News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Wed 24 Sep 2025· 91 articles
-
Inside Salt Typhoon: China’s State-Corporate Advanced Persistent Threat
Inside Salt Typhoon: China’s State-Corporate Advanced Persistent Threat charts a state-directed cyber espionage program that targets global telecommunications and defence-adjacent networks, with activity traced back to 2019 and continuing through 2025. The…
dti.domaintools.comGhostEmperor -
CISA: Attackers Breach Federal Agency via Critical GeoServer Flaw
CISA disclosed that threat actors breached a large federal civilian executive branch agency last year by exploiting CVE-2024-36401 in the open source GeoServer mapping server, a flaw rated 9.8 on the CVSS scale. According to CISA's advisory, the attackers…
Dark Reading -
Verily Faces Lawsuit Over Alleged HIPAA Violations
Verily, owned by Alphabet and formerly known as Google Life Sciences, is facing a lawsuit filed by an ex-employee who alleges the misuse of personally identifiable health information belonging to over 25,000 patients and the failure to submit HIPAA breach…
DataBreaches -
Bookworm to Stately Taurus Using the Unit 42 Attribution Framework
According to Unit 42 Attribution Framework, the article traces how Bookworm malware is linked to the Stately Taurus threat group through a systematic, evidence-based analysis. The piece notes that Stately Taurus is a Chinese APT active since at least 2012,…
unit42.paloaltonetworks.comMUSTANG PANDA -
ClaimPix Data Leak Exposes 5 Million Customer Records
ClaimPix Data Leak Exposes 5 Million Customer Records, reported by DataBreaches[.]Net, involved an unencrypted and non-password-protected database that contained 5.1 million files totalling 10 TB. According to Website Planet, the publicly exposed database…
DataBreaches -
Volvo Group Data Breach Affects Workforce PII
Volvo Group North America LLC experienced a data breach affecting current and former employees due to a ransomware attack on its third-party HR software supplier, Miljödata, discovered on August 23, 2025. An investigation revealed that personal data,…
DataBreaches -
Motility Data Breach Exposes Social Security Numbers & Affects 760,000 Consumers
On August 19, 2025, Motility Software Solutions detected suspicious activity on its network, leading to a data breach affecting approximately 760,000 consumers in the U.S. The breach exposed personally identifiable information (PII) including names,…
DataBreaches -
Scattered Spider2 articles this day · DataBreaches first
The Fall of Scattered Spider? Teen Member Surrenders Amid Group's Shutdown Claims · Feds Tie ‘Scattered Spider’ Duo to $115M in Ransoms
2 outlets-
The Fall of Scattered Spider? Teen Member Surrenders Amid Group's Shutdown Claims
A member of the cybercrime group Scattered Spider turned himself in at the Clark County Juvenile Detention Center in Las Vegas, marking another enforcement win after the group’s shutdown claims. The suspect, identified as a teenage male by the FBI’s Las…
Dark Reading -
Feds Tie ‘Scattered Spider’ Duo to $115M in Ransoms
U.S. prosecutors last week levied criminal hacking charges against 19-year-old Thalha Jubair and 18-year-old Owen Flowers, alleging they were core members of Scattered Spider and involved in extorting victims for at least $115 million in ransoms, according…
DataBreaches
-
-
Russia Targets Moldovan Election in Disinformation Play
A state-backed Russian threat actor is targeting the 2025 Moldovan elections with a far‑reaching disinformation campaign, researchers say. Threat hunting vendor Silent Push published research on Sept. 23 concerning a threat actor tracked as Storm-1679 (aka…
Dark Reading -
Retail at risk: How one alert uncovered a persistent cyberthreat
Retail at risk: How one alert uncovered a persistent cyberthreat details how a single Defender Experts alert about a Possible web shell installation on a SharePoint server led to uncovering a major multi-part attack. The investigations tie the intrusion to…
Microsoft -
Chinese Hackers RedNovember Target Global Governments Using Pantegana and Cobalt Strike
A cyber espionage cluster, believed to be a Chinese state-sponsored actor, has been reassessed as RedNovember, which previously targeted global governments and private sector organisations across Africa, Asia, the Americas and Oceania. According to Recorded…
The Hacker NewsStorm-2077 -
UNC5221 Uses BRICKSTORM Backdoor to Infiltrate U.S. Legal and Technology Sectors
UNC5221 is linked to BRICKSTORM, a Go-based backdoor used to infiltrate the U.S. legal services, SaaS and technology sectors, with the aim of maintaining long-term, stealthy access. The malware can pose as a web server, perform file operations, execute shell…
