Daily curated cyber threat intelligence for security professionals.
Sourcewww.helpnetsecurity.com
Curated
A major Cloudflare outage impacted numerous popular websites and services, including X (formerly Twitter) and OpenAI, due to an undisclosed network issue. While Cloudflare has stated the incident is resolved and implemented a fix, some users may still experience intermittent problems.
Published
‘Largest-ever’ cloud DDoS attack pummels Azure with 3.64B packets per second www.theregister.com/2025/11/1…
Azure was hit by the “largest-ever” cloud-based distributed denial of service (DDoS) attack, originating from the Aisuru botnet and measuring 15.72 terabits per second (Tbps), according to Microsoft. On October 24, the Windows giant’s cloud DDoS protection service auto-detected and mitigated the traffic tsunami
More than 500,000 source IPs from various regions flooded a single endpoint with User Datagram Protocol (UDP) packets during the DDoS event, he added. “This was the largest DDoS attack ever observed in the cloud and it targeted a single endpoint in Australia,” Whalen wrote, noting that the Aisuru botnet was behind the network flood.
Published
Cursor Issue Paves Way for Credential-Stealing Attacks www.darkreading.com/vulnerabi…
An inherent insecurity in the increasingly popular artificial intelligence (AI)-powered developer environment Cursor allows attackers to take over its browser to deliver credential-stealing attacks. The flaw allows for JavaScript injection to circumvent Cursor’s own controls, and demonstrates a threat to the overall agentic AI-assisted developer ecosystem.
Researchers at cybersecurity vendor Knostic discovered the attack vector, which exploits Cursor’s failure to perform integrity checks on features specific to the development environment, according to a recent blog post. Other coding environments, such as Visual Studio (VS) Code, perform these checks and, thus, add a security layer the Cursor AI environment doesn’t have.
“That difference makes Cursor’s runtime components a higher-risk target for tampering,” Knostic researcher Dor Munis wrote in the post. Indeed, researchers have discovered various weaknesses and flaws in these emerging AI-assisted developer tools that pose new threats to the software development supply chain.
Published
Eurofiber France warns of breach after hacker tries to sell customer data www.bleepingcomputer.com/news/secu…
Eurofiber France disclosed a data breach it discovered late last week when hackers gained access to its ticket management system by exploiting a vulnerability and exfiltrated information. Eurofiber France SAS is the French unit of the Eurofiber Group N.V., a Dutch telecommunications service provider that operates a fiber network of 76,000 km across the Netherlands, Belgium, France, and Germany.
The company specializes in providing digital infrastructure for businesses, rather than the consumer market. The cybersecurity incident impacts only the French division of the group, the company says in the announcement, including its cloud division (ATE portal) and its regional Eurafibre, FullSave, Netiwan, and Avelia sub-brands.
In a press release, the company states that the impact is minimal for indirect sales and wholesale partners in France, as most of them rely on separate systems.
Published
New EVALUSION ClickFix Campaign Delivers Amatera Stealer and NetSupport RAT thehackernews.com/2025/11/n…
Cybersecurity researchers have discovered malware campaigns using the now-prevalent ClickFix social engineering tactic to deploy Amatera Stealer and NetSupport RAT. The activity, observed this month, is being tracked by eSentire under the moniker EVALUSION.
First spotted in June 2025, Amatera is assessed to be an evolution of ACR (short for “AcridRain”) Stealer, which was available under the malware-as-a-service (MaaS) model until sales of the malware were suspended in mid-July 2024. Amatera is available for purchase via subscription plans that go from $199 per month to $1,499 for a year.
“Amatera provides threat actors with extensive data exfiltration capabilities targeting crypto-wallets, browsers, messaging applications, FTP clients, and email services,” the Canadian cybersecurity vendor said. “Notably, Amatera employs advanced evasion techniques such as WoW64 SysCalls to circumvent user-mode hooking mechanisms commonly used by sandboxes, Anti-Virus solutions, and EDR products.”
Published
Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem cloud.google.com/blog/topi…
Last year, Mandiant published a blog post highlighting suspected Iran-nexus espionage activity targeting the aerospace, aviation, and defense industries in the Middle East. In this follow-up post, Mandiant discusses additional tactics, techniques, and procedures (TTPs) observed in incidents Mandiant has responded to.
Since mid-2024, Mandiant has responded to targeted campaigns by the threat group UNC1549 against the aerospace, aviation and defense industries. To gain initial access into these environments, UNC1549 employed a dual approach: deploying well-crafted phishing campaigns designed to steal credentials or deliver malware and exploiting trusted connections with third-party suppliers and partners.
The latter technique is particularly strategic when targeting organizations with high security maturity, such as defense contractors. While these primary targets often invest heavily in robust defenses, their third-party partners may possess less stringent security postures. This disparity provides UNC1549 a path of lesser resistance, allowing them to circumvent the primary target’s main security controls by first compromising a connected entity.
