Security. In focus.

New Attack Targets DDR5 Memory to Steal Keys From Intel and AMD TEEs  - SecurityWeek

A new attack named TEE.fail targets DDR5 memory to steal cryptographic keys from Intel TDX and AMD SEV-SNP trusted execution environments (TEEs), requiring physical access to insert an interposer between the CPU and memory. This attack is significant as it affects the latest confidential computing offerings from Intel and AMD, and can also compromise Nvidia’s GPU Confidential Computing.

10 npm Packages Caught Stealing Developer Credentials on Windows, macOS, and Linux

Cybersecurity researchers have identified 10 malicious npm packages that steal developer credentials across Windows, Linux, and macOS. These packages, disguised as popular libraries, employ obfuscation and fake CAPTCHAs to harvest sensitive information from browsers and system keyrings.

Chrome to Turn HTTPS on by Default for Public Sites - SecurityWeek

Starting October 2026 with Chrome 154, Google will make HTTPS the default for all users, enhancing browsing security by preventing attackers from hijacking navigation. While most websites already use HTTPS, Chrome will display warnings and require user permission for sites that do not support secure connections.

Suspected Nation-State Threat Actor Uses New Airstalk Malware in a Supply Chain Attack

A new Windows-based malware family named Airstalk, with PowerShell and .NET variants, has been identified, potentially used by a nation-state threat actor in a supply chain attack. Airstalk misuses the AirWatch API for covert command-and-control (C2) and is capable of exfiltrating sensitive browser data.

Ad and PR Giant Dentsu Says Hackers Stole Merkle Data - SecurityWeek

Advertising and PR giant Dentsu has confirmed a data breach affecting its subsidiary Merkle, with hackers stealing files containing sensitive information about clients, suppliers, and employees. The company is notifying affected individuals and offering free dark web monitoring services, while stating that its Japanese systems remain unaffected.

XWiki Vulnerability Exploited in Cryptocurrency Mining Operation - SecurityWeek

A critical-severity vulnerability (CVE-2025-24893) in the XWiki enterprise wiki platform has been exploited in the wild, allowing attackers to execute arbitrary code for a cryptocurrency mining operation. The flaw, which involves improper sanitization of search parameters in the SolrSearch macro, was addressed in XWiki versions 15.10.11, 16.4.1, and 16.5.0RC1 in June 2024.

OpenAI Restructures, Nonprofit Foundation Retains Control

OpenAI has restructured, with its nonprofit Foundation retaining control and oversight of the for-profit group to ensure artificial general intelligence benefits all of humanity. This restructuring, reinforced by agreements with California and Delaware attorneys general, includes a majority of independent directors on the board and a Safety and Security Committee with veto power over model releases.

Warnings Mount Over Windows Server Update Services Hacks

Warnings have escalated regarding hackers exploiting a Windows Server Update Services (WSUS) flaw that allows unauthenticated attackers to execute arbitrary code. Cybersecurity firms have observed active hacks targeting thousands of exposed WSUS instances, with attacks focused on reconnaissance as a precursor to broader network compromise. The vulnerability, CVE-2025-59287, stems from a deserialization of untrusted data in WSUS, a tool no longer under active development and which should ideally not be exposed to the internet.

Aktia Bank has been fined 865,000 euros for neglecting cybersecurity. The penalty stems from an incident two years ago where a disruption in the bank’s electronic identification service allowed some customers to view other customers' personal information when logging into services requiring strong authentication. This included government and healthcare services. It was also possible to conduct transactions under another customer’s name, although logging into Aktia’s online bank itself was not affected. The Data Protection Ombudsman’s office reported the decision. This incident highlights ongoing concerns about data security in financial institutions, with other banks like S-Pankki and Nordea also experiencing system disruptions and security issues in the past. The article also links to related stories about digital scams and other data breaches, emphasizing the pervasive nature of cybersecurity threats.

www.mtvuutiset.fi/artikkeli…

Active Water Saci Campaign Spreading Via WhatsApp Features Multi-Vector Persistence and Sophisticated C&C www.trendmicro.com/en_us/res…

Further investigation into the active Water Saci campaign shows a new attack chain that utilizes an email-based C&C infrastructure, employs multi-vector persistence for resilience, and incorporates advanced checks to evade analysis and restrict activity to specific targets.

The new attack chain also features a sophisticated remote command-and-control system that allows threat actors real-time management, including pausing, resuming, and monitoring the malware’s campaign, effectively converting infected machines into a botnet tool for coordinated, dynamic operations across multiple endpoints.

