Cybersecurity Brief – 2025-11-05

Wed, 05 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

The Swedish IT systems supplier Miljödata suffered a data breach impacting 1.5 million individuals. The Swedish Authority for Privacy Protection (IMY) is investigating.
Japanese media conglomerate Nikkei reported a data breach after its Slack platform was compromised, exposing personal data of over 17,000 employees and business partners.
Hundreds of malicious Android apps on Google Play were downloaded over 42 million times between June 2024 and May 2025, according to Zscaler, distributing various malware strains.
Threat actors are actively exploiting a critical vulnerability in the Post SMTP WordPress plugin (installed on 400,000+ sites) to hijack admin accounts.
Attackers are exploiting a critical authentication bypass flaw in the JobMonster WordPress theme, allowing admin account hijacking under certain conditions.
European authorities dismantled a cryptocurrency fraud and money laundering network responsible for defrauding victims of over €600 million, arresting nine individuals.
U.S. prosecutors indicted three individuals for deploying BlackCat (ALPHV) ransomware against five U.S. companies between May and November 2023, resulting in network compromise and extortion.
Transportation and logistics companies have been targeted by threat actors using sophisticated attack chains to deploy remote access tools and steal cargo.

Newly Discovered Vulnerabilities

CISA added critical vulnerabilities in Gladinet and Control Web Panel (CWP) to its Known Exploited Vulnerabilities (KEV) catalog. The CWP flaw (CVE-2025-48703) allows remote, unauthenticated command execution and is being actively exploited.
A critical vulnerability (CVE-2025-11953) in the “@react-native-community/cli” npm package for React Native allowed arbitrary command/code execution on Windows, macOS, and Linux. The issue has now been patched.
Four security flaws were disclosed in Microsoft Teams enabling attackers to impersonate colleagues and edit messages without detection, facilitating social engineering and phishing attacks.
Google’s AI-powered agent “Big Sleep” discovered five new vulnerabilities in Apple’s Safari WebKit. Apple has issued patches addressing these and over 100 other vulnerabilities across its operating systems.
The November 2025 Android update patched two critical remote code execution vulnerabilities in the platform’s System component.
Apple released updates for iOS and macOS addressing 110 vulnerabilities, including 19 in WebKit, some of which were critical.

Notable Threat Actor Activity

A new cybercrime collective has formed, merging Scattered Spider, LAPSUS$, and ShinyHunters. The group has created at least 16 Telegram channels since August 2025, indicating increased coordination.
The Russian threat group “Curly COMrades” is abusing Microsoft Hyper-V to deploy hidden Alpine Linux-based virtual machines on Windows hosts, bypassing endpoint detection and response (EDR) solutions to run malware undetected.
Operation SkyCloak: Threat actors are deploying a Tor-enabled OpenSSH backdoor via weaponized phishing attachments, targeting defense sectors in Russia and Belarus.
The North Korean group Kimsuky has debuted the HTTPTroy backdoor against South Korean targets, with enhanced obfuscation and anti-analysis features.
The SesameOp backdoor has been observed using the OpenAI API as a covert command-and-control (C2) channel, demonstrating the misuse of generative AI services for stealthy communications.
Criminals are impersonating U.S. Immigration and Customs Enforcement (ICE) agents in social engineering campaigns, prompting an FBI warning to law enforcement.

Trends, Tools, or Tactics of Interest

Browser sandbox evasion: Attackers are exploiting browser behaviors to steal credentials, abuse extensions, and move laterally, bypassing traditional security tools.
Increased ransomware and extortion attacks in Europe, with attackers leveraging geopolitical tensions and AI-enhanced social engineering.
Malicious Android apps continue to proliferate on official app stores, using fake news and identification apps as lures for banking trojans and data theft.
Use of AI and cloud APIs (e.g., OpenAI) by threat actors for covert C2 and operational security.
Open source security: The Wazuh platform is being promoted for ransomware defense, reflecting ongoing interest in open source security tooling.

Regulatory or Policy Developments

Microsoft announced plans to remove Defender Application Guard from Office, starting with Office version 2602 in February 2026 and completing removal by December 2027.
California fined Sling TV for deceptive privacy practices, including misleading opt-out controls and improper use of children’s data for ad targeting.
The Swedish privacy regulator (IMY) is investigating the Miljödata breach for potential violations of data protection requirements.

