News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Fri 5 Sep 2025· 72 articles
-
IT threat evolution in Q2 2025. Mobile statistics
According to Kaspersky Security Network, in Q2 2025 our solutions blocked 10.71 million malware, adware, and unwanted mobile software attacks. Trojans were the most common mobile threat, accounting for 31.69% of total detected threats, while just under…
securelist.com -
IT threat evolution in Q2 2025. Non-mobile statistics
IT threat evolution in Q2 2025, non-mobile statistics, shows a broad surge across online and IoT threats. In the quarter, Kaspersky solutions blocked more than 471 million attacks originating from internet resources, with Web Anti-Virus detecting 77 million…
securelist.com -
North Korean Hackers Expose Their Playbook for Swapping Infrastructure
A sophisticated North Korean cyber operation has been exposed, revealing how state-sponsored hackers monitor cybersecurity intelligence platforms to detect when their infrastructure is discovered and rapidly deploy replacement assets to maintain operations.…
gbhackers.com -
More Cybersecurity Firms Hit by Salesforce-Salesloft Drift Breach
Proofpoint, SpyCloud, Tanium, and Tenable have confirmed that information in their Salesforce instances was compromised as part of the Salesforce–Salesloft Drift attack, with attackers accessing data stored in those tenants. The campaign, publicly disclosed…
SecurityWeek -
Automation Is Redefining Pentest Delivery
Automation is redefining pentest delivery, moving beyond static PDFs and manual handoffs to real-time, rules-based workflows. According to PlexTrac, automated delivery can route findings as they are identified, enabling faster remediation and tighter…
The Hacker News -
Hackers Exploit Google Calendar API with Serverless MeetC2 Framework
Hackers have demonstrated a novel serverless command-and-control technique, dubbed MeetC2, that abuses Google Calendar APIs to hide traffic inside trusted cloud services. According to GBHackers, the approach uses a minimal organiser and guest agent that talk…
gbhackers.com -
Recent SAP S/4HANA Vulnerability Exploited in Attacks
A critical SAP S/4HANA code injection flaw tracked as CVE-2025-42957 has been exploited in the wild, according to SecurityBridge. The vulnerability, fixed by SAP in August after being responsibly disclosed to the vendor by SecurityBridge in late June, can…
SecurityWeek -
France’s CNIL fined Google $379M and Shein $175M for breaching cookie rules
According to CNIL, the French data watchdog, Google was fined $379 million (€325 million) and Shein $175 million (€150 million) for breaching cookie rules. The sanctions, part of CNIL’s ongoing cookie enforcement, addressed issues such as placing cookies…
Security Affairs -
Hackers Exploit Raw Disk Reads to Evade EDR and Steal Sensitive Files
Hackers are shown bypassing Endpoint Detection and Response (EDR) tools by reading raw disk sectors instead of using normal file APIs, allowing them to steal sensitive files such as the SAM hive, SYSTEM hive, and NTDS[.]dit without triggering typical alerts.…
gbhackers.com -
NightshadeC2 Botnet Exploits ‘UAC Prompt Bombing’ to Evade Windows Defender
A new botnet named NightshadeC2 has emerged, identified in August 2025 by eSentire’s Threat Response Unit (TRU) as an evolution in malware evasion. It employs a novel UAC Prompt Bombing technique to force repeated Windows Defender prompts, arguing that the…
gbhackers.com -
VirusTotal Finds 44 Undetected SVG Files Used to Deploy Base64-Encoded Phishing Pages
According to VirusTotal, a Google-owned malware scanning service, researchers have flagged a new malware campaign that uses 44 unique Scalable Vector Graphics (SVG) files in phishing attacks spoofing the Colombian judicial system. The SVGs are distributed…
The Hacker News -
Windows Heap Buffer Overflow Vulnerability Allows Attackers to Gain Elevated Privileges
A critical security vulnerability has been discovered in Microsoft Windows systems that allows attackers to escalate their privileges and potentially gain complete control over affected machines. The vulnerability, designated CVE-2025-53149, affects the…
gbhackers.com -
Colombian Malware Exploits SWF and SVG to Evade Detection
A sophisticated malware campaign targeting Colombian institutions uses weaponized SWF and SVG files to evade detection, as reported by GBHackers on 5 September 2025. The discovery emerged via VirusTotal’s newly enhanced Code Insight platform, which added…
gbhackers.com -
Hackers Target Cisco ASA Devices in Massive Scan Across 25,000 IPs
Security researchers have spotted massive scanning campaigns aimed at Cisco Adaptive Security Appliance (ASA) devices, probing over 25,000 unique IP addresses in coordinated waves that may precede a vulnerability disclosure, according to GreyNoise. The first…
gbhackers.com -
Chess.com Confirms Data Breach After Hackers Exploit External System
Chess[.]com, the Orem, Utah-based online chess platform, has confirmed a data breach in which personal information of thousands of users was compromised after attackers exploited an external system connected to its network. The breach affected 4,541…
gbhackers.com -
A £100M Lawsuit: Tesco Sues Broadcom Over VMware License Dispute
Tesco has filed a lawsuit against Broadcom and its distributor Computacenter, alleging breach of licensing agreements and seeking up to £100 million in damages, according to The Register. The claim centres on Tesco’s January 2021 purchase of perpetual…