The Hacker NewsUTA0178 -
Nation-State hackers exploit Libraesva Email Gateway flaw
State-sponsored hackers exploited a command injection flaw tracked as CVE-2025-59689 in Libraesva Email Gateway, with Libraesva describing the issue as allowing arbitrary commands to be executed as a non-privileged user via a malicious e‑mail containing a…
Security Affairs -
Hackers Target Casino Operator Boyd Gaming
Boyd Gaming has disclosed a data breach after hackers gained access to its internal IT systems, with the incident affecting employee information and the information of a limited number of other individuals. According to SecurityWeek’s report, the Las…
SecurityWeek -
Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors
Written by: Sarah Yoder, John Wolfram, Ashley Pearson, Doug Bienstock, Josh Madeley, Josh Murchie, Brad Slaybaugh, Matt Lin, Geoff Carstairs, Austin Larsen Introduction Google Threat Intelligence Group (GTIG) is tracking BRICKSTORM malware activity, which is…
Google Cloud -
Automatically Secure: how we upgraded 6,000,000 domains by default to get ready for the Quantum Future
Cloudflare reports that Automatic SSL/TLS, which scans origin servers and upgrades domains to the strongest encryption mode they support by default, has strengthened security for more than 6 million domains over the past year. Since late 2024, this automatic…
Cloudflare -
A simpler path to a safer Internet: an update to our CSAM scanning tool
Cloudflare has updated its CSAM Scanning Tool to remove the need for site operators to create and share their own unique NCMEC credentials, a change that has driven a dramatic rise in adoption.
Cloudflare -
Two Critical Flaws Uncovered in Wondershare RepairIt Exposing User Data and AI Models
Cybersecurity researchers have disclosed two critical flaws in Wondershare RepairIt that could expose private user data and enable AI model tampering and supply chain risks. The flaws, CVE-2025-10643 (CVSS 9.1) and CVE-2025-10644 (CVSS 9.4), are…
The Hacker News -
Attackers Bypass EDR by Using In-Memory PE Loaders Delivered via Malicious Downloads
Security researchers have identified a wave of attacks that bypass endpoint detection and response by using in-memory PE loaders delivered via malicious downloads. In these campaigns, a small downloader is delivered to victims through malicious links or…
gbhackers.com -
Man arrested in UK over alleged cyberattack that affected European airports
According to AP reports, a man in his 40s was arrested in southern England over an alleged cyberattack that disrupted several European airports in recent days, including London Heathrow. The U.K.’s National Crime Agency said the suspect was held in West…
DataBreaches -
Cybercriminals cash out with casino giant’s employee data
Cybercriminals have reportedly stolen employee data in a breach affecting Boyd Gaming, a Las Vegas-based hotel and casino operator, with the company warning regulators that attackers may have removed certain data. According to a filing, Boyd Gaming disclosed…
DataBreaches -
Ukrainian Intelligence Hackers Breach Crimean Servers: Uncovered War Crimes Evidence and Russian Military Lists
According to Militarnyi, cyber specialists of the Defense Intelligence of Ukraine have gained full access to all computers and servers of the self-proclaimed authorities in temporarily occupied Crimea. The operation yielded over 100 terabytes of intelligence…
DataBreaches -
Lotte Card reissues 650,000 cards after data leak, protects 1.28 million customers
Lotte Card says that from the 1st of this month through the previous day, about 650,000 of the 2.97 million customers whose information was leaked applied for card reissuance, with roughly 820,000 changing their PINs and about 110,000 suspending their cards,…
DataBreaches -
Suspected cyberattack disrupts Circle K chain’s operations in Hong Kong
Circle K’s Hong Kong operations were disrupted by a suspected cyberattack, with a network disruption that has paralysed the chain for several days and forced nearly 400 outlets to suspend most electronic payments and loyalty services. The retailer said the…
DataBreaches -
NY DFS Superintendent Adrienne A. Harris Extends Blockchain Analytics Guidance to New York State Banking Organizations
NY DFS Superintendent Adrienne A. Harris extends blockchain analytics guidance to New York State banking organisations, with the guidance issued on 17 September 2025 according to DFS. The guidance covers the use of blockchain analytics tools for banking…
DataBreaches -
U.S. Secret Service disrupts telecom network that threatened NYC during U.N. General Assembly
