Security. In focus.

Cl0P Ransomware Group Allegedly Claims Breach of Entrust in Oracle 0-Day EBS Hack - Cyber Security News

The Cl0P ransomware group has claimed responsibility for breaching Entrust, a digital security firm, by exploiting a zero-day vulnerability in Oracle E-Business Suite (EBS). While Entrust stated that no customer data was compromised, the breach highlights ongoing risks associated with unpatched enterprise software.

AdNauseam is a unique privacy tool that actively fights surveillance capitalism by polluting the data advertisers rely on. Unlike traditional blockers that simply hide ads, it generates noise to make behavioural profiling unreliable, offering users a rare form of digital resistance.

kiledjian.com/2025/11/1…

The State of Ransomware in Q3 2025 blog.checkpoint.com/research/…

The ransomware landscape in Q3 2025 has reached a critical inflection point. Despite multiple law enforcement takedowns earlier in the year, ransomware attacks remain at historically high levels. Check Point Research tracked 1,592 new victims across 85 active extortion groups, marking a 25% increase year-over-year.

While major brands like RansomHub and 8Base have vanished, new and smaller threat actors have rapidly filled the void, fragmenting the ransomware-as-a-service (RaaS) market more than ever before.

Breaking: Google is easing up on Android’s new sideloading restrictions! www.androidauthority.com/android-p…

TL;DR:

Google is working to make it easier for ‘experienced users’ to install apps made by unverified developers.

The company is building a new ‘advanced flow’ that allows these users to accept the risks of installing unverified apps.

Previously, the only permitted method for experienced users to install apps from unverified developers was to use ADB.

Back in late August, Google announced a major change to Android that angered many enthusiasts and independent developers. Starting next year, Android will block users from installing apps made by unverified developers. The announcement spurred backlash from power users who felt that the new restrictions would effectively kill sideloading. Today, Google announced a major concession to appease these users. The company says it is building a new “advanced flow” that will allow “experienced users to accept the risks of installing software that isn’t verified.”

Suspected Fortinet zero-day exploited in the wild www.pwndefend.com/2025/11/1…

This weeks been an interesting one, I’ve been doing quite a bit of research recently with my friend Simo from Defused defusedcyber.com. Simo has built a new emulated honeypot platform, and anyone that know’s me knows I love honeypots, deception and intel sharing to help defenders and to impose cost on the baddies! (technical terms here ok!)

So what’s the deal? Right so going back a bit, in October a payload was noticed against Fortinet firewall devices. Turns out this may be a zero pay path traversal vulnerability (shocked, a vulnerability in this is unheard of /S).

So this is already public and already being sprayed over the internet, there’s always a concern here when we think about how much intel to share/publish etc. So I’m not going to write the full details but I will give enough to help with detection logic (someone else is free to do more, that’s their own choice!).

This payload appears to create a local ‘admin’ level user account on the target device. I’ve not got a Fortinet firewall running so I’ve not been able to confirm the effect works myself. This is however looking like enough to the point, I believe the vendor has been notified and it looks ‘exploity’ enough for me to even consider writing about this, 0day or not this is being sprayed, we can see this in logs. The key thing as always is to not panic, if you have a Fortinet with an exposed management interface (WHY?) then I would suggest taking some time to go and investigate.

Orgs Move to SSO, Passkeys to Solve Bad Password Habits www.darkreading.com/identity-…

New survey data indicates that organizations are pushing hard for passwordless authentication.

A significant chunk of online account passwords in 2025 remain basic and easy to crack — a fact that will surprise few. But last month, Dark Reading asked readers how their organizations are handling password security these days. The results were, perhaps surprisingly, optimistic.

As we enter the second quarter of the 21st century, rather than applying new Band-Aids to the problem, organizations finally appear to be moving toward a future with few to no passwords at all.

CISA warns feds to fully patch actively exploited Cisco flaws www.bleepingcomputer.com/news/secu…

CISA warned U.S. federal agencies to fully patch two actively exploited vulnerabilities in Cisco Adaptive Security Appliances (ASA) and Firepower devices.

Tracked as CVE-2025-20362 and CVE-2025-20333, these security flaws allow remote threat actors to access restricted URL endpoints without authentication and gain code execution on vulnerable Cisco firewall devices, respectively. If chained, they can enable unauthenticated attackers to gain complete control of unpatched devices remotely.

