News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Mon 29 Sep 2025· 72 articles
-
UK convicts "Bitcoin Queen" in world’s largest cryptocurrency seizure
The Metropolitan Police has secured a conviction in what is believed to be the world’s largest cryptocurrency seizure, valued at more than £5.5 billion. Zhimin Qian, 47, also known as Yadi Zhang, pleaded guilty today at Southwark Crown Court to acquiring and…
BleepingComputer -
IoT Security Flounders Amid Churning Risk
IoT security remains uneven as threat actors step up attacks on devices from medical gear to printers, even as a US government initiative lies in limbo and progress on curb measures is slow, according to Dark Reading’s September 29, 2025 report. The piece…
Dark Reading -
Sneaky, Malicious MCP Server Exfiltrates Secrets via BCC
Hundreds of organisations may be unknowingly funneling emails containing passwords, API keys, financial details and other sensitive data straight to a threat actor through a poisoned MCP server known as postmark-mcp. The malware was uncovered by Koi Security…
Dark Reading -
Storm-15674 articles this day · SecurityWeek first
Akira Hits SonicWall VPNs in Broad Ransomware Campaign · Cybercriminals Target SonicWall Firewalls to Deploy Akira Ransomware via Malicious Login Attempts
4 outlets-
Akira Hits SonicWall VPNs in Broad Ransomware Campaign
Akira ransomware actors are targeting SonicWall firewall customers vulnerable to a flaw discovered last year, specifically CVE-2024-40766, which enabled malicious logins and firewall crashes. While initial thoughts pointed to a zero-day, researchers note…
Dark Reading -
Cybercriminals Target SonicWall Firewalls to Deploy Akira Ransomware via Malicious Login Attempts
Security teams face a rapidly evolving campaign that abuses compromised SonicWall SSL VPN credentials to deliver Akira ransomware, with activity observed in under four hours from initial access. According to SonicWall, new malicious infrastructure tied to…
gbhackers.com -
Akira Ransomware bypasses MFA on SonicWall VPNs
Akira ransomware has been targeting SonicWall SSL VPNs since July 2025, exploiting credentials likely obtained from the exploitation of CVE-2024-40766 to bypass OTP MFA. The campaign, active since 21 July 2025, is affecting SonicWall NSA and TZ series…
Security Affairs -
Akira Ransomware’s Exploitation of SonicWall Vulnerability Continues
The Akira ransomware group continues to exploit a year-old SonicWall vulnerability for initial access and relies on pre-installed and legitimate tools to evade detection, security researchers warn, with a surge in activity around CVE-2024-40766 (CVSS 9.3)…
SecurityWeek
-
-
Japan's largest brewer suspends operations due to cyberattack
According to Asahi Group Holdings, Ltd, the cyberattack disrupted several of its operations and caused a system failure affecting its Japan-based activities. The incident has completely suspended ordering and shipping activity, with call centre operations…
BleepingComputer -
UK grants £1.5B loan to Jaguar Land Rover after cyberattack
The UK government has announced a support package of £1.5 billion for Jaguar Land Rover in response to a disruptive cyberattack, with a loan guarantee backed by the Export Development Guarantee provided by UK Export Finance and paid back over five years. The…
Security Affairs -
Ransomware gang sought BBC reporter’s help in hacking media giant
Threat actors claiming to represent the Medusa ransomware gang tried to recruit a BBC journalist by offering a substantial cut of any ransom, allegedly 15% initially and then a further 10%, for insider access to the BBC’s networks. The journalist, Joe Tidy,…
BleepingComputer -
EvilAI Malware Masquerades as AI Tools to Infiltrate Global Organizations
Threat actors are seen deploying EvilAI, a campaign that masquerades as legitimate AI and productivity tools to slip malware into organisations worldwide, according to Trend Micro. The campaign targets Europe, the Americas, and the AMEA region, with sectors…
The Hacker News -
UK govt backs JLR with £1.5 billion loan guarantee after cyberattack
The UK Government is providing Jaguar Land Rover (JLR) with a £1.5 billion loan guarantee to help restore its supply chain after a catastrophic cyberattack forced production to halt, according to today’s announcement. The guarantee is issued through the UK…
BleepingComputer -
Brave launches 'Ask Brave' feature to fuse AI with traditional search
Brave Software has unveiled a new subsystem called Ask Brave that fuses AI with traditional search, unifying the two into a single interface. The feature is free to use and accessible from search.brave[.]com/ask, designed with privacy at its core. Ask Brave…
