News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Wed 27 Aug 2025· 82 articles
-
Storm-05014 articles this day · Dark Reading first
Storm-0501 hackers shift to ransomware attacks in the cloud · Storm-0501 Exploits Entra ID to Exfiltrate and Delete Azure Data in Hybrid Cloud Attacks
4 outlets-
Storm-0501 hackers shift to ransomware attacks in the cloud
Microsoft warns that the storm-0501 threat actor has evolved its operations from encrypting devices to cloud-based encryption, data theft and extortion, abusing native cloud features to exfiltrate data, wipe backups and destroy storage accounts. The group,…
BleepingComputer -
Storm-0501 Exploits Entra ID to Exfiltrate and Delete Azure Data in Hybrid Cloud Attacks
The Storm-0501 threat actor has been refining its cloud-focused operations to exfiltrate data, destroy data and backups, and demand ransom in hybrid cloud environments. According to Microsoft Threat Intelligence, the group rapidly exfiltrates large volumes…
The Hacker News -
Storm-0501 Hits Enterprise With 'Cloud-Based Ransomware' Attack
Storm-0501 is described as having shifted toward cloud-based ransomware attacks that exploit victim environments’ native capabilities rather than relying on malware, enabling rapid exfiltration of data before any backups are destroyed. According to…
Dark Reading -
Storm-0501’s evolving techniques lead to cloud-based ransomware
According to Microsoft Threat Intelligence, Storm-0501, a financially motivated threat actor, has continuously evolved campaigns to focus on cloud-based ransomware tactics, shifting from on-premises endpoint encryption to rapid data exfiltration and…
Microsoft
-
-
Chinese Hacker Suspect Arrested in South Korea Over Major Financial Cyberattack
South Korean authorities extradited a key suspect in a large-scale hacking operation, identified as Mr. G, a 34-year-old Chinese national, from Thailand to Incheon International Airport on 22 August 2025. The embezzlement linked to the case exceeded 38…
gbhackers.com -
Anthropic AI Used to Automate Data Extortion Campaign
Anthropic revealed that a cybercriminal group tracked as GTG-2002 abused its Claude Code tool to automate a large-scale data theft and extortion campaign, marking a new evolution in AI-enabled cybercrime. In its August threat intelligence report, Anthropic…
Dark Reading -
Experimental PromptLock ransomware uses AI to encrypt, steal data
Threat researchers have identified the first AI-powered ransomware, called PromptLock, which uses Lua scripts to steal and encrypt data on Windows, macOS and Linux systems. According to ESET researchers, PromptLock is written in Golang and uses the Ollama…
BleepingComputer -
'ZipLine' Phishers Flip Script as Victims Email First
A financially motivated threat actor is flipping the phishing playbook by getting victims to make the first email contact, rather than the attacker initiating the exchange, a tactic linked to the ZipLine campaign tracked by Check Point Software. The…
Dark Reading -
Critical Zip Slip Bug Enables Malicious File Manipulation on Unzip
Zip Slip is a path traversal flaw that lets attackers manipulate file systems when archives are decompressed, a risk the article describes as a serious danger in cybersecurity threats. It stems from inadequate input validation in compression utilities,…
gbhackers.com -
Nevada's State Agencies Shutter in Wake of Cyberattack
Nevada’s state government shutters were prompted by a cyberattack first identified on Sunday, with the governor stating that in-person services were paused for two days while restoration efforts continue. Some state websites and phone lines became…
Dark Reading -
FreePBX servers hacked via zero-day, emergency fix released
According to Sangoma FreePBX Security Team, an actively exploited zero-day vulnerability in exposed FreePBX administrator control panels has impacted systems with the ACP accessible from the internet. The advisory notes that since 21 August, attackers have…
BleepingComputer -
China Hijacks Captive Portals to Spy on Asian Diplomats
Google researchers have linked the Mustang Panda espionage group to a campaign in which captive portal checks are hijacked to deliver malware disguised as Adobe plug‑ins. The activity, observed against Southeast Asian diplomats and other entities worldwide,…
Dark Reading -
Google: Salesforce Attacks Stemmed From Third-Party App
A threat group tracked as UNC6395 has been conducting a widespread data theft campaign by targeting Salesforce instances and compromising OAuth tokens tied to the third‑party Salesloft Drift application, according to Google Threat Intelligence Group. The…