When it patched the two flaws in September, Cisco cautioned customers that they had been exploited as zero-days in attacks targeting 5500-X Series devices with VPN web services enabled. The company also linked these attacks to the ArcaneDoor campaign, which has exploited two other zero-day bugs (CVE-2024-20353 and CVE-2024-20359) to breach government networks since November 2023.

www.cisa.gov/news-even…

Washington Post data breach impacts nearly 10K employees, contractors www.bleepingcomputer.com/news/secu…

The Washington Post is notifying nearly 10,000 employees and contractors that some of their personal and financial data has been exposed in the Oracle data theft attack.

The news organization is one of the largest daily newspapers in the U.S. with approximately 2.5 million digital subscribers.

Between July 10 and August 22, threat actors accessed parts of its network. They leveraged a vulnerability in Oracle E-Business Suite software that was a zero-day at the time to steal sensitive data.

AdNauseam

AdNauseam is a free browser extension that clicks on blocked ads to obfuscate browsing data and protect users from tracking. It aims to disrupt online advertising and amplify user discontent with privacy-violating advertising networks.

Cybersecurity firm Deepwatch lays off dozens, citing move to ‘accelerate’ AI investment | TechCrunch

Cybersecurity firm Deepwatch has laid off dozens of employees, citing a strategic move to accelerate AI investment and automation. This decision impacts approximately 60 to 80 staff members out of its 250-person workforce, aligning with broader trends of layoffs in the cybersecurity sector.

2B email addresses and 1.3B passwords compromised in data breaches

A recent compilation of data breaches has revealed that approximately 2 billion email addresses and 1.3 billion passwords have been compromised. This extensive collection, identified by cybersecurity expert Troy Hunt, includes over 625 million previously unseen passwords, highlighting the significant risks associated with password reuse across different online services.

CISA Adds Three Known Exploited Vulnerabilities to Catalog www.cisa.gov/news-even…

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2025-9242 WatchGuard Firebox Out-of-Bounds Write Vulnerability CVE-2025-12480 Gladinet Triofox Improper Access Control Vulnerability CVE-2025-62215 Microsoft Windows Race Condition Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

German extremist arrested over operating alleged darknet assassination marketplace therecord.media/german-ex…

German prosecutors have arrested a suspected far-right extremist accused of plotting the assassination of senior politicians through a website on the darknet, authorities said Tuesday.

The 49-year-old German-Polish national, identified only as Martin S., was detained in Dortmund earlier this week, according to the Federal Prosecutor’s Office. He is suspected of creating an online platform used to collect cryptocurrency donations to fund the killings of elected officials he had marked with “death sentences.”

The site also published instructions for making explosives and contained personal information about potential victims. It had reportedly been active since at least June.

Hackers exploited Citrix, Cisco ISE flaws in zero-day attacks www.bleepingcomputer.com/news/secu…

An advanced threat actor exploited the critical vulnerabilities “Citrix Bleed 2" (CVE-2025-5777) in NetScaler ADC and Gateway, and CVE-2025-20337 affecting Cisco Identity Service Engine (ISE) as zero-days to deploy custom malware.

Amazon’s threat intelligence team, analyzing “MadPot” honeypot data, found that hackers leveraged the two security issues before the security issues were disclosed publicly and patches became available.

Citrix Bleed 2 is a NetScaler ADC and Gateway out-of-bounds memory read problem that the vendor published fixes for in late June.

DanaBot malware is back to infecting Windows after 6-month break www.bleepingcomputer.com/news/secu…

The DanaBot malware has returned with a new version observed in attacks, six-months after law enforcement’s Operation Endgame disrupted its activity in May.

According to security researchers at Zscaler ThreatLabz, there is a new variant of DanaBot, version 669, that has a command-and-control (C2) infrastructure using Tor domains (.onion) and “backconnect” nodes.

Zscaler also identified and listed several cryptocurrency addresses that threat actors are using to receive stolen funds, in BTC, ETH, LTC, and TRX.