The U.S. Secret Service disrupted a sprawling telecommunications network in the New York tri-state area that investigators said posed a serious potential disruption to New York’s telecom systems and a possible threat to the United Nations General Assembly…
DataBreaches -
UK Police Arrest Suspect Tied to Ransomware Attack on European Airports
UK police have arrested a man in his forties in West Sussex as part of an investigation into a ransomware incident that disrupted several major European airports, including London Heathrow. According to the National Crime Agency, the arrest was made on…
gbhackers.com -
Multiple Apps on Google’s Firebase Platform Exposing Sensitive Data
A security analysis has uncovered a significant vulnerability in over 150 popular mobile applications using Google's Firebase platform, exposing sensitive user data due to misconfigurations. This issue affects approximately 80% of mobile apps, potentially…
gbhackers.com -
Attackers Use Domain Fronting to Tunnel Malicious Traffic via Google Meet, YouTube and Chrome Update Servers
On September 24, 2025, GBHackers reported that attackers are exploiting Google's core services, including Google Meet and YouTube, using a technique called domain fronting. This method allows malicious traffic to masquerade as legitimate connections to…
gbhackers.com -
Weaponized Malware: GitHub Hosts Malware from Malwarebytes, LastPass, Citibank, SentinelOne, and More
A large-scale campaign targeting Mac users is leveraging fake GitHub pages to distribute information‑stealing malware disguised as popular legitimate applications, with impersonations spanning Malwarebytes for Mac, LastPass, Citibank, SentinelOne and many…
gbhackers.com -
Threat Actor Deploys 'OVERSTEP' Backdoor in Ongoing SonicWall SMA Attacks
Threat actor UNC6148 is behind ongoing SonicWall SMA attacks, with researchersvtracking a “previously unknown” persistent backdoor called OVERSTEP that operates as a user-mode rootkit to maintain access, steal credentials and conceal activity. According to…
Dark Reading -
Securing today for the quantum future: WARP client now supports post-quantum cryptography (PQC)
Cloudflare has announced that its WARP client now supports post-quantum key agreement, extending PQC protection to both its free consumer 1.1.1[.]1 service and the enterprise Cloudflare One Agent. According to the National Institute of Standards and…
Cloudflare -
Giving users choice with Cloudflare’s new Content Signals Policy
According to Cloudflare, the new Content Signals Policy is a lightweight addition to robots[.]txt that lets website operators express their preferences for how content can be used after it has been accessed. The policy defines three content signals—search,…
Cloudflare -
To build a better Internet in the age of AI, we need responsible AI bot principles. Here’s our proposal.
Cloudflare’s blog proposes responsible AI bot principles to guide behaviour on the internet as AI crawlers and chatbots become more pervasive. The piece, dated 24 September 2025, outlines five starting points: public disclosure, self-identification, declared…
Cloudflare -
Police using drones to read your license plates, warns EFF
Police are using drones as flying automated license plate readers (ALPRs), according to a report by the Electronic Frontier Foundation (EFF). The piece notes that ALPR-equipped drones can systematically record vehicle location and movement, including in…
Malwarebytes -
Russian Disinformation Campaign Targets Moldova’s Upcoming Elections
A sophisticated Russian-linked disinformation effort is aimed at Moldova’s upcoming vote on 28 September 2025, raising concerns about foreign interference in the country’s democratic process. According to absatz[.]media, analysis of the sites reveals a…
gbhackers.com -
GeoServer Flaw Exploited in US Federal Agency Hack
The SecurityWeek report details a year-old GeoServer flaw, CVE-2024-36401 (CVSS 9.8), that was exploited to compromise a US federal civilian executive branch agency, with exploitation disclosed by CISA on 30 June 2024 and added to the KEV catalog shortly…
SecurityWeek -
Chromium-Based Browsers in Windows Domains Vulnerable to Arbitrary Extension Loads
A new study has shown that Chromium-based browsers in Windows domain environments are vulnerable to arbitrary extension loads. By manipulating where Chrome and related browsers store extension settings in preference files, attackers can silently inject code…
gbhackers.com -
European Airport Cyberattack Linked to Obscure Ransomware, Suspect Arrested
European Airport Cyberattack Linked to Obscure Ransomware, Suspect Arrested ties the incident at Collins Aerospace to the HardBit ransomware, which researchers say emerged in October 2022 and operates largely via an affiliate model. According to…
SecurityWeek