Trend Vision One™ detects and blocks the IoCs discussed in this blog. Trend Micro customers can also access tailored hunting queries, threat insights, and intelligence reports to better understand and proactively defend against this campaign. In addition, Trend customers are protected from the Water Saci campaign via the specific rules and filters listed at the end of this blog entry.

‘Jingle Thief’ Highlights Retail Cyber Threats www.darkreading.com/cyber-ris…

A large-scale gift card fraud campaign run by a Morocco-based cybercrime group offers an early look at the kinds of threats retailers may face as they head into this year’s busy holiday season.

Dubbed “Jingle Thief,” the operation primarily targets global retailers and consumer services organizations that rely heavily on cloud-based infrastructure. What makes it especially concerning is the ability of the attackers to maintain a stealthy, months-long presence on victim networks after gaining initial access, according to researchers at Palo Alto Networks' Unit 42

New Herodotus Android malware fakes human typing to avoid detection www.bleepingcomputer.com/news/secu…

A new Android malware family, Herodotus, uses random delay injection in its input routines to mimic human behavior on mobile devices and evade timing-based detection by security software.

Herodotus, according to Threat Fabric, is offered as a malware-as-a-service (MaaS) to financially motivated cybercriminals, believed to be the same operators behind Brokewell.

Although the malware is still in development, clients of the new MaaS platform are currently deploying it against Italian and Brazilian users through SMS phishing (smishing) text messages.

New Atroposia malware comes with a local vulnerability scanner www.bleepingcomputer.com/news/secu…

A new malware-as-a-service (MaaS) platform named Atroposia provides cybercriminals a remote access trojan that combines capabilities for persistent access, evasion, data theft, and local vulnerability scanning.

The malware is available for a $200 monthly subscription that unlocks advanced features such as hidden remote desktop, file system control, data exfiltration, clipboard theft, credential theft, cryptocurrency wallet theft, and DNS hijacking.

Atroposia was discovered by researchers at data security company Varonis, who warned that it’s the latest example of an easy-to-use, affordable “plug and play” toolkit, alongside SpamGPT and MatrixPDF.

BiDi Swap: The bidirectional text trick that makes fake URLs look real www.bleepingcomputer.com/news/secu…

Varonis Threat Labs is shining a spotlight on a decade-old vulnerability that opens the door to URL spoofing.

By exploiting how browsers handle Right-to-Left (RTL) and Left-to-Right (LTR) scripts, attackers can craft URLs that appear trustworthy but actually lead somewhere else, therefore this method, known as BiDi Swap, can be often abused in phishing attacks.

Crypto wasted: BlueNoroff’s ghost mirage of funding and jobs securelist.com/bluenorof…

Primarily focused on financial gain since its appearance, BlueNoroff (aka. Sapphire Sleet, APT38, Alluring Pisces, Stardust Chollima, and TA444) has adopted new infiltration strategies and malware sets over time, but it still targets blockchain developers, C-level executives, and managers within the Web3/blockchain industry as part of its SnatchCrypto operation. Earlier this year, we conducted research into two malicious campaigns by BlueNoroff under the SnatchCrypto operation, which we dubbed GhostCall and GhostHire.

GhostCall heavily targets the macOS devices of executives at tech companies and in the venture capital sector by directly approaching targets via platforms like Telegram, and inviting potential victims to investment-related meetings linked to Zoom-like phishing websites. The victim would join a fake call with genuine recordings of this threat’s other actual victims rather than deepfakes. The call proceeds smoothly to then encourage the user to update the Zoom client with a script. Eventually, the script downloads ZIP files that result in infection chains deployed on an infected host.

Around 70 countries sign new UN Cybercrime Convention—but not everyone’s on board www.malwarebytes.com/blog/news…

Around 70 countries have signed the new United Nations (UN) Convention against Cybercrime—the first global treaty designed to combat cybercrime through unified international rules and cooperation.

The treaty needs at least 40 UN member states to ratify it before it becomes international law. Once the 40th country does so, it will take another 90 days for the convention to become legally binding for all those who have joined.

Veeam security advisory (AV25-703) - Canadian Centre for Cyber Security

The Canadian Centre for Cyber Security issued Veeam security advisory AV25-703 on October 28, 2025, addressing vulnerabilities in Veeam Backup & Replication versions 12.3.2.3617 and prior. Users are encouraged to update to version 12.3.2.4165 to resolve these issues.

