News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 20 |
| Tue 27 Oct | 95 | 18 |
| Today, Wed 28 Oct | 80 so far | 15 |
Developing
Wed 28 May 202594 articles
- Windows 10 KB5058481 update brings seconds back to calendar flyout
Microsoft has released the optional KB5058481 preview cumulative update for Windows 10 22H2 with seven changes, including restoring seconds to the time display in the calendar flyout for those who previously lost it. [...]
BleepingComputer - Windows 11 KB5058499 update rolls out new Share and Click to Do features
Microsoft has released the KB5058499 preview cumulative update for Windows 11 24H2 with forty-eight new features or changes, with many gradually rolling out, such as the new Windows Share feature and tje Click to Do Preview. [...]
BleepingComputer - APT41 malware abuses Google Calendar for stealthy C2 communication
The Chinese APT41 hacking group uses a new malware named 'ToughProgress' that abuses Google Calendar for command-and-control (C2) operations, hiding malicious activity behind a trusted cloud service. [...]
BleepingComputer - Hundreds of Web Apps Have Full Access to OneDrive Files
Researchers at Oasis Security say the problem has to do with OneDrive File Picker having overly broad permissions.
Dark Reading - New PumaBot botnet brute forces SSH credentials to breach devices
A newly discovered Go-based Linux botnet malware named PumaBot is brute-forcing SSH credentials on embedded IoT devices to deploy malicious payloads. [...]
BleepingComputer - MATLAB Maker MathWorks Recovering From Ransomware Attack
The incident impacted multiple web and mobile applications, licensing services, downloads and online store, website, wiki, MathWorks accounts, and other services.
SecurityWeek - Interlock ransomware gang deploys new NodeSnake RAT on universities
The Interlock ransomware gang is deploying a previously undocumented remote access trojan (RAT) named NodeSnake against educational institutes for persistent access to corporate networks. [...]
BleepingComputer - Implementing Secure by Design Principles for AI
Harnessing AI's full transformative potential safely and securely requires more than an incremental enhancement of existing cybersecurity practices. A Secure by Design approach represents the best path forward.
Dark Reading - Czech Republic accuses China’s APT31 of a cyberattack on its Foreign Ministry
The Czech government condemned China after linking cyber espionage group APT31 to a cyberattack on its critical infrastructure. The Czech government strongly condemned China after the cyber espionage group APT31 was linked to a cyberattack targeting the…
Security Affairs - Pakistan Arrests 21 in ‘Heartsender’ Malware Service
Authorities in Pakistan have arrested 21 individuals accused of operating “Heartsender,” a once popular spam and malware dissemination service that operated for more than a decade. The main clientele for HeartSender were organized crime groups that tried to…
Krebs on Security - Deepfake-posting man faces huge $450,000 fine
A man is facing a $450,000 AU fine after he published deepfake images of prominent Australian women on the now-defunct MrDeepfakes web site. That’s if Australia’s online safety regulator gets its way. Anthony Rotondo faces charges of posting these and other…
Malwarebytes - Zanubis Android Malware Harvests Banking Credentials and Executes Remote Commands
The Zanubis Android banking Trojan has evolved into a highly sophisticated threat, initially targeting financial institutions in Peru before expanding its scope to virtual cards and cryptocurrency wallets. This malware, known for impersonating legitimate…
gbhackers.com - Iranian Hacker Pleads Guilty in $19 Million Robbinhood Ransomware Attack on Baltimore
An Iranian national has pleaded guilty in the U.S. over his involvement in an international ransomware and extortion scheme involving the Robbinhood ransomware. Sina Gholinejad (aka Sina Ghaaf), 37, and his co-conspirators are said to have breached the…
The Hacker News - Fake AI video generator tools lure in Facebook and LinkedIn users to deliver malware
Cybercriminals are taking advantage of the public’s interest in Artificial Intelligence (AI) and delivering malware via text-to-video tools. According to researchers at Mandiant, the criminals are setting up websites claiming to offer “AI video generator”…
Malwarebytes - Cybercriminals Are Turning Ordinary Citizens Into Money Mules in a New ‘Rent-a-Bank-Account’ Scam
Cybercriminals are exploiting vulnerable individuals by transforming them into unwitting money mules through a sophisticated fraud known as the ‘rent-a-bank-account’ scam. This scam involves fraudsters enticing people, often those in financial distress, with…
gbhackers.com - 364,000 Impacted by Data Breach at LexisNexis Risk Solutions
Data broker giant LexisNexis Risk Solutions says personal information was stolen from 364,000 people in a December 2024 data breach.
