Synology on DanSec Daily

Cybersecurity Brief – 2026-11-03

Tue, 03 Nov 2026 00:00:00 +0000

Major Incidents or Breaches

Harvard University disclosed that a breach of its Alumni Affairs and Development systems in November 2025 resulted in the exposure of data linked to over 850,000 unique email addresses ^[16].
Frontline Education reported a data breach affecting more than 1.3 million school district staff and students, with attackers exploiting a flaw in third-party software ^[20].
The UK-based school estate suffered a ransomware attack by a 3AM affiliate, which encrypted approximately 37 out of nearly 50 systems accessed from an unmanaged host. The attack is suspected to have used AI-assisted tactics ^[13]^[28].
Financial technology platform Sageworks, operated by Abrigo, was taken offline due to a suspected cyberattack, with borrower-facing capabilities still unavailable following the incident ^[18].
Mercado Bitcoin, Brazil’s largest cryptocurrency exchange, confirmed a cyberattack that led to the theft of more than $46 million ^[36].
Synology reported ransomware attacks targeting its NAS devices by exploiting a previously patched DSM vulnerability, urging customers to update their systems ^[5].
BTCPay Server users reported theft of Bitcoin and Litecoin from hot wallets due to exploitation of a server vulnerability. At least $1.63 million has been traced to attackers, and users are urged to update to the latest version ^[4]^[43].
Over 100 European supermarkets in Belgium, Sweden, Estonia, Ireland, and Luxembourg experienced a second wave of cyberattacks on refrigeration systems, resulting in tampered temperature settings and the removal of food from shelves ^[6]^[27]^[44]^[67].
Videostrong, a Chinese device manufacturer, was found to have intentionally shipped more than 1.3 million Android TV boxes with pre-installed backdoors, creating a botnet used for criminal purposes. The XCPE botnet was dismantled through a coordinated industry and law enforcement effort ^[10]^[19]^[25]^[31]^[40]^[47]^[60]^[77].

Newly Discovered Vulnerabilities

Red Hat released patches for a critical use-after-free vulnerability in the Linux kernel’s IPv4 TCP code (CVSS 9.8) affecting RHEL 8, 9, and 10. Ubuntu provided fixes for testing ^[1].
Siemens SIMATIC IoT2050 Advanced devices are under active attack due to exploitation of CVE-2026-58115, a maximum-severity authentication flaw, allowing remote command execution and backdoor installation ^[7].
Node-RED, a widely used OT programming tool, is being actively exploited via CVE-2026-58115, an authentication bypass vulnerability. Attackers are deploying Linux bots and webshells on unprotected servers ^[23]^[39]^[52].
Barracuda Networks warned of two critical vulnerabilities in its devices that could allow attackers to execute commands with root privileges. Customers are urged to patch immediately ^[11].
The CryptoPayment Gateway WordPress plugin is being targeted due to an unpatched maximum-severity security vulnerability that can expose wallet credentials ^[8].
Android’s November 2026 security updates patched over 200 vulnerabilities, including a critical remote code execution flaw in the Framework component ^[22].
Google introduced a new $250,000 Cloud Vulnerability Reward Program (VRP) payout for high-impact “Root-in-Cloud” bugs affecting its cloud architecture ^[15].
OpenAI increased its top bug bounty payout to $172,000, with bonuses for high-quality vulnerability reports ^[56].

Notable Threat Actor Activity

The Russia-aligned Gorbag APT group has been targeting Ukrainian organizations, including courts and city councils, using spearphishing attachments and self-deleting information-stealer malware. The group has been active since at least February 2025 ^[3]^[34]^[54].
Chinese threat actors used the open-source, multi-agent AI penetration-testing framework ARTEX in attacks against more than 200 organizations across 14 countries. These attacks were conducted in an automated fashion over 11 days ^[17]^[53].
BYOD ransomware gang claimed responsibility for a cyber incident at Michigan State University, following a previous attack on the University of Michigan hospital ^[37].
Police in Europe arrested seven suspects and seized over 100 servers in a crackdown on an investment fraud network responsible for more than €4 million in losses ^[14]^[49].
Russia’s Interior Ministry dismantled the infrastructure of the VasyGrek cybercrime group and detained three suspects ^[33].

Trends, Tools, or Tactics of Interest

AI is increasingly being used by both state and criminal threat actors for automated attacks, vulnerability discovery, and scaling offensive operations. The UK NCSC and other sources highlight that AI-powered ransomware and cyberattacks against critical infrastructure are expected to rise significantly by 2028 ^[24]^[35]^[38]^[45]^[48]^[53]^[80]^[85]^[86].
Reports indicate the emergence of “LLMjacking,” where criminals hijack access to large language models (LLMs) in cloud environments, resulting in illicit charges of up to $1 million for affected businesses ^[42]^[46]^[55].
The 3AM ransomware affiliate used suspected AI-generated loops to revise commands during the UK school estate attack, suggesting partial automation in ransomware operations ^[13]^[28].
NATO’s Crossed Swords exercise introduced AI agents and OpenAI Daybreak into joint cyber and kinetic operations training, indicating a trend toward integrating AI in both attack and defense scenarios ^[26].
Gartner predicts that by 2028, security operations centers (SOCs) will have 50 percent more engineers than analysts, as AI agents take over routine alert handling ^[12].
Attackers are exploiting misconfigured or forgotten internet-facing assets, including OT devices, as illustrated by recent Node-RED and Siemens IoT2050 incidents ^[7]^[23]^[39]^[52]^[50]^[59].
The Binance breach highlighted the risks of weak system separation and inadequate controls, demonstrating how a single compromised endpoint can lead to systemic losses ^[29].

Regulatory or Policy Developments Affecting the Security Industry

The UK National Cyber Security Centre (NCSC) issued a warning that AI-powered attacks on UK critical infrastructure are expected within the next two years, urging organizations to invest in resilience and address longstanding vulnerabilities ^[24]^[35]^[38]^[45]^[48]^[85]^[86].
Business groups are campaigning for long-term renewal of the US CISA 2015 information sharing law, seeking its extension in the upcoming defense authorization bill ^[61].

