News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 17 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 15 |
| Sat 24 Oct | 13 | 3 |
| Sun 25 Oct | 13 | 1 |
| Mon 26 Oct | 75 | 13 |
| Today, Tue 27 Oct | 19 so far | 5 |
Developing
Wed 2 Jul 202590 articles
- Qantas Airlines Breached, Impacting 6M Customers
Passengers' personal information was likely accessed via a third-party platform used at a call center, but didn't include passport or credit card info.
Dark Reading - Initial Access Broker Self-Patches Zero Days as Turf Control
A likely China-nexus threat actor has been exploiting unpatched Ivanti vulnerabilities to gain initial access to victim networks and then patching the systems to block others from breaking in to the same network.
Dark Reading - US Treasury Sanctions BPH Provider Aeza Group
In the past, the bulletproof group has been affiliated with many well-known ransomware and malware groups, such as BianLian and Lumma Stealer.
Dark Reading - DOJ investigates ex-ransomware negotiator over extortion kickbacks
Lawrence Abrams reports: An ex-ransomware negotiator is under criminal investigation by the Department of Justice for allegedly working with ransomware gangs to profit from extortion payment deals. The suspect is a former employee of DigitalMint, a…
DataBreaches - Russian APT 'Gamaredon' Hits Ukraine With Fierce Phishing
A Russian APT known as "Gamaredon" is using spear-phishing attacks and network-drive weaponization to target government entities in Ukraine.
Dark Reading - NimDoor crypto-theft macOS malware revives itself when killed
North Korean state-backed hackers have been using a new family of macOS malware called NimDoor in a campaign that targets web3 and cryptocurrency organizations. [...]
BleepingComputer - DOJ investigates ex-ransomware negotiator over extortion kickbacks
An ex-ransomware negotiator is under criminal investigation by the Department of Justice for allegedly working with ransomware gangs to profit from extortion payment deals. [...]
BleepingComputer - Cisco removed the backdoor account from its Unified Communications Manager
Digital communications technology giant Cisco addressed a static SSH credentials vulnerability in its Unified Communications Manager (Unified CM). A flaw, tracked as CVE-2025-20309 (CVSS score of 10), in Cisco Unified Communications Manager and its Session…
Security Affairs - ClickFix Spin-off Attack Bypasses Key Browser Safeguards
A new threat vector exploits how modern browsers save HTML files, bypassing Mark of the Web and giving attackers another social-engineering attack for delivering malware.
Dark Reading - Chinese Student Charged in Mass Smishing Campaign to Steal Victims’ Personal Information
Ruichen Xiong, a student from China, has been sentenced to over a year in prison at Inner London Crown Court for orchestrating a large-scale smishing (SMS phishing) campaign. Xiong deployed a sophisticated SMS Blaster device from the boot of his Black Honda…
gbhackers.com - Spain arrests hackers who targeted politicians and journalists
The Spanish police have arrested two individuals in the province of Las Palmas for their alleged involvement in cybercriminal activity, including data theft from the country's government. [...]
BleepingComputer - Gamaredon Unleashes Six New Malware Tools for Stealth, Persistence, and Lateral Movement
Gamaredon, a Russia-aligned advanced persistent threat (APT) group attributed by Ukraine’s Security Service (SSU) to the FSB’s 18th Center of Information Security, has exclusively targeted Ukrainian governmental institutions throughout 2024, abandoning prior…
gbhackers.com - North Korean Hackers Target Web3 with Nim Malware and Use ClickFix in BabyShark Campaign
Threat actors with ties to North Korea have been observed targeting Web3 and cryptocurrency-related businesses with malware written in the Nim programming language, underscoring a constant evolution of their tactics. "Unusually for macOS malware, the threat…
The Hacker News - Cisco warns that Unified CM has hardcoded root SSH credentials
Cisco has removed a backdoor account from its Unified Communications Manager (Unified CM), which would have allowed remote attackers to log in to unpatched devices with root privileges. [...]
BleepingComputer - Citrix warns of login issues after NetScaler auth bypass patch
Citrix warns that patching recently disclosed vulnerabilities that can be exploited to bypass authentication and launch denial-of-service attacks may also break login pages on NetScaler ADC and Gateway appliances. [...]
BleepingComputer - Forminator plugin flaw exposes WordPress sites to takeover attacks
The Forminator plugin for WordPress is vulnerable to an unauthenticated arbitrary file deletion flaw that could enable full site takeover attacks. [...]
BleepingComputer - Cybercriminals Use Malicious PDFs to Impersonate Microsoft, DocuSign, and Dropbox in Targeted Phishing Attacks
Cisco’s Talos security team has uncovered a surge in sophisticated phishing campaigns leveraging malicious PDF payloads to impersonate trusted brands like Microsoft, DocuSign, and Dropbox. According to a recent update to Cisco’s brand impersonation detection…
gbhackers.com - 1 Year Later: Lessons Learned From the CrowdStrike Outage
The ever-growing volume of vulnerabilities and threats requires organizations to remain resilient and anti-fragile — that is, to be able to proactively respond to issues and continuously improve.
Dark Reading - Microsoft fixes ‘Print to PDF’ feature broken by Windows update
Microsoft has fixed a known bug that breaks the 'Print to PDF' feature on Windows 11 24H2 systems after installing the April 2025 preview update. [...]
BleepingComputer - Esse Health Data Breach Exposes Personal and Medical Information of 263,000 Patients
Esse Health, a prominent healthcare provider, disclosed a data breach that has potentially exposed the personal and medical information of approximately 263,000 patients. The breach, detected on April 2025, involved unauthorized access to the organization’s…
gbhackers.com - Like Ransoming a Bike: Organizational Muscle Memory Drives the Most Effective Response
Ransomware is a major threat to the enterprise. Tools and training help, but survival depends on one thing: your organization’s muscle memory to respond fast and recover stronger.