BleepingComputer -
Amazon pays $2.5B settlement over deceptive Prime subscriptions
Amazon has agreed a $2.5 billion settlement with the Federal Trade Commission over deceptive Prime subscriptions, with the agreement requiring Amazon to pay a $1 billion civil penalty and provide $1.5 billion in refunds to harmed consumers, while ceasing…
Malwarebytes -
Ukrainian Cops Spoofed in Fileless Phishing Attacks on Kyiv
Ukrainian Cops Spoofed in Fileless Phishing Attacks on Kyiv reports that attackers impersonate the National Police of Ukraine to deploy Amatera Stealer and PureMiner, targeting Microsoft Windows machines at government entities in Ukraine. The phishing emails…
Dark Reading -
Sex offenders, terrorists, drug dealers, exposed in spyware breach
The Malwarebytes article reports a spyware breach that exposed monitoring data from RemoteCOM, a service marketed for managing pretrial, probation and parole clients, and its software branded as SCOUT. According to a report by Straight Arrow News, the hacker…
Malwarebytes -
Harrods suffers new data breach exposing 430,000 customer records
Harrods has disclosed a new cybersecurity incident after hackers compromised a third-party supplier and stole 430,000 records containing sensitive e-commerce customer information. According to BleepingComputer, the breach is not related to the May…
BleepingComputer -
New Spear-Phishing Attack Deploys DarkCloud Malware to Steal Keystrokes and Credentials
According to eSentire, a new spear-phishing campaign in September 2025 targeted a mid-sized manufacturer by delivering the DarkCloud infostealer to a Zendesk support inbox. The attackers used a banking-themed lure — “Swift Message MT103 Addiko Bank ad:…
gbhackers.com -
Can We Trust AI To Write Vulnerability Checks? Here's What We Found
According to Intruder, vulnerability management is a race where attackers move quickly, scans take time, and a slow or inaccurate scanner leaves organisations exposed. The piece describes how the security team tested AI for writing vulnerability checks,…
BleepingComputer -
15 years of helping build a better Internet: a look back at Birthday Week 2025
Cloudflare’s Birthday Week 2025 looked back on 15 years of building a better Internet while rolling out a new wave of initiatives aimed at creators, startups, and the next generation of talent. The company announced a goal to hire 1,111 interns in 2026, and…
Cloudflare -
Harrods alerts customers to new data breach linked to third-party provider
Harrods has warned that a data breach affected its online systems after one of its third-party provider systems was compromised, exposing names and contact details of some e-commerce customers. The company said the impacted data is limited to basic personal…
Security Affairs -
Jaguar Land Rover Confirms Gradual Restart of Operations Post-Cyberattack
Jaguar Land Rover has announced a controlled resumption of manufacturing operations following a significant cyberattack that disrupted its production facilities, with some sections expected to come back online in the coming days as part of a carefully…
gbhackers.com -
New TamperedChef Malware Exploits Productivity Tools to Access and Exfiltrate Sensitive Data
A cybersecurity write‑up reports a campaign dubbed “TamperedChef” that exploits trojanised productivity tools to bypass security controls and exfiltrate data. On 22 September 2025, Field Effect researchers flagged two PUAs, ImageLooker[.]exe and…
gbhackers.com -
⚡ Weekly Recap: Cisco 0-Day, Record DDoS, LockBit 5.0, BMC Bugs, ShadowV2 Botnet & More
The weekly recap highlights Cisco 0-day exploits affecting ASA firewalls, with two CVEs—CVE-2025-20362 and CVE-2025-20333—being actively abused to bypass authentication and run malicious code, in a campaign linked to the ArcaneDoor cluster and a China-linked…
The Hacker News -
WhatsApp 0-Click Flaw Abused via Malicious DNG Image File
A newly discovered zero-click remote code execution vulnerability in WhatsApp is being demonstrated as affecting iOS, macOS and iPadOS devices, with researchers from DarkNavyOrg presenting a PoC exploit that requires no user interaction. The attack chain…
gbhackers.com -
Acreed Infostealer Gaining Popularity Among Cybercriminals for C2 via Steam Platform
Acreed, a novel infostealer first observed in February 2025, has rapidly gained traction among threat actors seeking discreet credential and cryptocurrency data harvesting. Leveraging a unique command-and-control mechanism via the Steam platform’s community…
gbhackers.com -
Android RCE, CRM Breach, Axiom Crypto Drainer, and Airbus Panel Interest
