Security. In focus.

LongNosedGoblin Caught Snooping on Asian Governments

A new China-aligned APT group, dubbed LongNosedGoblin, has been conducting cyber-espionage against governments in Southeast Asia and Japan since at least 2023, utilizing custom C#/.NET applications and notably abusing Group Policy for malware deployment and lateral movement.

Code audit for the Tor Project completed by 7aSecurity | The Tor Project

The Tor Project has completed a code audit conducted by 7aSecurity on tools used to monitor the health of the Tor network, identifying six vulnerabilities and eleven hardening recommendations. The audit covered various projects including TagTor, DescriptorParser, Margot, Exitmap, Tor_fusion, Simple Bandwidth Scanner, C Tor, and Arti.

Smart TV manufacturer ordered to stop collecting viewer data while court case proceeds in Texas | The Record from Recorded Future News

A Texas judge has issued a temporary restraining order against Hisense, a smart TV manufacturer, to halt the collection of viewer data from state residents. This order comes amid a lawsuit alleging Hisense uses automated content recognition (ACR) technology to record viewing habits without consent, potentially violating Texas law and exposing data to foreign entities.

Rockrose Development suffers security breach affecting 47,000 people | Cybersecurity Dive

Rockrose Development suffered a security breach on July 4, impacting 47,392 people by potentially exposing sensitive personally identifiable information. The company discovered the breach on November 14 and has since implemented enhanced cybersecurity safeguards.

State-linked and criminal hackers use device code phishing against M365 users | Cybersecurity Dive

State-linked and criminal hackers are increasingly using device code phishing to target Microsoft 365 users, abusing a legitimate authorization workflow to gain account access. Threat groups, including those affiliated with China and Russia, are employing tools like SquarePhish2 and Graphish to execute these attacks, with some actors even selling malicious tools on hacking forums.

New cybersecurity laws and trends in 2026 | Kaspersky official blog

In 2026, new cybersecurity laws and trends will require users to understand local legislation, master secure access methods like VPNs, and brace for document leaks due to increased age verification. Users should also learn new scammer tactics, cultivate healthy AI usage habits, audit subscriptions, prioritize tech longevity, and secure their smart homes.

Fears thousands of confidential documents were leaked in Foreign Office hack | The Independent

The Foreign Office experienced a cyber attack two months ago, with fears that thousands of confidential documents, including visa details, were leaked. Ministers are reportedly confident that visa applicants' information was not compromised, and no individuals were harmed, although the incident is linked to a Beijing-linked cyber gang and raises concerns about Chinese spying and UK national security.

Government data stolen in hack, minister confirms

Trade Minister Chris Bryant confirmed that government data was stolen in a hack, though he believes the risk to individuals is low; a Chinese-affiliated group is suspected, and investigations are ongoing. The incident, which may have targeted visa details, has been referred to the Information Commissioner’s Office, and intelligence agencies have warned of increasing espionage from China.

Clop ransomware targets Gladinet CentreStack in data theft attacks

The Clop ransomware gang is actively targeting Gladinet CentreStack file servers exposed online in a new data theft campaign, exploiting an unknown vulnerability that could be a zero-day or an unpatched bug. This follows Clop’s history of exploiting secure file transfer products to steal and leak sensitive data.

Clop ransomware targets Gladinet CentreStack in data theft attacks

The Clop ransomware gang is actively targeting Gladinet CentreStack file servers exposed online in a new data theft campaign, exploiting an unknown vulnerability that could be a zero-day or an unpatched bug. This follows Clop’s history of exploiting secure file transfer products to steal and leak sensitive data.

New China-linked hacker group spies on governments in Southeast Asia, Japan | The Record from Recorded Future News

A newly identified, China-aligned hacker group named LongNosedGoblin has been observed spying on governments in Southeast Asia and Japan since at least September 2023. This group uniquely leverages Group Policy, a Windows feature, to deploy malware like NosyHistorian, which steals browser data to identify high-value targets for further compromise with tools such as the backdoor NosyDoor.

HPE OneView vulnerable to remote code execution attack | CSO Online

A critical remote code execution vulnerability (CVE-2025-37164) has been discovered in HPE OneView, affecting all versions between 5.20 and 10.20. This vulnerability can be exploited by an unauthenticated user, and there is no workaround, necessitating the immediate application of a hotfix provided by HPE.

North Korea’s Digital Surge: $2B Stolen in Crypto as Amazon Blocks 1,800 Fake IT Workers - SecurityWeek

North Korea has escalated its digital operations, stealing over $2 billion in cryptocurrency in 2025, a record high, according to Chainalysis. Concurrently, Amazon has blocked 1,800 fake IT workers from North Korea attempting to secure remote jobs through identity fraud, highlighting a sophisticated scheme to fund the sanctioned regime.

Nigeria Arrests RaccoonO365 Phishing Developer Linked to Microsoft 365 Attacks

Authorities in Nigeria have arrested the main developer behind the RaccoonO365 phishing-as-a-service (PhaaS) scheme, identified as Okitipi Samuel, who allegedly operated a Telegram channel to sell phishing links and host fraudulent login portals. This operation, a collaboration between the Nigeria Police Force, Microsoft, and the FBI, targeted Microsoft 365 accounts and is linked to the theft of at least 5,000 credentials from 94 countries.

