the government-backed ArcaneDoor threat crew (UAT4356), now cause devices to continually reload, leading to denial-of-service. Attackers have used zero-days, disabled logging, intercepted CLI commands, intentionally crashed devices, and even modified ROM Monitor for persistence.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/critical-cisco-uccx-flaw-lets-hackers-run-commands-as-root/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/06/cisco_firewall_ongoing_attacks/

Threat Landscape Commentary 📉

- A Comparitech report analysing over two billion leaked passwords in 2025 confirms that "123456", "admin", and "password" remain among the most common. A quarter of passwords were number-only, and 38% contained "123". This highlights persistent poor password hygiene, emphasising the need for longer passphrases or, ideally, biometric passkeys.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/06/most_common_passwords/

Data Privacy and Regulatory Issues 🔒

- The EU Parliament's Civil Liberties Committee (LIBE) has voted to advance a controversial proposal expanding Europol's data sharing and biometric data collection capabilities. While aimed at combating human trafficking and migrant smuggling, privacy advocates warn it could facilitate mass surveillance and significant data privacy violations across Europe.
- In a decisive move against cybercrime, a Chinese court has sentenced five leaders of a Myanmar crime syndicate to death. The syndicate ran industrial-scale scamming compounds near the China-Myanmar border, defrauding over $4 billion and causing six deaths, highlighting Beijing's severe crackdown on cross-border cyber fraud.

🗞️ The Record | https://therecord.media/eu-parliament-committee-votes-europol-data-sharing-agreement
🗞️ The Record | https://therecord.media/china-sentences-5-myanmar-scam-kingpins-to-death

#CyberSecurity #ThreatIntelligence #DataBreach #Ransomware #Malware #APT #NationState #Vulnerabilities #Cisco #Gootloader #Sandworm #Europol #DataPrivacy #InfoSec #CyberAttack #IncidentResponse

SonicWall has confirmed that its September cloud backup breach was carried out by a state-sponsored threat actor.

Mandiant assisted with the investigation; no firmware or internal systems were affected.
The company has released new analysis and credential reset tools for customers.

Another reminder that nation-state actors are increasingly targeting edge security providers and managed service infrastructure.

💬 Thoughts on transparency and response maturity in vendor-level breaches?
Follow TechNadu for balanced cyber reporting.

#CyberSecurity #SonicWall #InfoSec #ThreatIntel #DataBreach #CloudSecurity #IncidentResponse #NationState

Alright team, it's been a busy 24 hours in the cyber world! We've got updates on recent breaches, some interesting new threat actor TTPs, critical vulnerabilities under active exploitation, and a few policy shifts to keep an eye on. Let's dive in:

Recent Cyber Attacks and Breaches 🚨

- The University of Pennsylvania confirmed a data breach affecting development and alumni systems, with hackers stealing 1.71 GB of internal documents and 1.2 million donor records after a successful social engineering attack on an employee's SSO account.
- SonicWall's September security breach, which exposed customer firewall configuration backup files, has been attributed to a state-sponsored threat actor. The investigation confirmed no impact on SonicWall products, firmware, or source code, but customers were advised to reset credentials.
- International law enforcement, in "Operation Chargeback," dismantled three credit card fraud and money laundering networks that stole over €300 million from 4.3 million cardholders across 193 countries, exploiting German payment service providers to process fake online subscriptions.
- The Apache Software Foundation is disputing claims by the Akira ransomware gang that it breached OpenOffice and stole 23 GB of data, stating they do not possess the types of data claimed, and their investigation found no evidence of compromise.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/university-of-pennsylvania-confirms-data-stolen-in-cyberattack/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/sonicwall-says-state-sponsored-hackers-behind-security-breach-in-september/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/europol-credit-card-fraud-rings-stole-eur-300-million-from-43-million-cardholders/
🗞️ The Record | https://therecord.media/europe-police-bust-global-fraud-ring-payment-firms
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/apache-openoffice-disputes-data-breach-claims-by-ransomware-gang/