Published
Dutch police seizes 250 servers used by “bulletproof hosting” service www.bleepingcomputer.com/news/secu…
The police in the Netherlands have seized around 250 physical servers powering a bulletproof hosting service in the country used exclusively by cybercriminals for providing complete anonymity. Politie, the police force in the Netherlands, did not name the service but said that it has been used for illicit activities since 2022, and has emerged in more than 80 cybercrime investigations, both domestic and abroad.
Bulletproof hosting providers are companies that intentionally ignore abuse reports and refuse to comply with content takedowns requests from law enforcement while protecting their customers by not enforcing Know Your Customer policies. Cybercriminals that typically use them are ransomware operators, malware distributors, phishing actors, and spammers, as well as money laundering services that get to remain anonymous by paying in difficult-to-trace cryptocurrency.
Published
Microsoft: Windows 10 KB5068781 ESU update may fail with 0x800f0922 errors www.bleepingcomputer.com/news/micr…
Microsoft has confirmed it is investigating a bug causing the Windows 10 KB5068781 extended security update to fail to install with 0x800f0922 errors on devices with corporate licensing. KB5068781 is the first Windows 10 extended security update and was released on November 11 as part of Patch Tuesday. Since then, some business Windows 10 users have reported that the KB5068781 update is failing to install on certain devices.
“We are currently experiencing the same issue with this KB5068781 across our managed Win10 devices, despite purchasing and applying the ESU license (MAK key) to all our devices,” wrote a BleepingComputer reader.
“The update appears to install successfully, but after a restart, it fails to apply and rolls back with the common error 0x800f0922.”
Microsoft has now confirmed that they are aware of and investigating the issue, stating it only impacts Windows subscription activation through the Microsoft 365 Admin Center.
Published
Hardened Containers Look to Eliminate Common Source of Vulnerabilities www.darkreading.com/applicati…
Containerization technology makes software development and cloud deployment easier, but the images that are the foundation of the ecosystem commonly have unnecessary components and hundreds of vulnerabilities. A Chainguard study, for example, found that popular Debian-based Docker images had 280 vulnerabilities, on average, while a study published by NetRise and based on a randomly selected sample of 70 different images found that the average container had 604 vulnerabilities.
The massive vulnerability counts are a side effect of how images are often created — starting with a containerized Linux distribution and adding on other software. The aim is just to make the technology work, says Michael Donovan, vice president of product at Docker.
“What has sort of powered all these container workloads across the industry for over a decade has been the inclusion of a bunch of software that just didn’t need to be there,” Donovan says. “Most developers don’t really understand all the different system packages … you just want your application to work.”
Published
ShadowMQ: How Code Reuse Spread Critical Vulnerabilities Across the AI Ecosystem www.oligo.security/blog/shad…
In the race to make the adoption of AI faster, it is necessary to make AI infrastructure safer. Over the past year, Oligo Security’s research team disclosed a series of critical Remote Code Execution (RCE) vulnerabilities lurking inside some of the most widely used AI inference servers, including frameworks from Meta, NVIDIA, Microsoft, and PyTorch projects like vLLM and SGLang.
These vulnerabilities all traced back to the same root cause: the overlooked unsafe use of ZeroMQ (ZMQ) and Python’s pickle deserialization. But what surprised us the most wasn’t the bug itself. It was how it spread. As we dug deeper, we found that code files were copied between projects (sometimes line-for-line) carrying dangerous patterns from one repository to the next.
We call this pattern ShadowMQ: a hidden communication-layer flaw propagated through code reuse in the modern AI stack.
Published
4 Americans plead guilty to helping North Korean scammers earn over $2 million from dozens of companies www.politico.com/news/2025…
Four Americans and one Ukrainian national have pleaded guilty to helping North Koreans pose as remote information technology employees to infiltrate U.S. companies and generate millions of dollars in income for Pyongyang’s weapons program.
The yearslong ploy impacted at least 136 U.S. companies and generated over $2.2 million in revenue, the Justice Department announced Friday. The announcement is part of a larger effort by the U.S. and its allies to crack down on the widespread remote IT worker scheme, which has impacted firms around the world, including many Fortune 500 companies.
In Georgia, U.S. nationals Audricus Phagnasay, Jason Salazar and Alexander Paul Travis each pleaded guilty this week to one count of wire fraud conspiracy after they allegedly allowed North Korean scammers to use their identities to secure employment at U.S. companies. They are also accused of helping these fake North Korean job-seekers pass employer vetting procedures and keeping employer-provided laptops in their homes.
Published
RondoDox Exploits Unpatched XWiki Servers to Pull More Devices Into Its Botnet thehackernews.com/2025/11/r…
The botnet malware known as RondoDox has been observed targeting unpatched XWiki instances against a critical security flaw that could allow attackers to achieve arbitrary code execution.
The vulnerability in question is CVE-2025-24893 (CVSS score: 9.8), an eval injection bug that could allow any guest user to perform arbitrary remote code execution through a request to the “/bin/get/Main/SolrSearch” endpoint. It was patched by the maintainers in XWiki 15.10.11, 16.4.1, and 16.5.0RC1 in late February 2025.
