News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 17 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 15 |
| Sat 24 Oct | 13 | 3 |
| Sun 25 Oct | 13 | 1 |
| Mon 26 Oct | 75 | 13 |
| Today, Tue 27 Oct | 37 so far | 8 |
Developing
Tue 1 Jul 202589 articles
- Pre-CVE threat detection: 10 examples identifying malicious activity prior to public disclosure of a vulnerability
Darktrace leverages AI-driven anomaly detection to identify cyber threats before public CVE disclosures. By analyzing behavioral patterns, Darktrace can help organizations detect and contain zero-day exploits early. This proactive approach strengthens…
darktrace.com - Like SEO, LLMs May Soon Fall Prey to Phishing Scams
Just as attackers have used SEO techniques to poison search engine results, they could rinse and repeat with artificial intelligence and the responses LLMs generate from user prompts.
Dark Reading - AT&T rolls out "Wireless Lock" feature to block SIM swap attacks
AT&T has launched a new security feature called "Wireless Lock" that protects customers from SIM swapping attacks by preventing changes to their account information and the porting of phone numbers while the feature is enabled. [...]
BleepingComputer - LevelBlue Acquires Trustwave, Forms World's Largest Independent MSSP
As the largest managed security services provider, the combined entity will offer cyber consulting, managed detection and response, and incident response services.
Dark Reading - Scope, Scale of Spurious North Korean IT Workers Emerges
Microsoft warns thousands of North Korean workers have infiltrated tech, manufacturing, and transportation sectors to steal money and data.
Dark Reading - Ransomware Reshaped How Cyber Insurers Perform Security Assessments
Cyber insurance companies were forced to adapt once ransomware skyrocketed and highlighted crucial security weaknesses among organizations in all sectors.
Dark Reading - A sophisticated cyberattack hit the International Criminal Court
The International Criminal Court (ICC) is probing a sophisticated cyberattack that was discovered and contained last week. On June 30, 2025, the International Criminal Court (ICC) announced that it was hit by a sophisticated and targeted cyberattack. The…
Security Affairs - CMS Sending Letters to 103,000 Medicare beneficiaries whose info was involved in a Medicare.gov breach.
The Centers for Medicare & Medicaid Services (CMS) has been busy issuing notices about breaches this week. First, it warned providers about a fraud scheme involving medical records requests. Now it is notifying Medicare beneficiaries whose information was…
DataBreaches - Microsoft open-sources VS Code Copilot Chat extension on GitHub
Microsoft has released the source code for the GitHub Copilot Chat extension for VS Code under the MIT license. [...]
BleepingComputer - Esse Health provides update about April cyberattack and notifies 263,601 people
Esse Health has notified the Maine Attorney General’s Office that 263,601 people were affected by an incident they first disclosed in early May. Esse has 45 locations in and around the St. Louis metropolitan area. According to their notices and update of…
DataBreaches - We've All Been Wrong: Phishing Training Doesn't Work
Teaching employees to detect malicious emails isn't really having an impact. What other options do organizations have?
Dark Reading - DoJ Disrupts North Korean IT Worker Scheme Across Multiple US States
The US also conducted searches of 29 "laptop farms" across 16 states and seized 29 financial accounts used to launder funds.
Dark Reading - Critical Vulnerability in Anthropic's MCP Exposes Developer Machines to Remote Exploits
Cybersecurity researchers have discovered a critical security vulnerability in artificial intelligence (AI) company Anthropic's Model Context Protocol (MCP) Inspector project that could result in remote code execution (RCE) and allow an attacker to gain…
The Hacker News - New DEVMAN Ransomware by DragonForce Targets Windows 10 and 11 Users
A new ransomware variant, dubbed DEVMAN, has surfaced in the cyberthreat landscape, showcasing a complex lineage tied to the notorious DragonForce family. Built on a foundation of DragonForce and Conti codebases, DEVMAN introduces unique identifiers such as…
gbhackers.com - Esse Health data breach impacted 263,000 individuals
A cyberattack on healthcare provider Esse Health in April 2025 exposed data of 263K+ patients, including SSNs and medical info. In April 2025, Missouri-based healthcare provider Esse Health suffered a cyberattack that disrupted its systems and led to the…
Security Affairs - Kelly Benefits says 2024 data breach impacts 550,000 customers
Kelly & Associates Insurance Group (dba Kelly Benefits) is informing more than half a million people of a data breach that compromised their personal information. [...]
BleepingComputer - TA829 Hackers Use New TTPs and Enhanced RomCom Backdoor to Evade Detection
The cybercriminal group TA829, also tracked under aliases like RomCom, Void Rabisu, and Tropical Scorpius, has been observed deploying sophisticated tactics, techniques, and procedures (TTPs) alongside an updated version of its infamous RomCom backdoor, now…
gbhackers.com - Aeza Group sanctioned for hosting ransomware, infostealer servers
The U.S. Department of the Treasury has sanctioned Russian hosting company Aeza Group and four operators for allegedly acting as a bulletproof hosting company for ransomware gangs, infostealer operations, darknet drug markets, and Russian disinformation…
BleepingComputer - Planning your move to Microsoft Defender portal for all Microsoft Sentinel customers
In November 2023, Microsoft announced our strategy to unify security operations by bringing the best of XDR and SIEM together. Our first step was bringing Microsoft Sentinel into the Defender portal, giving teams a single, comprehensive view of incidents,…
techcommunity.microsoft.com - Kimusky Hackers Employ ClickFix Technique to Run Malicious Scripts on Victim Devices
The North Korean state-sponsored hacker collective Kimsuky has been found to use a dishonest technique called “ClickFix” to compromise victim machines in a number of concerning cyberattacks. First documented by Proofpoint in April 2024, ClickFix manipulates…
gbhackers.com - New FileFix attack runs JScript while bypassing Windows MoTW alerts
A new FileFix attack allows executing malicious scripts while bypassing the Mark of the Web (MoTW) protection in Windows by exploiting how browsers handle saved HTML webpages. [...]