Dark Reading -
Over 28,000 Citrix instances remain exposed to critical RCE flaw CVE-2025-7775
Shadowserver Foundation researchers warn that more than 28,200 Citrix NetScaler ADC and Gateway instances remain vulnerable to CVE-2025-7775, a memory overflow flaw that enables remote code execution and has been observed exploited in the wild. The advisory…
Security Affairs -
Hundreds of Swedish municipalities impacted by suspected ransomware attack on IT supplier
A suspected ransomware attack on Miljödata, a Swedish software provider used for managing sick leave and similar HR reports, is believed to have impacted around 200 of the country’s municipal governments. The attack was detected on Saturday, according to the…
DataBreaches -
IT system supplier cyberattack impacts 200 municipalities in Sweden
A cyberattack on Miljödata, an IT systems supplier for roughly 80% of Sweden’s municipal systems, has caused accessibility problems in more than 200 regions of the country. In addition to the service disruption, there are concerns that attackers also stole…
BleepingComputer -
U.S. CISA adds Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Citrix NetScaler flaw CVE-2025-7775 to its Known Exploited Vulnerabilities catalog, as reported on 27 August 2025. According to Binding Operational Directive (BOD) 22-01: Reducing the…
Security Affairs -
Global Salt Typhoon hacking campaigns linked to Chinese tech firms
The U.S. National Security Agency (NSA), the UKundefineds National Cyber Security Centre (NCSC), and partners from more than a dozen countries have linked the Salt Typhoon global hacking campaigns to three China-based technology firms: Sichuan Juxinhe…
BleepingComputerGhostEmperor -
Someone Created First AI-Powered Ransomware Using OpenAI's gpt-oss:20b Model
ESET has disclosed the discovery of an artificial intelligence-powered ransomware variant codenamed PromptLock. According to ESET, PromptLock is written in Golang and uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua…
The Hacker News -
Hackers Weaponize Trust with AI-Crafted Emails to Deploy ScreenConnect
SecurityWeek reports that hackers are weaponising trust by sending AI-crafted phishing emails to deploy ConnectWise ScreenConnect for remote access, with multiple campaigns showing the technique’s sophistication. Observed campaigns involve phishing emails…
SecurityWeek -
Over 28,000 Citrix devices vulnerable to new exploited RCE flaw
More than 28,200 Citrix instances are vulnerable to a critical remote code execution vulnerability tracked as CVE-2025-7775. The flaw affects NetScaler ADC and NetScaler Gateway and is already being exploited in the wild, with updates released yesterday by…
BleepingComputer -
Hundreds of Salesforce Customers Hit by Widespread Data Theft Campaign
Hundreds of Salesforce customers were affected in a widespread data-theft campaign, with Google Threat Intelligence Group (GTIG) warning that the attackers systematically exported large volumes of data from Salesforce instances. The activity, attributed to…
SecurityWeek -
Cephalus Ransomware Exploits RDP for Initial Access in Latest Attack Campaign
Cybersecurity researchers at Huntress identified a novel Cephalus ransomware variant deployed in two incidents targeting organisations with weak access controls, using exposed RDP endpoints as the initial access vector and compromised credentials without…
gbhackers.com -
China-Linked Hackers Hijack Web Traffic to Deliver Backdoor
SecurityWeek reports that a China-linked cyberespionage group, UNC6384, believed to be associated with Mustang Panda, hijacked web traffic to deliver the PlugX backdoor to diplomats and other targets. The operation, identified in March 2025 and described by…
SecurityWeek -
Healthcare Services Group discloses 2024 data breach that impacted 624,496 people
Healthcare Services Group disclosed that a 2024 data breach affected more than 624,496 people. Hackers accessed company systems between 27 September 2024 and 3 October 2024, with discovery on 7 October, after which the firm began an investigation and…
Security Affairs -
Anthropic Disrupts AI-Powered Cyberattacks Automating Theft and Extortion Across Critical Sectors
Anthropic on Wednesday revealed that it disrupted a sophisticated operation that weaponized its AI-powered chatbot Claude to conduct large-scale theft and extortion of personal data in July 2025. The actor targeted at least 17 distinct organisations,…
The Hacker News -
Microsoft ranked number one in modern endpoint security market share third year in a row