Hackers abuse Triofox antivirus feature to deploy remote access tools www.bleepingcomputer.com/news/secu…

Hackers exploited a critical vulnerability and the built-in antivirus feature in Gladinet’s Triofox file-sharing and remote-access platform to achieve remote code execution with SYSTEM privileges.

The security issue leveraged in the attack is CVE-2025-12480 and can be used to bypass authentication and obtain access to the application’s setup pages.

Security researchers at Google Threat Intelligence Group (GTIG) discovered the malicious activity on August 24, after a threat cluster tracked internally as UNC6485 targeted a Triofox server running version 16.4.10317.56372, released on April 3.

Russian hacker admits helping Yanluowang ransomware infect companies

A Russian hacker, Aleksey Olegovich Volkov, has admitted to pleading guilty for his role as an initial access broker for the Yanluowang ransomware group. Volkov specialized in gaining unauthorized network access and selling it to ransomware operators, earning over US $256,000 and agreeing to pay US $9 million in restitution. His case highlights the organized structure of the ransomware ecosystem and how cryptocurrency payments can be traced.

Australia’s spy chief warns of China-linked threats to critical infrastructure

Australia’s spy chief, Mike Burgess, has warned that China-linked actors, including the Volt Typhoon APT group, are probing and have gained access to critical infrastructure, posing a threat of cyber sabotage and espionage. These groups are targeting sectors like power, water, and transport, with China reportedly making ambiguous admissions about involvement in similar cyberattacks on U.S. infrastructure.

Judge Rules Flock Surveillance Images Are Public Records That Can Be Requested By Anyone

A Washington judge ruled that images from Flock’s AI license plate-scanning cameras are public records, rejecting the city’s arguments that the data was exempt due to privacy concerns and ownership by the private company. The ruling highlights the extent of surveillance technology and the public’s right to access information collected by such systems. Despite the victory, the requested images were deleted after 30 days, preventing their release.

Phishing Tool Uses Smart Redirects to Bypass Detection

A new phishing tool called Quantum Route Redirect is simplifying social engineering attacks against Microsoft 365 users, allowing less experienced cybercriminals to launch sophisticated campaigns. This tool bypasses security measures through an an intelligent redirect system that differentiates between security tools and human visitors, affecting victims in 90 countries.

Hyundai Data Breach May Have Leaked Drivers' Personal Information

Hyundai is notifying customers of a security breach that may have exposed millions of people’s personal information, including names, driver’s license numbers, and Social Security Numbers. The breach, which occurred at Hyundai AutoEver, lasted over a week and the company is now offering two-year credit-monitoring services to affected individuals.

Another Chinese security firm has its data leaked

A leak of over 12,000 internal documents from Chinese security firm KnownSec has exposed details about its contracts with the Chinese government, developed hacking tools, and a list of intelligence-gathering targets. The leak, which appears to be from 2023, includes information on 28 countries and sensitive data from various entities, such as immigration data from India and call records from South Korea’s LG U-Plus.

Taiwan: Amendment to Personal Data Protection Act - Global Compliance News

Taiwan’s Personal Data Protection Act (PDPA) has been amended, establishing the Personal Data Protection Commission (PDPC) as the new supervisory authority. Key changes include mandatory Data Protection Officers (DPOs) for government agencies, new data breach notification rules for non-government entities, and expanded inspection powers for the PDPC, with implementation expected in 2026.

Chipmaker Patch Tuesday: Over 60 Vulnerabilities Patched by Intel - SecurityWeek

Intel, AMD, and Nvidia have released security advisories detailing over 60 vulnerabilities across their products. These vulnerabilities, ranging in severity, can lead to issues such as denial-of-service attacks, privilege escalation, and information disclosure. While Intel and AMD have issued patches for most of these flaws, AMD has noted that a discontinued product, AMD StoreMi, will not receive patches for identified high-severity privilege escalation issues.

Update now: November Patch Tuesday fixes Windows zero-day exploited in the wild | Malwarebytes

The November Patch Tuesday addresses critical security vulnerabilities in Windows, including a zero-day flaw (CVE-2025-6215) that was actively exploited in the wild to gain admin access. This update also fixes a Remote Code Execution bug (CVE-2025-60724) in the Microsoft Graphics Component, urging users to run Windows Update immediately to ensure their systems are protected.