BleepingComputer - TA829 and UNK_GreenSec Share Tactics and Infrastructure in Ongoing Malware Campaigns
Cybersecurity researchers have flagged the tactical similarities between the threat actors behind the RomCom RAT and a cluster that has been observed delivering a loader dubbed TransferLoader. Enterprise security firm Proofpoint is tracking the activity…
The Hacker News - Hacktivist Group Launches Attacks on 20+ Critical Sectors Amid Iran–Israel Conflict
A series of sophisticated cyberattacks targeting over 20 vital sectors in Israel and its allies has been launched by more than 80 hacktivist groups in a major escalation of cyberwarfare that parallels the ongoing Iran-Israel confrontation. Following Israel’s…
gbhackers.com - Snake Keyloggers Exploit Java Utilities to Evade Detection by Security Tools
The S2 Group Intelligence team has uncovered a Russian-origin malware known as Snake Keylogger, a stealer coded in .NET, leveraging legitimate Java utilities to bypass security tools. This operation, distributed via a Malware as a Service (MaaS) model,…
gbhackers.com - Update your Chrome to fix new actively exploited zero-day vulnerability
Google has released an update for its Chrome browser to patch an actively exploited flaw. This update is crucial since it addresses an actively exploited vulnerability which can be exploited when the user visits a malicious website. It doesn’t require any…
Malwarebytes - Bluetooth vulnerability in audio devices can be exploited to spy on users
Researchers have found vulnerabilities in 29 Bluetooth devices like speakers, earbuds, headphones, and wireless microphones from reputable companies including Sony, Bose, and JBL. The vulnerabilities could be exploited to spy on users, and even steal…
Malwarebytes - Browsers Targeted via Chrome Zero-Day, Malicious Firefox Extensions
Separate threats to popular browsers highlight the growing security risk for enterprises presented by the original gateway to the Web, which remains an integral tool for corporate users.
Dark Reading - International Criminal Court hit by new 'sophisticated' cyberattack
On Monday, the International Criminal Court (ICC) announced that it's investigating a new "sophisticated" cyberattack that targeted its systems last week. [...]
BleepingComputer - How Businesses Can Align Cyber Defenses With Real Threats
Companies that understand the motivations of their attackers and position themselves ahead of the competition will be in the best place to protect their business operations, brand reputation, and their bottom line.
Dark Reading - US disrupts North Korean IT worker "laptop farm" scheme in 16 states
The U.S. Department of Justice (DoJ) announced coordinated law enforcement actions against North Korean government's fund raising operations using remote IT workers. [...]
BleepingComputer - New Flaw in IDEs Like Visual Studio Code Lets Malicious Extensions Bypass Verified Status
A new study of integrated development environments (IDEs) like Microsoft Visual Studio Code, Visual Studio, IntelliJ IDEA, and Cursor has revealed weaknesses in how they handle the extension verification process, ultimately enabling attackers to execute…
The Hacker News - Critical Vulnerability in Microsens Devices Exposes Systems to Hackers
A series of critical vulnerabilities have been discovered in MICROSENS NMP Web+, a widely used network management platform for industrial and critical manufacturing environments, putting thousands of organizations worldwide at significant risk of…
gbhackers.com - Esse Health says recent data breach affects over 263,000 patients
Esse Health, a healthcare provider based in St. Louis, Missouri, is notifying over 263,000 patients that their personal and health information was stolen in an April cyberattack. [...]
BleepingComputer - Terrible tales of opsec oversights: How cybercrooks get themselves caught
Connor Jones reports: They say that success breeds complacency, and complacency leads to failure. For cybercriminals, taking too many shortcuts when it comes to opsec delivers a little more than that. In these cases, failure might mean the criminal doesn’t…
DataBreaches - International Criminal Court hit with cyber attack during NATO summit
Euronews with AP reports: The International Criminal Court has been targeted by a “sophisticated” cyberattack and is taking measures to limit any damage. The ICC said the incident, which happened last week during the NATO leaders’ summit, had been contained…
DataBreaches - Swiss Government Confirms Radix Ransomware Attack Leaked Federal Data
The Swiss government has confirmed that sensitive federal data has been leaked onto the dark web following a ransomware attack on Radix, a non-profit health promotion foundation serving multiple federal offices. The breach, attributed to the Sarcoma…
gbhackers.com - Critical Microsens Product Flaws Allow Hackers to Go ‘From Zero to Hero’
CISA has informed organizations about critical authentication bypass and remote code execution vulnerabilities in Microsens NMP Web+.
SecurityWeek - Cloudflare Puts a Default Block on AI Web Scraping
The move could reshape how LLM developers gather information — and force new deals between creators and AI companies.
SecurityWeek - LevelBlue to Acquire Trustwave to Create Major MSSP
LevelBlue has announced plans to acquire Trustwave to create the largest pure-play managed security services provider (MSSP).
SecurityWeek - GDPR violations prompt Germany to push Google and Apple to ban DeepSeek AI
Germany asked Google and Apple to remove DeepSeek AI from their app stores, citing GDPR violations over unlawful data collection and transfers to China. The Berlin Commissioner for Data Protection requested Google and Apple to remove the DeepSeek AI app from…
Security Affairs