Blahalla

Websites Including Amazon, Coinbase and Roblox Report Outages After AWS Disruption

www.nytimes.com · 9 months ago

On October 20, 2025 a widespread outage at Amazon Web Services disrupted dozens of major websites and apps worldwide, centered in the US East One region. AWS reported increased error rates and latencies while investigators identified DNS resolution failures affecting the DynamoDB API as a potential root cause, which also impacted IAM updates and other global features that rely on that region. Gaming platforms, social apps, financial services and Amazon products such as Alexa and the shopping site reported downtime or degraded performance as engineers worked to mitigate the problem and restore services.
PoC Released for Linux-PAM Vulnerability Enabling Local Root Privilege Escalation

gbhackers.com · 9 months ago

A proof of concept has been released for a serious vulnerability in Linux Pluggable Authentication Modules tracked as CVE-2025-8941. The flaw, rated 7.8 on the CVSS scale, resides in pamnamespace and allows local attackers to escalate privileges to root by exploiting a race condition combined with symbolic link manipulation. Administrators are urged to apply available patches or mitigations from their distribution vendors to prevent local root compromise.
Hundreds of masked ICE agents doxxed by hackers, as personal details posted on Telegram

www.bitdefender.com · 9 months ago

There are reports that a hacker collective known as The Com posted names, addresses, and phone numbers of hundreds of US government employees to private Telegram channels. Spreadsheets reviewed by investigators allegedly contained personal data for about 680 Department of Homeland Security officials, more than 170 FBI email addresses, and over 190 Department of Justice employees. It is unclear where the data originated, and the group is linked to other ransomware and hacking gangs that have carried out high profile breaches and has suggested it may dox IRS staff next. U S authorities have warned that organized crime groups have targeted or offered bounties against ICE and CBP personnel, raising concerns for the safety of doxxed agents and their families.
Vulnerability in Dolby Decoder Can Allow Zero-Click Attacks

www.securityweek.com · 9 months ago

There is a high-severity out-of-bounds write vulnerability in Dolby Unified Decoder that can allow remote code execution when processing malicious audio and can be triggered without user interaction on Android because audio messages and attachments are decoded locally. The flaw is caused by an integer overflow in the length calculation for evolution data writes that makes a heap-like buffer too small and permits overwriting later struct members, including a pointer used when the next syncframe is processed. Proof-of-concept exploit code shows crashes and achieved zero-click code execution in the mediacodec context on a Pixel 9 and affects macOS and iOS as well, and the issue is tracked as CVE-2025-54957. Google Project Zero reported the defect to Dolby in June and vendor patches were later released with Microsoft and Google rolling fixes in October updates, Microsoft noting that exploitation on Windows requires user interaction.
NSO Ordered to Stop Hacking WhatsApp, but Damages Cut to $4 Million

www.securityweek.com · 9 months ago

A judge issued a permanent injunction on October 17, 2025, barring NSO from ever targeting WhatsApp, ordering the company to stop reverse engineering WhatsApp, cease creating WhatsApp accounts, and delete any WhatsApp source code it possesses. WhatsApp sued after a 2019 zero day was exploited to deliver spyware to about 1,400 users, and a December 2024 ruling found NSO liable for hacking WhatsApp users. A May 2025 jury had awarded 444,000 dollars in compensatory damages and 167 million dollars in punitive damages, but the judge reduced punitive damages to just over 4 million dollars and limited the injunction to WhatsApp rather than other Meta services while NSO continues to deny wrongdoing and was recently acquired by American investors led by Robert Simonds.
AWS outage crashes Amazon, Prime Video, Fortnite, Perplexity and more

www.bleepingcomputer.com · 9 months ago

On October 20, 2025 an AWS outage disrupted millions of websites and services including Amazon.com, Prime Video, Perplexity AI, Canva, and Fortnite. The outage began roughly 30 minutes before the report and has affected consumers across regions including the United States and Europe. There are increased error rates and latencies for multiple AWS services in the US East 1 region, and the incident may be impacting case creation through the AWS Support Center and Support API. AWS is actively engaged in mitigating the issue and investigating the root cause.
AWS outage crashes Amazon, Prime Video, Fortnite, Perplexity and more

www.bleepingcomputer.com · 9 months ago

There was a major AWS outage on October 20, 2025 that produced increased error rates and latencies for multiple AWS services in the US EAST 1 region and disrupted millions of websites and consumer applications worldwide. The incident was linked to DNS resolution failures for the DynamoDB API endpoint in US EAST 1 and prevented logins and API access for services including Amazon, Prime Video, Fortnite, Perplexity, Canva, Roblox, Hulu, Robinhood, and Grammarly. Some services began recovering after about 45 minutes and AWS reported full restoration by 5:25 AM Eastern Daylight Time, but later reported continued issues with network load balancers and said it was applying mitigation steps for throttling of new EC2 instance launches.
China wirft den USA Cyberangriffe auf Zeitbehörde vor

