Cybersecurity Brief – 2025-10-16

Thu, 16 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

F5 disclosed a significant breach attributed to nation-state actors, resulting in the theft of BIG-IP source code, undisclosed security vulnerabilities, and some customer information. The attack profile suggests Chinese involvement. Patches for stolen vulnerabilities have been released, and CISA has issued an emergency directive regarding F5 devices.
Capita has been fined £14 million by the UK Information Commissioner’s Office for a 2023 data breach that exposed personal data of 6.6 million people.
Harvard University suffered a breach via an Oracle zero-day exploit, with the Clop ransomware group claiming responsibility as part of a broader campaign targeting Oracle customers.
Spanish retailer MANGO disclosed a data breach affecting customer information, resulting from a compromise at a marketing vendor.
A 19-year-old individual was sentenced to four years in prison for orchestrating a major cyberattack on PowerSchool in December 2024.
Over 100 Visual Studio Code (VS Code) extensions were found to have leaked access tokens, creating supply chain risks by allowing attackers to update extensions maliciously.
Discord named customer service firm 5CA as the third-party responsible for a data breach; 5CA denies involvement.
Scientists reported ongoing leakage of unencrypted voice calls and text messages from geostationary satellites, exposing sensitive personal and business data.

Newly Discovered Vulnerabilities

Microsoft released fixes for 183 security flaws, including two new zero-days actively exploited in the wild-one affecting every version of Windows ever shipped.
A critical vulnerability in Adobe Experience Manager, rated CVSS 10.0, is under active attack and has been added to CISA’s Known Exploited Vulnerabilities catalog.
F5 released security updates for BIG-IP vulnerabilities compromised during the recent breach.
High-severity vulnerabilities have been patched by Fortinet and Ivanti in their October 2025 Patch Tuesday updates.
Siemens, Schneider, Rockwell, ABB, and Phoenix Contact published over 20 advisories addressing vulnerabilities in their industrial control systems (ICS).
Microsoft confirmed that September 2025 Windows Server updates are causing Active Directory issues on Windows Server 2025 systems.

Notable Threat Actor Activity

The Mysterious Elephant APT group has intensified operations, targeting government and diplomatic entities in South Asia with custom tools such as BabShell and MemLoader HidenDesk, and exfiltrating WhatsApp-related data.
Chinese threat group ‘Jewelbug’ conducted a five-month-long intrusion into a Russian IT service provider, indicating geographic expansion beyond Southeast Asia.
Clop ransomware group claimed responsibility for the Harvard University breach as part of a campaign exploiting Oracle zero-day vulnerabilities.
A new banking trojan, Maverick, was distributed at scale in Brazil via malicious LNK files sent over WhatsApp. The malware shares code with Coyote.
Ongoing phishing campaigns are targeting LastPass and Bitwarden users with fake breach alerts, leading to PC compromise through malicious downloads. Similar phishing tactics are being used against Robinhood users.

Trends, Tools, or Tactics of Interest

Attackers are actively bypassing synced passkeys, highlighting inherent risks in cloud-based passkey deployments.
There is an increase in supply chain risks due to compromised VS Code extensions, with over 100 leaking tokens that could allow malicious updates.
Satellite communications remain insecure, with continued leakage of unencrypted sensitive data.
Dark web threats are increasingly hiding within normal network traffic, with network detection and response (NDR) platforms being promoted as effective countermeasures.
TikTok is being used as a platform for crypto-related scams, luring victims with fraudulent paywall schemes.

Regulatory or Policy Developments Affecting the Security Industry

The UK ICO imposed a £14 million fine on Capita for failing to protect personal data in a 2023 breach.
CISA issued an emergency directive mandating urgent remediation of critical vulnerabilities in F5 devices.
LevelBlue announced plans to acquire Cybereason, expanding its extended detection and response (XDR) and managed detection and response (MDR) portfolio.

Cybersecurity Brief – 2025-10-15

Wed, 15 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

The U.S. Department of Justice, with UK cooperation, seized $15 billion in bitcoin from the leader of the Prince Group, a criminal syndicate responsible for large-scale “pig butchering” cryptocurrency investment fraud targeting US victims.
Harvard University was confirmed as a victim of the Oracle E-Business Suite zero-day vulnerability (CVE-2025-61884), with over 1TB of data allegedly stolen and leaked by the Cl0p ransomware group.
Chinese APT threat actors, attributed as “Flax Typhoon,” compromised an ArcGIS geo-mapping server, maintaining undetected persistence for over a year by modifying the software into a stealth backdoor.
Malicious crypto-stealing Visual Studio Code extensions, attributed to the “TigerJack” group, resurfaced on the OpenVSX registry and the Microsoft VSCode marketplace, targeting developers to exfiltrate cryptocurrency and sensitive data.

Newly Discovered Vulnerabilities

SAP released patches for 13 new vulnerabilities, including a maximum-severity bug in SAP NetWeaver AS Java that allows unauthenticated arbitrary command execution.
Oracle silently patched a zero-day vulnerability (CVE-2025-61884) in Oracle E-Business Suite, which had been publicly exploited with a proof-of-concept leaked by the ShinyHunters group.
A new side-channel attack, “Pixnapping,” was disclosed affecting Google and Samsung Android devices, enabling malicious apps with no permissions to steal 2FA codes, Google Maps timelines, and other sensitive data by extracting pixels from the display. Google has issued a partial patch.
AMD issued fixes for “RMPocalypse,” a vulnerability in Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP), which could allow attackers to undermine confidential computing guarantees with a single 8-byte write.
Nearly 200,000 Linux Framework laptops were shipped with signed UEFI shell components, exposing them to Secure Boot bypass attacks.
Adobe published advisories for over 35 vulnerabilities across its products, including a critical flaw in the Connect Collaboration Suite.

Notable Threat Actor Activity

Chinese state-backed actors (“Flax Typhoon”) exploited the ArcGIS server for year-long persistence and stealth access.
ShinyHunters leaked a proof-of-concept exploit for the Oracle E-Business Suite zero-day, leading to real-world breaches.
TigerJack continues to distribute malicious VSCode extensions to steal cryptocurrency from developers.

Trends, Tools, or Tactics of Interest

A new phishing campaign is leveraging AI tools to craft emails and evade detection, indicating increased sophistication in social engineering attacks.
Infostealers are increasingly targeting clipboard content, including images, for data exfiltration and on-the-fly modification (e.g., crypto-wallet address swapping).
Research into hacktivist campaigns identified over 2,000 unique hashtags across 11,000 posts, providing insight into hacktivist targeting and campaign organisation.
The emergence of autonomous AI agents in enterprise environments (“Shadow AI”) is shifting security risks, with agents now capable of opening tickets, fixing incidents, and making operational decisions independently.
Security firms FuzzingLabs and Gecko Security are in dispute over CVE reporting credit, highlighting ongoing issues around vulnerability disclosure attribution.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft Windows 10 and Exchange Server 2016/2019 have reached end-of-support, with no further security updates provided. Microsoft is urging customers to migrate to supported platforms.
The US and UK coordinated law enforcement action against the Prince Group, marking one of the largest cryptocurrency seizures in history.
Cybereason is to be acquired by LevelBlue, continuing consolidation in the managed security services provider (MSSP) sector.

LevelBlue on DanSec Daily

Cybersecurity Brief – 2025-10-16

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2025-10-15

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry