News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Fri 3 Oct 2025· 59 articles
-
ShinyHunters Launches Data Leak Site: Trinity of Chaos Announces New Ransomware Victims
ShinyHunters-Led Trinity of Chaos launched a Data Leak Site (DLS) on the TOR network, listing 39 firms hit through vulnerabilities in Salesforce and other weaknesses. The group is described as tied to Lapsus$, Scattered Spider and ShinyHunters, continuing…
Security AffairsShinyHunters -
Scattered Lapsus$ Hunters Returns With Salesforce Leak Site
Scattered Lapsus$ Hunters have returned with a Salesforce-focused leak site, claiming to hold data from Salesforce customers and listing 39 victim organisations. The group says the leak site contains roughly 1 billion records and has set an Oct 10 deadline…
Dark ReadingUNC6040 -
Dutch Authorities Arrest Two Teens for Alleged Pro-Russian Espionage
Two 17-year-olds in the Netherlands were arrested last week on suspicion of conducting cyber-espionage for Russia-backed threat actors, authorities said. Prosecutors say the suspects are accused of government-sponsored interference on behalf of Russian…
Dark Reading -
Detour Dog Caught Running DNS-Powered Malware Factory for Strela Stealer
Detour Dog has been identified as powering campaigns distributing Strela Stealer, with Infoblox tracing the threat actor to control domains hosting the stealer’s first stage, including a backdoor called StarFish. According to Infoblox, Detour Dog’s…
The Hacker News -
Top 10 Best End-to-End Threat Intelligence Companies in 2025
GBHackers On Security’s Top 10 Best End-to-End Threat Intelligence Companies in 2025 article, published by Varshini on 3 October 2025, surveys the leading threat intelligence platforms enterprises can consider for 2025. The list names Recorded Future,…
gbhackers.com -
Rhadamanthys Stealer Evolves: Adds Device Fingerprinting, PNG Steganography Payloads
The Hacker News reports that Rhadamanthys Stealer has evolved to include device and web browser fingerprinting and now delivers its payload hidden in steganographic PNG files, as part of its ongoing updates in version 0.9.2. The article notes that the threat…
The Hacker News -
Jaguar Land Rover Shows Cyberattacks Mean (Bad) Business
The month-long outage at Jaguar Land Rover appears to be ending, with the firm beginning a controlled, phased restart of manufacturing after a cyberattack disrupted operations. JLR said on 2 September 2025 that it had proactively shut down operations…
Dark Reading -
Top 10 Best Supply Chain Risk Management Solutions in 2025
GBHackers On Security’s Top 10 Best Supply Chain Risk Management Solutions in 2025 surveys a range of AI-powered tools designed to identify, monitor and mitigate supplier and cyber risks across extended networks. The list features Interos[.]ai, RiskIQ,…
gbhackers.com -
Scattered Lapsus Hunters2 articles this day · SOCRadar first
More Salesforce customer attacks revealed in new leak site by Scattered LAPSUS$ Hunters · Dark Web Profile: Scattered Lapsus$ Hunters
2 outlets-
More Salesforce customer attacks revealed in new leak site by Scattered LAPSUS$ Hunters
According to DataBreaches[.]Net, the Scattered LAPSUS$ Hunters have opened a leak site in both clear net and onion versions and are pressuring Salesforce by threatening to leak their clients’ data if payment is not received by 10 October.
DataBreaches -
Dark Web Profile: Scattered Lapsus$ Hunters
Dark Web Profile: Scattered Lapsus$ Hunters, published by SOCRadar, describes a mid-2025 campaign in which attackers intruded Salesforce environments across 91 organisations, including Adidas, Cartier, Google, Louis Vuitton, Dior, Chanel, Tiffany & Co.,…
SOCRadar
-
-
In Other News: PQC Adoption, New Android Spyware, FEMA Data Breach
In Other News this week highlights post-quantum cryptography uptake, with PQC support for SSH servers rising to 8.5% of all SSH servers and 26% of OpenSSH servers, while TLS 1.3 adoption for PQC remains at 19%, according to an analysis by Forescout. The…
SecurityWeek -
ProSpy, ToSpy malware pose as Signal and ToTok to steal data in UAE
Researchers from ESET uncovered two Android spyware campaigns, ProSpy and ToSpy, that target UAE users by impersonating Signal and ToTok and delivering malicious APKs via fake websites and social engineering. The campaigns are tracked separately due to…
Security Affairs -
BCI: The Thing of Nightmare or Dreams?