Sources

Harvard University data breach exposed info of 851,000 accounts - bleepingcomputer.com
Frontline Education Data Breach Impacts Over 1.3 Million - securityweek.com
UK school estate hit by 3AM ransomware in suspected AI-assisted attack - bleepingcomputer.com
3AM Affiliate Embraces AI-Like Loops in European School Attack - darkreading.com
Fintech platform Sageworks taken offline after suspected cyberattack - bleepingcomputer.com
Largest crypto exchange in Brazil confirms cyberattack as millions flow out of platform - therecord.media
Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw - thehackernews.com
Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets - thehackernews.com
Hackers Exploit BTCPay Server Flaw to Steal Cryptocurrency - infosecurity-magazine.com
New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food - thehackernews.com
Over 100 European Stores Hit as Supermarket Fridge Attacks Return - securityweek.com
Cyber-Attack on Refrigeration Systems Hits Supermarkets Across Europe - infosecurity-magazine.com
Supermarket freezers across Europe hit by second suspected cyber-attack - databreaches.net
Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access - thehackernews.com
Google disrupts million-device XCPE Android malware botnet, bans TV box maker - bleepingcomputer.com
Google Dismantles XCPE Botnet of 1.3 Million Android Devices - securityweek.com
Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies - krebsonsecurity.com
Cops bust botnet of 1.3M infected Android TV boxes - theregister.com
Police and Tech Firms Team Up to Dismantle XCPE Botnet - infosecurity-magazine.com
Google shuts down global botnet running on certified Android devices - cyberscoop.com
A hidden backdoor put 1.3 million TV boxes to work for criminals - malwarebytes.com
Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing - thehackernews.com
Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors - thehackernews.com
Critical Node-RED Flaw Exploited in Attacks - securityweek.com
Max-severity bug in widely used OT programming tool exploited to deliver Linux malware - theregister.com
Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115) - helpnetsecurity.com
Barracuda warns of critical flaws allowing root access to devices - bleepingcomputer.com
Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials - thehackernews.com
Android’s November 2026 Updates Patch Over 200 Vulnerabilities - securityweek.com
Google adds new $250,000 Cloud VRP reward for Root-in-Cloud bugs - bleepingcomputer.com
OpenAI raises top bug bounty payout to $172,000 with bonuses - helpnetsecurity.com
Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware - thehackernews.com
Russia-linked cyber spies target Ukraine's war crimes investigations, military aid routes - therecord.media
Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware - helpnetsecurity.com
Chinese hackers use ARTEX AI in automated attacks against 200 orgs - bleepingcomputer.com
AI agents scale and speed up Chinese-linked attacks - helpnetsecurity.com
Michigan State cyber incident claimed by ransomware gang behind recent hospital attack - therecord.media
Police seizes over 100 servers in investment scam crackdown - bleepingcomputer.com
Police seize over 100 servers linked to investment fraud with more than €4 million in losses - helpnetsecurity.com
Russia dismantles infrastructure of VasyGrek cybercrime group, detains three suspects - therecord.media
UK Cyber Chief Says the UK Will Face AI Cyberattacks on Critical Infrastructure by 2028 - securityweek.com
UK faces ‘unprecedented rise’ in cyberattacks in coming months, warns cyber chief - therecord.media
Britain on notice: AI-powered ransomware attacks to arrive by 2028 - theregister.com
NCSC Chief Warns of Imminent AI Ransomware Threat to UK Critical Infrastructure - infosecurity-magazine.com
UK to face AI-powered cyber attacks within two years, warns NCSC - computerweekly.com
Unit 42 Threat Intelligence Highlights - Nov. 2, 2026 - unit42.paloaltonetworks.com
Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years - ncsc.gov.uk
Artificial intelligence and cyber intrusion - ncsc.gov.uk
Token thieves costing companies $100K+ per day in illicit LLM charges - theregister.com
LLMJacking is Costing Some Businesses Up to $1m, Warns Google - infosecurity-magazine.com
Stolen AI access leaves companies with cloud bills of up to $1 million - helpnetsecurity.com
NATO’s Crossed Swords Exercise Brings AI Agents Into Cyber Operations Training - securityweek.com
Gartner Predicts SOCs Will Have 50% More Engineers Than Analysts by 2028 - bleepingcomputer.com
Novee puts forgotten internet-facing assets through penetration testing - helpnetsecurity.com
CISA’s new strategy runs into America’s blind trust problem - cyberscoop.com
One Compromised Laptop, Billions Lost: The Binance Attack-Path Warning - darkreading.com
Business groups mount fresh campaign for long-term renewal of information sharing law - cyberscoop.com

Cybersecurity Brief – 2026-11-02

Mon, 02 Nov 2026 00:00:00 +0000

Major Incidents or Breaches

Google, with industry partners, dismantled the XCPE Android botnet, which had enrolled over 1.3 million TV set-top boxes. The backdoor was attributed with high confidence to Videostrong, a manufacturer that allegedly sold access to criminal groups. Google has banned the company from its ecosystem ^[1]^[48]^[70].
Hackers disrupted refrigeration systems at supermarkets across several European countries in a second wave of attacks, remotely changing temperature settings and causing food spoilage and operational disruptions ^[10]^[35]^[39]^[50].
The FBI confirmed that North Korean state-sponsored group TraderTraitor was responsible for the $6.3 billion Binance cryptocurrency heist, the largest such theft on record. Over 600 associated crypto addresses have been flagged, and laundering activity is ongoing ^[15]^[23]^[40]^[43]^[53]^[65].
Chainalysis suffered a data breach after attackers used “offensive agentic techniques” involving AI-driven methods to access internal systems and tools ^[21]^[44]^[52].
The Florida Department of Education reported a breach of its student aid website, potentially exposing SSNs and other sensitive data of 4.9 million individuals ^[17].
Online retailer Revolve disclosed a breach impacting at least 180,000 people, with theft of personal and payment card information ^[18].
DebugBear, a website monitoring service, suffered a DNS hijack via its domain registrar, leading to compromise of customer accounts. Polymarket, a prediction market affected by the incident, is returning $3.9 million to impacted traders ^[22]^[31].
Synology warned customers of ongoing C3RB3R ransomware attacks targeting NAS devices and urged immediate updates ^[13].
BTCPay Server maintainers warned that outdated instances are being targeted for hot wallet cryptocurrency thefts ^[8].
Trezor advised that some hardware wallets sold by a reseller may contain a seed-stealing implant, placing owners’ recovery phrases at risk ^[51].
Applebee’s customer data was exposed due to an embedded password left in its app, allowing unauthorised access ^[67].
Russia’s federal statistics agency, Rosstat, confirmed a cyberattack claimed by Belarusian and Ukrainian hackers, resulting in the theft of sensitive government data ^[32].
Emergency alert systems in both Ukraine and Russia were hijacked, with attackers spreading fake nuclear attack warnings ^[34]^[38].

Newly Discovered Vulnerabilities

Two additional zero-day vulnerabilities in Ivanti Connect Secure (CVE-2026-111357 and CVE-2026-118527) have been patched after being chained in active attacks since at least October 1. CISA added both to its Known Exploited Vulnerabilities catalog and issued remediation guidance to federal agencies ^[14]^[24]^[47]^[71].
Over 1,000 GitLab servers remain unpatched and exposed to a maximum-severity remote code execution flaw that is being actively exploited ^[12].
Two critical vulnerabilities in Langflow, an open-source AI agent builder, allow unauthenticated attackers to bypass authentication and execute arbitrary code on servers ^[3].
The maintainer of BTCPay Server highlighted that outdated versions are susceptible to attacks draining hot cryptocurrency wallets ^[8].
Trezor identified a seed-stealing implant in some Safe 5 hardware wallets distributed by a third-party reseller ^[51].
A recent vulnerability in Linux’s implementation of Multipath TCP (RFC 8684) was noted, though technical details remain limited ^[63].
Applebee’s app contained an embedded password, exposing customer data to unauthorised access ^[67].

Notable Threat Actor Activity

North Korean APT group TraderTraitor was attributed by the FBI as responsible for the Binance cryptocurrency heist, with ongoing laundering of stolen funds ^[15]^[23]^[40]^[43]^[53]^[65].
An Iran-aligned threat actor, DarkBlinders, conducted a cyber espionage campaign targeting Israeli and Iraqi Kurdish government cloud environments between August and October 2026 ^[2].
The Bitter group, linked to India, deployed PapRAT malware in cyber-espionage campaigns targeting South and Southeast Asian organisations, leveraging three distinct infection chains including one without a malware executable ^[26]^[42].
Cybercriminals posed as IT support staff on Microsoft Teams to social engineer employees, gain remote access, and abuse insecure Active Directory Certificate Services settings to steal company data ^[5].
Cybersecurity researchers disclosed a campaign targeting government Linux servers with SysGoRAT malware and suspected AI-generated scripts ^[6].
Hackers hijacked DNS records at DebugBear’s domain registrar to compromise customer accounts, targeting Polymarket for financial theft ^[22]^[31].
C3RB3R ransomware operators increased attacks on Synology NAS devices, exploiting unpatched systems ^[13].
Chainalysis breach involved attackers using AI-powered “offensive agentic” methods to access internal tools ^[21]^[44]^[52].

Trends, Tools, or Tactics of Interest

VOLTA-AUTODOXER (VOLTA), a new Windows infostealer, uses large language models (Claude, Gemini, Kimi) to rank stolen victim data by potential financial value, representing a novel use of AI in cybercrime ^[7]^[49].
There is a notable rise in attacks using AI and LLMs, including LLMjacking, where attackers compromise cloud and model resources to monetise stolen API tokens, costing organisations over $100,000 per day in illicit charges ^[37]^[69].
The CyberStrikeAI framework was observed in real-world attacks, automating post-exploitation phases against educational institutions ^[62].
The use of AI agents in security operations is increasing, with 40% of security teams using them daily and another 56% testing them ^[4].
A malicious Claude code extension was distributed in a supply chain attack against Cursor, performing host reconnaissance and attempting to establish a reverse SSH tunnel ^[20].
Thieves exploited the Trigger AI workflow tool to steal environment variables, highlighting risks in workflow automation platforms ^[36].
Attackers increasingly target existing customer relationships in digital fraud, with 81% of attacks focusing on established accounts ^[61].
Hundreds of AI apps and websites, primarily from Chinese-language developers, were found to have hidden sexually abusive deepfake features ^[29].
A significant increase in critical software security bugs was noted, with 3% of all recorded critical bugs discovered in the last month, suggesting a rapid acceleration in vulnerability discovery ^[30].
Armadin’s testing found that 88% of critical and high-severity vulnerabilities in client environments were not covered by vendor advisories ^[41].

Regulatory or Policy Developments Affecting the Security Industry

CISA directed federal agencies to remediate the newly exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) and added them to its Known Exploited Vulnerabilities catalog ^[24]^[47].
Google introduced a $250,000 bug bounty for “root-in-cloud” exploits, rewarding high-impact research that demonstrates full administrative control in cloud environments ^[19].
CISA announced the start of Critical Infrastructure Security and Resilience Month 2026, aiming to raise awareness and drive action around critical infrastructure protection ^[72].

Sources

Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access - thehackernews.com
Google disrupts XCPE botnet, bans the company behind it - helpnetsecurity.com
Shutting the Door on the XCPE Botnet - cloud.google.com
Hackers disrupt refrigeration systems at European supermarkets - bleepingcomputer.com
Second wave of suspected cyberattacks hits supermarket freezers across Europe - therecord.media
Frozen part II: Hackers remotely defrost produce in Euro supermarkets ... again - theregister.com
Second wave of refrigeration cyberattacks hits European supermarkets - helpnetsecurity.com
FBI links $6.3 billion Binance crypto heist to North Korean hackers - bleepingcomputer.com
FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist - securityweek.com
FBI pins $6.3B Binance crypto heist on North Korean hackers - theregister.com
FBI Attributes Binance Heist to North Korea’s TraderTraitor - infosecurity-magazine.com
FBI pins $6.3 billion Binance crypto heist on North Korea while scammers circle anxious users - helpnetsecurity.com
2nd November – Threat Intelligence Report - research.checkpoint.com
Chainalysis Discloses Data Breach Following AI-Driven Cyberattack - securityweek.com
Chainalysis Warns Customers After “Offensive Agentic” Security Incident - infosecurity-magazine.com
Chainalysis breached using “offensive agentic techniques” - helpnetsecurity.com
Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk - securityweek.com
Revolve Data Breach Impacts at Least 180,000 People - securityweek.com
Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack - securityweek.com
Polymarket pledges to give $3.9 million back to victims after site compromise - therecord.media
Synology warns of C3RB3R ransomware attacks targeting NAS devices - bleepingcomputer.com
BTCPay Server warns of hot wallet crypto thefts on outdated instances - bleepingcomputer.com
Trezor warns some of its wallets may hide a seed-stealing implant - helpnetsecurity.com
Applebee’s customer data exposed by password left in app - malwarebytes.com
Russia's statistics agency confirms cyberattack claimed by Belarusian and Ukrainian hackers - therecord.media
Russian and Ukrainian hackers hijack emergency apps to spread fake nuclear attack warnings - therecord.media
Nuclear threats and street brawls: Russia, Ukraine report attacks on their emergency alert apps - theregister.com
Ivanti patches two more Connect Secure zero-days chained in attacks - bleepingcomputer.com
Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain - securityweek.com
CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) - helpnetsecurity.com
Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) - rapid7.com
Over 1,000 GitLab servers vulnerable to ongoing RCE attacks - bleepingcomputer.com
Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers - thehackernews.com
Mutipath TCP: Use and Detection, (Mon, Nov 2nd) - isc.sans.edu
DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment - thehackernews.com
PapRAT Cyber Espionage Campaign Leaves a 'Bitter' Taste in South Asia - darkreading.com
Bitter Deploys PapRAT in Asian Cyber-Espionage Campaign - infosecurity-magazine.com
Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data - thehackernews.com
Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts - thehackernews.com
New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value - thehackernews.com
AI-powered infostealer picks out the most profitable parts of your stolen data - helpnetsecurity.com
Token thieves costing companies $100K+ per day in illicit LLM charges - theregister.com
The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources - cloud.google.com
CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations - securelist.com
Is Your SOC Ready for AI Agents? A Maturity Check Before You Deploy - thehackernews.com
Malicious Claude Code Extension Served in Cursor Supply Chain Attack - securityweek.com
Thieves pilfer environment variables from Trigger AI workflow tool - theregister.com
Report: Most Fraud Attacks Target Existing Customer Relationships - blog.knowbe4.com
Hundreds of Mundane AI Apps Are Hiding Sexually Abusive Deepfake Features - wired.com
AI Vulnerability Finding - schneier.com
Armadin Tests Find 88% of Severe Flaws Outside Vendor Advisories - infosecurity-magazine.com
Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward - securityweek.com
CISA Kicks Off Critical Infrastructure Security and Resilience Month 2026 - cisa.gov