New Threat Research on Actors, Malware, and TTPs 🕵🏼

- A new threat cluster, UNK_SmudgedSerpent, is targeting US academics and foreign policy experts with phishing attacks leveraging domestic political lures related to Iran, deploying legitimate RMM software like PDQ Connect, and mimicking Iranian cyber espionage groups like TA455 and TA453.
- Russia-linked Curly COMrades are innovating their cyber-espionage campaigns by hiding custom malware (CurlyShell and CurlCat) within lightweight Alpine Linux virtual machines running on Hyper-V, a tactic designed to bypass traditional endpoint detection tools.
- Google's Threat Intelligence Group (GTIG) reports a significant shift towards AI-powered malware, with new families like PromptFlux (a VBScript dropper using Gemini for obfuscation) and PromptSteal (a data miner) emerging, alongside various state-backed actors abusing LLMs for reconnaissance, malware development, and phishing.

📰 The Hacker News | https://thehackernews.com/2025/11/mysterious-smudgedserpent-hackers.html
🗞️ The Record | https://therecord.media/virtual-machines-cyber-espionage-russia-linked-curly-comrades
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/google-warns-of-new-ai-powered-malware-families-deployed-in-the-wild/
📰 The Hacker News | https://thehackernews.com/2025/11/researchers-find-chatgpt.html

Vulnerabilities and Active Exploitation ⚠️

- CISA has added two critical flaws to its KEV catalog due to active exploitation: CVE-2025-11371, a local file inclusion in Gladinet CentreStack/Triofox, and CVE-2025-48703, an unauthenticated RCE in Control Web Panel (CWP) via shell command injection. Federal agencies must patch by November 25th.
- Hackers are actively exploiting CVE-2025-11833, a critical 9.8-severity vulnerability in the Post SMTP WordPress plugin (affecting over 400,000 sites), allowing unauthenticated attackers to read email logs, including password reset messages, to hijack administrator accounts.
- OpenAI's ChatGPT has been found vulnerable to several indirect prompt injection techniques, including via trusted sites, search context, and conversation injection, which could lead to data leakage from user memories and chat histories.
- AMD is set to release microcode patches for CVE-2025-62626 (CVSS 7.2), a high-severity flaw in Zen 5 Epyc and Ryzen CPUs where the RDSEED function can return zero instead of a random number, potentially weakening cryptographic keys if an attacker has local privileges.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/hackers-exploit-wordpress-plugin-post-smtp-to-hijack-admin-accounts/
📰 The Hacker News | https://thehackernews.com/2025/11/cisa-adds-gladinet-and-cwp-flaws-to-kev.html
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-centos-web-panel-bug-exploited-in-attacks/
📰 The Hacker News | https://thehackernews.com/2025/11/researchers-find-chatgpt.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/05/amd_promises_to_fix_chips/

Threat Landscape Commentary 📉

- The US federal cybersecurity posture is facing a "perfect storm" due to the F5 security breach (attributed to a nation-state actor), proposed CISA job and funding cuts, and the ongoing government shutdown, collectively eroding cyber readiness and creating an expanded attack surface.
- House GOP leaders are pushing the Commerce Department to investigate and restrict Chinese government-connected tech products across critical industries like AI, energy, and industrial control systems, citing China's view of information technology as a battlefield.
- Congressional leaders are also urging federal agencies to develop a clear strategy to compete with China in 6G telecommunications and secure US tech supply chains, learning from past mistakes that allowed Chinese companies to gain significant global influence in 5G.

