Tag: Cyber Security

Oct 07, 2025Ravie LakshmananArtificial Intelligence / Software Security

Google’s DeepMind division on Monday announced an artificial intelligence (AI)-powered agent called CodeMender that automatically detects, patches, and rewrites vulnerable code to prevent future exploits.

The efforts add to the company’s ongoing efforts to improve AI-powered vulnerability discovery, such as Big Sleep and OSS-Fuzz.

DeepMind said the AI agent is designed to be both reactive and proactive, by fixing new vulnerabilities as soon as they are spotted as well as rewriting and securing existing codebases with an aim to eliminate whole classes of vulnerabilities in the process.

“By automatically creating and applying high-quality security patches, CodeMender’s AI-powered agent helps developers and maintainers focus on what they do best — building good software,” DeepMind researchers Raluca Ada Popa and Four Flynn said.

“Over the past six months that we’ve been building CodeMender, we have already upstreamed 72 security fixes to open source projects, including some as large as 4.5 million lines of code.”

CodeMender, under the hood, leverages Google’s Gemini Deep Think models to debug, flag, and fix security vulnerabilities by addressing the root cause of the problem, and validate them to ensure that they don’t trigger any regressions.

The AI agent, Google added, also makes use of a large language model (LLM)-based critique tool that highlights the differences between the original and modified code in order to verify that the proposed changes do not introduce regressions, and self-correct as required.

Google said it also intended to slowly reach out to interested maintainers of critical open-source projects with CodeMender-generated patches, and solicit their feedback, so that the tool can be used to keep codebases secure.

The development comes as the company said it’s instituting an AI Vulnerability Reward Program (AI VRP) to report AI-related issues in its products, such as prompt injections, jailbreaks, and misalignment, and earn rewards that go as high as $30,000.

In June 2025, Anthropic revealed that models from various developers resorted to malicious insider behaviors when that was the only way to avoid replacement or achieve their goals, and that LLM models “misbehaved less when it stated it was in testing and misbehaved more when it stated the situation was real.”

That said, policy-violating content generation, guardrail bypasses, hallucinations, factual inaccuracies, system prompt extraction, and intellectual property issues do not fall under the ambit of the AI VRP.

Google, which previously set up a dedicated AI Red Team to tackle threats to AI systems as part of its Secure AI Framework (SAIF), has also introduced a second iteration of the framework to focus on agentic security risks like data disclosure and unintended actions, and the necessary controls to mitigate them.

The company further noted that it’s committed to using AI to enhance security and safety, and use the technology to give defenders an advantage and counter the growing threat from cybercriminals, scammers, and state-backed attackers.

Cybersecurity researchers have charted the evolution of XWorm malware, turning it into a versatile tool for supporting a wide range of malicious actions on compromised hosts.

“XWorm’s modular design is built around a core client and an array of specialized components known as plugins,” Trellix researchers Niranjan Hegde and Sijo Jacob said in an analysis published last week. “These plugins are essentially additional payloads designed to carry out specific harmful actions once the core malware is active.”

XWorm, first observed in 2022 and linked to a threat actor named EvilCoder, is a Swiss Army knife of malware that can facilitate data theft, keylogging, screen capture, persistence, and even ransomware operations. It’s primarily propagated via phishing emails and bogus sites advertising malicious ScreenConnect installers.

Some of the other tools advertised by the developer include a .NET-based malware builder, a remote access trojan called XBinder, and a program that can bypass User Account Control (UAC) restrictions on Windows systems. In recent years, the development of XWorm has been led by an online persona called XCoder.

In a report published last month, Trellix detailed shifting XWorm infection chains that have used Windows shortcut (LNK) files distributed via phishing emails to execute PowerShell commands that drop a harmless TXT file and a deceptive executable masquerading as Discord, which then ultimately launches the malware.

XWorm incorporates various anti-analysis and anti-evasion mechanisms to check for tell-tale signs of a virtualized environment, and if so, immediately cease its execution. The malware’s modularity means various commands can be issued from an external server to perform actions like shutting down or restarting the system, downloading files, opening URLs, and initiating DDoS attacks.

“This rapid evolution of XWorm within the threat landscape, and its current prevalence, highlights the critical importance of robust security measures to combat ever-changing threats,” the company noted.

XWorm’s operations have also witnessed their share of setbacks over the past year, the most important being XCoder’s decision to delete their Telegram account abruptly in the second half of 2024, leaving the future of the tool in limbo. Since then, however, threat actors have been observed distributing a cracked version of XWorm version 5.6 that contained malware to infect other threat actors who may end up downloading it.

This included attempts made by an unknown threat actor to trick script kiddies into downloading a trojanized version of the XWorm RAT builder via GitHub repositories, file-sharing services, Telegram channels, and YouTube videos to compromise over 18,459 devices globally.

This has been complemented by attackers distributing modified versions of XWorm – one of which is a Chinese variant codenamed XSPY – as well as the discovery of a remote code execution (RCE) vulnerability in the malware that allows attackers with the command-and-control (C2) encryption key to execute arbitrary code.

While the apparent abandonment of XWorm by XCoder raised the possibility that the project was “closed for good,” Trellix said it spotted a threat actor named XCoderTools offering XWorm 6.0 on cybercrime forums on Jun 4, 2025, for $500 for lifetime access, describing it as a “fully re-coded” version with fix for the aforementioned RCE flaw. It’s currently not known if the latest version is the work of the same developer or someone else capitalizing on the malware’s reputation.

Campaigns distributing XWorm 6.0 in the wild have used malicious JavaScript files in phishing emails that, when opened, display a decoy PDF document, while, in the background, PowerShell code is executed to inject the malware into a legitimate Windows process like RegSvcs.exe without raising any attention.

XWorm V6.0 is designed to connect to its C2 server at 94.159.113[.]64 on port 4411 and supports a command called “plugin” to run more than 35 DLL payloads on the infected host’s memory and carry out various tasks.

“When the C2 server sends the command ‘plugin,’ it includes the SHA-256 hash of the plugin DLL file and the arguments for its invocation,” Trellix explained. “The client then uses the hash to check if the plugin has been previously received. If the key is not found, the client sends a ‘sendplugin’ command to the C2 server, along with the hash.”

“The C2 server then responds with the command’savePlugin’ along with a base64 encoded string containing the plugin and SHA-256 hash. Upon receiving and decoding the plugin, the client loads the plugin into the memory.”

Some of the supported plugins in XWorm 6.x (6.0, 6.4, and 6.5) are listed below –

• RemoteDesktop.dll, to create a remote session to interact with the victim’s machine.
• WindowsUpdate.dll, Stealer.dll, Recovery.dll, merged.dll, Chromium.dll, and SystemCheck.Merged.dll, to steal the victim’s data, such as Windows product keys, Wi-Fi passwords, and stored credentials from web browsers (bypassing Chrome’s app-bound encryption) and other applications like FileZilla, Discord, Telegram, and MetaMask
• FileManager.dll, to facilitate filesystem access and manipulation capabilities to the operator
• Shell.dll, to execute system commands sent by the operator in a hidden cmd.exe process.
• Informations.dll, to gather system information about the victim’s machine.
• Webcam.dll, to record the victim and to verify if an infected machine is real
• TCPConnections.dll, ActiveWindows.dll, and StartupManager.dll, to send a list of active TCP connections, active windows, and startup programs, respectively, to the C2 server
• Ransomware.dll, to encrypt and decrypt files and extort users for a cryptocurrency ransom (shares code overlaps with NoCry ransomware)
• Rootkit.dll, to install a modified r77 rootkit
• ResetSurvival.dll, to survive device reset through Windows Registry modifications

XWorm 6.0 infections, besides dropping custom tools, have also served as a conduit for other malware families such as DarkCloud Stealer, Hworm (VBS-based RAT), Snake KeyLogger, Coin Miner, Pure Malware, ShadowSniff Stealer (open-source Rust stealer), Phantom Stealer, Phemedrone Stealer, and Remcos RAT.

“Further investigation of the DLL file revealed multiple XWorm V6.0 Builders on VirusTotal that are themselves infected with XWorm malware, suggesting that an XWorm RAT operator has been compromised by XWorm malware!,” Trellix said.

“The unexpected return of XWorm V6, armed with a versatile array of plugins for everything from keylogging and credential theft to ransomware, serves as a powerful reminder that no malware threat is ever truly gone.”

For years, security leaders have treated artificial intelligence as an “emerging” technology, something to keep an eye on but not yet mission-critical. A new Enterprise AI and SaaS Data Security Report by AI & Browser Security company LayerX proves just how outdated that mindset has become. Far from a future concern, AI is already the single largest uncontrolled channel for corporate data exfiltration—bigger than shadow SaaS or unmanaged file sharing.

The findings, drawn from real-world enterprise browsing telemetry, reveal a counterintuitive truth: the problem with AI in enterprises isn’t tomorrow’s unknowns, it’s today’s everyday workflows. Sensitive data is already flowing into ChatGPT, Claude, and Copilot at staggering rates, mostly through unmanaged accounts and invisible copy/paste channels. Traditional DLP tools—built for sanctioned, file-based environments—aren’t even looking in the right direction.

From “Emerging” to Essential in Record Time

In just two years, AI tools have reached adoption levels that took email and online meetings decades to achieve. Almost one in two enterprise employees (45%) already use generative AI tools, with ChatGPT alone hitting 43% penetration. Compared with other SaaS tools, AI accounts for 11% of all enterprise application activity, rivaling file-sharing and office productivity apps.

The twist? This explosive growth hasn’t been accompanied by governance. Instead, the vast majority of AI sessions happen outside enterprise control. 67% of AI usage occurs through unmanaged personal accounts, leaving CISOs blind to who is using what, and what data is flowing where.

Sensitive Data Is Everywhere, and It’s Moving the Wrong Way

Perhaps the most surprising and alarming finding is how much sensitive data is already flowing into AI platforms: 40% of files uploaded into GenAI tools contain PII or PCI data, and employees are using personal accounts for nearly four in ten of those uploads.

Even more revealing: files are only part of the problem. The real leakage channel is copy/paste. 77% of employees paste data into GenAI tools, and 82% of that activity comes from unmanaged accounts. On average, employees perform 14 pastes per day via personal accounts, with at least three containing sensitive data.

That makes copy/paste into GenAI the #1 vector for corporate data leaving enterprise control. It’s not just a technical blind spot; it’s a cultural one. Security programs designed to scan attachments and block unauthorized uploads miss the fastest-growing threat entirely.

The Instant Messaging Blind Spot

While AI is the fastest-growing channel of data leakage, instant messaging is the quietest. 87% of enterprise chat usage occurs through unmanaged accounts, and 62% of users paste PII/PCI into them. The convergence of shadow AI and shadow chat creates a dual blind spot where sensitive data constantly leaks into unmonitored environments.

Together, these findings paint a stark picture: security teams are focused on the wrong battlefields. The war for data security isn’t in file servers or sanctioned SaaS. It’s in the browser, where employees blend personal and corporate accounts, shift between sanctioned and shadow tools, and move sensitive data fluidly across both.

Rethinking Enterprise Security for the AI Era

The report’s recommendations are clear, and unconventional:

1. Treat AI security as a core enterprise category, not an emerging one. Governance strategies must put AI on par with email and file sharing, with monitoring for uploads, prompts, and copy/paste flows.
2. Shift from file-centric to action-centric DLP. Data is leaving the enterprise not just through file uploads but through file-less methods such as copy/paste, chat, and prompt injection. Policies must reflect that reality.
3. Restrict unmanaged accounts and enforce federation everywhere. Personal accounts and non-federated logins are functionally the same: invisible. Restricting their use – whether fully blocking them or applying rigorous context-aware data control policies – is the only way to restore visibility.
4. Prioritize high-risk categories: AI, chat, and file storage. Not all SaaS apps are equal. These categories demand the tightest controls because they are both high-adoption and high-sensitivity.

The Bottom Line for CISOs

The surprising truth revealed by the data is this: AI isn’t just a productivity revolution, it’s a governance collapse. The tools employees love most are also the least controlled, and the gap between adoption and oversight is widening every day.

For security leaders, the implications are urgent. Waiting to treat AI as “emerging” is no longer an option. It’s already embedded in workflows, already carrying sensitive data, and already serving as the leading vector for corporate data loss.

The enterprise perimeter has shifted again, this time into the browser. If CISOs don’t adapt, AI won’t just shape the future of work, it will dictate the future of data breaches.

The new research report from LayerX provides the full scope of these findings, offering CISOs and security teams unprecedented visibility into how AI and SaaS are really being used inside the enterprise. Drawing on real-world browser telemetry, the report details where sensitive data is leaking, which blind spots carry the greatest risk, and what practical steps leaders can take to secure AI-driven workflows. For organizations seeking to understand their true exposure and how to protect themselves, the report delivers the clarity and guidance needed to act with confidence.

Oct 07, 2025Ravie LakshmananVulnerability / Cloud Security

Redis has disclosed details of a maximum-severity security flaw in its in-memory database software that could result in remote code execution under certain circumstances.

The vulnerability, tracked as CVE-2025-49844 (aka RediShell), has been assigned a CVSS score of 10.0.

“An authenticated user may use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free, and potentially lead to remote code execution,” according to a GitHub advisory for the issue. “The problem exists in all versions of Redis with Lua scripting.”

However, for exploitation to be successful, it requires an attacker to first gain authenticated access to a Redis instance, making it crucial that users don’t leave their Redis instances exposed to the internet and secure them with strong authentication.

The issue impacts all versions of Redis. It has been addressed in versions 6.2.20, 7.2.11, 7.4.6, 8.0.4, and 8.2.2 released on October 3, 2025.

As temporary workarounds until a patch can be applied, it’s advised to prevent users from executing Lua scripts by setting an access control list (ACL) to restrict EVAL and EVALSHA commands. It’s also crucial that only trusted identities can run Lua scripts or any other potentially risky commands.

Cloud security company Wiz, which discovered and reported the flaw to Redis on May 16, 2025, described it as a use-after-free (UAF) memory corruption bug that has existed in the Redis source code for about 13 years.

It essentially permits an attacker to send a malicious Lua script that leads to arbitrary code execution outside of the Redis Lua interpreter sandbox, granting them unauthorized access to the underlying host. In a hypothetical attack scenario, it can be leveraged to steal credentials, drop malware, exfiltrate sensitive data, or pivot to other cloud services.

“This flaw allows a post auth attacker to send a specially crafted malicious Lua script (a feature supported by default in Redis) to escape from the Lua sandbox and achieve arbitrary native code execution on the Redis host,” Wiz said. “This grants an attacker full access to the host system, enabling them to exfiltrate, wipe, or encrypt sensitive data, hijack resources, and facilitate lateral movement within cloud environments.”