Cybersecurity Brief – 2025-11-12

Wed, 12 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

GlobalLogic, a Hitachi group company, is notifying over 10,000 current and former employees of data theft following a breach of Oracle E-Business Suite (EBS).
The Rhadamanthys infostealer malware operation has been disrupted, with operators and customers losing access to their servers.
A Chinese national known as the “Bitcoin Queen” was sentenced in London to over 11 years in prison for laundering Bitcoin from a $7.3 billion cryptocurrency investment scam.

Newly Discovered Vulnerabilities

Microsoft’s November 2025 Patch Tuesday addressed 63 vulnerabilities, including one actively exploited Windows kernel zero-day and several critical flaws. Emergency and cumulative updates were also released for Windows 10 and Windows 11 to address security vulnerabilities and ESU enrollment issues.
Synology patched a critical remote code execution vulnerability in BeeStation products, demonstrated at Pwn2Own Ireland.
Gladinet’s Triofox file-sharing and remote-access platform was found to have a critical vulnerability that allowed attackers to exploit the built-in antivirus feature to gain SYSTEM privileges and deploy remote access tools.
SAP released patches for multiple vulnerabilities, including a maximum severity flaw in SQL Anywhere Monitor due to hardcoded credentials and a critical code execution issue in Solution Manager.
Adobe released security updates addressing 29 vulnerabilities across multiple products, including InDesign, InCopy, Photoshop, Illustrator, Pass, Substance 3D Stager, and Format Plugins.
A critical zero-day vulnerability affecting Samsung mobile devices was exploited in the wild to deliver LANDFALL spyware.
Mozilla introduced new fingerprinting protections in Firefox, reducing the number of trackable users.
A new side-channel attack, dubbed “Whisper Leak,” allows attackers intercepting network traffic to infer user prompt topics in large language model (LLM) conversations, despite end-to-end encryption.

Notable Threat Actor Activity

Threat actors are distributing a new banking malware called “Maverick” via WhatsApp, targeting major Brazilian banks. Maverick shares similarities with the Coyote banking malware.
GootLoader malware has resurfaced, now using a novel font-based obfuscation technique to hide malicious payloads on compromised WordPress sites.
A malicious npm package, “@acitons/artifact”, was discovered typosquatting the legitimate “@actions/artifact” package, targeting GitHub-owned repositories.
The Fantasy Hub Android remote access trojan (RAT) is being sold on Russian-speaking Telegram channels as a Malware-as-a-Service (MaaS), turning Telegram into a distribution hub for threat actors.
Kimsuky (DPRK-linked) APT group is exploiting Google Find Hub to compromise South Korean Android devices, remotely wiping devices and abusing the KakaoTalk messaging app.
RansomHub ransomware was detected during an in-progress attack, initiated via fake browser updates and leading to domain-admin privilege escalation.
Scammers are using AI-generated fake faces combined with real body images in extortion scams, and leveraging AI voice cloning and open-source data for social engineering attacks, particularly targeting the elderly.
Thieves are increasingly phishing Apple ID credentials through fake “Find My” messages to unlock stolen iPhones.

Trends, Tools, or Tactics of Interest

AI-enabled supply chain attacks increased by 156% over the past year, with CISOs advised to reassess traditional defenses.
Script-kiddie-level phishing campaigns remain effective at rapidly stealing credentials, even with poorly crafted lures.
The use of Telegram as a central hub for malware distribution and MaaS offerings is increasing.
Threat actors are exploiting built-in software features (e.g., antivirus in Triofox) to escalate privileges and deploy malware.
Fake browser update lures are being used as initial access vectors for ransomware attacks.
Social engineering attacks are leveraging AI-generated content and public data to bypass human defences.