🤫 CyberScoop | https://cyberscoop.com/us-cyber-readiness-crisis-f5-breach-cisa-job-cuts-shutdown-op-ed/
🤫 CyberScoop | https://cyberscoop.com/house-gop-leaders-seek-government-probe-restrictions-on-chinese-made-tech/
🤫 CyberScoop | https://cyberscoop.com/exclusive-china-6g-letter-krishnamoorthi-congress-state-commerce-letters/

Data Privacy Concerns 🔒

- The US Department of Homeland Security (DHS) is proposing a sweeping expansion of biometric data collection for immigration applications, including iris scans, voice prints, and DNA, from immigrants and even some US citizens associated with these cases, raising significant privacy concerns.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/04/dhs_wants_to_collect_biometric_data/

Regulatory Issues and Changes 🏛️

- The US Treasury Department has sanctioned two North Korean financial institutions and eight individuals for laundering over $12.7 million in cryptocurrency from cybercrime and fraudulent IT worker schemes, aiming to disrupt funding for Pyongyang's weapons programs.
- UK mobile carriers have committed to upgrading their networks within a year to block spoofed phone numbers, a key tactic used by scammers impersonating banks and government agencies, as part of a new Telecoms Charter to combat fraud.
- A House lawmaker predicts that Democratic support for the reauthorization of FISA Section 702, a key US national security surveillance power, will be a "heavier lift" in 2026 due to concerns over its use for warrantless searches of American data.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/us-treasury-sanctions-north-korean-bankers-linked-to-cybercrime-it-worker-fraud/
📰 The Hacker News | https://thehackernews.com/2025/11/us-sanctions-10-north-korean-entities.html
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/uk-carriers-to-block-spoofed-phone-numbers-in-fraud-crackdown/
🗞️ The Record | https://therecord.media/section-702-surveillance-powers-renewal-jim-himes-house-democrats

Other Noteworthy Updates 💡

- The UK's Department for Environment, Food & Rural Affairs (Defra) spent £312 million upgrading its IT estate, including replacing Windows 7 laptops with Windows 10, just as Windows 10 reached end-of-support, highlighting significant technical debt and potential future costs for extended security updates.
- Famed cryptographer and software engineer Daniel J. Bernstein (DJB) has given a favourable report on Fil-C, a new memory-safe C/C++ compiler based on Clang, noting its compatibility and ability to trap categories of C errors, despite performance drawbacks.
- Google's $32 billion acquisition of cloud security firm Wiz has received clearance from the US Department of Justice after an antitrust investigation, marking Google's largest-ever acquisition and a significant move to enhance Google Cloud's security offerings.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/05/uk_defra_dept_spent_312m_window_10/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/05/djb_tries_filc_and_approves/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/05/googles_32b_wiz_acquisition_its/

#CyberSecurity #ThreatIntelligence #Vulnerabilities #ActiveExploitation #RCE #Malware #Ransomware #NationState #APT #AI #DataPrivacy #Regulatory #InfoSec #CyberAttack #IncidentResponse #SupplyChainSecurity

Alright team, it's been a pretty active 24 hours in the cyber world! We've got some significant law enforcement actions against ransomware and infostealer groups, several actively exploited zero-days to keep an eye on, and some important discussions around government policy and critical infrastructure security. Let's dive in:

Recent Cyber Attacks and Law Enforcement Action 🚨

- Oleksii Lytvynenko, an alleged Conti ransomware member, has been extradited from Ireland to the US, facing up to 25 years for wire fraud and computer fraud conspiracy. He's accused of involvement in data theft and ransom note deployment, with Conti extorting over $150 million globally.
- The University of Pennsylvania experienced a security incident where offensive "We got hacked" emails were sent to students and alumni, criticising the university's security and admission policies. The emails originated from a Penn mailing list platform hosted on Salesforce Marketing Cloud, which is currently under investigation.
- This extradition highlights ongoing international efforts to bring cybercriminals to justice, while the Penn incident serves as a reminder of the impact of even seemingly simple compromises on an organisation's reputation and operations.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/ukrainian-extradited-from-ireland-on-conti-ransomware-charges/
🤫 CyberScoop | https://cyberscoop.com/ukrainian-oleksii-lytvynenko-conti-ransomware-extradited/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/offensive-we-got-hacked-emails-sent-in-penn-security-incident/