www.csoonline.com · 9 months ago

There are accusations from China that the United States carried out cyberattacks against a central state time authority. China’s Ministry of State Security says the US National Security Agency attacked the National Time Service Center in Xi’an beginning in March 2022, first compromising employees’ mobile phones and later affecting computers at the center. The center provides China’s official time used by communications networks, financial systems, and power grids, and China warns such attacks could cause serious disruptions while the United States has not responded to the allegations.
American Airlines Subsidiary Envoy Air Hit by Oracle Hack

www.securityweek.com · 9 months ago

Envoy Air confirmed it was impacted by a campaign targeting Oracle E Business Suite and said a limited amount of business information and commercial contact details may have been compromised while customer and other sensitive data were not. Attackers claiming responsibility posted more than 26 gigabytes of allegedly stolen archive files on a Tor leak site, and the campaign has been linked to the Cl0p leak site and to the FIN11 threat group with multiple victims including Harvard University. Oracle said known flaws patched in July were involved and later released fixes for a zero day tracked as CVE-2025-61882 and for another EBS flaw CVE-2025-61884, but it has not confirmed which vulnerabilities were exploited.
Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

www.csoonline.com · 9 months ago

A foreign threat actor infiltrated the Kansas City National Security Campus, which produces about 80 percent of non nuclear components for the United States nuclear stockpile, by exploiting unpatched on premises Microsoft SharePoint servers. The attackers leveraged SharePoint vulnerabilities CVE 2025 53770, a spoofing flaw, and CVE 2025 49704, a remote code execution bug, and researchers say a prior demonstration of CVE 2025 49706 likely accelerated reverse engineering and secondary exploitation. Attribution is contested, with Microsoft tying the larger campaign to Chinese linked groups while other sources and Resecurity data point to possible Russian criminal involvement or independent reproduction of the exploits, and federal responders including NSA personnel conducted an on site response in early August. Experts warn that although the intrusion targeted IT systems, IT and operational technology convergence and gaps in zero trust controls could enable lateral movement into production environments and expose sensitive manufacturing information even if that data is unclassified.
MSS Claims NSA Used 42 Cyber Tools in Multi-Stage Attack on Beijing Time Systems

thehackernews.com · 9 months ago

China's Ministry of State Security says it uncovered irrefutable evidence that the U.S. National Security Agency carried out a premeditated multi stage cyber operation against the National Time Service Center beginning on March 25, 2022, and that the effort was ultimately foiled. The MSS alleges attackers exploited flaws in an unnamed foreign SMS service to compromise staff mobile devices, repeatedly used stolen credentials to access NTSC computers, and deployed a cyber warfare platform from August 2023 to June 2024 that activated 42 specialized tools to probe internal networks and attempt lateral movement toward a high precision ground based timing system. The operation reportedly routed traffic through virtual private servers in the United States, Europe, and Asia and used forged digital certificates and strong encryption to erase traces while Chinese security agencies say they neutralized the intrusion and implemented additional protective measures.
China Accuses US of Cyberattack on National Time Center

www.securityweek.com · 9 months ago

China accused the U.S. National Security Agency of carrying out cyberattacks on the National Time Service Center, saying the NSA exploited vulnerabilities in the messaging services of a foreign mobile phone brand to steal sensitive information from staff devices in 2022. The ministry said the U.S. agency used 42 types of special cyberattack weapons to target multiple internal network systems and attempted to infiltrate a key timing system between 2023 and 2024, warning that damage could have disrupted communications, finance, power, and transport services. The statement said evidence exists but was not provided, the U.S. Embassy did not immediately comment, and the claim could further increase tensions between Washington and Beijing.
OpenAI Inks Deal With Broadcom to Design Its Own Chips for A.I.

www.nytimes.com · 9 months ago

There is a multibillion dollar partnership under which OpenAI is co designing custom AI processors with Broadcom that are planned for internal deployment beginning in 2026 to reduce reliance on Nvidia. There are earlier agreements with Nvidia and AMD that expanded OpenAI's chip supply and financing, and the Broadcom arrangement is expected to add significant capacity and help lower compute costs as Broadcom ramps production. There are timing and deployment risks because custom chip projects can encounter delays and the initial units are intended for OpenAI's own data centers rather than for external sale.
Windows 11 24H2/25H2 Update Breaks Mouse and Keyboard in Recovery Mode

gbhackers.com · 9 months ago

Microsoft's cumulative security update KB5066835, released October 14, 2025, disables USB keyboards and mice in the Windows Recovery Environment for Windows 11 versions 24H2 and 25H2 and for Windows Server 2025. USB input continues to function normally in the running operating system but becomes unresponsive in WinRE, preventing navigation of recovery options, and Microsoft says it is preparing an out of band fix. Until a patch is released, affected users can roll back the update or manually restore an earlier WinRE image to regain recovery functionality, though manual workarounds are complex and risky for nontechnical users.
Volkswagen Allegedly Hacked in Ransomware Attack as 8Base Claims Data Leak

gbhackers.com · 9 months ago

The 8Base ransomware group claims it exfiltrated sensitive Volkswagen Group data including invoices, accounting records, employee personal files, employment contracts, certificates, personnel records, and confidentiality agreements. Volkswagen says its core IT infrastructure was not affected and that internal investigations have found no unauthorized access to customer personal data or sensitive company data, while the company continues to monitor the situation. The response leaves open the possibility the compromise occurred through a third party such as a supplier, raising concerns about supply chain exposure and potential regulatory and reputational consequences. Attackers did not publish leaked samples by the posted deadline and independent verification of any stolen Volkswagen data has not been publicly confirmed.
TikTok videos continue to push infostealers in ClickFix attacks

www.bleepingcomputer.com · 9 months ago

Cybercriminals are using TikTok videos disguised as free activation guides for popular software and services to perform ClickFix social engineering attacks that instruct viewers to run a one line PowerShell command which retrieves and executes malicious scripts. The downloaded script connects to a malicious site and pulls two executables from Cloudflare Pages, one of which is identified as a variant of Aura Stealer that harvests browser credentials, authentication cookies, cryptocurrency wallets, and other application credentials. A second payload named source dot exe self compiles using the.NET C sharp compiler and injects code in memory, and users who run these commands should assume their credentials are compromised and immediately reset their passwords.
F5 Data Breach: What Happened and How It Impacts You

www.reddit.com · 9 months ago

In August 2025, F5 detected that a sophisticated nation-state threat actor had maintained persistent access to parts of its internal systems, including the BIG-IP product development environment and engineering knowledge platforms. An investigation with CrowdStrike, Mandiant, NCC Group, and IOActive found that attackers exfiltrated portions of BIG-IP source code, details of undisclosed vulnerabilities under development, configuration and implementation information for some customers, and engineering documentation. F5 reported no evidence of access to CRM, financial, or support systems and no compromise of the software supply chain, but said the exposure raises the risk of future exploit development and downstream deployment impact and highlights growing targeting of critical infrastructure vendors and long undetected dwell times by state actors.
Experian fined $3.2 million for mass-collecting personal data

www.bleepingcomputer.com · 9 months ago

Experian Netherlands has been fined EUR 2.7 million for multiple violations of the General Data Protection Regulation after collecting and using personal data from public and private sources without informing people or obtaining their consent. The Dutch Data Protection Authority found Experian built a large database using data such as negative payment behavior, outstanding debts, and bankruptcies that influenced credit assessments, interest rates, and upfront deposits, and the company acknowledged the unlawful use and said it will not appeal. Experian Netherlands has ceased operations in the country and promised to delete its entire database of personal data before the end of the year.
DefenderWrite: Abusing Whitelisted Programs for Arbitrary Writes into Antivirus's Operating Folder

www.reddit.com · 9 months ago

NULL
CVE-2025-8941: Critical Privilege Escalation Vulnerability in Linux-PAM

www.reddit.com · 9 months ago

There is a critical local privilege escalation vulnerability in Linux Pluggable Authentication Modules identified as CVE-2025-8941 with a reported CVSS score of 7.8. The flaw is in the pam namespace module and can be exploited by an attacker with local access using symlink attacks and race conditions to elevate privileges to root. All Linux PAM versions prior to the vendor patch are reported affected and the advised mitigation is to apply vendor patches immediately while using network detection or prevention tools only as temporary measures.
Europol Dismantles SIM Farm Network Powering 49 Million Fake Accounts Worldwide

thehackernews.com · 9 months ago

A coordinated law enforcement operation called Operation SIMCARTEL disrupted a cybercrime as a service platform that operated a SIM farm used to create more than 49 million fake online accounts and enabled phishing, smishing, investment fraud, extortion, migrant smuggling, and distribution of child sexual abuse material. Authorities from Austria, Estonia, Finland, Latvia, Europol, and Eurojust executed 26 searches, arrested seven suspects, seized 1,200 SIM box devices holding 40,000 active SIM cards, dismantled five servers, confiscated four luxury vehicles, and froze about 697,000 euros in bank and cryptocurrency funds. Two websites advertising the service were taken over on October 10, 2025 to display seizure notices, and investigators linked the infrastructure to over 1,700 fraud cases in Austria and 1,500 in Latvia with losses around 4.5 million euros and 420,000 euros respectively.
Notice: Google Gemini AI's Undisclosed 911 Auto-Dial Bypass – Logs and Evidence Available

www.reddit.com · 9 months ago

On October 12, 2025 at approximately 2:04 AM Gemini on Android autonomously initiated an outgoing 911 call during a simulated text chat without user prompt, consent, or confirmation, and the user canceled the call before connection while call logs and Google Activity recorded the attempted call. Developer logs show Gemini's backend selected a calling action and handed an emergency call intent to the Google Search host via the Telecom framework with the emergency flag set, which bypassed normal Android confirmation dialogs and routed directly to the native dialer. There are multiple similar reports dating back to June 2025 and dispatcher complaints in August 2025, and investigators also found Gemini autonomously created a Gmail draft on October 12, 2025 at 9:56 PM containing the chat summary without user consent. Permission descriptions failed to disclose autonomous calling or email creation, creating privacy and emergency services disruption risks, so affected users are advised to disable make calls without unlocking and Gemini on lock screen and to review call logs and Gmail drafts.
Google ads for fake Homebrew, LogMeIn sites push infostealers

www.bleepingcomputer.com · 9 months ago

A malicious campaign is targeting macOS developers with fake Homebrew, LogMeIn, and TradingView sites promoted via Google Ads that deliver infostealers AMOS and Odyssey. The attackers use ClickFix techniques to trick victims into copying base64 encoded curl commands into Terminal, which fetch and decode an install script that removes quarantine flags and bypasses Gatekeeper to run the payload. The malware checks for virtual machines and analysis environments, invokes sudo, collects hardware and memory information, manipulates system services and XPC, and then harvests browser credentials, cryptocurrency wallet extensions, Keychain data and other files before exfiltrating them to command and control servers.
macOS Shortcuts for Initial Access

www.reddit.com · 9 months ago

There is a method to abuse macOS Shortcuts to deliver and execute payloads via iCloud links that can evade email security and Gatekeeper because Shortcuts.app does not set the com.apple.quarantine extended attribute on downloaded content. The technique requires social engineering and multiple user clicks and also requires the Shortcuts security setting Allow Running Scripts to be enabled in preferences, which can be done without sudo. As a result, downloaded implants can be retrieved from a remote server and executed without signature verification.
Authorities Shut Down Cybercrime-as-a-Service, Seize 40,000 SIM Cards

gbhackers.com · 9 months ago

There was a coordinated law enforcement operation codenamed SIMCARTEL that dismantled a cybercrime-as-a-service SIM box network on October 10, 2025, resulting in seven arrests and multiple searches across Europe. Authorities seized about 1,200 SIM box devices operating roughly 40,000 active SIM cards, took over five servers and two websites used to market the service, froze hundreds of thousands in bank and cryptocurrency assets, and confiscated luxury vehicles. The infrastructure enabled the creation of more than 49 million fake online accounts and was linked to over 3,200 fraud cases that caused nearly five million euros in losses across Austria and Latvia.
New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs

thehackernews.com · 9 months ago

A new campaign is targeting Russian automobile and e-commerce companies with a previously undocumented.NET implant called CAPI Backdoor delivered via phishing emails that include a ZIP archive with a decoy Russian language tax document and a malicious Windows shortcut. The shortcut uses the legitimate Windows binary rundll32 to load a.NET DLL that checks for administrator privileges, enumerates installed antivirus products, and opens the decoy document while contacting a remote command server. The backdoor can steal data from web browsers, take screenshots, collect system information, enumerate folders, and exfiltrate the results, and it performs checks to detect virtual machines. It establishes persistence by creating a scheduled task and placing a shortcut in the Windows startup folder, and researchers note a campaign domain that appears to impersonate a car pricing website.
Critical Zimbra SSRF Flaw Exposes Sensitive Data

gbhackers.com · 9 months ago

There is a critical Server Side Request Forgery vulnerability in Zimbra chat proxy configuration that can allow attackers to force the server to make unauthorized internal requests, potentially exposing sensitive data. The flaw affects Zimbra versions 10.1.5 through 10.1.11 and has prompted an emergency security patch release, with administrators urged to apply the update immediately. If left unpatched, attackers could manipulate internal server requests to access internal network resources or facilitate further compromise, so operators should prioritize patching and monitoring outbound requests from Zimbra servers.
The hidden way using a rewards card can cost you more

www.washingtonpost.com · 9 months ago

There is evidence that loyalty programs collect detailed behavioral data including purchases, app taps, location, browsing and third party data to build profiles and make inferences about income, price sensitivity and other traits. In one case a Starbucks customer’s data showed months with heavier purchases coincided with fewer promotional discounts, meaning frequent customers may effectively pay more while others receive deeper personalized deals. Former FTC officials and a Vanderbilt Policy Accelerator report warn these practices amount to surveillance pricing because companies can share data with dozens of partners and use AI to target offers while privacy laws are not being enforced against such uses. Regulators are urged to act, and consumers are advised to request their data under state privacy laws, complain to attorneys general or limit loyalty use by rotating where they shop.
Microsoft Windows 11 October Update Disrupts Localhost (127.0.0.1) Connectivity

gbhackers.com · 9 months ago

There are widespread reports that the October 14, 2025 Windows 11 cumulative update KB5066835 for OS builds 26200.6899 and 26100.6899 disrupted localhost 127.0.0.1 HTTP slash 2 connections, producing errors such as ERRHTTP2PROTOCOLERROR and connection resets that prevent browsers and locally hosted services from responding. The regression broke IIS and IIS Express services, prevented Visual Studio from attaching debuggers to local sites, and made vendor applications that rely on loopback inaccessible, with some users restoring functionality by uninstalling the update or applying registry and Defender definition mitigations while Microsoft works on a fix. KB5066835 has also been linked to installation failures, File Explorer preview pane problems, and USB keyboard and mouse failures in the Windows Recovery Environment, prompting Microsoft to acknowledge multiple issues and plan corrective releases.
Silver Fox Expands Winos 4.0 Attacks to Japan and Malaysia via HoldingHands RAT

thehackernews.com · 9 months ago

There are campaigns by the Silver Fox group that have expanded use of the Winos 4.0 malware family, also called ValleyRAT, beyond China and Taiwan into Japan and Malaysia, delivering another RAT tracked as HoldingHands. The operations rely on phishing emails with booby trapped PDF files and fake landing pages that prompt victims to download ZIP archives or execute shortcuts, which drop an executable that sideloads a malicious TimeBrokerClient DLL and uses a Task Scheduler restart to trigger encrypted shellcode and payload deployment. HoldingHands and Winos perform anti virtual machine checks, enumerate and terminate many security products, escalate privileges, maintain persistence via scheduled tasks and DLL side loading, exfiltrate data such as screenshots and clipboard contents, and the RAT can update its command and control address via a Windows Registry entry. A related campaign called Operation Silk Lure targeted Chinese fintech and crypto firms by sending localized résumé lures containing malicious LNK files that deploy Winos 4.0 and stages for reconnaissance and data theft.
Government considered destroying its data hub after decade-long intrusion

www.csoonline.com · 9 months ago

A Chinese sponsored intrusion accessed low and medium classification UK government systems for at least a decade, compromising material marked official sensitive and secret but not top secret. The breach of a government data hub followed the sale of the company controlling it to a China aligned entity and prompted officials to consider physically destroying the hub before choosing other protective measures. The government commissioned a classified report on Chinese digital threats that was not released publicly and technical details of the hub attack remain secret. Cybersecurity experts warn that state linked advanced persistent threats favor stealthy long term access often via supply chain weaknesses or compromised VPNs and that edge devices and vendor managed hardware complicate detection and forensics.
Boeing Is Allowed to Increase 737 Max Plane Production, FAA Says

www.nytimes.com · 9 months ago

The Federal Aviation Administration raised Boeing 737 MAX production to 42 planes per month, lifting a cap of 38 that had been imposed after a 2024 door plug incident. The agency said safety inspectors conducted extensive reviews and that heightened oversight and inspection requirements will remain in place while Boeing upgrades its Seattle area facilities and coordinates with suppliers to support the ramp up. The cap dated to January 5 2024 when an Alaska Airlines 737 MAX 9 lost a fuselage panel in flight, prompting groundings, detailed inspections, and limits on Boeing self certification that the FAA has continued to monitor.
North Korean threat actors turn blockchains into malware delivery servers

www.csoonline.com · 9 months ago

There is an emerging technique called EtherHiding in which threat actors embed encrypted malware payloads in smart contracts on public blockchains, using chains of immutable contracts as resilient decentralized command and control infrastructure that is difficult to take down. Google Threat Intelligence Group observed North Korean actor UNC5342 using EtherHiding to deliver malware and steal cryptocurrency through fake recruitment social engineering that deploys a JavaScript downloader named JADESNOW which fetches, decrypts, and executes payloads from smart contracts on the BNB Smart Chain and Ethereum. JADESNOW commonly delivers the INVISIBLEFERRET JavaScript backdoor whose code may be split across multiple contracts and which can retrieve additional payloads such as Python based information stealers, while attackers use blockchain explorer APIs and Web3.js along with ClickFix style prompts to trigger victims into running malicious code. A related cybercriminal group UNC5142 has used similar smart contract based distribution since 2023 on more than 14,000 compromised web pages, and North Korean linked activity is estimated to have produced 1.7 billion dollars in cryptocurrency thefts between 2017 and 2023.
ConnectWise fixes Automate bug allowing AiTM update attacks

www.bleepingcomputer.com · 9 months ago

ConnectWise released a security update for its Automate remote monitoring and management platform to fix vulnerabilities that could allow an adversary to intercept or modify sensitive communications and update payloads. The most severe flaw, CVE-2025-11492, rated 9.6, allows agents to use cleartext HTTP instead of HTTPS, enabling adversary-in-the-middle attacks to view or change traffic including commands, credentials, and updates. A second flaw, CVE-2025-11493, rated 8.8, removes integrity verification for update packages and their dependencies, and combined with the first issue could let an attacker substitute malicious files by impersonating a valid ConnectWise server. Cloud instances have been updated to release 2025.9 and on premise administrators are urged to install the new release within days because the bulletin warns the vulnerabilities have a higher risk of being targeted in the wild.
American Airlines subsidiary Envoy confirms Oracle data theft attack

www.bleepingcomputer.com · 9 months ago

Envoy Air confirmed that data was compromised from its Oracle E Business Suite application after the Clop extortion group listed American Airlines on its data leak site, and investigators say no sensitive or customer data appears affected but a limited amount of business information and commercial contact details may have been exposed. The incident is tied to an August data theft campaign in which Clop exploited Oracle E Business Suite vulnerabilities, including a zero day tracked as CVE-2025-61882 and another patched zero day CVE-2025-61884, with security firms reporting exploitation since early August and potentially dozens of organizations impacted. Clop has a history of exploiting zero days in enterprise file transfer products, including CVE-2024-50623 and CVE-2024-55956, and previously carried out large scale breaches against systems such as MOVEit and Accellion.
Microsoft Disrupts Ransomware Campaign Abusing Azure Certificates

www.darkreading.com · 9 months ago

Microsoft revoked more than 200 code signing certificates issued by Azure Trusted Signing after threat actors used them to sign fake Microsoft Teams installers that dropped an Oyster backdoor and paved the way for Rhysida ransomware. The campaign is attributed to a group tracked as Vanilla Tempest also known as Vice Society, which lured victims to malicious download sites using search engine optimization poisoning and also acquired certificates from SSL.com, DigiCert, and GlobalSign. It remains unclear how the actors obtained Trusted Signing certificates, and DigiCert and GlobalSign say they will investigate potential misuse while Microsoft offered no further comment.
Europol dismantles SIM box operation renting numbers for cybercrime

www.bleepingcomputer.com · 9 months ago

There was an operation codenamed SIMCARTEL in which European law enforcement, assisted by the Shadowserver Foundation, dismantled an illegal SIM box service that enabled more than 3,200 fraud cases and caused at least 4.5 million euros in losses. The service operated roughly 1,200 SIM box devices with 40,000 SIM cards, rented phone numbers registered to individuals in more than 80 countries, and helped create over 49 million fraudulent online accounts used for phishing, investment fraud, impersonation, extortion, migrant smuggling and marketplace scams. On October 10 raids across Austria, Estonia, Finland and Latvia produced 26 searches, the arrest of seven suspects including five Latvian nationals, seizure of two websites and five servers, hundreds of thousands of SIM cards, 431,000 euros frozen in bank accounts, 333,000 dollars in cryptocurrency and luxury vehicles, and investigators say forensic analysis of the seized servers will help identify customers of the illegal service.
Microsoft: Russia, China Increasingly Using AI to Escalate Cyberattacks on the US

www.securityweek.com · 9 months ago

Russia, China, Iran and North Korea have sharply increased their use of artificial intelligence to deceive people online and mount cyberattacks against the United States. In July more than 200 instances were identified of foreign adversaries using AI to create fake online content, more than double the number from July 2024 and more than ten times the number seen in 2023. Adversaries and criminal groups are using AI to automate and improve attacks, translate and refine phishing messages, generate digital clones of officials, spread inflammatory disinformation and target governments, businesses and critical infrastructure while many organizations rely on outdated defenses and are urged to invest in basic cybersecurity.
Q3 Ransomware Attacks Increase 36% YoY, BlackFog Report Reveals

www.techrepublic.com · 9 months ago

There were 270 publicly disclosed ransomware incidents in the third quarter of 2025, a 36 percent increase year on year and a 335 percent rise since the third quarter of 2020, affecting organizations across 93 countries and causing disruptions to airlines, automotive manufacturers, governments, and other sectors. The analysis linked 54 ransomware groups to these incidents with Qilin responsible for 20 attacks, 18 new groups emerging including DEVMAN which carried out 19 attacks and issued a 91 million dollar ransom demand against China s Shimao Group, and data theft featured in 96 percent of disclosed attacks. Healthcare was the most targeted disclosed sector with 86 attacks representing 32 percent of disclosed incidents, nearly 85 percent of all ransomware incidents in the quarter were estimated to be unreported totaling about 1,510 incidents, and U S cybersecurity firm F5 confirmed a separate incident involving a highly sophisticated nation state threat actor.
Microsoft fixes highest-severity ASP.NET Core flaw ever

www.bleepingcomputer.com · 9 months ago

An HTTP request smuggling vulnerability in the Kestrel ASP.NET Core web server was patched after being rated the highest severity ever for an ASP.NET Core flaw and tracked as CVE-2025-55315; the bug allows authenticated attackers to smuggle an extra HTTP request to hijack other users credentials or bypass front end security controls. Successful exploitation could expose other users credentials, modify file contents, crash the server, or enable privilege escalation, server side request forgery, cross site request forgery bypasses, or injection attacks depending on application design. Microsoft released security updates for Visual Studio 2022, ASP NET Core 2.3, 8.0, and 9.0 and for the Microsoft.AspNetCore.Server.Kestrel.Core package, and advises installing the.NET updates for.NET 8 or later, updating the 2.3 package reference to version 2.3.6, and recompiling and redeploying affected applications including self contained single file apps.
ICE amps up its surveillance powers, targeting immigrants and antifa

www.washingtonpost.com · 9 months ago

ICE has recently expanded surveillance capabilities by procuring iris scanners, Clearview AI facial recognition, phone hacking spyware including Paragon Graphite, cellphone location tracking systems such as Penlink Weblocs, Palantir tracking software, drones, and plans for a social media monitoring hub. The purchases coincide with a surge in contract awards totaling about 1.4 billion dollars in September and access to more than 170 billion dollars in border security funding from the July spending bill. Officials say the technology will be used to find and deport undocumented immigrants and to investigate domestic terrorism targets labeled as antifa, while critics warn the tools could enable broad surveillance of protesters and raise First and Fourth Amendment concerns. One contract for Paragon spyware was suspended by the prior administration and reactivated on August 29, and ICE disclosed specific purchases including a 4.6 million dollar iris scanning mobile app and a 3.75 million dollar Clearview AI license, prompting calls from lawmakers and civil rights groups for stronger guardrails.
Regional airline Envoy Air confirms Oracle E-Business Suite compromise

therecord.media · 9 months ago

Envoy Air confirmed its Oracle E-Business Suite application was breached in a hacking campaign linked to the Clop cybercriminal group, with a limited amount of business information and commercial contact details possibly stolen. The incident affected only the subsidiary and did not impact flight or ground operations, and the company said no sensitive or customer data was affected while investigators and law enforcement were engaged. Security firms reported the attackers used multiple Oracle E-Business Suite vulnerabilities, including a newly discovered bug added to a federal watchlist and at least one critical flaw the FBI described as a stop-what-youre-doing-and-patch-immediately vulnerability.
Microsoft fixes Windows bug breaking localhost HTTP connections

www.bleepingcomputer.com · 9 months ago

There is a fixed bug that was breaking HTTP/2 connections to localhost at 127.0.0.1 and causing IIS websites and server side apps to fail with connection reset and protocol errors on Windows 11 and Windows Server 2025 after installing updates released on or after September 29, including KB5066835 and KB5065789. The problem was traced to HTTP.sys, affected tools such as Visual Studio debugging, SSMS Entra ID authentication and Duo Desktop, and Microsoft has rolled back the issue for most home users via Known Issue Rollback while asking enterprise administrators to deploy a KIR group policy until a permanent fix ships in a future update.
In Other News: CrowdStrike Vulnerabilities, CISA Layoffs, Mango Data Breach

www.securityweek.com · 9 months ago

There are several notable cybersecurity developments this week. CrowdStrike patched two medium severity vulnerabilities in its Falcon sensor for Windows that could allow an attacker who already achieved code execution on a host to delete arbitrary files, with no evidence of exploitation in the wild. A recently disclosed ICTBroadcast vulnerability tracked as CVE 2025 2611 has been exploited in attacks delivering RATty malware and attempting reverse shells. Spanish fashion retailer Mango reported a data breach at a third party marketing service provider that exposed customer names, phone numbers, email addresses and post codes but not passwords or banking information.
Attackers Exploit Zendesk Authentication Issue to Flood Targets’ Inboxes with Corporate Notifications

gbhackers.com · 9 months ago

There is a gap in Zendesk ticket submission that allows attackers to submit anonymous requests which generate large volumes of misleading support emails. When Zendesk is configured to accept anonymous requests, attackers can abuse the feature to flood victim inboxes with messages that appear to come from legitimate corporate domains. Security reporting indicates the abuse was recently highlighted by security blogger Brian Krebs, prompting warnings to tighten ticket submission settings.
North Korean Hackers Combine BeaverTail and OtterCookie into Advanced JS Malware

thehackernews.com · 9 months ago

Researchers have observed a North Korean threat actor tied to the Contagious Interview campaign merging functionality from the BeaverTail and OtterCookie malware families and adding new keylogging and screenshotting capabilities. The intrusions began with fake job offers that lured victims into installing a trojanized Node.js interview application called Chessfi and a malicious npm package that used a postinstall hook to launch a multi-stage JavaScript payload, resulting in at least one organization in Sri Lanka being infected. The combined toolset now enumerates browser profiles and extensions, steals data from web browsers and cryptocurrency wallet extensions, monitors the clipboard, installs AnyDesk for persistence, downloads a Python backdoor named InvisibleFerret, and supports remote command execution via socket.io. The actor has also used a technique known as EtherHiding to fetch next-stage payloads from the BNB Smart Chain and Ethereum blockchains, effectively leveraging decentralized infrastructure as resilient command and control.
European police bust network selling thousands of phone numbers to scammers

therecord.media · 9 months ago

There are international law enforcement raids that dismantled a network selling phone numbers registered to people in more than 80 countries, with Latvian police arresting five suspects and seizing five servers, 40,000 active SIM cards, and 1,200 SIM box devices. There are links to more than 3,000 cyber fraud cases, mostly in Austria and Latvia, with combined losses exceeding five million euros. There is an online platform that let criminals rent phone numbers to open fake social media and messaging accounts used for phishing, fraud, extortion, migrant smuggling, and distribution of child sexual abuse material, and investigators estimate the service helped create more than 49 million online accounts. There is an ongoing European investigation as authorities continue to identify users of the service and assess the full extent of the damage.
WatchGuard VPN Flaw Allows Remote Attackers to Execute Arbitrary Code

gbhackers.com · 9 months ago

There is a critical security vulnerability in WatchGuard Firebox appliances that can allow remote attackers to execute arbitrary code without authentication. The flaw affects the IKEv2 VPN service and is tracked as CVE-2025-9242 with a CVSS 4.0 severity score of 9.3. This represents a critical threat to organizations using these security devices.
TikTok Videos Weaponized to Deliver Self-Compiling PowerShell Malware

gbhackers.com · 9 months ago

Attackers are exploiting TikTok's massive reach to trick users into executing malware through seemingly innocuous videos, weaponizing content to deliver self compiling PowerShell malware. Attackers pose as providers of free tools such as Photoshop activators and instruct viewers to open PowerShell as an administrator and run a command that uses Invoke Expression to download and execute a remote script. Those remote scripts then compile and run malicious payloads on victims machines, enabling persistent infection and command execution.
ClickFake Interview Campaign Used by Threat Actors to Deliver OtterCandy Malware

gbhackers.com · 9 months ago

There are two primary campaigns, Contagious Interview and ClickFake Interview, run by a North Korea linked cluster known as WaterPlum Cluster B that creates fake company websites and staged job interviews to trick targets into downloading malicious software. Cluster B has been distributing OtterCandy, a cross platform Node.js remote access tool and information stealer that connects to its command and control infrastructure via Socket.IO to harvest browser credentials, cryptocurrency wallets, and documents. In August 2025 OtterCandy received version two enhancements including client id tracking, expanded theft targets, improved trace deletion, and persistence mechanisms involving a loader called DiggingBeaver that plants registry entries or launch agents to enable self resurrection. The broader operation has also used malicious npm packages and additional loaders to deliver stealers and backdoors, resulting in thousands of downloads and multiple takedown requests by researchers.