Cybersecurity Brief – 2025-10-31

Fri, 31 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Ribbon Communications, a major telecom services provider with clients including the US government and global telecom firms, disclosed a breach of its IT network by nation-state actors, with access dating back to December 2023.
Conduent, a business process outsourcing (BPO) giant, confirmed a 2024 data breach impacting over 10.5 million individuals. Stolen data includes names, addresses, dates of birth, Social Security numbers, and health and insurance information. A ransomware gang has claimed responsibility.
The Canadian Centre for Cyber Security reported that hackers tampered with industrial control systems (ICS) at a water facility and an oil and gas firm, warning of increasing hacktivist activity targeting internet-exposed ICS environments.

Newly Discovered Vulnerabilities

CISA added a high-severity zero-day vulnerability affecting Broadcom VMware Tools and VMware Aria Operations to its Known Exploited Vulnerabilities Catalog. The flaw is being actively exploited by China-linked threat actors, and federal agencies have been ordered to patch immediately.
A critical authentication bypass vulnerability (CVE-2025-54603) was patched in Claroty products, which exposed operational technology (OT) environments and critical infrastructure to potential disruption and data theft.
A severe exploit targeting the Chromium Blink rendering engine was disclosed, allowing attackers to crash Chromium-based browsers instantly via a malicious URL.
Researchers highlighted a DNS poisoning flaw, supply-chain attack vectors, and new malware strains in the npm ecosystem, including over 130 packages delivering infostealers and PhantomRaven malware stealing GitHub tokens from developers.
A Living-off-the-Land (LotL) attack technique was detailed, leveraging Windows’ native AI stack to hide malware in trusted AI data files.

Notable Threat Actor Activity

Russian ransomware gangs are increasingly adopting the open-source AdaptixC2 command-and-control framework for advanced attacks.
China-linked hackers are actively exploiting VMware vulnerabilities in live attacks.
LinkedIn is being abused for targeted phishing campaigns against finance executives, using fake executive board invitations to steal Microsoft credentials.
Multiple malicious npm packages, including those delivering PhantomRaven malware, have been downloaded over 100,000 times, targeting developer credentials and tokens.

Trends, Tools, or Tactics of Interest

There is a surge in NFC relay malware in Eastern Europe, with over 760 Android apps identified as capable of stealing payment card data via NFC relay attacks.
Attackers are increasingly leveraging supply-chain attacks, with npm registry being a recurring target for infostealer distribution.
AI and machine learning defenses are scaling up: Google reports its built-in Android AI blocks over 10 billion scam messages and calls monthly.
Security researchers note a rise in attackers focusing on fewer, high-impact targets and exploiting defender blind spots.
Living-off-the-Land (LotL) tactics are evolving, with attackers embedding malware in trusted system components like Windows AI stacks to evade detection.
Social engineering tactics are being refined, with threat actors exploiting “Contact Us” forms and public data to craft more effective phishing and business email compromise (BEC) attacks.

Regulatory or Policy Developments

CISA and NSA, with global partners, released new security guidance for hardening Microsoft Exchange servers to address persistent exploitation risks.
CISA mandated immediate patching of the VMware Tools vulnerability for federal agencies due to active exploitation.
Guidance and warnings from Canadian authorities emphasize the need for increased ICS/OT security amid rising hacktivist threats.

Cybersecurity Brief – 2025-10-22

Wed, 22 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

The PassiveNeuron cyber-espionage campaign has been reported targeting high-profile servers in government, industrial, and financial sectors across Asia, Africa, and Latin America. Attackers are deploying custom Neursite and NeuralExecutor APT implants alongside Cobalt Strike to maintain persistence and exfiltrate data.
CISA has confirmed active exploitation of an Oracle E-Business Suite SSRF vulnerability (CVE-2025-61884) and has added it to its Known Exploited Vulnerabilities catalog.
Over 73,000 WatchGuard Firebox devices are impacted by a critical flaw in the Fireware OS iked process, allowing unauthenticated remote code execution.
Myanmar military authorities have shut down a major cybercrime centre, detaining over 2,000 individuals involved in global cyberscam operations.

Newly Discovered Vulnerabilities

TP-Link Omada gateway devices are affected by four newly disclosed vulnerabilities, including two critical flaws enabling remote code execution and a critical pre-auth OS command injection. Security updates have been released.
Cursor and Windsurf IDEs have been found to contain over 94 n-day vulnerabilities inherited from outdated Chromium and V8 JavaScript engine components.
CISA has issued warnings about exploited vulnerabilities in Apple, Kentico, and Microsoft products, involving code execution, authentication bypass, and privilege escalation.
A supply chain attack has been identified targeting VS Code extensions with ‘GlassWorm’ malware, which leverages invisible Unicode characters for obfuscation and uses blockchain-based infrastructure for resilience.

Notable Threat Actor Activity

The PolarEdge botnet is actively targeting Cisco, ASUS, QNAP, and Synology routers in an expanding campaign, as documented by researchers.
Russian state-backed group Star Blizzard has increased deployment of evolving malware families (NoRobot, MaybeRobot), using complex delivery chains that begin with compromised “I am not a robot” CAPTCHA pages.
Fraud campaigns targeting streaming platforms are increasingly using generative AI and bots to create and promote fake content.

Trends, Tools, or Tactics of Interest

Email phishing campaigns in 2025 are leveraging PDF attachments with QR codes, password-protected PDFs, calendar phishing, and advanced phishing sites capable of validating email addresses.
Vidar Stealer 2.0 has been released, featuring multi-threaded data theft and enhanced evasion capabilities, reinforcing its position as a leading malware-as-a-service operation.
Hackers exploited 34 zero-day vulnerabilities on the first day of Pwn2Own Ireland 2025, demonstrating continued interest and success in vulnerability research.
Social engineering attacks are targeting Salesforce accounts via fake support calls.
Research from Anthropic indicates that poisoning AI models can be achieved with as few as 250 malicious documents, highlighting the susceptibility of AI systems to data poisoning.
Streaming fraudsters are increasingly using AI tools and bots for large-scale manipulation.
Electronic warfare and GPS interference are affecting a wide range of commercial sectors beyond aviation, including shipping, agriculture, and finance.

Regulatory or Policy Developments Affecting the Security Industry

CISA has updated its Known Exploited Vulnerabilities list to include recent vulnerabilities affecting Oracle, Apple, Kentico, and Microsoft products.
Meta has introduced new tools and warnings on WhatsApp and Messenger to help protect users from scams.
Allan Friedman, a leading figure in Software Bill of Materials (SBOM) advocacy, has joined NetRise as a strategic advisor to advance supply chain visibility.
Veeam has announced the acquisition of Securiti AI for $1.7 billion, aiming to unify data resilience with data security, privacy, and governance.
Dataminr is set to acquire ThreatConnect for $290 million to combine data signal analysis with internal threat intelligence capabilities.

Chromium on DanSec Daily

Cybersecurity Brief – 2025-10-31

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Cybersecurity Brief – 2025-10-22

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry