News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Thu 16 Oct 2025· 82 articles
-
Threat Brief: Nation-State Actor Steals F5 Source Code and Undisclosed Vulnerabilities
On 15 October 2025, F5 disclosed that a nation-state threat actor conducted a long-term compromise, stealing source code from the BIG-IP product family and information about undisclosed vulnerabilities, according to F5. Unit 42 notes that Cortex Xpanse…
unit42.paloaltonetworks.com -
Hackers’ “bullet-proof” hosts deliver malware from blockchains
According to Google Threat Intelligence Group, hacking groups associated with the North Korean government have adopted a new technique to distribute malware from “bullet-proof” hosts by stashing payloads on public cryptocurrencies blockchains. The method,…
Ars Technica -
Cyberattackers Target LastPass, Top Password Managers
Cyberattackers are exploiting the trust people place in password managers in a wave of phishing campaigns that impersonate LastPass, Bitwarden and 1Password, with the attackers’ aim being to obtain master passwords and access credential stores. In a…
Dark Reading -
Leaks in Microsoft VS Code Marketplace Put Supply Chain at Risk
Researchers uncovered more than 550 unique secrets exposed in Visual Studio Code marketplaces, prompting Microsoft to bolster security measures, according to Wiz. The findings also revealed more than 130 tokens, including Azure DevOps Personal Access Tokens…
Dark Reading -
Operation Zero Disco: Threat actors targets Cisco SNMP flaw to drop Linux rootkits
Trend Micro researchers disclosed details of a campaign, tracked as Operation Zero Disco, that exploits Cisco IOS and IOS XE SNMP vulnerabilities to drop Linux rootkits on older devices. The flaw, CVE-2025-20352 (CVSS 7.7), allows remote authenticated…
Security Affairs -
Microsoft named a Leader in the 2025 Gartner® Magic Quadrant™ for SIEM
Microsoft has again been recognised as a Leader in the 2025 Gartner® Magic Quadrant™ for Security Information and Event Management (SIEM), a designation noted in the article with Gartner’s official citation dated 8 October 2025. According to Gartner® Magic…
Microsoft -
China Hackers Test AI-Optimized Attack Chains in Taiwan
A Chinese threat actor known as DropPitch has been testing whether artificial intelligence can enhance its cyberattacks against Taiwan. In an April and May 2025 wave, DropPitch targeted Taiwan’s semiconductor sector, focusing on major investment firms in…
Dark Reading -
U.S. CISA adds Adobe Experience Manager Forms flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Adobe Experience Manager Forms flaw to its Known Exploited Vulnerabilities catalog, tracked as CVE-2025-54253 (CVSS 10.0). The vulnerability is a misconfiguration issue in Adobe…
Security Affairs -
North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts
According to Google Threat Intelligence Group, a North Korea-linked threat actor has been observed using EtherHiding to distribute malware and enable cryptocurrency theft, marking the first time a state-sponsored group has embraced this method. The activity…
The Hacker News -
Hackers Abuse Blockchain Smart Contracts to Spread Malware via Infected WordPress Sites
A financially motivated threat actor codenamed UNC5142 has been observed abusing blockchain smart contracts to distribute information stealers such as Atomic (AMOS), Lumma, Rhadamanthys (aka RADTHIEF), and Vidar, by compromising WordPress sites on Windows…
The Hacker News -
Microsoft Revokes Over 200 Certificates to Disrupt Ransomware Campaign
Microsoft Revokes Over 200 Certificates to Disrupt Ransomware Campaign reported that Vanilla Tempest, also known as Vice Spider and Vice Society, was targeted. The campaign aimed to sign malware with fake Microsoft Teams installers to install a backdoor…
SecurityWeek -
LinkPro Linux Rootkit Uses eBPF to Hide and Activates via Magic TCP Packets
An investigation into an AWS-hosted infrastructure compromise has uncovered a new GNU/Linux rootkit named LinkPro, according to findings from Synacktiv. The backdoor relies on two eBPF modules: one to conceal itself and another to be remotely activated when…
The Hacker News -
Video call app Huddle01 exposed 600K+ user logs
The Malwarebytes article reports that the video call app Huddle01 exposed over 600,000 user logs through an unprotected Kafka broker. According to Cybernews, the Kafka instance contained over 621,000 log entries from the last 13 days, including usernames,…
Malwarebytes -
Denial of Fuzzing: Rust in the Windows kernel