While there is no evidence that the vulnerability was ever exploited in the wild, Redis instances are a lucrative target for threat actors looking to conduct cryptojacking attacks and enlist them in a botnet. As of writing, there are about 330,000 Redis instances exposed to the internet, out of which about 60,000 of them lack any authentication.

“With hundreds of thousands of exposed instances worldwide, this vulnerability poses a significant threat to organizations across all industries,” Wiz said. “The combination of widespread deployment, default insecure configurations, and the severity of the vulnerability creates an urgent need for immediate remediation.”

Oct 07, 2025Ravie LakshmananVulnerability / Cloud Security

Microsoft on Monday attributed a threat actor it tracks as Storm-1175 to the exploitation of a critical security flaw in Fortra GoAnywhere software to facilitate the deployment of Medusa ransomware.

The vulnerability is CVE-2025-10035 (CVSS score: 10.0), a critical deserialization bug that could result in command injection without authentication. It was addressed in version 7.8.4, or the Sustain Release 7.6.3.

“The vulnerability could allow a threat actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection and potential remote code execution (RCE),” the Microsoft Threat Intelligence team said.

According to the tech giant, Storm-1175 is a cybercriminal group known for deploying Medusa ransomware and exploiting public-facing applications for initial access since September 11, 2025. It’s worth noting that watchTowr revealed last week that there were indications of active exploitation of the flaw since at least September 10.

Furthermore, successful exploitation of CVE-2025-10035 could allow attackers to perform system and user discovery, maintain long-term access, and deploy additional tools for lateral movement and malware.

The attack chain following initial access entails dropping remote monitoring and management (RMM) tools, such as SimpleHelp and MeshAgent, to maintain persistence. The threat actors have also been observed creating .jsp files within the GoAnywhere MFT directories, often at the same time as the dropped RMM tools.

In the next phase, commands for user, network, and system discovery are executed, followed by leveraging mstsc.exe (i.e., Windows Remote Desktop Connection) for lateral movement across the network.

The downloaded RMM tools are used for command-and-control (C2) using a Cloudflare tunnel, with Microsoft observing the use of Rclone in at least one victim environment for data exfiltration. The attack ultimately paves the way for the Medusa ransomware deployment.

“Organizations running GoAnywhere MFT have effectively been under silent assault since at least September 11, with little clarity from Fortra,” watchTowr CEO and Founder, Benjamin Harris, said. “Microsoft’s confirmation now paints a pretty unpleasant picture — exploitation, attribution, and a month-long head start for the attackers.

“What’s still missing are the answers only Fortra can provide. How did threat actors get the private keys needed to exploit this? Why were organizations left in the dark for so long? Customers deserve transparency, not silence. We hope they will share in the very near future so affected or potentially affected organizations can understand their exposure to a vulnerability that is being actively exploited in the wild.”

Oct 07, 2025Ravie LakshmananVulnerability / Cloud Security

Redis has disclosed details of a maximum-severity security flaw in its in-memory database software that could result in remote code execution under certain circumstances.

The vulnerability, tracked as CVE-2025-49844 (aka RediShell), has been assigned a CVSS score of 10.0.

“An authenticated user may use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free, and potentially lead to remote code execution,” according to a GitHub advisory for the issue. “The problem exists in all versions of Redis with Lua scripting.”

However, for exploitation to be successful, it requires an attacker to first gain authenticated access to a Redis instance, making it crucial that users don’t leave their Redis instances exposed to the internet and secure them with strong authentication.

The issue impacts all versions of Redis. It has been addressed in versions 6.2.20, 7.2.11, 7.4.6, 8.0.4, and 8.2.2 released on October 3, 2025.

As temporary workarounds until a patch can be applied, it’s advised to prevent users from executing Lua scripts by setting an access control list (ACL) to restrict EVAL and EVALSHA commands. It’s also crucial that only trusted identities can run Lua scripts or any other potentially risky commands.

Cloud security company Wiz, which discovered and reported the flaw to Redis on May 16, 2025, described it as a use-after-free (UAF) memory corruption bug that has existed in the Redis source code for about 13 years.

It essentially permits an attacker to send a malicious Lua script that leads to arbitrary code execution outside of the Redis Lua interpreter sandbox, granting them unauthorized access to the underlying host. In a hypothetical attack scenario, it can be leveraged to steal credentials, drop malware, exfiltrate sensitive data, or pivot to other cloud services.

“This flaw allows a post auth attacker to send a specially crafted malicious Lua script (a feature supported by default in Redis) to escape from the Lua sandbox and achieve arbitrary native code execution on the Redis host,” Wiz said. “This grants an attacker full access to the host system, enabling them to exfiltrate, wipe, or encrypt sensitive data, hijack resources, and facilitate lateral movement within cloud environments.”

While there is no evidence that the vulnerability was ever exploited in the wild, Redis instances are a lucrative target for threat actors looking to conduct cryptojacking attacks and enlist them in a botnet. As of writing, there are about 330,000 Redis instances exposed to the internet, out of which about 60,000 of them lack any authentication.

“With hundreds of thousands of exposed instances worldwide, this vulnerability poses a significant threat to organizations across all industries,” Wiz said. “The combination of widespread deployment, default insecure configurations, and the severity of the vulnerability creates an urgent need for immediate remediation.”

Oct 07, 2025Ravie LakshmananCyber Attack / Ransomware

CrowdStrike on Monday said it’s attributing the exploitation of a recently disclosed security flaw in Oracle E-Business Suite with moderate confidence to a threat actor it tracks as Graceful Spider (aka Cl0p), and that the first known exploitation occurred on August 9, 2025.

The exploitation involves the exploitation of CVE-2025-61882 (CVSS score: 9.8), a critical vulnerability that facilitates remote code execution without authentication.

The cybersecurity company also noted that it’s currently not known how a Telegram channel “insinuating” collaboration between Scattered Spider, LAPSUS$ (aka Slippy Spider), and ShinyHunters came into the possession of an exploit for the flaw, and if they and other threat actors have leveraged it in real-world attacks.

The Telegram channel has been observed sharing the purported Oracle EBS exploit, while criticizing Graceful Spider’s tactics.

The observed activity so far involves an HTTP request to /OA_HTML/SyncServlet, resulting in an authentication bypass. The attacker then targets Oracle’s XML Publisher Template Manager by issuing GET and POST requests to /OA_HTML/RF.jsp and /OA_HTML/OA.jsp to upload and execute a malicious XSLT template,

The commands in the malicious template are executed when it is previewed, resulting in an outbound connection from the Java web server process to attacker-controlled infrastructure over port 443. The connection is subsequently used to remotely load web shells to execute commands and establish persistence.

It’s believed that one or more threat actors are in possession of the CVE-2025-61882 exploit for purposes of data exfiltration.

“The proof-of-concept disclosure and the CVE-2025-61882 patch release will almost certainly encourage threat actors – particularly those familiar with Oracle EBS — to create weaponized POCs and attempt to leverage them against internet-exposed EBS applications,” it said.

In a separate analysis, WatchTowr Labs said, “The chain demonstrates a high level of skill and effort, with at least five distinct bugs orchestrated together to achieve pre-authenticated remote code execution.” The entire sequence of events is as follows –

• Send an HTTP POST request containing a crafted XML to /OA_HTML/configurator/UiServlet to coerce the backend server to send arbitrary HTTP requests by means of a Server-Side Request Forgery (SSRF) attack
• Use a Carriage Return/Line Feed (CRLF) Injection to inject arbitrary headers into the HTTP request triggered by the pre-authenticated SSRF
• Use this vulnerability to smuggle requests to an internet-exposed Oracle EBS application via “apps.example.com:7201/OA_HTML/help/../ieshostedsurvey.jsp” and load a malicious XSLT template

The attack, at its core, takes advantage of the fact that the JSP file can load an untrusted stylesheet from a remote URL, opening the door for an attacker to achieve arbitrary code execution.

“This combination lets an attacker control request framing via the SSRF and then reuse the same TCP connection to chain additional requests, increasing reliability and reducing noise,” the company said. “HTTP persistent connections, also known as HTTP keep-alive or connection reuse, let a single TCP connection carry multiple HTTP request/response pairs instead of opening a new connection for every exchange.”

CVE-2025-61882 has since been added to the Known Exploited Vulnerabilities (KEV) catalog by the Cybersecurity and Infrastructure Security Agency (CISA), noting that it has been used in ransomware campaigns, urging federal agencies to apply the fixes by October 27, 2025.

“Cl0p has been exploiting multiple vulnerabilities in Oracle EBS since at least August 2025, stealing large amounts of data from several victims, and has been sending extortion emails to some of those victims since last Monday,” Jake Knott, principal security researcher at watchTowr, said in a statement.

“Based on the evidence, we believe this is Cl0p activity, and we fully expect to see mass, indiscriminate exploitation from multiple groups within days. If you run Oracle EBS, this is your red alert. Patch immediately, hunt aggressively, and tighten your controls — fast.”

Oct 06, 2025Ravie LakshmananNetwork Security / Cyber Espionage

A Chinese company named the Beijing Institute of Electronics Technology and Application (BIETA) has been assessed to be likely led by the Ministry of State Security (MSS).

The assessment comes from evidence that at least four BIETA personnel have clear or possible links to MSS officers and their relationship with the University of International Relations, which is known to share links with the MSS, according to Recorded Future. The names of the four individuals include Wu Shizhong, He Dequan, You Xingang, and Zhou Linna.

“BIETA and its subsidiary, Beijing Sanxin Times Technology Co., Ltd. (CIII), research, develop, import, and sell technologies that almost certainly support intelligence, counterintelligence, military, and other missions relevant to China’s national development and security,” the company said in a report shared with The Hacker News.

“Their activities include researching methods of steganography that can likely support covert communications (COVCOM) and malware deployment; developing and selling forensic investigation and counterintelligence equipment; and acquiring foreign technologies for steganography, network penetration testing, and military communications and planning.”

According to information shared on its website, BIETA is a “research and development institution” that specializes in communication technology, multimedia information processing technology, multimedia information security technology, computer and network technology application research, and special circuit development. It’s said to have existed in some form since 1983.

One of BIETA’s core focus areas concerns the use of steganography across several media, with CIII also receiving copyrights for software related to the covert communication tactic. CIII has also developed various applications for uploading files to Baidu Cloud and OneDrive, communicating with friends, and carrying out network simulations and penetration testing against websites, mobile apps, enterprise systems, servers, databases, cloud platforms, and Internet of Things devices.

As recently as November 2021, the company has worked on a tool named Intelligent Discussion Android App and a cell phone positioning system that can identify, monitor, position, and block mobile phones within large venues, including the ability to harvest text messages and calls from phones under their control.

Other solutions advertised by CIII range from communication simulation to network functionality testing tools, as well as a program called Datacrypt Hummingbird online storage upload software. That said, there is limited public information on how these programs may have augmented the MSS.

The Mastercard-owned company noted both BIETA and CIII “almost certainly” are part of a set of front organizations that contribute to the development of tools to facilitate cyber-enabled intelligence operations by Beijing’s intelligence apparatus and its proxies.

“BIETA’s research is almost certainly used to create technologies that enable the MSS’s mission. The MSS then likely makes capabilities benefiting from BIETA’s achievements available to subordinate state security departments, bureaus, and officers, which in turn provide them to their contractors or proxies,” it said.

The disclosure comes a little over a month after cybersecurity company Spur uncovered a Chinese proxy and VPN service called WgetCloud (formerly GaCloud) that has been put to use in cyber campaigns allegedly orchestrated by a North Korean threat actor known as Kimsuky.

“Whether or not they purchased a subscription or acquired this particular Trojan proxy through other means is unknown,” it said. “This highlights the broader risk of APT proxy infrastructure blending into commercial offerings.”

Oct 06, 2025Ravie LakshmananMalware / Data Breach

Cybersecurity researchers have shed light on a Chinese-speaking cybercrime group codenamed UAT-8099 that has been attributed to search engine optimization (SEO) fraud and theft of high-value credentials, configuration files, and certificate data.

The attacks are designed to target Microsoft Internet Information Services (IIS) servers, with most of the infections reported in India, Thailand, Vietnam, Canada, and Brazil, spanning universities, tech firms, and telecom providers. The group was first discovered in April 2025. The targets are primarily mobile users, encompassing both Android and Apple iPhone devices.

UAT-8099 is the latest China-linked actor to engage in SEO fraud for financial gain. As recently as last month, ESET revealed details of another threat actor named GhostRedirector that has managed to compromise at least 65 Windows servers primarily located in Brazil, Thailand, and Vietnam with a malicious IIS module codenamed Gamshen to facilitate SEO fraud.

“UAT-8099 manipulates search rankings by focusing on reputable, high-value IIS servers in targeted regions,” Cisco Talos researcher Joey Chen said. “The group maintains persistence and alters SEO rankings using web shells, open-source hacking tools, Cobalt Strike, and various BadIIS malware; their automation scripts are customized to evade defenses and hide activity.”

Once a vulnerable IIS server is found – either via security vulnerability or weak settings in the web server’s file upload feature – the threat actor uses the foothold to upload web shells to conduct reconnaissance and gather basic system information. The financially motivated hacking group subsequently enables the guest account to escalate their privileges, all the way to the administrator, and use it to enable Remote Desktop Protocol (RDP).

UAT-8099 has also been observed taking steps to plug the initial access pathway to maintain sole control of the compromised hosts and prevent other threat actors from compromising the same servers. In addition, Cobalt Strike is deployed as the preferred backdoor for post-exploitation.

In order to achieve persistence, RDP is combined with VPN tools like SoftEther VPN, EasyTier, and Fast Reverse Proxy (FRP). The attack chain culminates with the installation of BadIIS malware, which has been put to use by multiple Chinese-speaking threat clusters like DragonRank and Operation Rewrite (aka CL-UNK-1037).

UAT-8099 uses RDP to access IIS servers and search for valuable data within the compromised host using a graphical user interface (GUI) tool named Everything, which is then packaged for either resale or further exploitation. It’s not currently clear how many servers the group has compromised.

The BadIIS malware deployed in this case, however, is a variant that has tweaked its code structure and functional workflow to sidestep detection by antivirus software. It functions similarly to Gamshen in that the SEO manipulation component kicks in only when the request originates from Google (i.e., User-Agent is Googlebot).

BadIIS can operate in three different modes –

• Proxy, which extracts the encoded, embedded command-and-control (C2) server address and uses it as a proxy to retrieve content from a secondary C2 server
• Injector, which intercepts browser requests originating from Google search results, connects to the C2 server to retrieve JavaScript code, embeds the downloaded JavaScript into the HTML content of the response, and returns the altered response back to redirect the victim to the chosen destination (unauthorized advertisements or illegal gambling websites)
• SEO fraud, which compromises multiple IIS servers to conduct SEO fraud by serving backlinks to artificially boost website rankings

“The actor employs a conventional SEO technique known as backlinking to boost website visibility,” Talos said. “Google’s search engine uses backlinks to discover additional sites and assess keyword relevance.”

