Security. In focus.

High-Severity Vulnerabilities Patched by Ivanti and Zoom - SecurityWeek

Ivanti and Zoom have released patches for several vulnerabilities, including high-severity issues that could allow for arbitrary file writes and code execution. Ivanti addressed three bugs in Endpoint Manager (EMP) that could lead to remote code execution or privilege escalation, while Zoom fixed three high-severity flaws in its mobile and desktop clients, potentially enabling privilege escalation.

Synnovis Notifying UK Providers of Data Theft in 2024 Attack

British pathology firm Synnovis is notifying healthcare providers of a data breach stemming from a June 2024 ransomware attack, after a complex forensics review. The attack, claimed by the Qilin ransomware group, disrupted patient care and led to blood shortages, with some stolen data including patient information and test results.

ClickFix may be the biggest security threat your family has never heard of arstechnica.com/security/…

Over the past year, scammers have ramped up a new way to infect the computers of unsuspecting people. The increasingly common method, which many potential targets have yet to learn of, is quick, bypasses most endpoint protections, and works against both macOS and Windows users.

ClickFix often starts with an email sent from a hotel that the target has a pending registration with and references the correct registration information. In other cases, ClickFix attacks begin with a WhatsApp message. In still other cases, the user receives the URL at the top of Google results for a search query. Once the mark accesses the malicious site referenced, it presents a CAPTCHA challenge or other pretext requiring user confirmation. The user receives an instruction to copy a string of text, open a terminal window, paste it in, and press Enter.

Once entered, the string of text causes the PC or Mac to surreptitiously visit a scammer-controlled server and download malware. Then, the machine automatically installs it—all with no indication to the target. With that, users are infected, usually with credential-stealing malware. Security firms say ClickFix campaigns have run rampant. The lack of awareness of the technique, combined with the links also coming from known addresses or in search results, and the ability to bypass some endpoint protections are all factors driving the growth.

GootLoader Is Back, Using a New Font Trick to Hide Malware on WordPress Sites thehackernews.com/2025/11/g…

The malware known as GootLoader has resurfaced yet again after a brief spike in activity earlier this March, according to new findings from Huntress.

The cybersecurity company said it observed three GootLoader infections since October 27, 2025, out of which two resulted in hands-on keyboard intrusions with domain controller compromise taking place within 17 hours of initial infection.

“GootLoader is back and now leveraging custom WOFF2 fonts with glyph substitution to obfuscate filenames,” security researcher Anna Pham said, adding the malware “exploits WordPress comment endpoints to deliver XOR-encrypted ZIP payloads with unique keys per file.”

GootLoader, affiliated with a threat actor tracked as Hive0127 (aka UNC2565), is a JavaScript-based malware loader that’s often distributed via search engine optimization (SEO) poisoning tactics to deliver additional payloads, including ransomware.

GlassWorm Returns, Slices Back into VS Code Extensions www.darkreading.com/cyberatta…

GlassWorm, a self-propagating malware targeting Visual Studio Code (VS Code) extensions on the Open VSX marketplace, have apparently continued despite statements that the threat had been contained.

Researchers at Koi Security reported their discovery of GlassWorm last month, highlighting the worm’s sophistication as well as its compromise of approximately 35,800 developer machines. The malware is similar to Shai-hulud, an NPM package worm discovered earlier this year that established itself as a particularly worrisome supply chain threat. The malware, first reported in September, spread to hundreds of open source software packages, stealing credentials without much attacker input to speak of.

OWASP Highlights Supply Chain Risks in New Top 10 List www.darkreading.com/applicati…

OWASP has updated its list of Top 10 software vulnerabilities to align it better with the current threat landscape and modern development practices.

The Nov. 6 release is OWASP’s first major Top 10 update since 2021 and is notable for its emphasis on supply chain risks and systemic design weakness rather than just common software coding errors. For defenders, the key takeaway is the need to integrate application security, software supply chain oversight, and operational resilience practices more tightly together.

CISA orders feds to patch Samsung zero-day used in spyware attacks www.bleepingcomputer.com/news/secu…

CISA ordered U.S. federal agencies today to patch a critical Samsung vulnerability that has been exploited in zero-day attacks to deploy LandFall spyware on devices running WhatsApp.

Tracked as CVE-2025-21042, this out-of-bounds write security flaw was discovered in Samsung’s libimagecodec.quram.so library, allowing remote attackers to gain code execution on devices running Android 13 and later.