SecurityWeek - US Calls Reported Threats by Pro-Iran Hackers to Release Trump-Tied Material a ‘Smear Campaign’
The United States has warned of continued Iranian cyberattacks following American strikes on Iran’s nuclear facilities.
SecurityWeek - New macOS Malware Uses Process Injection and Remote Access to Steal Keychain Credentials
A sophisticated campaign by North Korean (DPRK)-aligned threat actors targeting Web3 and cryptocurrency businesses has been uncovered, showcasing an alarming evolution in macOS malware tactics. According to detailed analysis by SentinelLABS, alongside…
gbhackers.com - Dozens of fake wallet add-ons flood Firefox store to drain crypto
More than 40 fake extensions in Firefox's official add-ons store are impersonating popular cryptocurrency wallets from trusted providers to steal wallet credentials and sensitive data. [...]
BleepingComputer - U.S. Sanctions Russia’s Aeza Group for aiding crooks with bulletproof hosting
U.S. Treasury sanctions Russia-based Aeza Group and affiliates for aiding cybercriminals via bulletproof hosting services. The U.S. Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Russia-based Aeza Group for aiding global cybercriminals via…
Security Affairs - FileFix Attack Chain Enables Malicious Script Execution
By using social engineering tactics, threat actors are able to manipulate their victims into saving and renaming files that will backfire against them.
Dark Reading - YONO SBI Banking App Vulnerability Exposes Users to Man-in-the-Middle Attack
A critical security flaw has been discovered in the widely used YONO SBI: Banking & Lifestyle app, potentially exposing millions of users to man-in-the-middle (MITM) attacks and putting sensitive financial data at risk. The vulnerability, catalogued as…
gbhackers.com - IDE Extensions Like VSCode Allow Attackers to Bypass Trust Checks and Deliver Malware to Developer Systems
OX Research conducted a ground-breaking study in May and June 2025 that revealed concerning security flaws in the extension verification procedures of some of the most popular Integrated Development Environments (IDEs), such as Visual Studio Code (VSCode),…
gbhackers.com - Cybersecurity M&A Roundup: 41 Deals Announced in June 2025
Forty-one cybersecurity merger and acquisition (M&A) deals were announced in June 2025.
SecurityWeek - Grok 4 spotted ahead of launch with special coding features
Elon Musk-funded xAI is skipping Grok 3.5 and releasing Grok 4 after Independence Day in the United States. [...]
BleepingComputer - Microsoft: DNS issue blocks delivery of Exchange Online OTP codes
Microsoft is working to fix a DNS misconfiguration that is causing one-time passcode (OTP) message delivery failures in Exchange Online for some users. [...]
BleepingComputer - Hackers Target Linux SSH Servers to Deploy TinyProxy and Sing-Box Proxy Tools
Hackers are exploiting poorly managed Linux servers, particularly those with weak SSH credentials, to install proxy tools such as TinyProxy and Sing-box. The AhnLab Security Intelligence Center (ASEC) has been closely monitoring these intrusions through…
gbhackers.com - Office 365 Introduces New Mail Bombing Detection to Shield Users
Microsoft has announced a significant security upgrade for its Office 365 platform, introducing a new Mail Bombing Detection feature within Microsoft Defender for Office 365. This enhancement, rolling out globally from late June through early July 2025, is…
gbhackers.com - Microsoft Ends Authenticator App’s Password Management Support From 2025
Microsoft has announced it will discontinue password management features in its widely used Authenticator app, marking a significant shift in its approach to digital security. Starting July 2025, the app’s autofill capability will be disabled, and by August…
gbhackers.com - Hackers Using PDFs to Impersonate Microsoft, DocuSign, and More in Callback Phishing Campaigns
Ravie Lakshmanan reports: Cybersecurity researchers are calling attention to phishing campaigns that impersonate popular brands and trick targets into calling phone numbers operated by threat actors. “A significant portion of email threats with PDF payloads…
DataBreaches - Qantas: Breach affects 6 million people, “significant” amount of data likely taken
Australia’s largest airline Qantas has confirmed that cybercriminals have gained access to a third party customer servicing platform that contained 6 million customer service records. Qantas says the breach occurred after a cybercriminal targeted a call…
Malwarebytes - One in Five Law Firms Hit by Cyberattacks Over Past 12 Months
Caroline Byrne writes: One in five U.S. law firms were targeted in a cyberattack in the past year and nearly one in 10 lost data or suffered exposure, according to a comprehensive study by a Swiss tech company. The numbers, which demonstrate the extent to…
DataBreaches - U.S. Sanctions Russian Bulletproof Hosting Provider for Supporting Cybercriminals Behind Ransomware
Ravie Lakshmanan reports: The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has levied sanctions against Russia-based bulletproof hosting (BPH) service provider Aeza Group to assist threat actors in their malicious activities and…
DataBreaches - Senator Chides FBI for Weak Advice on Mobile Security
Brian Krebs reports: Agents with the Federal Bureau of Investigation (FBI) briefed Capitol Hill staff recently on hardening the security of their mobile devices, after a contacts list stolen from the personal phone of the White House Chief of Staff Susie…
DataBreaches - Cl0p cybercrime gang’s data exfiltration tool found vulnerable to RCE attacks
Connor Jones reports: Security experts have uncovered a hole in Cl0p’s data exfiltration tool that could potentially leave the cybercrime group vulnerable to attack. The vulnerability in the Python-based software, which was used in the 2023-2024 MOVEit mass…
DataBreaches