Industry Moves

Bugcrowd acquired application security firm Mayhem, nearly doubling its valuation.
Zscaler acquired AI security company SPLX to enhance its Zero Trust Exchange platform with red teaming and threat inspection capabilities.

Cybersecurity Brief – 2025-08-13

Wed, 13 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Hackers leaked data stolen from Allianz Life in ongoing Salesforce data theft campaigns, exposing 2.8 million records containing sensitive information on business partners and customers.
Over 275 million patient records were breached in the healthcare sector in 2024, primarily due to weak or stolen passwords.
Researchers identified Docker images on Docker Hub still containing the XZ Utils backdoor, more than a year after its public disclosure. At least 35 Linux images remain affected, posing ongoing supply chain risks.
The U.S. Department of Justice seized approximately $1 million in cryptocurrency from the BlackSuit ransomware gang.
Over 3,300 Citrix NetScaler devices remain unpatched against the actively exploited “CitrixBleed 2” vulnerability, leaving organisations at risk of authentication bypass attacks.

Newly Discovered Vulnerabilities

Microsoft’s August 2025 Patch Tuesday addressed 107–111 vulnerabilities, including 13–17 rated as critical. One publicly disclosed zero-day vulnerability in Windows Kerberos was patched, alongside several elevation-of-privilege flaws.
Adobe released security updates fixing over 60 vulnerabilities across 13 products, including Commerce, Substance, InDesign, FrameMaker, and Dimension.
SAP patched a critical vulnerability in S/4HANA as part of its August 2025 security notes.
Major industrial control system (ICS) vendors (Siemens, Schneider, Aveva, Honeywell, ABB, Phoenix Contact) issued advisories for code execution vulnerabilities.
Citrix NetScaler ADC products are being actively exploited via CVE-2025-6543, a critical security flaw confirmed by the Dutch National Cyber Security Centre (NCSC-NL).
A vulnerability in Erlang/OTP (CVE-2025-32433) has been widely exploited in operational technology (OT) networks since early May.
A now-patched WinRAR vulnerability has been exploited by at least two separate threat groups.

Notable Threat Actor Activity

The Charon ransomware family, employing APT-level evasion tactics, has been deployed in targeted attacks against public sector and aviation organisations in the Middle East. The campaign may be linked to China’s state-sponsored Earth Baxia group.
Cybercrime groups ShinyHunters and Scattered Spider have joined forces in data extortion campaigns, initially targeting Salesforce customers, with indications of expansion towards financial services and technology providers. ShinyHunters’ tactics now mirror those of Scattered Spider.
The newly identified Curly COMrades APT group has targeted government entities in Georgia and Moldova using custom backdoor malware and NGEN COM hijacking for persistent access.
Fortinet SSL VPN devices experienced a significant spike in brute-force attacks globally, with attackers later shifting focus to FortiManager.
Researchers report ongoing exploitation of Microsoft Teams in social engineering attacks to facilitate credential theft and malware delivery.

Trends, Tools, or Tactics of Interest

Supply chain risks persist as malicious Docker images with the XZ Utils backdoor remain available on Docker Hub.
Threat actors continue to abuse business logic flaws and leverage dark web marketplaces to sell enterprise network access, streamlining cybercrime operations.
Social engineering remains a prominent attack vector, with attackers exploiting communication platforms (e.g., Microsoft Teams) and using tactics such as tax office or Amazon recall impersonation scams.
APT actors are leveraging advanced persistence techniques, such as NGEN COM hijacking and scheduled tasks, to maintain long-term access in targeted environments.
The debate between enterprise browsers and secure browser extensions is highlighted as a key consideration for mitigating browser-based risks.
Elevation-of-privilege vulnerabilities dominated Microsoft’s August 2025 Patch Tuesday, reflecting ongoing attacker interest in privilege escalation.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced end-of-support for Windows 11 23H2 Home and Pro editions in November 2025.
Android’s protected Kernel-based Virtual Machine (pKVM) achieved SESIP Level 5 security certification, the highest level for IoT and mobile platforms.
The Dutch NCSC issued an alert regarding active exploitation of Citrix NetScaler CVE-2025-6543 in critical sectors.
Chinese authorities have publicly questioned the security of AI chips from Nvidia and AMD, citing concerns about potential backdoors.

Curly COMrades on DanSec Daily

Cybersecurity Brief – 2025-11-05

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Industry Moves

Cybersecurity Brief – 2025-08-13

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry