News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 13 so far |
Fri 14 Nov 2025· 66 articles
-
Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT
According to Unit 42, two interconnected malware campaigns operated through 2025, targeting Chinese-speaking users with Gh0st RAT variants. The first campaign, active from February to March 2025 and called Campaign Trio, impersonated three brands and…
unit42.paloaltonetworks.com -
Storm-15672 articles this day · SecurityWeek first
Akira RaaS Targets Nutanix VMs, Threatens Critical Orgs · Akira Ransomware Group Made $244 Million in Ransom Proceeds
2 outlets-
Akira RaaS Targets Nutanix VMs, Threatens Critical Orgs
The Akira ransomware group has been expanding its tools and attack surfaces, with a June 2025 operation encrypting Nutanix AHV virtual machine disk files, marking a shift to a hypervisor that isn’t as commonly targeted. Authorities note Akira’s rapid data…
Dark Reading -
Akira Ransomware Group Made $244 Million in Ransom Proceeds
The Akira ransomware group has made over $244 million in proceeds from its activities, according to an updated joint advisory from government agencies in the US, France, Germany, and the Netherlands. Active since at least March 2023, the group is best known…
SecurityWeek
-
-
New Security Tools Target Growing macOS Threats
Two researchers, Obinna Igbe and Godwin Attigah, have developed Malet, a public dataset of macOS malware, and Katalina, an open source static analysis tool designed to process thousands of binaries per minute, to help defenders better identify macOS threats.…
Dark Reading -
Hardened Containers Look to Eliminate Common Source of Vulnerabilities
Hardened containers are being promoted as a way to eliminate common vulnerabilities in the software supply chain, after a kitchen-sink approach left many images with flaws. According to Chainguard, popular Debian-based Docker images had 280 vulnerabilities…
Dark Reading -
Fortinet Confirms Active Exploitation of Critical FortiWeb Vulnerability
Fortinet has warned that a FortiWeb vulnerability, CVE-2025-64446 (CVSS 9.1), allows remote, unauthenticated attackers to gain administrative access to FortiWeb appliances through a relative path traversal and authentication bypass. Fortinet says the flaw…
SecurityWeek -
150,000 Packages Flood NPM Registry in Token Farming Campaign
Amazon researchers identified more than 150,000 malicious NPM packages engaged in a token farming campaign targeting the tea[.]xyz protocol, a blockchain-based system that rewards open source contributors. The campaign stood out for its self-replicating…
Dark Reading -
Suspected Russian hacker reportedly detained in Thailand, faces possible US extradition
The DataBreaches[.]Net report says a Russian citizen reportedly detained on Phuket on suspicion of cybercrimes and held in Bangkok as authorities consider extradition to the United States. According to the Russian Embassy in Thailand, consular access is…
DataBreaches -
Critical CVE-2025-59367 flaw lets hackers access ASUS DSL routers remotely
ASUS has patched a critical authentication-by-pass flaw, tracked as CVE-2025-59367, in several DSL routers, allowing remote, unauthenticated attackers to access unpatched devices. The vulnerability affects the DSL-AC51, DSL-N16 and DSL-AC750 router families,…
Security Affairs -
Did you hear the one about the ransom victim who made a ransom installment payment after they were told that it wouldn’t be accepted?
