Daily curated cyber threat intelligence for security professionals.
Sourcem.koreaherald.com
Curated
Shinhan Card has reported an internal data leak affecting approximately 190,000 customers, primarily small business owners, with leaked information including mobile phone numbers and some personal details. The breach was not a cyberattack but resulted from an employee improperly accessing and using customer data for solicitation purposes.
Sourcewww.wsj.com
Curated
Iranian-linked hackers have successfully breached less-defended Israeli institutions, such as hospitals, exploiting known vulnerabilities. These attacks, known as “hack and leak,” have resulted in the leaking of sensitive data, including passport information and internal documents. Experts suggest that a comprehensive cyber law, extending beyond critical infrastructure protection, could better safeguard Israel from such breaches.
Sourcewww.cxtoday.com
Curated
A third-party breach at Red Hat, a vendor for Nissan, exposed the personal data of 21,000 Nissan customers in Japan, including names, addresses, and phone numbers. This incident highlights the growing security risks associated with third-party vendors managing sensitive customer information.
Published
DDoS incident disrupts France’s postal and banking services ahead of Christmas therecord.media/la-poste-…
France’s national postal service, La Poste, confirmed that a suspected cyberattack disrupted its websites and mobile applications days before Christmas, slowing deliveries and knocking some online services offline.
In a statement on Monday, La Poste said that a distributed denial-of-service (DDoS) incident knocked key digital systems offline. The company said there was no evidence that customer data had been compromised, but acknowledged that postal operations, including parcel distribution, had been affected.
The disruption extended to La Banque Postale, the banking service, which warned customers that access to online banking and its mobile app was affected. Card payments at in-store terminals and cash withdrawals from ATMs continued to function, and online payments remained possible if authenticated by text message, the bank said.
La Poste said some post offices were operating at reduced capacity, though customers were still able to carry out banking and postal transactions at counters. “Our teams are fully mobilised to restore services as quickly as possible,” the company said in a statement.
Published
Critical RCE flaw impacts over 115,000 WatchGuard firewalls www.bleepingcomputer.com/news/secu…
Over 115,000 WatchGuard Firebox devices exposed online remain unpatched against a critical remote code execution (RCE) vulnerability actively exploited in attacks.
The security flaw, tracked as CVE-2025-14733, affects Firebox firewalls running Fireware OS 11.x and later (including 11.12.4_Update1), 12.x or later (including 12.11.5), and 2025.1 up to and including 2025.1.3.
Successful exploitation enables unauthenticated attackers to execute arbitrary code remotely on vulnerable devices, following low-complexity attacks that don’t require user interaction.
As WatchGuard explained in a Thursday advisory, when it released CVE-2025-14733 security updates and tagged it as exploited in the wild, unpatched Firebox firewalls are only vulnerable to attacks if configured for IKEv2 VPN. It also warned that even if vulnerable configurations are removed, the firewall may still be at risk if a Branch Office VPN (BOVPN) to a static gateway peer is still configured.
Published
Ukrainian hacker admits affiliate role in Nefilim ransomware gang www.bleepingcomputer.com/news/secu…
A Ukrainian national pleaded guilty on Friday to conducting Nefilim ransomware attacks that targeted high-revenue businesses across the United States and other countries.
The defendant, 35-year-old Artem Aleksandrovych Stryzhak, was arrested in Spain in June 2024 and extradited to the U.S. on April 30, 2025.
Stryzhak has admitted to computer fraud conspiracy charges brought by U.S. prosecutors in connection with ransomware attacks targeting businesses in the United States, Norway, France, Switzerland, Germany, and the Netherlands.
Published
Interpol-led action decrypts 6 ransomware strains, arrests hundreds www.bleepingcomputer.com/news/secu…
An Interpol-coordinated initiative called Operation Sentinel led to the arrest of 574 individuals and the recovery of $3 million linked to business email compromise, extortion, and ransomware incidents.
Between October 27 and November 27, the investigation, which involved law enforcement in 19 countries, took down more than 6,000 malicious links and decrypted six distinct ransomware variants.
Interpol says that the cybercrime cases investigated are connected to more than $21 million in financial losses.
Sourcewww.securityweek.com
Curated
MacSync Stealer, a macOS malware, has updated its distribution method to use a signed Swift application within a disk image, eliminating the need for direct terminal interaction. This new approach, also adopted by the Odyssey infostealer family, allows the malware to appear more legitimate and bypass security measures like Gatekeeper.
Sourcewww.malwarebytes.com
Curated
Following a data breach that exposed a limited set of analytics events for certain Pornhub Premium members, the platform is warning users to expect sextortion emails from cybercriminals. Users are advised not to respond to blackmail demands, to change their passwords, and to enable multi-factor authentication to protect themselves.
Sourcewww.bleepingcomputer.com
Curated
The Romanian water authority was subjected to a ransomware attack over the weekend, impacting approximately 1,000 computer systems across its national and regional offices. While critical operational technology (OT) systems remain unaffected, the investigation is ongoing to identify the attack vector and attribute responsibility.
Sourcebeelzebub.ai
Curated
A Rust-based DDoS botnet exploiting unauthenticated Docker APIs was analyzed. The botnet’s custom bincode C2 protocol was reverse engineered, revealing weaknesses like predictable nonces and lack of encryption. A honeypot was built to monitor the botnet’s activity and track its evolution.
Sourcewww.csoonline.com
Curated
Pirate activists claim to have copied Spotify’s entire music library, including 256 million rows of metadata and 86 million audio files, with some data now available on Annas Archive. Spotify has confirmed it is investigating the incident, stating a third party allegedly accessed public metadata and circumvented DRM to obtain audio files.
Sourcethehackernews.com
Curated
A malicious npm package named lotusbail has been discovered that functions as a WhatsApp API but secretly steals messages, contacts, and login tokens. This package, downloaded over 56,000 times, hijacks the device linking process to maintain persistent access to a victim’s WhatsApp account, even after being uninstalled.
Sourcewww.csoonline.com
Curated
Scammers are increasingly using AI to create fake art documentation, making long-standing fraud easier and faster. To combat this, insurers and appraisers are also employing AI to detect manipulated metadata.
Sourcewww.darkreading.com
Curated
Uzbek users are being targeted by increasingly sophisticated Android SMS stealer malware, distributed via APK files and Telegram, which steals money and credentials. Attackers are improving their distribution and obfuscation tactics, making detection more difficult and operations more mature.
Published
Iranian Infy APT Resurfaces with New Malware Activity After Years of Silence thehackernews.com/2025/12/i…
Threat hunters have discerned new activity associated with an Iranian threat actor known as Infy (aka Prince of Persia), nearly five years after the hacking group was observed targeting victims in Sweden, the Netherlands, and Turkey.
“The scale of Prince of Persia’s activity is more significant than we originally anticipated,” Tomer Bar, vice president of security research at SafeBreach, said in a technical breakdown shared with The Hacker News. “This threat group is still active, relevant, and dangerous.”
Infy is one of the oldest advanced persistent threat (APT) actors in existence, with evidence of early activity dating all the way back to December 2004, according to a report released by Palo Alto Networks Unit 42 in May 2016 that was also authored by Bar, along with researcher Simon Conant.
Published
Chinese Hackers Targeting Cisco Email Gateways www.databreachtoday.com/chinese-h…
Cisco Talos, the manufacturer’s threat intel arm, said Wednesday that hackers have been exploiting since mid-November a zero-day in the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. It attributes the attacks with medium confidence to a Chinese threat actor it tracks as UAT-9686, in part because of overlap in tooling and infrastructure with other Chinese nation-state hacking groups.
The campaign exploits an improper input validation flaw tracked as CVE-2025-20393. Cisco said it became aware of the flaw on Dec. 10 and that there currently exist no workarounds to counter the attacks. If a vulnerable device’s web management console has been exposed to the internet - or if the devices were configured with a spam quarantine feature that opened up the corresponding software port - then Cisco says customers' best bet is to yank the device off the internet.
If it’s too late - if hackers have already gotten in - then “rebuilding the appliances is, currently, the only viable option to eradicate the threat actors persistence mechanism from the appliance,” the company said.
Talos’s assessment is that only appliances “with non-standard configurations” are being hacked.
Published
Testing AI-Orchestrated Attacks in Practice blog.fraktal.fi/testing-a…
In November 2025, Anthropic published a report documenting what they called “the first reported AI-orchestrated cyber espionage campaign”. The attackers had used Claude Code as an autonomous hacking agent, compromising targets with minimal human intervention. According to Anthropic, the AI performed 80–90% of the campaign work, making thousands of requests while humans only intervened at 4–6 critical decision points.
I wanted to see how this would play out in practice. Not with sophisticated tooling or months of preparation, oh no. Just the obvious, lazy approach: have the AI build everything, then tell it to go. Nation-state espionage operation level this isn’t.