Technology that directly interfaces with the brain raises pressing security and privacy questions as brain–computer interfaces (BCIs) move from research to potential everyday use. The piece notes that security must match the risk since a breach could target…
Dark Reading -
New Android Spyware Targeting Users by Imitating Signal and ToTok Apps
According to ESET researchers, two sophisticated Android spyware campaigns target users seeking secure communication by impersonating Signal and ToTok, with the operations focused mainly on UAE residents. The campaigns—ProSpy, which began activity in 2024…
gbhackers.com -
Microsoft's Voice Clone Becomes Scary & Unsalvageable
Microsoft’s Speak for Me (S4M) voice clone was designed to act as a Windows accessibility feature that could create virtual microphones for Teams and other apps, but it devolved into a deepfake and fraud vehicle after a raft of development bugs. The article…
Dark Reading -
UAT-8099 Hijacks Reputable Sites for SEO Fraud & Theft
A Chinese-language threat actor is infecting Internet Information Services (IIS) servers at reputable organisations, hijacking the sites for SEO fraud and data theft, according to Cisco Talos researchers. The operation, dubbed UAT-8099, uses all parts of the…
Dark ReadingUAT-8099 -
Threat Actors Pose as Government Officials to Attack Organizations with StallionRAT
In a recent wave of targeted phishing, the Cavalry Werewolf cluster escalated its operations by impersonating government officials and deploying FoalShell and StallionRAT malware. The campaign began by registering or compromising email addresses belonging to…
gbhackers.com -
Oneleet Raises $33 Million for Security Compliance Platform
Oneleet has announced it raised $33 million in a Series A round, bringing its total funding to $35 million, according to SecurityWeek. The round was led by Dawn Capital, with additional support from Y Combinator and several angel investors, and it will help…
SecurityWeek -
DrayOS Router Flaw Allows Remote Code Execution by Attackers
A critical vulnerability affecting DrayOS routers could let unauthenticated attackers execute code remotely by targeting the Web User Interface (WebUI). The flaw stems from the use of an uninitialized variable in WebUI logic, and crafting special HTTP or…
gbhackers.com -
New XWorm V6 Variant Embeds Malicious Code into Trusted Windows Applications
According to Trellix ARC, XWorm has evolved into a modular threat whose V6.0 campaign expands its plugin arsenal and introduces persistence techniques designed to conceal its activity on Windows. The campaign, first publicly documented as a resurgence on 4…
gbhackers.com -
Researchers Warn of Self-Spreading WhatsApp Malware Named SORVEPOTEL
Brazilian users are the focus of a new self-propagating WhatsApp malware campaign codenamed SORVEPOTEL, according to Trend Micro. The researchers describe an automated spread mechanism that relies on convincing phishing messages with malicious ZIP file…
The Hacker News -
From threats to apology, hackers pull child data offline after public backlash
According to Malwarebytes, a group calling itself “Radiant” claimed to have stolen sensitive data relating to around 8,000 children from nursery chain Kido, which operates in the UK, US, China and India. To prove possession, the criminals posted samples on…
Malwarebytes -
Unauthenticated RCE Flaw Patched in DrayTek Routers
DrayTek has patched an unauthenticated remote code execution vulnerability affecting DrayOS routers, tracked as CVE-2025-10547, which can be exploited via crafted HTTP or HTTPS requests to a vulnerable device’s web interface. According to DrayTek, successful…
SecurityWeek -
Product Walkthrough: How Passwork 7 Addresses Complexity of Enterprise Security
Passwork 7, released as part of an October 3, 2025 update, positions Passwork as an on-premises unified platform for both password and secrets management. The redesign tightens how credentials are organised through a hierarchical structure of vaults,…
The Hacker News -
GhostSocks Malware-as-a-Service Turns Compromised Devices into Proxies for Threat Actors
On October 15, 2023, a threat actor using the handle GhostSocks published a sales post on the Russian cybercrime forum xss[.]is advertising a novel Malware-as-a-Service. The service is designed to turn compromised Windows machines into residential SOCKS5…
gbhackers.com -
Organizations Warned of Exploited Meteobridge Vulnerability
According to CISA, a Meteobridge vulnerability patched in May has been exploited in attacks and added to the Known Exploited Vulnerabilities (KEV) catalog. The flaw, tracked as CVE-2025-4008 with a CVSS score of 8.7, allows remote unauthenticated attackers…
SecurityWeek -