While Samsung patched it in April following a report from Meta and WhatsApp Security Teams, Palo Alto Networks' Unit 42 revealed last week that attackers had been exploiting it since at least July 2024 to deploy previously unknown LandFall spyware via malicious DNG images sent over WhatsApp.

Quantum Route Redirect PhaaS targets Microsoft 365 users worldwide www.bleepingcomputer.com/news/secu…

A new phishing automation platform named Quantum Route Redirect is using around 1,000 domains to steal Microsoft 365 users' credentials.

The kit comes pre-configured with phishing domains to allow less skilled threat actors to achieve maximum results with the least effort.

Since August, analysts at security awareness company KnowBe4 have noticed Quantum Route Redirect (QRR) attacks in the wild across a wide geography, although nearly three-quarters are located in the U.S.

APT37 hackers abuse Google Find Hub in Android data-wiping attacks www.bleepingcomputer.com/news/secu…

North Korean hackers are abusing Google’s Find Hub tool to track the GPS location of their targets and remotely reset Android devices to factory settings.

The attacks are primarily targeting South Koreans, and start by approaching the potential victims over KakaoTalk messenger - the most popular instant messaging app in the country.

South Korean cybersecurity solutions company Genians links the malicious activity to a KONNI activity cluster, which “has overlapping targets and infrastructure with Kimsuky and APT37.”

GlobalLogic warns 10,000 employees of data theft after Oracle breach www.bleepingcomputer.com/news/secu…

GlobalLogic, a provider of digital engineering services part of the Hitachi group, is notifying over 10,000 current and former employees that their data was stolen in an Oracle E-Business Suite (EBS) data breach.

Based in Santa Clara, California, this software and product development services company was founded in 2000. Since then, it has expanded to 59 product engineering centers and several offices worldwide.

In a breach notification letter filed with the office of Maine’s Attorney General, the company states that the attackers exploited an Oracle EBS zero-day vulnerability to steal personal information belonging to 10,471 employees.

Iranian-backed Cyber Toufan Hacks Israeli Defense Contractors, Leaks Classified Australian Military Plans - SSBCrack News

The Iranian-backed hacking group Cyber Toufan has breached 17 Israeli defense contractors, leaking classified Australian military plans for the AS21 Redback infantry fighting vehicle. This cyberattack, which exploited the supply chain company MAYA Technologies, has resulted in the online release of sensitive documents, 3D models, and blueprints, impacting major firms like Elbit Systems and potentially Rafael Advanced Defense Systems.

Tehran-Linked Hacking Group Leaks Technical Designs of Australia’s $7 Billion Armored Vehicles - Iran Focus

A Tehran-linked hacking group, Cyber Tornado, has allegedly leaked the technical designs of Australia’s $7 billion armored vehicles, the Redback infantry fighting vehicles. The group, which claims ties to Hamas and the Iranian regime, reportedly obtained the data by breaching Israeli defense companies.

Healthcare firm apparently hit by major cyberattack exposing over a million medical records - how to find out if you’re affected | TechRadar

A cyberattack has allegedly impacted Doctor Alliance, a healthcare firm, with a threat actor claiming to have stolen 1.24 million sensitive health files. The compromised data reportedly includes prescriptions, diagnoses, and personal contact information, posing significant risks of fraud, extortion, and identity theft for affected individuals.

CISA Adds One Known Exploited Vulnerability to Catalog: Samsung Mobile Devices Out-of-Bounds Write Vulnerability www.cisa.gov/news-even…

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2025-21042 Samsung Mobile Devices Out-of-Bounds Write Vulnerability
This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

Threat Hunting vs. Threat Intelligence www.recordedfuture.com/blog/thre…

Threat intelligence and threat hunting are two cornerstone practices in modern cybersecurity, serving different but complementary roles. At the most basic level, threat intelligence is about understanding threats outside the organization, while threat hunting is the active pursuit of threats already within an organization’s network or systems.

The two functions work best in tandem, but because they are so closely related, they are often misunderstood or conflated. However, the stakes for getting it right are high—cyber threats are growing more advanced and costly, with the global average cost of a data breach reaching $4.4 million. Organizations that invest in both proactive threat hunting and a well-developed threat intelligence program are better positioned to improve security, decision-making, and incident preparedness. And understanding the distinction between the two helps security leaders leverage the right teams and processes for each.

Hack halts Dutch broadcaster, forcing radio hosts back to LPs www.bitdefender.com/en-us/blo…

A Dutch TV and radio broadcaster has found itself at the mercy of cybercriminals after suffering a cyber attack, and leaving it scrambling to find ways to play music to its listeners.

