News

Sat 22 Nov 2025· 10 articles

1. 17:11

   BadAudio malware: how APT24 scaled its cyberespionage through supply chain attacks

   China-linked group APT24 used supply-chain attacks and multiple techniques over three years to deploy the BadAudio downloader and additional malware payloads, according to Google Threat Intelligence Group. The researchers note a shift from broad web…

   Security AffairsAPT24
   
2. 15:19

   China-Linked APT31 Launches Stealthy Cyberattacks on Russian IT Using Cloud Services

   According to Positive Technologies researchers Daniil Grigoryan and Varvara Koloskova, the China-linked APT31 group has been attributed with a series of cyberattacks against the Russian information technology sector between 2024 and 2025, conducted while…

   The Hacker NewsAPT31
3. 12:16

   Cyberattack disables Onsolve Code Red emergency alert system across St. Louis region

   A cyberattack has caused a nationwide outage of the Code Red emergency notification system, leaving cities and counties across the St. Louis region unable to send tornado warnings and other emergency alerts directly to residents’ phones. Code Red has been…

   DataBreaches
4. 12:00

   This hacker conference installed a literal antivirus monitoring system

   This hacker conference quietly launched a real-time, room-by-room carbon dioxide monitoring system for attendees at New Zealand’s Kawaiicon, installed before doors opened on 6 November. To enable public visibility, organisers deployed 13 RGB Matrix Portal…

   Ars Technica
5. 10:34

   U.S. CISA adds an Oracle Fusion Middleware flaw to its Known Exploited Vulnerabilities catalog

   According to CISA, the U.S. Cybersecurity and Infrastructure Security Agency, Oracle Fusion Middleware has been added to the Known Exploited Vulnerabilities (KEV) catalog as CVE-2025-61757, a flaw with a CVSS score of 9.8. The vulnerability is a missing…

   Security Affairs
   
6. 06:47

   Matrix Push C2 Uses Browser Notifications for Fileless, Cross-Platform Phishing Attacks

   Matrix Push C2 is a browser-native, fileless framework that uses push notifications, fake alerts, and link redirects to deliver phishing campaigns across operating systems, according to The Hacker News. Bad actors stock the MaaS kit with a web-based…

   The Hacker News
7. 06:45

   CISA Warns of Actively Exploited Critical Oracle Identity Manager Zero-Day Vulnerability

   According to CISA, the U.S. Cybersecurity and Infrastructure Security Agency, one critical Oracle Identity Manager vulnerability—CVE-2025-61757 with a CVSS of 9.8—has been added to the Known Exploited Vulnerabilities catalog due to active exploitation. The…

   The Hacker News
8. 00:16

   Cryptography group cancels election results after official loses secret key

   According to the IACR, one of the three independent trustees responsible for the cryptographic key material irretrievably lost their private key, making it impossible to complete the decryption and verify the final election outcome stored in Helios, an open…

   Ars Technica
9. 00:10

   Trojanized VPN Installer Deploys NKNShell Backdoor, Using P2P Blockchain and MQTT Protocols for Covert C2

   On 22 November 2025, ASEC reported a new malware distribution campaign that compromised a major South Korean VPN provider, delivering multiple backdoors via a trojanised VPN installer. The threat actor, tracked as Larva-24010, has again weaponised the…

   SecurityOnline
   
10. 00:00

    SonicWall Patches Two Vulnerabilities in Email Security Appliances, Including Code Execution Flaw (CVE-2025-40604)

    SonicWall released security updates for its Email Security appliances to address two flaws, including a code execution vulnerability tracked as CVE-2025-40604 and a path traversal issue, CVE-2025-40605. The most severe flaw, CVE-2025-40604, is rated 7.2 on…

    SecurityOnline