“A higher number of backlinks increases the likelihood of Google crawlers visiting a site, which can accelerate ranking improvements and enhance exposure for the webpages. However, simply accumulating backlinks without regard to quality can lead to penalties from Google.”

Oct 06, 2025Ravie LakshmananCybersecurity / Hacking News

The cyber world never hits pause, and staying alert matters more than ever. Every week brings new tricks, smarter attacks, and fresh lessons from the field.

This recap cuts through the noise to share what really matters—key trends, warning signs, and stories shaping today’s security landscape. Whether you’re defending systems or just keeping up, these highlights help you spot what’s coming before it lands on your screen.

⚡ Threat of the Week

Oracle 0-Day Under Attack — Threat actors with ties to the Cl0p ransomware group have exploited a zero-day flaw in E-Business Suite to facilitate data theft attacks. The vulnerability, tracked as CVE-2025-61882 (CVSS score: 9.8), concerns an unspecified bug that could allow an unauthenticated attacker with network access via HTTP to compromise and take control of the Oracle Concurrent Processing component. In a post shared on LinkedIn, Charles Carmakal, CTO of Mandiant at Google Cloud, said “Cl0p exploited multiple vulnerabilities in Oracle EBS which enabled them to steal large amounts of data from several victims in August 2025,” adding “multiple vulnerabilities were exploited including vulnerabilities that were patched in Oracle’s July 2025 update as well as one that was patched this weekend (CVE-2025-61882).”

• Phantom Taurus Targets Africa, the Middle East, and Asia — A previously undocumented Chinese nation-state actor has been targeting government agencies, embassies, military operations, and other entities across Africa, the Middle East, and Asia in a cyber-espionage operation as sophisticated as it is stealthy and persistent. What makes the campaign different from other China-nexus activity is the threat actor’s surgical precision, unprecedented persistence, and its use of a highly sophisticated, custom-built toolkit called NET-STAR to go after high-value systems at organizations of interest. The threat actor’s operations are supported by other bespoke tools like TunnelSpecter and SweetSpecter to compromise mail servers and steal data based on keyword searches.
• Detour Dog Uses Compromised WordPress Sites to Deliver Strela Stealer — An established, persistent group of cybercriminals has been silently infecting WordPress websites around the world since 2020, using them to redirect unsuspecting site visitors to scam, and, more recently, to malware such as Strela Stealer. The threat actor is tracked as Detour Dog. The attack involves using DNS TXT records to send secret commands to the infected sites to either redirect visitors to scams or fetch and run malicious code. In about 90% of the cases, the website performs as intended, triggering its malicious behavior only in select conditions. Because normal visitors only rarely encounter the malicious payloads, infections often go unnoticed for extended periods of time. Infoblox said Detour Dog likely operates as a distribution-as-a-service (DaaS), using its infrastructure to deliver other malware.
• Self-Spreading WhatsApp Malware SORVEPOTEL Targets Brazil — Brazilian users have emerged as the target of a new self-propagating malware that spreads via the popular messaging app WhatsApp. The campaign, codenamed SORVEPOTEL by Trend Micro, weaponizes the trust with the platform to extend its reach across Windows systems, adding that the attack is “engineered for speed and propagation” rather than data theft or ransomware. The starting point of the attack is a phishing message sent from an already compromised contact on WhatsApp to lend it a veneer of credibility. The message contains a ZIP attachment that masquerades as a seemingly harmless receipt or health app-related file. Once the attachment is opened, the malware automatically propagates via the desktop web version of WhatsApp, ultimately causing the infected accounts to be banned for engaging in excessive spam. There are no indications that the threat actors have leveraged the access to exfiltrate data or encrypt files.
• ProSpy and ToSpy Spyware Campaigns Target U.A.E. Android Users — Two Android spyware campaigns dubbed ProSpy and ToSpy have impersonated apps like Signal and ToTok to target users in the United Arab Emirates (U.A.E.). The malicious apps are distributed via fake websites and social engineering to trick unsuspecting users into downloading them. Once installed, both the spyware malware strains establish persistent access to compromised Android devices and exfiltrate data. Neither app containing the spyware was available in official app stores.
• Researchers Demonstrate Battering RAM and WireTap — A new attack called Battering RAM can use a $50 interposer to bypass the confidential computing defenses of both Intel and AMD processors used in hardware powering cloud environments, thus allowing attackers to break encryption designed to protect sensitive data. Similarly, WireTap undermines the guarantees offered by Intel’s Software Guard eXtensions (SGX) on DDR4 systems to passively decrypt sensitive data. For the attack to be successful, however, it requires that someone have one-time physical access to the hardware system. Both Intel and AMD have marked the physical attack as “out of scope” of their threat models. The findings coincide with VMScape, another attack that breaks existing virtualization isolation to leak arbitrary memory and expose cryptographic keys. VMScape has been described as “the first Spectre-based end-to-end exploit in which a malicious guest user can leak arbitrary, sensitive information from the hypervisor in the host domain, without requiring any code modifications and in default configuration.”

‎️‍🔥 Trending CVEs

Hackers move fast. They often exploit new vulnerabilities within hours, turning a single missed patch into a major breach. One unpatched CVE can be all it takes for a full compromise. Below are this week’s most critical vulnerabilities gaining attention across the industry. Review them, prioritize your fixes, and close the gap before attackers take advantage.

This week’s list includes — CVE-2025-27915 (Zimbra Collaboration), CVE-2025-61882 (Oracle E-Business Suite), CVE-2025-4008 (Smartbedded Meteobridge), CVE-2025-10725 (Red Hat OpenShift AI), CVE-2025-59934 (Formbricks), CVE-2024-58260 (SUSE Rancher), CVE-2025-43400 (iOS 26.0.1, iPadOS 26.0.1, iOS 18.7.1, iPadOS 18.7.1, macOS Tahoe 26.0.1, macOS Sequoia 15.7.1, macOS Sonoma 14.8.1, and visionOS 26.0.1), CVE-2025-30247 (Western Digital MyCloud), CVE-2025-41250, CVE-2025-41251, CVE-2025-41252 (Broadcom VMware), CVE-2025-9230, CVE-2025-9231, CVE-2025-9232 (OpenSSL), CVE-2025-52906 (TOTOLINK), CVE-2025-59951 (Termix Docker), CVE-2025-10547 (DrayTek), CVE-2025-49844 (Redis), CVE-2025-57714 (QNAP NetBak Replicator), and vulnerabilities in a Russian guest management system called PassOffice.