PoC code drops for remotely exploitable BIND 9 DNS flaw (CVE-2025-40778) - Help Net Security

A high-severity BIND 9 DNS vulnerability (CVE-2025-40778) allows remote attackers to perform cache poisoning, potentially redirecting internet traffic. Proof-of-concept exploit code is available, making it critical for administrators to patch affected BIND 9 versions immediately, as there are no known workarounds.

More Collins Aerospace Hacking Fallout - GovInfoSecurity

A Russian data extortion group, Everest Group, has threatened to release 1.5 million passenger records stolen from Dublin Airport, claiming the data was obtained through a breach stemming from a Collins Aerospace cybersecurity incident. This incident, which affected multiple European airports in September due to issues with Collins Aerospace’s Muse software, is being investigated, with Dublin Airport stating there is no evidence of direct impact on its systems. While ENISA classified the initial incident as ransomware, Everest Group denies using crypto-locking malware, and another cybercrime group may have also targeted Collins Aerospace simultaneously.

Iranian Intel-Linked Cybersecurity School Hit by Data Breach

A data breach at Ravin Academy, a cyber training firm linked to Iranian intelligence, has exposed the personal data of over 1,000 individuals enrolled in its programs. The academy, sanctioned by the U.S. Treasury in 2022, confirmed the breach on its Telegram channel, stating the incident aimed to damage its reputation and security in Iran.

Ransomware profits drop as victims stop paying hackers www.bleepingcomputer.com/news/secu…

The number of victims paying ransomware threat actors has reached a new low, with just 23% of the breached companies giving in to attackers' demands.

With some exceptions, the decline in payment resolution rates continues the trend that Coveware has observed for the past six years.

In the first quarter of 2024, the payment percentage was 28%. Although it increased over the next period, it continued to drop, reaching an all-time low in the third quarter of 2025.

Italian spyware vendor linked to Chrome zero-day attacks www.bleepingcomputer.com/news/secu…

A zero-day vulnerability in Google Chrome, exploited in Operation ForumTroll earlier this year, delivered malware linked to Italian spyware vendor Memento Labs, born after IntheCyber ​​Group acquired the infamous Hacking Team.

Operation ForumTroll was uncovered by Kaspersky in March. The campaign targeted Russian organizations - media outlets, universities, research centers, government organizations, and financial institutions, with well-crafted invitations to the Primakov Readings forum that contained a malicious link.

Loading the link in any Chromium-based web browser was enough to infect the computer system. Kaspersky researchers said that the malware delivery was done by exploiting CVE-2025-2783, a sandbox escape zero-day in the Chrome browser.

QNAP warns of critical ASP.NET flaw in its Windows backup software www.bleepingcomputer.com/news/secu…

QNAP warned customers to patch a critical ASP.NET Core vulnerability that also impacts the company’s NetBak PC Agent, a Windows utility for backing up data to a QNAP network-attached storage (NAS) device.

Tracked as CVE-2025-55315, this security bypass flaw was found in the Kestrel ASP.NET Core web server and enables attackers with low privileges to hijack other users' credentials or bypass front-end security controls via HTTP request smuggling.

“NetBak PC Agent installs and depends on Microsoft ASP.NET Core components during setup. Therefore, computers running NetBak PC Agent may contain an affected version of ASP.NET Core if the system has not been updated,” QNAP said.

The Swedish national grid company, Svenska kraftnät, has been the target of a cyberattack. The hacker group Everest has claimed responsibility for the breach, stating they have exfiltrated 280 gigabytes of data. Svenska kraftnät has confirmed the incident and reported it to the police. The company is currently investigating the extent of the data leak and its potential impact. While they have found no indications of the electricity grid being affected, the hacker group has threatened to release the stolen data if their demands are not met. The nature of the compromised data remains unknown. Svenska kraftnät is responsible for Sweden’s national electricity grid and ensuring its functionality during crisis situations. This incident highlights ongoing cybersecurity threats targeting critical infrastructure.

www.mtvuutiset.fi/artikkeli…

The ForumTroll and his colleagues www.kaspersky.com/blog/foru…

Our experts from the Kaspersky Global Research and Analysis Team (GReAT) reconstructed the chain of infection used in attacks by the ForumTroll APT group. During their investigation, they discovered that the tools used by ForumTroll were also used to distribute the commercial malware Dante. Boris Larin gave a detailed presentation on this research at the Security Analyst Summit 2025 conference in Thailand.