Microsoft has been ranked number one in modern endpoint security market share for a third consecutive year, according to IDC. The IDC note accompanies the Worldwide Modern Endpoint Security Market Shares, 2024 report, with Microsoft Defender for Endpoint…
Microsoft -
Why zero trust is never 'done' and is an ever-evolving process
Six months after celebrating their “zero trust transformation,” a financial services firm suffers a devastating breach through a supply chain vulnerability in a third-party API, despite meeting every configured control. According to Specops Software, zero…
BleepingComputer -
Developer verification: a promised lift for Android security
Google has announced that certified Android devices will require all apps to be registered by verified developers in order to be installed, a move aimed at reducing harmful apps targeting Android users. The measure targets sideloaded apps as well as those on…
Malwarebytes -
ShadowSilk Hits 36 Government Targets in Central Asia and APAC Using Telegram Bots
ShadowSilk has been attributed to a fresh campaign targeting government entities in Central Asia and the Asia-Pacific region, with Group-IB noting nearly three dozen victims and a focus on data exfiltration. The operation is run by a bilingual crew, with…
The Hacker NewsYoroTrooper -
Healthcare Services Group data breach impacts 624,000 people
The Healthcare Services Group Inc. (HSGI) data breach impacted 624,000 people, with the organisation confirming that unauthorized access to its network was detected on 7 October 2024 and that the intrusion began on 27 September 2024. The investigation found…
BleepingComputer -
AI-Powered Ransomware Has Arrived With 'PromptLock'
It was probably inevitable — analysts have spotted the first known ransomware strain powered by artificial intelligence. According to ESET researchers Anton Cherepanov and Peter Strycek, PromptLock uses the gpt-oss:20b model from OpenAI locally via the…
Dark Reading -
NVIDIA NeMo AI Curator Vulnerability Allows Code Execution and Privilege Escalation
NVIDIA released a security bulletin for NVIDIA® NeMo Curator addressing a high-severity vulnerability (CVE-2025-23307) that affects all prior versions of the Curator software. The flaw, rooted in improper handling of user-supplied files, allows a maliciously…
gbhackers.com -
Nevada State Offices Closed Following Disruptive Cyberattack
Nevada state offices were forced to close on Monday and Tuesday after a cyberattack described as a network incident disrupted state websites and phone lines, with emergency services remaining unaffected. The disruptions were disclosed in a post on X, and a…
SecurityWeek -
More vulnerable stalkerware victims’ data exposed in new TheTruthSpy flaw
Posted on 27 August 2025, Malwarebytes reports that TheTruthSpy’s Android-based stalkerware contains a flaw that lets anyone compromise any record in the system, after a security researcher demonstrated password changes on test accounts. TheTruthSpy collects…
Malwarebytes -
Infostealers: The Silent Smash-and-Grab Driving Modern Cybercrime
Infostealers have become the fulcrum of modern cybercrime, enabling stealthy data harvesting and rapid, mass-scale exfiltration. The article explains that these MaaS-enabled tools broaden the attacker base by allowing non-experts to deploy effective…
SecurityWeek -
TAG-144: Actors Attacking Government Entities With New Tactics, Techniques, and Procedures
The threat actor TAG-144, also referred to as Blind Eagle or APT-C-36, has been linked to five distinct activity clusters operating from May 2024 through July 2025, with a focus on Colombian government entities at local, municipal, and federal levels. The…
gbhackers.comAPT-C-36 -
77 malicious apps removed from Google Play Store
Google has removed 77 malicious apps from the Google Play Store, with researchers at ThreatLabz having discovered the apps had been installed over 19 million times before their removal. One of the malware families identified is a banking trojan known as…
Malwarebytes -
Citrix Patches Exploited NetScaler Zero-Day
Citrix has released patches for three NetScaler vulnerabilities, including a critical zero-day that was exploited in the wild, prompting emergency patch deadlines for federal agencies. Tracked as CVE-2025-7775 (CVSS 9.2), the flaw is a memory overflow that…
SecurityWeek -
PromptLock: First AI-Powered Ransomware Emerges
PromptLock is the first known AI-powered ransomware to rely on AI systems for local operations, though it is described as a proof-of-concept or work-in-progress and not deployed in the wild yet, according to ESET. Written in GoLang, the malware relies on…
SecurityWeek