📰 Around the Cyber World

• New iOS Video Injection Tool Can Conduct Deepfake Attacks — Cybersecurity researchers have uncovered a highly specialized tool designed to perform advanced video injection attacks, marking a significant escalation in digital identity fraud. “The tool is deployed via jailbroken iOS 15 or later devices and is engineered to bypass weak biometric verification systems—and crucially, to exploit identity verification processes that lack biometric safeguards altogether,” iProov said. “This development signals a shift toward more programmatic and scalable attack methods.” To perform the attack, the threat actor uses a Remote Presentation Transfer Mechanism (RPTM) server to connect their computer to the compromised iOS device and then inject sophisticated synthetic media.
• Qilin Ransomware Claims 104 Attacks in August — The Qilin ransomware operation claimed 104 attacks in August 2025, making it the most active group, followed by Akira (56), Sinobi (36), DragonForce (30), and SafePay (29). “The U.S. remains overwhelmingly the biggest target for ransomware groups, while Europe and Canada continue to draw significant interest from attackers, with Germany and the UK moving past Canada into second and third place, respectively,” Cyble said. According to data compiled by Halcyon, Manufacturing, Retail, and Hospitals and Physicians Clinics were the sectors most targeted industry verticals in August 2025.
• New Impact Solutions Toolkit Emerges — A new phishing toolkit named Impact Solutions has surfaced on cybercrime networks, further democratizing access to advanced phishing attacks for threat actors with minimal technical skills. The kit includes modules to build Windows shortcut (LNK) attachments, HTML files for HTML smuggling attacks, HTML templates mimicking login pages and secure invoice viewers, SVG files embedded with scripts, and payloads that leverage the Windows Run dialog for ClickFix attacks. “Promoted as a comprehensive payload delivery framework, Impact Solutions provides attackers with a user-friendly, point-and-click interface to create malicious email attachments that appear completely legitimate,” Abnormal AI said. “The toolkit specializes in creating persuasive social engineering lures designed to bypass both user awareness and security filters. These include weaponized Windows shortcut files (.LNK), covert HTML pages, and cleverly disguised SVG images—all built to exploit human trust rather than technical vulnerabilities.”
• Microsoft Plans to Retire SVG Support in Outlook — Microsoft said it’s retiring support for inline Scalable Vector Graphics (SVG) images in Outlook for Web and the new Outlook for Windows starting early September 2025. “Outlook for Web and new Outlook for Windows will stop displaying inline SVG images, showing blank spaces instead,” the company said in a Microsoft 365 Message Center update. “This affects under 0.1% of images, improves security, and requires no user action. SVG attachments remain supported. Organizations should update documentation and inform users.” The development comes as threat actors are increasingly using SVG files as a way to distribute malware in phishing campaigns. Previously, Microsoft said the Outlook app for Windows will start blocking .library-ms and .search-ms file types.
• Profile of Keymous+ — A profile of Keymous+ has described it as a threat actor that uses publicly available DDoS booter services to launch DDoS attacks. According to NETSCOUT, the group has been attributed to confirmed 249 DDoS attacks targeting organizations across 15 countries and 21 industry sectors. Government agencies, hospitality and tourism, transportation and logistics, financial services, and telecommunications are some of the most targeted sectors. Morocco, Saudi Arabia, Sudan, India, and France have experienced the most frequent attacks. “Although the group’s individual attacks peaked at 11.8Gbps, collaborative efforts with partners reached 44Gbps, demonstrating significantly enhanced disruptive capability,” the company said.
• Lunar Spider Uses Fake CAPTCHA for Malware Delivery — The Russian-speaking cybercriminal group known as Lunar Spider (aka Gold Swathmore), which is assessed to be behind IcedID and Latrodectus, has been observed using ClickFix tactics to distribute Latrodectus. “The fake CAPTCHA framework includes a command to run PowerShell that downloads an MSI file and also features victim click monitoring, which reports back to a Telegram channel,” NVISO Labs said. “During the execution chain, the MSI file contains an Intel EXE file registered in a Run key that subsequently sideloads a malicious DLL, identified as Latrodectus V2.” In a separate report published by The DFIR Report, the threat actor has been attributed to a nearly two-month-long intrusion in May 2024 that began with a JavaScript file disguised as a tax form to execute the Brute Ratel framework via an MSI installer, along with Latrodectus, Cobalt Strike, and a custom .NET backdoor. “Threat actor activity persisted for nearly two months with intermittent command and control (C2) connections, discovery, lateral movement, and data exfiltration,” it said. “Twenty days into the intrusion, data was exfiltrated using Rclone and FTP.” Details of the activity were previously shared by EclecticIQ.