Millicom faced a ransomware dispute after ShinyHunters claimed to have exfiltrated 380 million customer records, including names, email addresses, account numbers, and masked card details, with a date of mid‑September attack and a demand of 15 BTC.…
DataBreaches -
North Korean Hackers Turn JSON Services into Covert Malware Delivery Channels
The Hacker News reports that North Korean threat actors behind the Contagious Interview campaign have updated their tactics by using JSON storage services to stage malicious payloads, including JSON Keeper, JSONsilo and npoint[.]io, to host and deliver…
The Hacker News -
CYBERCOM 2.0: Pentagon Unveils Plan to Fix Cyber Talent Shortfalls
The SecurityWeek report outlines CYBERCOM 2.0, a Pentagon plan to overhaul cyber force generation with the aim of increasing lethality and operational effectiveness for US Cyber Command. The DoW says the revised model integrates CYBERCOM with military…
SecurityWeek -
Shadow Program Gives AWS Exec New Security Lens
A Dark Reading profile of Arielle Waldman recounts how Sara Duffer, vice president of compliance and security assurance at AWS, spent three years in Amazon’s shadow program, moving from the security team to work under Andy Jassy. Between 2020 and 2023 she…
Dark Reading -
Identity Governance and Administration, App Proliferation, and the App Integration Chasm
Identity Governance and Administration, App Proliferation, and the App Integration Chasm highlights that most enterprises use more than 1,000 apps, with a mean of about 1,100 across organisations, and that only around half of these are adequately integrated…
Dark Reading -
Be careful responding to unexpected job interviews
Be careful responding to unexpected job interviews, Malwarebytes warns, after incidents where scam recruiters contacted targets via LinkedIn and followed up with a Gmail-originated email inviting a Zoom interview. The messages describe a virtual meeting and…
Malwarebytes -
In Other News: Deepwatch Layoffs, macOS Vulnerability, Amazon AI Bug Bounty
Deepwatch laid off between 60 and 80 employees, representing roughly a quarter of its total workforce, with TechCrunch noting the move was to accelerate investments in AI and automation. CEO John DiLullo described the restructuring as necessary to…
SecurityWeek -
Researchers Find Serious AI Bugs Exposing Meta, Nvidia, and Microsoft Inference Frameworks
Cybersecurity researchers have uncovered remote code execution vulnerabilities across major AI inference engines from Meta, Nvidia, Microsoft, and open-source PyTorch projects such as vLLM and SGLang, tracing the flaws to an unsafe pattern dubbed ShadowMQ.…
The Hacker News -
Millions of sites at risk from Imunify360 critical flaw exploit
A vulnerability in ImunifyAV/Imunify360 lets attackers upload malicious files to shared servers and execute arbitrary code, risking millions of websites, according to Patchstack. The flaw affects Imunify360 AV before v32.7.4.0 and enables remote code…
Security Affairs -
Iranian Hackers Launch ‘SpearSpecter’ Spy Operation on Defense & Government Targets
The Hacker News reports that the Iranian state-sponsored threat actor APT42 has been observed targeting individuals and organisations of interest to the IRGC in a new espionage-focused campaign codenamed SpearSpecter, detected in early September 2025 and…
The Hacker News -
Cisco Catalyst Center Vulnerability Allows Attackers to Escalate Privileges
A critical security vulnerability has been identified in the Cisco Catalyst Center Virtual Appliance that could enable authenticated, remote attackers to escalate their privileges to Administrator on affected systems. This vulnerability CVE-2025-20341 is…
gbhackers.com -
FortiWeb Path Traversal Exploit Actively Targeted: What You Need to Know
A newly observed Fortinet FortiWeb vulnerability is a path traversal flaw that could enable an unauthenticated attacker to create a local administrator account by sending a crafted POST request to the API endpoint…
SOCRadar -
Multiple Cisco Unified CCX Vulnerabilities Enable Arbitrary Command Execution by Attackers
Two critical vulnerabilities in Cisco Unified Contact Center Express (Unified CCX) could allow unauthenticated, remote attackers to take control of affected systems, with the first being CVE-2025-20354, a Remote Code Execution flaw in the Java RMI process…
gbhackers.com -
RONINGLOADER Uses Signed Drivers to Disable Microsoft Defender and Bypass EDR
According to Elastic Security Labs, a campaign deploying a newly identified loader, dubbed RONINGLOADER, weaponises legitimately signed kernel drivers to systematically disable Microsoft Defender and evade EDR tools, with the activity attributed to the…
gbhackers.com -
Hackers Exploit Rogue MCP Server to Inject Malicious Code into Cursor’s Built-In Browser
Security researchers have uncovered a critical vulnerability in Cursor, the AI-powered code editor, that lets attackers inject malicious code via rogue MCP servers. Unlike VS Code, Cursor lacks integrity checks on its runtime components, making it vulnerable…
gbhackers.com -
Checkout.com Discloses Data Breach After Extortion Attempt
Checkout[.]com has disclosed a data breach after an extortion attempt, the company saying the incident involved a legacy, third-party cloud file storage system that had not been used since 2020 and did not affect its payment processing platform. According to…