SecurityWeek - Botnet hacks 9,000+ ASUS routers to add persistent SSH backdoor
Over 9,000 ASUS routers are compromised by a novel botnet dubbed "AyySSHush" that was also observed targeting SOHO routers from Cisco, D-Link, and Linksys. [...]
BleepingComputer - Dark Partners cybercrime gang fuels large-scale crypto heists
A sprawling network of fake AI, VPN, and crypto software download sites is being used by the "Dark Partner" threat actors to conduct a crypto theft attacks worldwide. [...]
BleepingComputer - Worldwide Operation Shuts Down Hundreds of Ransomware Servers and Domains, Ending Key Attack Infrastructure
Law enforcement and judicial officials, working together with Europol and Eurojust, have dealt a devastating blow to the worldwide ransomware ecosystem in a historic international operation. From May 19 to 22, 2025, Operation Endgame targeted the critical…
gbhackers.com - Apple Blocked 2 million Malicious App & $9 Billion in Fraudulent Transactions
Apple has strengthened the App Store as a bulwark of confidence, a remarkable testament to its commitment to customer safety. According to the company’s annual fraud analysis, over the past five years, Apple has thwarted more than $9 billion in fraudulent…
gbhackers.com - Czech Republic Blames China-Linked APT31 Hackers for 2022 Cyberattack
The Czech Republic on Wednesday formally accused a threat actor associated with the People's Republic of China (PRC) of targeting its Ministry of Foreign Affairs. In a public statement, the government said it identified China as the culprit behind a…
The Hacker News - DragonForce Ransomware Actors Exploits RMM Tools to Gain Access to Organizations
Sophos Managed Detection and Response (MDR) successfully responded to a sophisticated targeted attack orchestrated by threat actors leveraging DragonForce ransomware. The attackers gained unauthorized access to a Managed Service Provider’s (MSP) remote…
gbhackers.com - Czech Government Condemns Chinese Hack on Critical Infrastructure
The Czech government issues a blunt warning to China after APT31 hackers linked to intrusion at critical infrastructure network.
SecurityWeek - Cellcom Restores Regional Mobile Services After Cyberattack
Customers in parts of Wisconsin and Michigan could not make calls or send text messages for nearly a week after an incident on May 14, and service is still intermittent in some areas.
Dark Reading - Earth Lamia Hackers Exploits Vulnerabilities in Web Applications to Attack Multiple Industries
Cybersecurity researchers at Trend Research have uncovered the aggressive operations of Earth Lamia, an Advanced Persistent Threat (APT) group with a China-nexus, targeting organizations across Brazil, India, and Southeast Asia since 2023. This threat actor…
gbhackers.com - Evertz SDN Vulnerabilities Enable Unauthenticated Arbitrary Command Execution
A newly disclosed critical vulnerability (CVE-2025-4009) in Evertz’s Software Defined Video Network (SDVN) product line exposes a wide range of broadcasting infrastructure to unauthenticated remote code execution. The flaw, uncovered by ONEKEY Research Labs,…
gbhackers.com - Russian APT28 Hackers Attacking NATO-aligned Organizations to Steal Sensitive Data
Russia’s GRU-backed APT28, widely known as Fancy Bear, has intensified its cyber espionage campaign against NATO-aligned organizations. Active since at least 2007, this notorious threat actor has been attributed to a series of sophisticated attacks targeting…
gbhackers.com - XenServer Windows VM Tools Flaw Enables Attackers to Run Arbitrary Code
Citrix has issued a high-severity security bulletin addressing multiple vulnerabilities—CVE-2025-27462, CVE-2025-27463, and CVE-2025-27464—affecting XenServer VM Tools for Windows. These vulnerabilities allow attackers with the ability to execute arbitrary…
gbhackers.com - Czechia blames China for Ministry of Foreign Affairs cyberattack
The Czech Republic says the Chinese-backed APT31 hacking group was behind cyberattacks targeting the country's Ministry of Foreign Affairs and critical infrastructure organizations. [...]