• Red Hat Confirms Security Incident — Red Hat disclosed that unauthorized threat actors broke into its GitLab instance used for internal Red Hat Consulting collaboration in select engagements and copied some data from it. “The compromised GitLab instance housed consulting engagement data, which may include, for example, Red Hat’s project specifications, example code snippets, and internal communications about consulting services,” the company said. “This GitLab instance typically does not house sensitive personal data.” It also said it’s reaching out to impacted customers directly. The acknowledgement came after an extortion group calling itself the Crimson Collective said it stole nearly 570GB of compressed data across 28,000 internal development repositories.
• Google Upgrades CSE in Gmail — Google announced that Gmail client-side encryption (CSE) users can send end-to-end encrypted (E2EE) emails to anyone, even if the recipient uses a different email provider. “Recipients will receive a notification and can easily access the encrypted message via a guest account, ensuring secure communication without the hassle of exchanging keys or using custom software,” Google said. The company first announced CSE in Gmail way back in December 2022 and made it generally available in March 2023.
• FunkSec Returns with FunkLocker — The FunkSec ransomware group has resurfaced with a new ransomware strain called FunkLocker that exhibits signs of being developed by artificial intelligence. “Some versions are barely functional, while others integrate advanced features such as anti-VM checks,” ANY.RUN said. “FunkLocker forcefully terminates processes and services using predefined lists, often causing unnecessary errors but still leading to full system disruption.”
• Ransomware Threat Actor Connected to Play, RansomHub and DragonForce — A September 2024 intrusion that commenced with the download of a malicious file mimicking the EarthTime application by DeskSoft, led to the deployment of SectopRAT, which then dropped SystemBC and other tools to conduct reconnaissance. Also discovered in the compromised environment were Grixba, a reconnaissance utility linked to Play ransomware; Betruger, a backdoor associated with RansomHub; and the presence of a previous NetScan output containing data from a company reportedly compromised by DragonForce ransomware, indicating that the threat actor was likely an affiliate for multiple ransomware groups, the DFIR Report said. While no file-encrypting malware was executed, the actor managed to laterally move across the network through RDP connections and exfiltrate data over WinSCP to an FTP server in the form of WinRAR archives.
• LinkedIn Sues ProAPIs for Unauthorized Scraping — LinkedIn filed a lawsuit against a company called ProAPIs for allegedly operating a network of millions of fake accounts used to scrape data from LinkedIn members before selling the information to third-parties without permission. The Microsoft-owned company said ProAPIs charges customers up to $15,000 per month for scraped user data taken from the social media platform. “Defendants’ industrial-scale fake account mill scrapes member information that real people have posted on LinkedIn, including data that is only available behind LinkedIn’s password wall and that Defendants’ customers may not otherwise be allowed to access, and certainly are not allowed to copy and keep in perpetuity,” according to the lawsuit.
• BBC Journalist Offered Money to Hack into Company’s Network — A BBC journalist was offered a significant amount of money by cybercriminals who sought to hack into the BBC’s network in hopes of stealing valuable data and leveraging it for a ransom. “If you are interested, we can offer you 15% of any ransom payment if you give us access to your PC,” the message received by the journalist on the Signal messaging app in July 2025. The individual who reached out claimed to be part of the Medusa ransomware group. Eventually, out of precaution, their account was disconnected from BBC entirely. When the journalist stopped responding, the threat actor ended up deleting their Signal account. The findings show that threat actors are increasingly looking for underpaid or disgruntled employees at prospective targets to sell their access in order to breach networks.
• Spike in Exploitation Efforts Targeting Grafana Flaw — GreyNoise warned of a sharp one-day surge of exploitation attempts targeting CVE-2021-43798 – a Grafana path traversal vulnerability that enables arbitrary file reads – on September 28, 2025. Over the course of the day, 110 unique malicious IP addresses attempted exploitation, with China-, Germany-, and Bangladesh-based IPs targeting the U.S., Slovakia, and Taiwan. “The uniform targeting pattern across source countries and tooling indicates common tasking or shared exploit use,” it said. “The convergence suggests either one operator leveraging diverse infrastructure or multiple operators reusing the same exploit kit and target set.”
• New Data Leak Site Launched by LAPSUS$, Scattered Spider, and ShinyHunters — The loose-knit group comprising LAPSUS$, Scattered Spider, and ShinyHunters has published a dedicated data leak site on the dark web, called Scattered LAPSUS$ Hunters, threatening to release nearly a billion records stolen from companies that store their customers’ data in cloud databases hosted by Salesforce. “We are aware of recent extortion attempts by threat actors, which we have investigated in partnership with external experts and authorities,” Salesforce said in response. “Our findings indicate these attempts relate to past or unsubstantiated incidents, and we remain engaged with affected customers to provide support. At this time, there is no indication that the Salesforce platform has been compromised, nor is this activity related to any known vulnerability in our technology.” In its Telegram channel named “SLSH 6.0 Part 3,” Scattered Lapsus$ Hunters said it plans to launch a second data leak site after the October 10 deadline that will be devoted to “our (UNC6395) Salesloft Drift App campaign.” The development came after the cyber extortion group announced its farewell last month.
• Signal Announces Sparse Post Quantum Ratchet — Signal has introduced the Sparse Post Quantum Ratchet (SPQR), a new upgrade to its encryption protocol that mixes quantum-safe cryptography into its existing Double Ratchet. The result, which Signal calls the Triple Ratchet, makes it much more challenging for future quantum computers to break private chats. The new component guarantees forward secrecy and post-compromise security, ensuring that even in the case of key compromise or theft, future messages exchanged between parties will be safe. Signal said the rollout of SPQR on the messaging platform will be gradual, and users don’t need to take any action for the upgrade to apply apart from keeping their clients updated to the latest version. In September 2023, the messaging app first added support for quantum resistance by upgrading the Extended Triple Diffie-Hellman (X3DH) specification to Post-Quantum Extended Diffie-Hellman (PQXDH).
• Large-Scale Phishing Operations Go Undetected for Years — A “multi-year, industrial-scale phishing and brand impersonation scheme” operated undetected for more than three years on Google Cloud and Cloudflare platforms. The activity relates to a large-scale phishing-as-a-service (PhaaS) operation that included 48,000 hosts and more than 80 clusters abusing “high-trust” expired domains. The campaign subsequently used these domains to impersonate trusted brands to distribute fake login pages, malware, and gambling content. “Many of the cloned sites still load resources from the original brand’s cloud infrastructure – meaning the original brand may actively be serving content to a malicious impersonator,” Deep Specter said.
• HeartCrypt Evolves into a Loader for Stealer and RATs — The packer-as-a-service (PaaS) malware called HeartCrypt has been distributed via phishing emails to ultimately deploy off-the-shelf stealers and remote access trojans (RATs), as well as a lesser-prevalent antivirus termination program known as AVKiller. The activity used copyright infringement notices to target victims in Italy using LNK files that contained a URL to fetch an intermediate PowerShell payload that displays a decoy document while also simultaneously downloading HeartCrypt from Dropbox. “The HeartCrypt packer takes legitimate executables and modifies them by injecting malicious code in the .text section. It also inserts a few additional Portable Executable (PE) resources,” Sophos said. These resources are disguised as bitmap files and start with a BMP header, but afterwards the malicious content follows.”
• Software Supply Chain Attack Exploiting Packaging Order — Researchers from the KTH Royal Institute of Technology and Universtité de Montréal have detailed a novel attack called Maven-Hijack that exploits the order in which Maven packages dependencies and the way the Java Virtual Machine (JVM) resolves classes at runtime. “By injecting a malicious class with the same fully qualified name as a legitimate one into a dependency that is packaged earlier, an attacker can silently override core application behavior without modifying the main codebase or library names,” the researchers said.
• LNK Files Lead to RAT — In a new attack chain detailed by K7 Security Labs, it has been found that threat actors are leveraging LNK files distributed via Discord to launch a decoy PDF and run PowerShell responsible for dropping a ZIP archive that, in turn, executes a malicious DLL using the Windows command-line tool odbcconf.exe. The DLL is a multi-functional RAT designed to execute commands from a C2 server and collect system information from the infected host. “It employs several techniques, including collecting antivirus product information, bypassing Anti-Malware Scan Interface (AMSI), and patching EtwEventWrite to disable Windows Event Tracing (ETW), making it harder for security solutions to detect its malicious activities,” the company said.
• Unpatched Flaws in Cognex InSight IS2000M-120 Smart Camera — As many as nine security vulnerabilities have been disclosed in Cognex IS2000M-120, an industrial smart camera used for machine vision applications, that allow an attacker to fully compromise the devices, undermining their operational integrity and safety. No patches are being planned for the model, given that the company is considering an end-of-life status. “First, an unauthenticated attacker on the same network segment as the device – who is capable of intercepting traffic, for example via a Man-in-the-Middle (MitM) attack – can fully compromise the device through multiple attack vectors,” Nozomi Networks said. “This scenario presents a critical risk in environments where network segmentation or encryption is not enforced.” Furthermore, a low-privileged user with limited access to the camera can escalate their privileges by creating a new administrative account and gaining full control of the device. Lastly, an attacker with limited access to the Windows workstation where the Cognex In-Sight Explorer software is installed can manipulate backup data intended for the camera and carry out malicious actions.
• Hacktivist Group zerodayx1 Launches Ransomware — A pro-Palestinian hacktivist group known as zerodayx1 launched its own Ransomware-as-a-Service (RaaS) operation called BQTLock, making it the latest group to make such as pivot. Zerodayx1 is believed to be a Lebanese hacktivist active since at least 2023, positioning themselves as a Muslim and pro-Palestinian threat actor. “Hacktivism is no longer confined to ideological messaging,” Outpost24 said. “Increasingly, groups are integrating financially motivated operations, signaling a shift toward hybrid models that combine activism with profit-seeking agendas.”
• Mobile Apps Leak Data — New findings from Zimperium have revealed that one in three Android apps and more than half of iOS apps leak sensitive data. Nearly half of mobile apps contain hard-coded secrets such as API keys. On top of that, an analysis of 800 free VPN apps for both Android and iOS uncovered that many apps provide no real privacy at all, some request excessive permissions far beyond their purpose, others leak personal data, and some rely on outdated, vulnerable code. Other risky behaviors included missing privacy nutrition labels for apps and susceptibility to Man-in-the-Middle (MitM) attack. “Not all VPN apps can be trusted,’ the company said. “Many suffer from weak encryption, data leakage, or dangerous permission requests—problems that are invisible to most end users.” In another research published last month, Mike Oude Reimer found that misconfigured mobile apps could be exploited to achieve access to more than 150 different Firebase services. This consisted of access to real-time databases, storage buckets, and secrets.
• Microsoft Shares Insights on XSS Flaws — According to Microsoft, 15% of all important or critical MSRC cases between July 2024 – July 2025 were cross-site scripting (XSS) flaws. Out of 265 XSS cases, 263 were rated Important severity and 2 were rated Critical severity. In all, the company has mitigated over 970 XSS cases since January 2024 alone as of mid-2025.
• Threat Actor Exposes Themselves After Installing Security Software — A threat actor has inadvertently revealed their methods and day-to-day activities after installing a trial version of Huntress security software on their own operating machine and a premium Malwarebytes browser extension. The actor is said to have discovered Huntress through a Google advertisement while searching for security solutions like Bitdefender. Further analysis revealed their attempts to use make.com to automate certain workflows, find running instances of Evilginx, and their interest in residential proxy services like LunaProxy and Nstbrowser. “This incident gave us in-depth information about the day-to-day activities of a threat actor, from the tools they were interested in to the ways they conducted research and approached different aspects of attacks,” Huntress said.
• Using bitpixie to Bypass BitLocker — Cybersecurity researchers have found that attackers can circumvent BitLocker drive encryption using a Windows local privilege escalation flaw. “The bitpixie vulnerability in Windows Boot Manager is caused by a flaw in the PXE soft reboot feature, whereby the BitLocker key is not erased from memory,” SySS said. “To exploit this vulnerability on up-to-date systems, a downgrade attack can be performed by loading an older, unpatched boot manager. This enables attackers to extract the Volume Master Key (VMK) from main memory and bypass BitLocker encryption, which could grant them administrative access.” To counter the threat, it’s advised to use a pre-boot PIN or apply a patch that Microsoft released in 2023 (CVE-2023-21563), which prevents downgrade attacks on the vulnerable boot manager by replacing the old Microsoft certificate from 2011 with the new Windows UEFI CA 2023 certificate.
• How Threat Actors Can Abuse Domain Fronting — In domain fronting, an attacker could connect to a domain that looks outwardly legitimate by connecting to a domain as google.com or meet.google.com, while the backend routes quietly diverts the connection to attacker-controlled infrastructure hosted inside the Google Cloud Platform. By routing C2 traffic through core internet infrastructure and domains, it allows malicious traffic to blend in and fly under the radar. “You make the SNI [Server Name Indication] look like a trusted, high-reputation service (google.com), but the Host header quietly points traffic to attacker-controlled infrastructure,” Praetorian said. “From the outside, the traffic looks like normal usage of a major service. But on the backend, it’s routed somewhere entirely different.”
• Mis-issued certificates for Cloudflare’s 1.1.1.1 DNS service — Cloudflare revealed that unauthorized certificates were issued by Fina CA for 1.1.1.1, one of the IP addresses used by its public DNS resolver service. “From February 2024 to August 2025, Fina CA issued 12 certificates for 1.1.1.1 without our permission,” the web infrastructure company said. “We have no evidence that bad actors took advantage of this error. To impersonate Cloudflare’s public DNS resolver 1.1.1.1, an attacker would not only require an unauthorized certificate and its corresponding private key, but attacked users would also need to trust the Fina CA.”
• New Attack to Compromise Web Browsing AI Agents — A novel attack demonstrated by JFrog shows that website cloaking techniques can be weaponized to poison autonomous web-browsing agents powered by Large Language Models (LLMs). “As these agents become more prevalent, their unique and often homogenous digital fingerprints – comprising browser attributes, automation framework signatures, and network characteristics – create a new, distinguishable class of web traffic. The attack exploits this fingerprintability,” security researcher Shaked Zychlinski said. “A malicious website can identify an incoming request as originating from an AI agent and dynamically serve a different, “cloaked” version of its content. While human users see a benign webpage, the agent is presented with a visually identical page embedded with hidden, malicious instructions, such as indirect prompt injections. This mechanism allows adversaries to hijack agent behavior, leading to data exfiltration, malware execution, or misinformation propagation, all while remaining completely invisible to human users and conventional security crawlers.”
• Exploit Tool Invocation Prompt to Hijack LLM-Based Agentic Systems — Tool Invocation Prompt (TIP) serves as a critical component in LLM systems, determining how LLM-based agentic systems invoke various external tools and interpret feedback from the execution of these tools. However, new research has disclosed that tools like Cursor and Claude Code are susceptible to remote code execution or denial-of-service (DoS) by injecting malicious prompts or code into tool descriptions. The finding comes as Forescout noted that LLMs are falling short in performing vulnerability discovery and exploitation development tasks.

