October 2025: Oracle Exploitation, Red Hat Incident, PhantomCaptcha, and Major Breaches

October 2025 saw Crimson Collective claim large-scale theft from Red Hat’s consulting repositories, with samples posted and alleged access to more than 28,000 internal repositories spanning over 800 organisations. PhantomCaptcha continued to drive the ClickFix campaign, targeting Ukraine-focused aid and government organisations by impersonating the Ukrainian President’s Office and guiding victims to a fake Zoom page via an eight-page memo, followed by PowerShell execution.

MuddyWater targeted more than 100 government entities across the Middle East and North Africa using Phoenix v4 backdoor, after a phishing email delivered a Word document that installed the loader and a credential-harvesting tool. Clop ransomware operators exploited Oracle EBS, with CVE-2025-61884 announced by Oracle on 11 October and added to CISA’s Known Exploited Vulnerabilities catalog, building on connections to CVE-2025-61882.

Prosper data exposure affected more than 17.6 million accounts, exposing a range of personal data, while Conduent disclosed a breach impacting over 10.5 million individuals. Medusa ransomware claimed access to data relating to more than 1.2 million SimonMed patients, underscoring ongoing pressure on healthcare and enterprise systems. According to SOCRadar, the month also highlighted continued use of dark web channels and extortion practices alongside these intrusions.