‘Kimwolf’ Android Botnet Ensnares 1.8 Million Devices - SecurityWeek

A new Android botnet named Kimwolf has infected over 1.8 million devices and is capable of launching massive DDoS attacks. This botnet, primarily targeting Android TV set-top boxes, is linked to the Aisuru botnet and has been observed issuing billions of DDoS attack commands.

University of Sydney Data Breach Affects 27,000 Individuals  - SecurityWeek

The University of Sydney experienced a data breach affecting approximately 27,500 individuals, including current and former staff, alumni, and students. Hackers accessed personal information from an online code library, though there is currently no evidence of misuse. The university is investigating the incident and notifying affected parties.

AI Advertising Company Hacked - Schneier on Security

The AI advertising company Doublespeed, which manages hundreds of AI-generated social media accounts using a phone farm, has been hacked. The hack exposed the products promoted by these accounts, often without disclosure, and gave the hacker control over more than 1,000 smartphones. The hacker reported the vulnerability on October 31 and still had backend access at the time of writing.

Denmark blames Russia for destructive cyberattack on water utility

Denmark has blamed Russia for a destructive cyberattack on a water utility, identifying Z-Pentest and NoName057(16) as state-backed groups involved in hybrid warfare. These attacks aim to create insecurity and undermine Western support for Ukraine, with Danish officials summoning the Russian ambassador for explanations.

Stealth in Layers: Unmasking the Loader used in Targeted Email Campaigns

This analysis details a sophisticated commodity loader used in targeted email campaigns against Manufacturing and Government organizations in Italy, Finland, and Saudi Arabia. The campaign employs advanced techniques like steganography and trojanized libraries, delivering Remote Access Trojans (RATs) and Infostealers through a four-stage evasion pipeline and a novel UAC bypass.

Reuters reports that Chinese scientists in Shenzhen have built a prototype extreme ultraviolet (EUV) lithography machine — the class of tool required to manufacture the most advanced semiconductors used in AI, smartphones and modern defence systems. Sources say the prototype was completed in early 2025, is generating EUV light and is now undergoing testing, but has not yet produced working chips. China’s internal target is 2028; sources closer to the effort suggest 2030 is more realistic.

If confirmed, it would indicate faster-than-expected progress toward semiconductor self-sufficiency despite years of export controls aimed at limiting access to EUV and related equipment. The report also highlights the remaining bottlenecks: replicating the precision optics and achieving the reliability and contamination control needed for production-grade chipmaking. For global technology leaders, the strategic takeaway is clear — the semiconductor supply chain is increasingly shaped by resilience planning, sovereignty objectives and long-horizon geopolitical competition.

Reuters

16.4 million could be affected in giant French hack | Insurance Business

France is investigating a malicious intrusion into its Ministry of the Interior systems, with a poster on BreachForums claiming access to data on over 16.4 million people. While authorities are working to determine the extent of the breach, they have confirmed that sensitive databases like the Criminal Records Processing System (TAJ) and the Wanted Persons File (FPR) were accessed, and a suspect has been arrested.

‘Pay The Ransom Or…’: Hackers Warn Pornhub Data Leak Could Turn Ugly For Premium Users | Tech News - News18

Hackers from the group ShinyHunters have leaked Pornhub data and are demanding a ransom in Bitcoin to prevent further publication of premium user information. The authenticity of the leaked data has been confirmed, and Pornhub has disclosed the breach but has not yet addressed the ransom demand.

Bennett concedes cyber breach after Iranian hackers leak private chats

Former prime minister Naftali Bennett has confirmed a cyber breach of his Telegram account after an Iranian-linked hacker group, Handala, leaked private chats and phone numbers of Israeli officials and world leaders. The hackers, who dubbed the breach “Operation Octopus,” claimed affiliation with Iran’s intelligence apparatus, though this has not been publicly confirmed by Israeli officials.

UAT-9686 actively targets Cisco Secure Email Gateway and Secure Email and Web Manager blog.talosintelligence.com/uat-9686/

Cisco Talos recently discovered a campaign targeting Cisco AsyncOS Software for Cisco Secure Email Gateway, formerly known as Cisco Email Security Appliance (ESA), and Cisco Secure Email and Web Manager, formerly known as Cisco Content Security Management Appliance (SMA).

We assess with moderate confidence that the adversary, who we are tracking as UAT-9686, is a Chinese-nexus advanced persistent threat (APT) actor whose tool use and infrastructure are consistent with other Chinese threat groups.

As part of this activity, UAT-9686 deploys a custom persistence mechanism we track as “AquaShell” accompanied by additional tooling meant for reverse tunneling and purging logs.

Our analysis indicates that appliances with non-standard configurations, as described in Cisco’s advisory, are what we have observed as being compromised by the attack.

NATO’s battle for cloud sovereignty: Speed is existential www.theregister.com/2025/12/1…

NATO is in an existential race to develop sovereign cloud-based technologies to underpin its mission, the alliance’s Assistant Secretary General for Cyber and Digital Transformation told an audience at the Royal United Services Institute (RUSI) last week.

Jean-Charles Ellermann-Kingombe said the Ukraine war has highlighted the impact of technology on the battlefield, from drones to AI for targeting. Likewise, it shows the need for a coherent, secure approach to data and similarly coherent and secure cloud platforms to store and process it.