While there was evidence that the shortcoming had been exploited in the wild since at least March, it wasn’t until late October, when VulnCheck disclosed it had observed fresh attempts weaponizing the flaw as part of a two-stage attack chain to deploy a cryptocurrency miner.
Sourceindustrialcyber.co
Curated
The Industrial Cyber Days: Critical Infrastructure 2025 event highlighted a significant shift in cyber-physical resilience, emphasizing practical steps, collaboration, and engineered resilience over abstract models. Key takeaways include the critical need for specialized OT security roles, understanding operational consequences, and deepening visibility into IT/OT convergence to effectively manage evolving threat landscapes and supply chain risks.
Sourcewww.cisa.gov
Curated
CISA is aware of exploitation of a relative path traversal vulnerability (CVE-2025-64446) affecting Fortinet FortiWeb products. This vulnerability allows an unauthenticated actor to execute administrative commands via crafted requests, and Fortinet recommends applying necessary upgrades to affected versions.
Sourcewww.cyber.gc.ca
Curated
The Canadian Centre for Cyber Security has issued security advisory AV25-759 regarding vulnerabilities in Cisco Catalyst Center Hardware Appliance and Virtual Appliance versions prior to 2.3.7.10. Users and administrators are advised to review the advisory, implement suggested mitigations, and apply necessary updates.
Sourceunit42.paloaltonetworks.com
Curated
Two interconnected malware campaigns in 2025 used large-scale brand impersonation to distribute the Gh0st remote access Trojan (RAT) to Chinese-speaking users, evolving from simple droppers to complex, multi-stage infection chains that misuse legitimate software to bypass defenses. The campaigns show a clear operational playbook with characteristics like programmatic infrastructure generation, a focus on the Chinese demographic, and a rapid, disposable infrastructure deployment strategy.
Sourcewww.csoonline.com
Curated
A coordinated token farming campaign continues to flood the npm registry with tens of thousands of infected packages daily, aiming to steal Tea tokens by inflating download numbers. This worm, dubbed IndonesianFoods, has grown significantly since its initial discovery, highlighting a major crisis in open source supply chain security.
Sourcesecurityaffairs.com
Curated
Multiple vulnerabilities in GoSign Desktop allow for Remote Code Execution and Privilege Escalation due to disabled TLS certificate validation and an unsigned update mechanism. A fix was released in version 2.4.1, but the TLS validation issue remains unresolved.
Sourcewww.govinfosecurity.com
Curated
Google has sued the Chinese-speaking operators of the Lighthouse Smishing Campaign, a phishing-as-a-service operation responsible for over 100 counterfeit website templates and affecting more than 1 million victims globally. The lawsuit aims to deter the prolific service, which has been used to steal credentials, financial information, and credit card details from millions of individuals.
Sourcewww.govinfosecurity.com
Curated
The cybercrime gang Kazu is threatening to publish 353 gigabytes of data allegedly stolen from Doctor Alliance, a tech firm providing services to physician practices. Doctor Alliance is investigating the claims, stating they identified unauthorized access to a single client account and are working with security experts, while Kazu demands a $200,000 ransom.
Sourcewww.govinfosecurity.com
Curated
The DOJ has secured guilty pleas and over $15 million in civil forfeiture as part of a crackdown on North Korea’s cyber schemes. U.S. facilitators aided North Korean IT workers in obtaining remote tech jobs at U.S. companies using stolen identities, generating millions for the regime and affecting over 136 victim firms.
Sourcewww.somaliguardian.com
Curated
Somalia’s controversial e-visa system suffered a major cyberattack, compromising personal data of over 35,000 applicants, including Western nationals, raising security concerns and exacerbating turmoil. This data breach coincides with an escalating dispute with Somaliland over airspace and visa authority, further destabilizing the region.
Sourcewww.cyber.gc.ca
Curated
The Canadian Centre for Cyber Security has issued Splunk security advisory AV25-754, detailing vulnerabilities in multiple versions of Splunk Enterprise and Splunk Cloud Platform. Users and administrators are advised to review the advisory and apply necessary updates to address issues such as open redirects and risky command safeguards bypass.
Sourcewww.cyber.gc.ca
Curated
Microsoft Edge Stable Channel versions prior to 142.0.3595.80 have vulnerabilities addressed in a security update published on November 13, 2025. The Cyber Centre advises users and administrators to review the update and apply it.
Sourcewww.sentinelone.com
Curated
A Russian national has pleaded guilty to acting as an initial access broker for Yanluowang ransomware attacks, while an international effort called Operation Endgame dismantled over 1000 servers linked to infostealers and botnets. Additionally, a critical vulnerability in Gladinet Triofox (CVE-2025-12480) allowed for remote code execution, and The Washington Post is notifying nearly 10,000 individuals about a data breach involving Oracle software (CVE-2025-61884), suspected to be carried out by the Cl0p ransomware operation.