New Threat Research & Law Enforcement Crackdowns 🛡️

- Russian authorities have arrested three individuals suspected of developing and distributing Meduza Stealer, an info-stealing malware capable of "reviving" expired Chrome authentication cookies and linked to Aurora Stealer. This rare domestic crackdown follows the group's targeting of a Russian institution, signalling a potential shift in Russia's long-standing tolerance for cybercrime that avoids local targets.
- A new malware family, Airstalk, has been identified, deployed by a suspected nation-state actor (CL-STA-1009) in what appears to be a supply chain attack. Airstalk misuses the AirWatch MDM API for covert command-and-control, harvesting browser data and screenshots, with some samples signed by a likely stolen certificate.
- The Eclipse Foundation has revoked leaked tokens from Open VSX VS Code extensions after a Wiz report found them exposed in public repositories due to developer errors. New security measures, including a token prefix "ovsxp_" and automated scanning, are being implemented to bolster supply chain security.

🗞️ The Record | https://therecord.media/meduza-stealer-malware-suspected-developers-arrested-russia
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/alleged-meduza-stealer-malware-admins-arrested-after-hacking-russian-org/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/10/31/russia_arrests_three_meduza_cyber_suspects/
🌐 The Hacker News | https://thehackernews.com/2025/10/nation-state-hackers-deploy-new.html
🌐 The Hacker News | https://thehackernews.com/2025/10/eclipse-foundation-revokes-leaked-open-vsx-tokens-following-wiz-discovery.html

Actively Exploited Vulnerabilities and Zero-Days ⚠️

- A Windows LNK zero-day (CVE-2025-9491) is being actively exploited by China-linked threat actor UNC6384 (Mustang Panda) in spearphishing campaigns targeting European diplomats. The flaw allows remote code execution via malicious LNK files to deploy the PlugX RAT, with no official Microsoft patch available yet.
- CISA has added a high-severity privilege escalation flaw in Broadcom VMware Tools and VMware Aria Operations (CVE-2025-41244) to its KEV catalog, noting active exploitation as a zero-day by China-linked UNC5174. This vulnerability allows unprivileged local actors to escalate to root.
- Unpatched Cisco IOS XE devices are still being targeted with BadCandy webshells, exploiting CVE-2023-20198 for unauthenticated root access. Australia warns of ongoing infections, attributing spikes to state-sponsored actors like China's Salt Typhoon, and advises immediate patching and hardening.
- A high-severity Linux kernel privilege escalation flaw (CVE-2024-1086) in netfilter: nf_tables is now actively exploited in ransomware attacks. CISA has added it to the KEV catalog, urging federal agencies to patch or apply mitigations like blocklisting 'nf_tables' or restricting user namespaces.
- Separately, CISA and NSA also highlighted active exploitation of CVE-2025-59287, a re-patched RCE flaw in Windows Server Update Services (WSUS), used by threat actors to harvest sensitive data from US organisations.

🌐 The Hacker News | https://thehackernews.com/2025/10/cisa-flags-vmware-zero-day-exploited-by.html
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/chinese-hackers-exploit-windows-zero-day-to-spy-on-european-diplomats/
🌐 The Hacker News | https://thehackernews.com/2025/10/china-linked-hackers-exploit-windows.html
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/australia-warns-of-badcandy-infections-on-unpatched-cisco-devices/
🗞️ The Record | https://therecord.media/chinese-hackers-scan-exploit-firewalls-government
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/cisa-linux-privilege-escalation-flaw-now-exploited-in-ransomware-attacks/
🌐 The Hacker News | https://thehackernews.com/2025/10/cisa-and-nsa-issue-urgent-guidance-to.html