SOCRadar’s Dark Web Team has flagged multiple high-impact listings in underground forums, including an alleged remote code execution exploit for Android advertised at 600,000 USD. The same postings include an alleged unauthorized CRM access sale claimed to…
SOCRadar -
OpenAI is routing GPT-4o to safety models when it detects harmful activities
OpenAI is routing GPT-4o to safety models when conversations touch on sensitive or emotional topics, a mechanism described as a safety feature rather than a permanent change. The article notes that GPT-4o can switch mid-chat to a GPT-5-designed reasoning or…
BleepingComputer -
The State of AI in the SOC 2025 - Insights from Recent Study
A new survey of 282 security leaders across industries paints a stark picture of SOCs under pressure, with alert volumes pushing teams to leave critical threats uninvestigated. On average, organisations process 960 alerts per day, and large enterprises…
The Hacker News -
Cyberattack on JLR Prompts £1.5 Billion UK Government Intervention
The government has announced a £1.5 billion loan guarantee for Jaguar Land Rover (JLR) in response to the cyberattack that disrupted the carmaker’s operations. The loan, backed by the Export Development Guarantee provided by UK Export Finance, will be paid…
SecurityWeek -
ThreatBook Launches Best-of-Breed Advanced Threat Intelligence Solution
ThreatBook has launched ThreatBook Advanced Threat Intelligence (ATI), a global service designed to provide granular, APAC-focused threat insights for TIPs, SOCs and cybersecurity analysts, with operations centred in Singapore and Hong Kong. The ATI platform…
gbhackers.com -
Hackers Exploit Weaponized Microsoft Teams Installer to Deploy Oyster Malware
A sophisticated malvertising campaign has been targeting organisations through a weaponized Microsoft Teams installer that delivers the Oyster malware, according to a recent investigation by cybersecurity experts. The attackers employ a multi‑stage chain…
gbhackers.com -
Forensic-timeliner: A Windows Forensics Tool for DFIR Investigators
Forensic-Timeliner is a fast, open-source command-line tool designed to help digital forensics and incident response (DFIR) teams quickly build a unified timeline of Windows artifacts. By automatically collecting, filtering, and merging CSV output from…
gbhackers.com -
SafeHill Emerges from Stealth With $2.6 Million Pre-Seed Funding
SafeHill Emerges from Stealth With $2.6 Million Pre-Seed Funding, led by Mucker Capital and Chingona Ventures, marks Chicago-based SafeHill’s first public funding round after its stealth launch. The firm was founded by Mike Pena (CEO), Nicholas Gonzalez…
SecurityWeek -
Dutch Teens Arrested for Allegedly Helping Russian Hackers
Two teenage boys, both 17, were arrested in the Netherlands amid suspicions of spying for pro-Russian hackers. The pair were allegedly approached by the hackers on Telegram, and one was reportedly seen walking near Europol and Eurojust headquarters and the…
SecurityWeek -
New Olymp Loader Malware-as-a-Service Promises Defender Bypass with Auto Certificate Signing
Olymp Loader, a newly emerged Malware-as-a-Service (MaaS) offering, has rapidly gained traction across underground forums and Telegram since its debut on 5 June 2025. Developed by a trio of seasoned Assembly coders under the alias “OLYMPO,” the loader…
gbhackers.com -
Microsoft Flags AI-Driven Phishing: LLM-Crafted SVG Files Outsmart Email Security
According to Microsoft Threat Intelligence team, a new phishing campaign aimed at U.S.-based organisations has likely used large language models to obfuscate payloads inside Scalable Vector Graphics files and evade security tools. The activity, detected on…
The Hacker News -
First Malicious MCP Server Found Stealing Emails in Rogue Postmark-MCP Package
Cybersecurity researchers have identified what is described as the first-ever malicious MCP server found in the wild, tied to a rogue npm package called postmark-mcp. According to Koi Security, a legitimate-looking developer slipped in this code, copying the…
The Hacker News -
Formbricks Signature Verification Flaw Lets Attackers Reset User Passwords
A critical vulnerability in the open source Formbricks experience management toolbox allows attackers to reset any user’s password without authorisation, according to GHSA-7229-q9pv-j6p4. The flaw stems from missing JWT signature verification in Formbricks…
gbhackers.com -
Cybercriminals Exploit Facebook and Google Ads as Tools for Stealing Sensitive Data
Cybercriminals have expanded a malvertising campaign that began with Facebook Ads selling fake TradingView Premium to infiltrate Google Ads and YouTube, targeting financial platform users worldwide. According to Bitdefender researchers, the campaign now…
gbhackers.com