BleepingComputer - Threat Actors Weaponize Fake AI-Themed Websites to Deliver Python-based infostealers
Mandiant Threat Defense has uncovered a malicious campaign orchestrated by the threat group UNC6032, which capitalizes on the global fascination with artificial intelligence (AI). Since at least mid-2024, UNC6032 has been deploying fake AI video generator…
gbhackers.com - Zscaler to Acquire Red Canary, Enhancing AI-Powered Security Operations
Zscaler, Inc. (NASDAQ: ZS), the global leader in cloud security, has announced a definitive agreement to acquire Red Canary, a top Managed Detection and Response (MDR) provider. This strategic move is set to transform security operations by integrating…
gbhackers.com - New PumaBot targets Linux IoT surveillance devices
PumaBot targets Linux IoT devices, using SSH brute-force attacks to steal credentials, spread malware, and mine crypto. Darktrace researchers discovered a new botnet called PumaBot targets Linux-based IoT devices, using SSH brute-force attacks to steal…
Security Affairs - 251 Malicious IPs Target Cloud-Based Device Exploiting 75 Exposure Points
On May 8, 2025, cybersecurity researchers at GreyNoise detected a highly orchestrated scanning operation targeting 75 known exposure points across the internet in just 24 hours. The campaign, executed by 251 malicious IP addresses—all geolocated to Japan and…
gbhackers.com - Why Take9 Won't Improve Cybersecurity
The latest cybersecurity awareness campaign asks users to pause for nine seconds before clicking — but this approach misplaces responsibility and ignores the real problems of system design.
Dark Reading - Mark Your Calendar: APT41 Innovative Tactics
Written by: Patrick Whitsell Google Threat Intelligence Group’s (GTIG) mission is to protect Google’s billions of users and Google’s multitude of products and services. In late October 2024, GTIG discovered an exploited government website hosting malware…
Google Cloud - Microsoft OneDrive File Picker Flaw Grants Apps Full Cloud Access — Even When Uploading Just One File
Cybersecurity researchers have discovered a security flaw in Microsoft's OneDrive File Picker that, if successfully exploited, could allow websites to access a user's entire cloud storage content, as opposed to just the files selected for upload via the…
The Hacker News - New warning issued over toll fee scams
Over a year ago the FBI warned about what was then a new form of smishing (phishing via SMS) scam: text messages that demanded payment for toll fees. The FTC sent out a similar warning in January, 2025. Then, in April another wave of toll fee scams began…
Malwarebytes - Cerby Raises $40 Million for Identity Automation Platform
Identity security automation platform Cerby has raised $40 million in Series B funding to scale operations.
SecurityWeek - Vietnamese Hackers Distribute Malware via Fake AI-Themed Websites
Mandiant warns that a Vietnamese hacking group tracked as UNC6032 is distributing malware via fake AI video generator websites.
SecurityWeek - Microsoft introduces new Windows backup tool for businesses
Microsoft has introduced Windows Backup for Organizations, a new backup tool for enterprises that simplifies backups and makes the transition to Windows 11 easier. [...]
BleepingComputer