Regulatory or Policy Developments

The US Department of Defense began enforcement of Cybersecurity Maturity Model Certification (CMMC) requirements for contractors on 10 November 2025.
Microsoft announced end of security update support for Windows 11 23H2 Home and Pro editions; extended security updates for Windows 10 are now available.
Firefox introduced new privacy protections to reduce user tracking.
Tenzai, an Israeli startup, raised $75 million in seed funding to develop an AI-powered penetration testing platform.

Cybersecurity Brief – 2025-10-22

Wed, 22 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

The PassiveNeuron cyber-espionage campaign has been reported targeting high-profile servers in government, industrial, and financial sectors across Asia, Africa, and Latin America. Attackers are deploying custom Neursite and NeuralExecutor APT implants alongside Cobalt Strike to maintain persistence and exfiltrate data.
CISA has confirmed active exploitation of an Oracle E-Business Suite SSRF vulnerability (CVE-2025-61884) and has added it to its Known Exploited Vulnerabilities catalog.
Over 73,000 WatchGuard Firebox devices are impacted by a critical flaw in the Fireware OS iked process, allowing unauthenticated remote code execution.
Myanmar military authorities have shut down a major cybercrime centre, detaining over 2,000 individuals involved in global cyberscam operations.

Newly Discovered Vulnerabilities

TP-Link Omada gateway devices are affected by four newly disclosed vulnerabilities, including two critical flaws enabling remote code execution and a critical pre-auth OS command injection. Security updates have been released.
Cursor and Windsurf IDEs have been found to contain over 94 n-day vulnerabilities inherited from outdated Chromium and V8 JavaScript engine components.
CISA has issued warnings about exploited vulnerabilities in Apple, Kentico, and Microsoft products, involving code execution, authentication bypass, and privilege escalation.
A supply chain attack has been identified targeting VS Code extensions with ‘GlassWorm’ malware, which leverages invisible Unicode characters for obfuscation and uses blockchain-based infrastructure for resilience.

Notable Threat Actor Activity

The PolarEdge botnet is actively targeting Cisco, ASUS, QNAP, and Synology routers in an expanding campaign, as documented by researchers.
Russian state-backed group Star Blizzard has increased deployment of evolving malware families (NoRobot, MaybeRobot), using complex delivery chains that begin with compromised “I am not a robot” CAPTCHA pages.
Fraud campaigns targeting streaming platforms are increasingly using generative AI and bots to create and promote fake content.

Trends, Tools, or Tactics of Interest

Email phishing campaigns in 2025 are leveraging PDF attachments with QR codes, password-protected PDFs, calendar phishing, and advanced phishing sites capable of validating email addresses.
Vidar Stealer 2.0 has been released, featuring multi-threaded data theft and enhanced evasion capabilities, reinforcing its position as a leading malware-as-a-service operation.
Hackers exploited 34 zero-day vulnerabilities on the first day of Pwn2Own Ireland 2025, demonstrating continued interest and success in vulnerability research.
Social engineering attacks are targeting Salesforce accounts via fake support calls.
Research from Anthropic indicates that poisoning AI models can be achieved with as few as 250 malicious documents, highlighting the susceptibility of AI systems to data poisoning.
Streaming fraudsters are increasingly using AI tools and bots for large-scale manipulation.
Electronic warfare and GPS interference are affecting a wide range of commercial sectors beyond aviation, including shipping, agriculture, and finance.

Regulatory or Policy Developments Affecting the Security Industry

CISA has updated its Known Exploited Vulnerabilities list to include recent vulnerabilities affecting Oracle, Apple, Kentico, and Microsoft products.
Meta has introduced new tools and warnings on WhatsApp and Messenger to help protect users from scams.
Allan Friedman, a leading figure in Software Bill of Materials (SBOM) advocacy, has joined NetRise as a strategic advisor to advance supply chain visibility.
Veeam has announced the acquisition of Securiti AI for $1.7 billion, aiming to unify data resilience with data security, privacy, and governance.
Dataminr is set to acquire ThreatConnect for $290 million to combine data signal analysis with internal threat intelligence capabilities.