SecurityOnline -
Windows Update Is Causing Unexpected UAC Prompts and App Installation Issues
According to a notice published on the Windows Health Dashboard, Microsoft has confirmed that the routine security updates released in August are causing unexpected UAC prompts and application installation issues across all supported versions of Windows. The…
SecurityOnline -
Poke Is Back: Facebook Revives a Classic Feature with a Gamified Twist
According to Meta, the once-familiar poke feature on Facebook is being revived, this time with a gamified twist and new interactive elements, announced on Instagram on 5 September 2025. The updated poke introduces interaction tracking and a mechanic…
SecurityOnline -
Cloudflare 1.1.1.1 Hit by 12 Unauthorized Certificates: Fina CA’s Misissuance Raises Microsoft Trust Concerns
Cloudflare 1.1.1[.]1 was revealed to have twelve unauthorized certificates for its public DNS service, 1.1.1[.]1, issued by Croatia’s Fina CA since early 2024, far exceeding the initial report of three. The mississuance went undetected for nineteen months,…
SecurityOnline -
-
Argo CD Patches Critical CVSS 10 Vulnerability Exposing Repository Credentials (CVE-2025-55190)
Argo CD has disclosed and patched a critical vulnerability (CVE-2025-55190, CVSS 10) that affects its GitOps platform for Kubernetes, exposing repository credentials stored in projects. The flaw resides in the Project API, where tokens with basic project…
SecurityOnline -
CISA Adds Three New Vulnerabilities to Catalog, Urges Immediate Patching
According to CISA, the Cybersecurity and Infrastructure Security Agency, three new vulnerabilities have been added to the Known Exploited Vulnerabilities (KEV) Catalog amid evidence of active exploitation in the wild, affecting the Linux kernel, Android…
SecurityOnline -
SentinelLABS Reveals How North Korean “Contagious Interview” Operators Abuse Threat Intel Platforms
The SentinelLABS intelligence team, in collaboration with Validin, published an in-depth analysis of North Korean-aligned actors exploiting cyber threat intelligence platforms to monitor their exposure, scout new infrastructure, and refine operations,…
SecurityOnlineLazarus Group -
CVE-2025-56752: Remote Attackers Can Gain Full Administrative Access to Affected Ruijie Networks Devices Without Authentication
CVE-2025-56752 is a critical vulnerability in Ruijie Reyee RG-ES series switches that could allow remote attackers to modify the device login password and gain full administrative access without authentication. The flaw, which carries a CVSS score of 9.4,…
SecurityOnline -
Kimsuky APT Is Using Social Engineering and AppleSeed Malware to Spy on South Korea
The Genians Security Center (GSC) published a detailed analysis of a new APT campaign attributed to the North Korea–linked group Kimsuky, which is tied to the AppleSeed malware family and targets defence, activist, and North Korea–related communities in…
SecurityOnlineKimsuky -
A Massive Coordinated Attack Is Probing Cisco ASA Devices
Two unusually large waves of scanning activity targeted Cisco Adaptive Security Appliance (ASA) devices in late August 2025, with GreyNoise Intelligence noting a surge that could indicate attackers preparing to exploit a new vulnerability. According to…
SecurityOnline -
Acronis TRU Uncovers Surge in ScreenConnect Abuse with Dual-RAT Deployment
Acronis Threat Research Unit (TRU) has published findings on a campaign that abuses ConnectWise ScreenConnect, a legitimate remote monitoring and management tool, to deliver multiple remote access trojans. Since March 2025, researchers have observed a surge…
SecurityOnline -
CVE-2025-53187: Critical RCE in ABB ASPECT BMS with CVSS 9.8, No Prior Authentication
CVE-2025-53187 is described as a critical RCE and authentication bypass in ABB ASPECT BMS, with a CVSS of 9.8 and no prior authentication required. ABB has stated that three major vulnerabilities affect ASPECT firmware versions prior to 3.08.04-s01, with the…
SecurityOnline -
BlockEDRTraffic – EDR Evasive Lateral Movement Tool
BlockEDRTraffic is a pair of Windows proof-of-concept tools described as EDR evasive lateral movement utilities that prevent Endpoint Detection and Response (EDR) agents from sending network telemetry. It offers two evasion paths: creating inbound and…
darknet.org.uk -
Department of State employee sentenced for transmitting national defense information to suspected Chinese government agents
A U.S. Department of State employee, Michael Charles Schena, 42, of Alexandria, was sentenced to four years in prison for conspiring to collect and transmit national defense information to individuals he believed were working for the government of the…
DataBreaches -
Beyond Simple Scripts: A New XWorm Campaign Uses Multi-Stage Stealth
A new XWorm campaign, identified by researchers at the Trellix Advanced Research Center, marks a shift to multi-stage stealth with the aim of evasion, persistence and evading detection. The attack commonly begins with a malicious .lnk shortcut delivered via…
SecurityOnline -
NotDoor: A New Backdoor by Russia’s APT28 Is Hiding in Microsoft Outlook Macros
NotDoor is a new backdoor campaign attributed to APT28, the Russia-linked threat group also known as Fancy Bear, according to LAB52. The malware, implemented as a VBA macro for Microsoft Outlook, monitors incoming emails for a trigger word and, when…
SecurityOnlineAPT28