Check Point Research (CPR) identified a security vulnerability in the Rust-based kernel component of Windows Graphics Device Interface (GDI) in January 2025, with Microsoft fixing the issue starting with OS Build 26100.4202 in the May 28, 2025 KB5058499…
Check Point -
China-linked APT Jewelbug targets Russian IT provider in rare cross-nation cyberattack
China-linked APT Jewelbug, also known as CL-STA-0049, Earth Alux, and REF7707, carried out a five-month intrusion on a Russian IT service provider, marking a rare cross-nation campaign, according to Symantec Threat Hunter Team researchers. The operation,…
Security AffairsREF7707 -
Extortion and ransomware drive over half of cyberattacks
Extortion and ransomware now drive more than half of cyberattacks, with the latest Microsoft Digital Defense Report noting that over 52% of incidents with known motives were driven by extortion or ransomware. In 80% of the cyber incidents investigated by…
blogs.microsoft.com -
New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware
Written by: Mark Magee, Jose Hernandez, Bavi Sadayappan, Jessa Valdez Since late 2023, Mandiant Threat Defense and Google Threat Intelligence Group (GTIG) have tracked UNC5142, a financially motivated threat actor that abuses the blockchain to facilitate the…
Google Cloud -
DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains
Written by: Blas Kojusner, Robert Wallace, Joseph Dobson Google Threat Intelligence Group (GTIG) has observed the North Korea (DPRK) threat actor UNC5342 using ‘EtherHiding’ to deliver malware and facilitate cryptocurrency theft, the first time GTIG has…
Google Cloud -
North Korean Hackers Deploy BeaverTail–OtterCookie Combo for Keylogging Attacks
Researchers at Cisco Talos have uncovered a sophisticated campaign by the Famous Chollima subgroup of Lazarus, in which attackers deploy blended JavaScript tools—BeaverTail and OtterCookie—to conduct keylogging, screenshot capture and data exfiltration. The…
gbhackers.comWageMole -
Phishing Alert: Fake ‘LastPass Hack’ Emails Spreading Malware
A phishing campaign impersonating LastPass is circulating, with messages purportedly dated 13 October 2025 that aim to coax users into downloading malicious desktop software. Emails claim to come from “hello@lastpasspulse[.]blog” or…
gbhackers.com -
AISLE Emerges From Stealth With AI-Based Reasoning System That Remediates Vulnerabilities on the Fly
AISLE has emerged from stealth with a new AI-based cyber reasoning system (CRS) described as an “AI-native cyber reasoning system that autonomously identifies, triages and remediates with verification both known and zero-day application vulnerabilities.” The…
SecurityWeek -
Matters.AI Raises $6.25 Million to Safeguard Enterprise Data
Matter[.]AI has announced raising $6.25 million in seed and pre-seed funding. The company’s seed round of $4.75 million was co-led by Endiya Partners and Kalaari Capital, with additional participation from Better Capital, Carya Venture Partners, and angel…
SecurityWeek -
Operation Silk Lure: Weaponizing Windows Scheduled Tasks for ValleyRAT Delivery
Operation Silk Lure describes a targeted cyber-espionage campaign that uses Windows Scheduled Tasks and DLL side-loading to deploy ValleyRAT, with Seqrite Lab researchers having uncovered its operations and revealing the C2 server at 206.119.175[.]16. The…
gbhackers.com -
Organizations Warned of Exploited Adobe AEM Forms Vulnerability
According to CISA, a recent Adobe Experience Manager Forms (AEM Forms) vulnerability has been exploited in the wild, with CVE-2025-54253 (CVSS 10.0) added to the Known Exploited Vulnerabilities catalogue. The flaw, described as a misconfiguration issue…
SecurityWeek -
CISA Alerts on Actively Exploited Windows Improper Access Control Flaw
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert about an actively exploited vulnerability in Microsoft Windows. The flaw sits in the Windows Remote Access Connection Manager and could allow an authorised attacker to…
gbhackers.com -
The Alliance That Wasn’t: A Critical Analysis of ReliaQuest’s Q3 2025 Ransomware Report
According to ReliaQuest's Threat Spotlight: Ransomware and Cyber Extortion in Q3 2025, the groups LockBit, DragonForce, and Qilin had allegedly formed a cooperative “alliance” sharing software, resources, and affiliates to boost their operational reach.…
DataBreaches -
Fuji Electric HMI Configurator Flaws Expose Industrial Organizations to Hacking