Threat Landscape & Best Practices 🛡️

- CISA, NSA, and international partners have released a security blueprint for hardening on-premises Microsoft Exchange Servers, reiterating best practices like restricting admin access, MFA, strict TLS, zero-trust, and regular patching. This guidance is a response to the constant threat and complexity of Exchange security, which remains a prime target for nation-state and criminal actors.
- The UK's NHS is facing significant cybersecurity risks as 2% of its medical devices remain on unsupported Windows 10, with suppliers resisting upgrades to Windows 11 due to compatibility and cost issues. This situation forces trusts to quarantine devices and highlights the critical need for vendor cooperation and proactive patching to avoid past incidents like WannaCry.
- A US House Homeland Security Committee chairman's op-ed stresses the urgent need for government and industry collaboration to secure America's cyber future. Key priorities include strong information sharing, reducing duplicative compliance standards, bolstering the cyber workforce, and safely leveraging AI, while criticising the impact of government shutdowns on critical cybersecurity tools.

🤫 CyberScoop | https://cyberscoop.com/cisa-nsa-microsoft-exchange-server-guidance/
🌐 The Hacker News | https://thehackernews.com/2025/10/cisa-and-nsa-issue-urgent-guidance-to.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/10/31/nhs_windows_11_issues/
🤫 CyberScoop | https://cyberscoop.com/defending-america-cybersecurity-national-security-private-sector-andrew-garbarino-op-ed/

Data Privacy & Regulatory Updates ⚖️

- Sling TV's parent company has settled with California's Attorney General for $530,000 over violations of the California Consumer Privacy Protection Act (CCPA). The streaming service allegedly failed to provide an easy opt-out for data sales and inadequately protected children's privacy, highlighting the need for clear, accessible privacy controls.
- The FCC plans to vote on removing cybersecurity regulations for telecommunications companies, which were initially implemented after Chinese hackers (Salt Typhoon) breached multiple providers to steal sensitive data from high-profile US officials. The FCC argues these regulations are "legally erroneous" and that voluntary industry efforts and partnerships are sufficient.
- The Consumer Financial Protection Bureau (CFPB) has closed its probe into Meta's practices regarding the use of consumer financial data for targeted advertising. The investigation had explored potential violations of the Consumer Financial Protection Act, which protects against unfair and deceptive financial practices.

🗞️ The Record | https://therecord.media/sling-tv-california-data-protection-settlement
🗞️ The Record | https://therecord.media/fcc-plans-vote-rescind-biden-era-ruling-telecoms-cyber
🗞️ The Record | https://therecord.media/cfpb-meta-probe-advertising

Government Staffing & Program Changes 🏛️

- Participants in the CyberCorps: Scholarship for Service program are facing significant debt, with job and internship offers rescinded due to federal hiring freezes and budget cuts. This situation forces students to convert their scholarships into loans if they cannot secure government employment within 18 months, raising concerns about the program's future and the government's cyber workforce pipeline.
- Students criticise the lack of clear communication and support from overseeing agencies, with some being told to "get creative" in their job searches. This "bait-and-switch" scenario is seen as undermining trust and future recruitment efforts for federal cyber talent.

🤫 CyberScoop | https://cyberscoop.com/cyber-scholarship-for-service-students-say-government-has-pulled-rug-on-them-potentially-burdening-them-with-debt/

Sponsored Content 🤝

- ThreatLocker has launched Defense Against Configurations (DAC) for macOS, currently in Beta, to help organisations identify and remediate security misconfigurations before they are exploited. DAC scans Macs up to four times daily, flagging risky settings like unencrypted drives, disabled firewalls, and permissive sharing, and provides remediation guidance aligned with frameworks like CIS and NIST.
- This new feature aims to provide Mac administrators with the same level of security insight and control previously available for Windows, addressing a common attack vector often overlooked in macOS environments.

🌐 The Hacker News | https://thehackernews.com/2025/10/a-new-security-layer-for-macos-takes.html

#CyberSecurity #ThreatIntelligence #Ransomware #NationState #APT #ZeroDay #Vulnerability #Malware #IncidentResponse #DataPrivacy #Regulatory #Government #InfoSec #CyberAttack #MicrosoftExchange #WSUS #VMware #Cisco #Linux #MeduzaStealer #Airstalk #SupplyChainSecurity