🎥 Cybersecurity Webinars

• Beyond the Hype: Practical AI Workflows for Cybersecurity Teams — AI is transforming cybersecurity workflows, but the best results come from blending human oversight with automation. In this webinar, Thomas Kinsella of Tines shows how to pinpoint where AI truly adds value, avoid over-engineering, and build secure, auditable processes that scale.

• Halloween Special: Real Breach Stories and the Fix to End Password Horrors — Passwords are still a prime target for attackers—and a constant pain for IT teams. Weak or reused credentials, frequent helpdesk resets, and outdated policies expose organizations to costly breaches and reputational damage. In this Halloween-themed webinar from The Hacker News and Specops Software, you’ll see real breach stories, discover why traditional password policies fail, and watch a live demo on blocking compromised credentials in real time—so you can end password nightmares without adding user friction.

🔧 Cybersecurity Tools

• Malifiscan – Modern software supply chains rely on public and internal package repositories, but malicious uploads increasingly slip through trusted channels. Malifiscan helps teams detect and block these threats by cross-referencing external vulnerability feeds like OSV against their own registries and artifact repositories. It integrates with JFrog Artifactory, supports 10+ ecosystems, and automates exclusion pattern creation to prevent compromised dependencies from being downloaded or deployed.
• AuditKit – This new tool helps teams verify cloud compliance across AWS and Azure without manual guesswork. Designed for SOC2, PCI-DSS, and CMMC frameworks, it automates control checks, highlights critical audit gaps, and generates auditor-ready evidence guides. Ideal for security and compliance teams preparing for formal assessments, AuditKit bridges the gap between technical scans and the documentation auditors actually need.

Disclaimer: These tools are for educational and research use only. They haven’t been fully security-tested and could pose risks if used incorrectly. Review the code before trying them, test only in safe environments, and follow all ethical, legal, and organizational rules.

🔒 Tip of the Week

Quick Windows Hardening with Open-Source Tools — Most Windows attacks succeed not because of zero-days, but because of weak defaults — open ports, old protocols, reused admin passwords, or missing patches. Attackers exploit what’s already there. A few small, smart changes can block most threats before they start.

Harden your Windows systems using free, trusted open-source tools that cover audit, configuration, and monitoring. You don’t need enterprise tools to raise your defense baseline — just a few solid steps.

Quick Actions (Under 30 Minutes):

• Run Hardentools — disable unsafe defaults instantly.
• Use CIS-CAT Lite — identify missing patches, open RDP, or weak policies.
• Check Local Admins — remove unused accounts, deploy LAPS for password rotation.
• Turn On Logging — enable PowerShell, Windows Defender, and Audit Policy logs.
• Run WinAudit — export a report and compare it weekly for unauthorized changes.
• Scan with Wazuh or OpenVAS — look for outdated software or exposed services.

Key Risks to Watch:

🔑 Reused or shared admin passwords

🌐 Open RDP/SMB without firewall or NLA

⚙️ Old PowerShell versions without logging

🧩 Users running with local admin rights

🪟 Missing Defender Attack Surface Reduction (ASR) rules

📦 Unpatched or unsigned software from third-party repos

These simple, repeatable checks close 80% of the attack surface exploited in ransomware and credential theft campaigns. They cost nothing, take minutes, and build muscle memory for good cyber hygiene.

Conclusion

Thanks for reading this week’s recap. Keep learning, stay curious, and don’t wait for the next alert to take action. A few smart moves today can save you a lot of cleanup tomorrow.