The result? 39 minutes of completely autonomous hacking from a standard user shell to Domain Admin. 5 more minutes to own the entire forest.
Published
CISA warns ASUS Live Update backdoor is still exploitable, seven years on www.malwarebytes.com/blog/news…
Recently, the Cybersecurity and Infrastructure Security Agency (CISA) added (along with two others) a vulnerability in ASUS Live Update to its catalog of Known Exploited Vulnerabilities (KEV).
The KEV catalog lists vulnerabilities that are known to be exploited in the wild and sets patch deadlines for Federal Civilian Executive Branch (FCEB) agencies. When CISA adds an issue to this list, it’s a strong signal that exploitation is real, ongoing, and urgent.
The ASUS Live Update Embedded Malicious Code vulnerability, tracked as CVE-2025-59374 (with a CVSS score of 9.3), affects Live Update, a utility commonly used to deliver firmware and software updates to ASUS devices.
Published
Airbus to migrate critical apps to a sovereign Euro cloud www.theregister.com/2025/12/1…
Airbus is preparing to tender a major contract to migrate mission-critical workloads to a digitally sovereign European cloud – but estimates only an 80/20 chance of finding a suitable provider.
The aerospace manufacturer, which has already consolidated its datacenter estate and uses services like Google Workspace, now wants to move key on-premises applications including ERP, manufacturing execution systems, CRM, and product lifecycle management (aircraft designs) to the cloud.
“I need a sovereign cloud because part of the information is extremely sensitive from a national and European perspective,” Catherine Jestin, Airbus’s executive vice president of digital, told The Register. “We want to ensure this information remains under European control.”
The driver is access to new software. Vendors like SAP are developing innovations exclusively in the cloud, pushing customers toward platforms like S/4HANA.
The request for proposals launches in early January, with a decision expected before summer. The contract – understood to be worth more than €50 million – will be long term (up to ten years), with price predictability over the period.
Digital sovereignty has become more critical since Donald Trump’s return to the White House in January. His policies created volatility in trade and geopolitical relations, prompting European customers to reduce reliance on US providers.
While Microsoft, AWS, and Google have created solutions to address these concerns, fears persist about the US CLOUD Act, which allows authorities to request data held by American corporations in overseas datacenters
Published
WatchGuard sounds alarm as critical Firebox flaw comes under active attack www.theregister.com/2025/12/1…
WatchGuard is in emergency patch mode after confirming that a critical remote code execution flaw in its Firebox firewalls is under active attack.
In an advisory published this week, the network security vendor warned customers that attackers are exploiting CVE-2025-32978, a 9.3-rated vulnerability affecting Firebox firewalls. The bug allows unauthenticated attackers to execute arbitrary commands remotely, effectively handing over control of the firewall if the device is reachable over the internet.
WatchGuard said the bug resides in the Fireware OS Internet Key Exchange (IKE) service and can be exploited remotely, without authentication, to execute arbitrary code on vulnerable Firebox devices. The vendor confirmed it has seen the flaw actively exploited in the wild and has released indicators of compromise to help customers assess whether they’ve been hit.
Sourcewww.securityweek.com
Curated
OpenAI is notifying users about a data breach impacting its analytics provider, Mixpanel. The breach exposed limited customer identifiable and analytics information, including names, email addresses, and location, which could be used for phishing attacks. OpenAI has confirmed that its own infrastructure, ChatGPT content, and API data were not compromised.
Sourcewww.bleepingcomputer.com
Curated
Over 25,000 Fortinet devices have been found exposed online with FortiCloud SSO enabled, making them vulnerable to remote attacks targeting a critical authentication bypass flaw. Threat actors are actively exploiting this vulnerability to gain admin-level access and steal sensitive configuration files.
Sourcewww.cybersecuritydive.com
Curated
Senator Tom Cotton is urging the White House to address the risks of open-source software, citing concerns about foreign adversaries tampering with code and the unstable foundations of the open-source ecosystem. He has asked the National Cyber Director to develop a plan to track foreign influence on OSS and contributions from adversary nations.
Sourcethehackernews.com
Curated
A new campaign is distributing CountLoader malware through cracked software downloads, employing a multi-stage attack that includes evasion and delivery of other malware. Separately, GachiLoader malware is being spread via compromised YouTube accounts, utilizing obfuscated JavaScript and advanced techniques like PE injection.