RTV Noord, which provides TV and radio programming in the northern province of Groningen in the Netherlands, discovered it had been hacked on November 6, 2025.

On Thursday morning, staff on the “De Ochtendploeg” breakfast show discovered their access to computer systems was blocked, forcing them to resort to manually playing CDs, and even putting LP vinyl records on a turntable to keep listeners entertained.

ClickFix Campaign Targets Hotels, Spurs Secondary Customer Attacks www.darkreading.com/cyberatta…

Researchers have uncovered a broad campaign in which threat actors target hotels with ClickFix attacks to steal customer data as part of ongoing attacks against the hospitality sector that includes secondary attacks against the establishments' customers.

Threat analysts at Sekoia.io uncovered the activity when a partner alerted them to a phishing campaign that used either emails sent from a hotel’s compromised Booking.com account or messages in WhatsApp, according to a report published Friday. Attackers had customer data, including personal identifiers and reservation details, which made their phishing attempts appear more legitimate.

After further analysis, the researchers realized the activity was part of a much broader campaign that started around April and was still active up to at least October involving a ClickFix attack spreading infostealing malware that targeted hotels and other lodging establishments, they said. The campaign enabled the theft of professional credentials granting access to booking platforms, such as Booking.com and Expedia.

5 reasons why attackers are phishing over LinkedIn www.bleepingcomputer.com/news/secu…

Phishing attacks are no longer confined to the email inbox, with 34% of phishing attacks now taking place over non-email channels like social media, search engines, and messaging apps.

LinkedIn in particular has become a hotbed for phishing attacks, and for good reason. Attackers are running sophisticated spear-phishing attacks against company executives, with recent campaigns seen targeting enterprises in financial services and technology verticals.

But phishing outside of email remains severely underreported — not exactly surprising when we consider that most of the industry’s phishing metrics come from email security tools.

Your initial thought might be “why do I care about employees getting phished on LinkedIn?” Well, while LinkedIn is a personal app, it’s routinely used for work purposes, accessed from corporate devices, and attackers are specifically targeting business accounts like Microsoft Entra and Google Workspace.

So, LinkedIn phishing is a key threat that businesses need to be prepared for today. Here’s 5 things you need to know about why attackers are going phishing on LinkedIn — and why it’s so effective.

1: It bypasses traditional security tools

2: It’s cheap, easy, and scalable for attackers

3: Easy access to high-value targets

4: Users are more likely to fall for it

5: The potential rewards are huge

Nationwide U.S. government shutdown – travel and service impacts The continuing U.S. federal government shutdown is expected to last into at least early November and is already affecting selected services and parts of the transport system. Travellers and organizations with U.S. exposure should expect sustained operational friction rather than a single one-day disruption. The Federal Aviation Administration plans to cut capacity by up to 10 per cent at 40 major airports, with an initial four per cent reduction ramping up over several days. Commercial flights are still operating, but thousands of domestic services are likely to face delays, schedule changes or cancellations. Some airports, including Nashville International, have already reduced flight volumes due to air traffic controller shortages, and staffing pressures are also reported at Newark, Denver, Dallas–Fort Worth, Chicago O’Hare and Philadelphia. International flights are generally expected to continue, and major U.S. carriers are offering flexible rebooking and refund options. Beyond aviation, the shutdown is disrupting several federally funded services, including some food inspection and assistance programs, national park operations and the release of key economic data. Essential personnel in border protection, law enforcement and in-hospital healthcare remain on duty, but rising staff absences could degrade service levels over time. Public transit, Amtrak and most local rail systems continue to operate normally. Recommended actions: confirm all U.S. travel before departure, monitor airline and FAA updates closely, allow extra time at airports and anticipate delays in federal services, including customs, visas and some welfare and healthcare programs.

Danish authorities in rush to close security loophole in Chinese electric buses www.theguardian.com/world/202…

Authorities in Denmark are urgently studying how to close an apparent security loophole in hundreds of Chinese-made electric buses that enables them to be remotely deactivated.

The investigation comes after transport authorities in Norway, where the Yutong buses are also in service, found that the Chinese supplier had remote access for software updates and diagnostics to the vehicles’ control systems – which could be exploited to affect buses while in transit.

Gootloader malware is back with new tricks after 7-month break www.bleepingcomputer.com/news/secu…

The Gootloader malware loader operation has returned after a 7-month absence and is once again performing SEO poisoning to promote fake websites that distribute the malware.