SideWinder Hacker Group Targets Users with Fake Outlook/Zimbra Portals to Steal Login Credentials
The SideWinder APT group has intensified its credential harvesting operations across South Asia, launching sophisticated phishing campaigns that lure officials with fake Outlook Web App and Zimbra portals to steal login credentials, according to Hunt[.]io.…
gbhackers.comRAZOR TIGER -
MokN Raises $3 Million for Phish-Back Solution
MokN, the French cybersecurity startup, today announced it has raised €2.6 million (~$3 million) for its deception-based identity protection solution. The investment round was led by Moonfire, with additional support from OVNI Capital, Kima Ventures, and…
SecurityWeek -
New "Cavalry Werewolf" Attack Hits Russian Agencies with FoalShell and StallionRAT
A threat actor known to share overlaps with the hacking group YoroTrooper has been observed targeting the Russian public sector with FoalShell and StallionRAT, researchers say. According to BI[.]ZONE, the activity is being tracked under the moniker Cavalry…
The Hacker NewsYoroTrooper -
Hackers Exploit Grafana Vulnerability Allowing Arbitrary File Reads
Researchers at GreyNoise observed a surge in Grafana exploitation attempts tied to the well-known path traversal flaw CVE-2021-43798, which allows attackers to read arbitrary files on a server. According to GreyNoise, 110 unique IP addresses scanned Grafana…
gbhackers.com -
MCP Servers in Threat Intelligence: 10 Use Cases for CISOs
MCP servers are presented as a means to transform threat intelligence workflows by letting security teams query, correlate and act on data through natural language prompts. The article outlines 10 use cases for CISOs, from unifying incident response…
SOCRadar -
Oracle Says Known Vulnerabilities Possibly Exploited in Recent Extortion Attacks
Oracle has confirmed that some customers have received extortion emails and that its investigation suggests attackers may have exploited vulnerabilities that were addressed in the July 2025 Critical Patch Update. The company fixed about 200 vulnerabilities…
SecurityWeek -
WhatsApp Exploited to Spread SORVEPOTEL Malware on Windows Systems
An aggressive malware campaign dubbed SORVEPOTEL is exploiting WhatsApp messages to infiltrate Windows systems, with its epicentre in Brazil, according to GBHackers. Trend Research telemetry shows that 457 of the 477 detected infections originate in Brazil,…
gbhackers.com -
New ‘Point-and-Click’ Phishing Kit Evades Security Filters to Deliver Malicious Payloads
A new toolkit named Impact Solutions has emerged on cybercrime forums, offering a comprehensive, user-friendly framework for crafting advanced phishing campaigns. By democratising malware delivery, Impact Solutions empowers even low-skill threat actors to…
gbhackers.com -
Chrome 141 and Firefox 143 Patches Fix High-Severity Vulnerabilities
According to SecurityWeek, Google promoted Chrome 141 to the stable channel with 21 security fixes, including 12 for security defects reported by external researchers who earned a total of $50,000. Two externally reported bugs, CVE-2025-11205 and…
SecurityWeek -
CISA Flags Meteobridge CVE-2025-4008 Flaw as Actively Exploited in the Wild
CISA has added the high-severity vulnerability CVE-2025-4008 in Smartbedded Meteobridge to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The flaw is a command injection vulnerability in the Meteobridge web interface…
The Hacker News -
IIS Servers Compromised by Chinese Hackers for SEO Manipulation
According to Cisco Talos, UAT-8099, a Chinese-speaking cybercrime group, has been exploiting vulnerable Internet Information Services (IIS) servers across multiple countries to conduct search engine optimisation (SEO) fraud and steal high-value data.…
gbhackers.com -
Threat Actors Imitate Popular Brands in New Malware Distribution Campaigns
Threat actors are employing a rising smishing tactic that embeds trusted brand names into deceptive URLs and group messages to entice users to download malware, with familiar company names such as FedEx and Microsoft used in the links. Attackers place the…
gbhackers.com -
Oracle Confirms Hackers Target E-Business Suite Data in Extortion Campaigns
Oracle has confirmed that a group of hackers stole data from its E-Business Suite (EBS) applications and is using the information in extortion campaigns, with victims receiving ransom notes and proofs of stolen records. The firm says the attackers exploited…
gbhackers.com -
Rhadamanthys Stealer Offered on Dark Web for $299–$499
Rhadamanthys, described as a sophisticated information stealer, has appeared on underground marketplaces with subscription packages ranging from $299 to $499 per month. The offering is marketed in three core tiers: Self-Hosted at $299 per month, allowing…
gbhackers.com