Fuji Electric has patched several vulnerabilities in its V-SFT HMI configuration and development software, which is used to create and manage Monitouch HMIs across manufacturing and other industrial sectors. Cybersecurity researcher Michael Heinzl disclosed…
SecurityWeek -
Architectures, Risks, and Adoption: How to Assess and Choose the Right AI-SOC Platform
Security Operations Centers are under unprecedented pressure as AI-SOC discussions shift from whether to use AI to how to measure its impact and select a platform that delivers value without undue risk, according to SACR's AI-SOC Market Landscape 2025. The…
The Hacker News -
Hackers Deploy Linux Rootkits via Cisco SNMP Flaw in "Zero Disco' Attacks
Cybersecurity researchers have detailed a campaign, codenamed Operation Zero Disco by Trend Micro, that exploited a recently disclosed Cisco IOS/IOS XE flaw to install Linux rootkits on older, unprotected systems. The flaw, CVE-2025-20352, is a stack…
The Hacker News -
Qilin Ransomware Leverages Ghost Bulletproof Hosting for Global Attacks
Qilin ransomware is described as an increasingly prolific ransomware-as-a-service operation that has intensified global extortion campaigns by exploiting a covert network of bulletproof hosting providers. According to the piece, these BPH services allow…
gbhackers.com -
Cisco Routers Hacked for Rootkit Deployment
Threat actors are exploiting CVE-2025-20352, a Cisco zero-day, to deploy a rootkit on older networking devices, in a campaign described by Trend Micro as Operation ZeroDisco. According to Trend Micro, the operation targets older Cisco devices such as the…
SecurityWeek -
Critical Samba Flaw Allows Remote Attackers to Execute Arbitrary Code
A newly disclosed vulnerability in Samba’s WINS server hook script allows unauthenticated attackers to execute arbitrary commands on affected domain controllers. The flaw, tracked as CVE-2025-10230, has a maximum CVSSv3.1 score of 10.0, reflecting its ease…
gbhackers.com -
US Charges Cambodian Executive in Massive Crypto Scam and Seizes More Than $14 Billion in Bitcoin
The U.S. government has seized more than $14 billion in bitcoin and charged Prince Holding Group chairman Chen Zhi with wire fraud conspiracy and money laundering conspiracy, according to Associated Press. The indictment was unsealed in Brooklyn as sanctions…
SecurityWeek -
Heritage Provider Network $49.99M Class Action Settlement
Heritage Provider Network Inc. and several affiliated medical entities agreed to pay $49,995,000 to settle a class action lawsuit over a December 2022 data breach that potentially exposed names, Social Security numbers, addresses, dates of birth, medical…
DataBreaches -
Anti-Israel cyberattack disrupts operations at Kelowna airport
Operations at Kelowna, B.C., airport (YLW) were disrupted on Tuesday evening after passenger information screens and public address systems were overtaken in a terrorist cyberattack. The incident began about 5:15 p.m., with pro-Hamas messaging visible and…
DataBreaches -
F5 discloses breach tied to nation-state threat actor
F5 disclosed on Wednesday that it had been the target of a “highly sophisticated” cyberattack attributed to a nation-state actor. According to an 8-K form filed with the Securities and Exchange Commission, the company first became aware of unauthorised…
DataBreaches -
Qilin Ransomware and the Ghost Bulletproof Hosting Conglomerate
Resecurity has published a report titled “Qilin Ransomware and the Ghost Bulletproof Hosting Conglomerate,” which examines the Qilin RaaS operation’s reliance on bullet-proof-hosting infrastructures. According to Resecurity, Qilin is one of the most prolific…
DataBreaches -
Integris Health Agrees to $30 Million Settlement Over 2023 Data Breach
Integris Health, an Oklahoma health system, has agreed to a $30 million settlement in a data breach class action that impacted over two million people. The filing describes a breach that occurred in November 2023, exposing Social Security Numbers, dates of…
DataBreaches -
Beware the Hidden Costs of Pen Testing
Penetration testing helps organisations ensure IT systems are secure, but it should never be treated as a one-size-fits-all exercise. The article notes that traditional pen tests can be rigid, time‑consuming and costly, delivering results that may not meet…
The Hacker News -
Gov’t seeks police probe of KT for allegedly obstructing data breach investigation
According to Yonhap News, the Ministry of Science and ICT has asked the police to investigate allegations that KT obstructed a government probe into unauthorized mobile payment breaches. In late August, unauthorized mobile payments worth a combined 240…
DataBreaches