“In this latest campaign, we’ve observed thousands of unique keywords spread over 100 websites,” reads a new blog post by the Gootloader researcher. “The ultimate goal remains the same: convince victims to download a malicious ZIP archive containing a JScript (.JS) file that establishes initial access for follow-on activity — usually leading to ransomware deployment.”

ESET APT Activity Report Q2 2025–Q3 2025 www.welivesecurity.com/en/eset-r…

ESET APT Activity Report Q2 2025–Q3 2025 summarizes notable activities of selected advanced persistent threat (APT) groups that were documented by ESET researchers from April through September 2025. The highlighted operations are representative of the broader landscape of threats we investigated during this period. They illustrate the key trends and developments and contain only a small fraction of the cybersecurity intelligence data provided to customers of ESET APT reports.

Sandworm, similar to Gamaredon, focused on Ukraine – albeit with motives of destruction rather than cyberespionage. The group deployed data wipers (ZEROLOT, Sting) against governmental entities, companies in the energy and logistics sectors, and, more notably, against the grain sector – the likely objective being the weakening of the Ukrainian economy.

Malicious Infrastructure Finds Stability with aurologic GmbH www.recordedfuture.com/research/…

German hosting provider aurologic GmbH has emerged as a central nexus within the global malicious infrastructure ecosystem. It provides upstream transit and data center services to a large concentration of high-risk hosting networks, which have consistently ranked among the top sources of validated malicious infrastructure seen within Recorded Future’s Network Intelligence. This nexus includes several hosting providers Insikt Group assesses with a high degree of confidence as threat activity enablers (TAEs), such as metaspinner net GmbH, Femo IT Solutions Ltd, Global-Data System IT Corporation (SWISSNETWORK02), Railnet, and the recently sanctioned Aeza Group.

There are likely multiple contributing factors, including aurologic’s self-proclaimed neutrality, its continued provision of upstream connectivity to sanctioned entities such as Aeza, and the perception of limited enforcement risk within the European regulatory environment. Collectively, these factors may have made aurologic an attractive option for high-risk providers seeking operational stability and resilience.

Insikt Group assesses that aurologic’s case exemplifies the broader structural challenges surrounding accountability within the hosting ecosystem. Upstream providers occupy a pivotal position within the internet’s infrastructure hierarchy and are uniquely positioned to disrupt persistent abuse. Yet many continue to defer responsibility for downstream activity, intervening only when legally compelled. While neutrality remains a foundational principle of internet governance, in practice, it has become a rationale for inaction, enabling networks repeatedly associated with cybercrime, disinformation, and other forms of abuse to persist. Meaningful progress against such activity can be made by upstream providers acting not solely out of legal obligation, but from an operational and ethical responsibility to prevent the misuse of the infrastructure.

China sentences 5 Myanmar scam kingpins to death therecord.media/china-sen…

A Chinese court sentenced five members of a Myanmar crime syndicate to death for their roles in running industrial-scale scamming compounds near the border with China.

According to Xinhua, the Bai family and its associates built 41 industrial parks where they “engaged in telecommunications and online fraud, operating casinos, intentional homicide, intentional injury, kidnapping, extortion, organizing and forcing prostitution, and organizing illegal border crossings.” They defrauded people of more than 29 billion yuan (more than $4 billion), the court alleged, and their operations resulted in the deaths of at least six Chinese citizens.

Crossed wires: a case study of Iranian espionage and attribution www.proofpoint.com/us/blog/t…

In June, Proofpoint Threat Research began investigating a benign email discussing economic uncertainty and domestic political unrest in Iran. While coinciding with the escalations in the Iran-Israel conflict, there was no indication that the observed activity was directly correlated with Israel’s attacks on Iranian nuclear facilities or Iran’s actions in response.

Initial analysis of the activity found tactics, techniques, and procedures (TTP) overlaps with multiple Iranian aligned groups, including TA455 (C5 Agent, Smoke Sandstorm), TA453 (Mint Sandstorm, Charming Kitten), and TA450 (MuddyWater, Mango Sandstorm). Given a lack of high confidence links to any one established threat group, we designated the activity as a temporary cluster called UNK_SmudgedSerpent.

The infection chain began with a benign conversation, followed by an email exchange and a credential harvesting attempt. After this initial credential harvesting attempt, UNK_SmudgedSerpent continued to conduct phishing activity within the same email thread with a specific target and subsequently delivered a URL that hosted an archive file with an MSI that loaded RMM payloads.