Cybersecurity Brief – 2025-11-03

Mon, 03 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

A hacker has claimed responsibility for breaching the University of Pennsylvania, stating that data on 1.2 million donors was exposed. The breach was more extensive than initially reported and follows a prior incident where the university sent out a “We got hacked” email.

Check Point Research identified three security vulnerabilities in the Windows Graphics Device Interface (GDI) that could lead to remote code execution and memory exposure. These issues were reported to Microsoft and have been addressed.
Increased scanning activity has been observed on TCP ports 8530 and 8531, which is likely related to the recently disclosed WSUS vulnerability CVE-2025-59287.

Open VSX registry access tokens were accidentally leaked in public repositories, enabling threat actors to publish malicious extensions as part of a supply-chain attack. The registry rotated the affected tokens in response.
A Ukrainian national, alleged to be the coder “MrICQ” behind Jabber Zeus, has been arrested in Italy and is now in U.S. custody. He was previously indicted for conspiring with a hacking group responsible for stealing tens of millions of dollars from U.S. businesses.

The supply-chain attack on Open VSX demonstrates ongoing threat actor interest in exploiting development infrastructure and public repositories to distribute malicious code.
The observed scanning for WSUS-related ports indicates active reconnaissance for exploitation opportunities following the disclosure of CVE-2025-59287.

Sat, 25 Oct 2025 00:00:00 +0000

Toys ‘R’ Us Canada experienced a data breach resulting in customer information, including names, addresses, phone numbers, and email addresses, being leaked and published on the dark web.
A major AWS outage occurred this week due to a significant DNS failure, impacting multiple websites and online services.
A large-scale malicious network on YouTube has been identified, with over 3,000 videos used as malware delivery traps, leveraging trusted platforms for distribution.
Multiple fraudulent domains and fake applications have targeted users of the newly launched Perplexity Comet browser.
LastPass customers are being targeted by a phishing campaign involving fake death claims to illicitly access password vaults via legacy inheritance processes.

Microsoft released out-of-band patches for a critical Windows Server Update Services (WSUS) vulnerability (CVE-2025-59287). This flaw allows remote, unauthenticated code execution and is under active exploitation, with public proof-of-concept exploit code available.
WordPress websites using outdated GutenKit and Hunk Companion plugins are being targeted in a mass exploitation campaign, with attackers leveraging old, critical vulnerabilities to achieve remote code execution.

The Smishing Triad group has been linked to over 194,000 malicious domains used in a global smishing campaign since January 2024, targeting a wide range of services.
APT36, a Pakistan-linked threat actor, has been observed targeting Indian government entities using spear-phishing emails to deliver Golang-based DeskRAT malware.
North Korean Lazarus Group has targeted European drone technology companies using fake job offers in order to steal sensitive information.
The Everest group has claimed responsibility for a cyberattack on Collins Aerospace.
Gamers are being targeted with red teaming tools and remote access trojans (RATs) in ongoing campaigns.

Phishing campaigns are increasingly impersonating trusted brands and services, including Google Careers recruiters and LastPass, to target job seekers and password management users.
Large-scale abuse of trusted platforms such as YouTube is being used for widespread malware distribution.
Attackers are rapidly exploiting newly disclosed vulnerabilities, particularly in widely used software such as Microsoft WSUS and WordPress plugins.
There is a reported increase in cyberattacks against financially constrained US government agencies during periods of shutdown and resource reduction.
Microsoft has disabled downloaded file previews in Windows to prevent NTLM hash leaks via HTML tags referencing external paths.
Shadow Escape and other red teaming tools are being used in active campaigns targeting specific user groups, including gamers.

Mozilla will require, starting next month, that Firefox extension developers disclose whether their add-ons collect or share user data with third parties.
CISA layoffs in the US are reducing federal cybersecurity resources, prompting calls for enterprises to strengthen their own cyber defences.
The US Department of Homeland Security is soliciting proposals for AI-powered surveillance trucks to enhance border monitoring capabilities.