SecurityWeek -
NVIDIA NeMo Flaw Enables Code Injection and Privilege Escalation Attacks
NVIDIA has issued security patches for two high-severity flaws in its NeMo Framework that could allow attackers to execute arbitrary code and escalate privileges on affected systems. The vulnerabilities affect all versions before 2.5.0, with CVEs…
gbhackers.com -
Cybercriminals Use Fake Invoices to Deploy XWorm and Steal Login Credentials
According to Malwarebytes, security researchers have uncovered an active malware distribution operation that uses fake invoice emails to deploy Backdoor[.]XWorm, a remote-access Trojan (RAT) that can steal credentials, record keystrokes, and even deploy…
gbhackers.com -
Critical FortiWeb flaw under attack, allowing complete compromise
Fortinet FortiWeb is facing an actively exploited authentication bypass flaw that enables attackers to hijack admin accounts and take full control of devices, with Fortinet releasing version 8.0.2 to address the issue. The vulnerability was publicly…
Security Affairs -
Washington Post Says Nearly 10,000 Employees Impacted by Oracle Hack
According to The Washington Post, nearly 10,000 individuals were affected by a data breach stemming from a cyberattack on its Oracle E-Business Suite (EBS) instance. The incident is linked to a threat actor associated with the Cl0p ransomware, apparently a…
SecurityWeek -
Advanced macOS DigitStealer Uses Multi-Stage Attack Chain to Evade Detection
According to Jamf Threat Labs, a new macOS malware family tracked as DigitStealer represents a significant evolution in macOS-targeted threats, using a four-stage, multi-stage attack chain to evade detection. The campaign begins with an unsigned disk image…
gbhackers.com -
Researchers question Anthropic claim that AI-assisted attack was 90% autonomous
Researchers from Anthropic described a “first reported AI-orchestrated cyber espionage campaign” in which their Claude AI tool was used to automate up to 90 percent of the work, with human intervention required only sporadically (perhaps 4-6 critical…
Ars Technica -
Your passport, now on your iPhone. Helpful or risky?
Posted on 14 November 2025, the Malwarebytes piece explains that Apple has launched Digital ID, a way for users in the US to create and present a government-issued ID in Apple Wallet using passport information, initially for TSA checkpoints at more than 250…
Malwarebytes -
Formbook Malware Campaign Uses Malicious ZIP Files and Layered Scripting Techniques
A new Formbook malware campaign has emerged, highlighted by a phishing email that delivers a ZIP archive containing a single script named Payment_confirmation_copy_30K__202512110937495663904650431.vbs. Opening the VBS file reveals obfuscated tricks,…
gbhackers.com -
Analysis of Multi-Stage Phishing Kits Leveraging Telegram for Credential Theft and Evasion Techniques
According to Group-IB, researchers have uncovered a sophisticated phishing framework that industrialises credential theft through automation, evasion techniques and Telegram-based data exfiltration. The kit targets Aruba S.p.A., an Italian IT services…
gbhackers.com -
Kraken Ransomware Targets Windows, Linux, and VMware ESXi in Enterprise Environments
According to Talos, Kraken is a cross‑platform ransomware threat that has emerged from the HelloKitty ecosystem and was observed in August 2025 conducting big‑game hunting and double‑extortion attacks against enterprise environments worldwide. The group…
gbhackers.com -
Amazon Detects 150,000 NPM Packages in Worm-Powered Campaign
Amazon says more than 150,000 malicious NPM packages were published in a spam campaign linked to a self-replicating worm, expanding a previously reported total of about 80,000 packages across 18 accounts. The activity, identified between 24 October and 12…
SecurityWeek -
Ransomware's Fragmentation Reaches a Breaking Point While LockBit Returns
According to Check Point Research, Q3 2025 saw a record 85 active ransomware and extortion groups, marking the most decentralised ransomware ecosystem to date. Across more than 85 leak sites, operators published 1,592 new victims in Q3 2025, with an average…
The Hacker News -
Chinese Hackers Use Anthropic's AI to Launch Automated Cyber Espionage Campaign
State-sponsored threat actors from China used Anthropic’s AI technology to orchestrate automated cyber attacks as part of a highly sophisticated espionage campaign in mid-September 2025. The attackers used AI’s “agentic” capabilities to execute the attacks…
The Hacker News -
Imunify360 Vulnerability Could Expose Millions of Sites to Hacking
A serious vulnerability in Imunify360’s ImunifyAV+ malware scanner could allow arbitrary code execution by uploading a specially crafted file to shared hosting servers, potentially compromising the entire hosting environment. According to Patchstack, the…
SecurityWeek -
Germany’s BSI issues guidelines to counter evasion attacks targeting LLMs
Germany’s BSI has published guidance on evasion attacks in large language models, warning that such attacks can subvert model safeguards. The document, titled Evasion Attacks on LLMs – Countermeasures in Practice, is aimed at developers and IT managers in…
Security Affairs
