Security. In focus.

Oracle E-Business Suite Zero-Day Exploited in Cl0p Attacks - SecurityWeek

The Cl0p ransomware group exploited a zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite, stealing data from customers and sending extortion emails. The vulnerability, impacting versions 12.2.3-12.2.14, allows remote code execution and has a CVSS score of 9.8. Oracle has released patches and indicators of compromise for affected customers.

Beer Giant Asahi Says Data Stolen in Ransomware Attack - SecurityWeek

Asahi Group Holdings, a Japanese brewing company, confirmed a ransomware attack on its domestic subsidiaries, causing a week-long outage. The attack disrupted order and shipment operations, call center downtime, and led to data exfiltration. Asahi is working to restore systems and assess the financial impact.

Patch Now: Dell UnityVSA Flaw Allows Command Execution Without Login

A critical vulnerability (CVE-2025-36604) in Dell UnityVSA allows attackers to execute commands without authentication. The flaw, discovered by WatchTowr, exploits login redirection logic and affects versions 5.5 and earlier. Dell recommends upgrading to version 5.5.1 or later to mitigate the risk.

Data Breach at Doctors Imaging Group Impacts 171,000 People - SecurityWeek

Doctors Imaging Group, a radiology practice in Florida, experienced a data breach in November 2024, impacting over 171,000 individuals. The breach exposed sensitive information including names, Social Security numbers, and medical records.

Android Spyware Targets UAE Messaging Users - GovInfoSecurity

Two Android spyware campaigns, ProSpy and ToSpy, target UAE messaging users by masquerading as Signal and ToTok upgrades. These campaigns, discovered by Eset researchers, exfiltrate sensitive data and have been ongoing since 2024. The spyware uses phishing domains to distribute malicious APK files, bypassing Google Play safeguards.

Agentic AI is reshaping cybersecurity — not just as a defensive tool but as an autonomous threat capable of exploiting vulnerabilities, orchestrating attacks and outpacing traditional controls. This post explores how attackers are already using agentic AI, the defences that work today and the governance gaps organisations must close.

kiledjian.com/2025/10/0…

Inside the ‘Trinity of Chaos’ group of young hackers targeting major companies - ABC News

The Trinity of Chaos, a supergroup of young hackers including LAPSUS$, ShinyHunters, and Scattered Spider, has targeted major companies like Qantas, Allianz Life, Adidas, and Google using social engineering and extortion tactics. Despite announcing their retirement, their hacking techniques continue to be seen in recent cyber attacks, suggesting they may still be active.

Bill C-8: What Operators of Critical Cyber Systems Should Know and Do to Prepare their Cybersecurity Programs

Bill C-8 introduces the Critical Cyber Systems Protection Act (CCSPA), mandating designated operators in key sectors to implement comprehensive cybersecurity programs, report incidents within 72 hours, and comply with government directives to bolster cybersecurity resilience. Organizations must assess risks, maintain records, and face penalties for non-compliance, with enforcement by existing regulators.

‘I have your nudes and everything to ruin your life’ - the cyber scammers targeting teenagers

The BBC investigates sextortion scams targeting teenagers, focusing on the tragic case of Evan Boettler, who took his own life after being blackmailed. The scammers, often operating from Lagos, Nigeria, use fake profiles and deepfake technology to extort victims, with social media platforms facing criticism for not doing enough to prevent these crimes.

Firefighter Recruitment Site Hack Exposes 50,000 Personal Records

A data breach on the firefighter recruitment website ‘119Gosi’ exposed the personal information of 50,093 individuals. The National Fire Agency is investigating the incident and plans to use the Ministry of Personnel Management’s integrated recruitment system in the future.

Discord customer service data breach leaks user info and scanned photo IDs | The Verge

Discord customer service data breach exposed user information, including names, usernames, emails, and partial credit card numbers, due to a compromised third-party provider. The breach did not impact full credit card numbers or passwords.

Almost 1 billion Salesforce records stolen, hacker group claims | Reuters

A hacker group, “Scattered LAPSUS$ Hunters,” claims to have stolen almost 1 billion records from Salesforce by targeting its customers through “vishing” attacks. Salesforce denies any compromise of its systems, stating the activity is unrelated to any known vulnerabilities. The group also claims responsibility for previous attacks on British retailers and published a leak site on the dark web.

Cyberattack on Israeli hospital leaks patient information | The Jerusalem Post

Shamir Medical Center in Israel suffered a Yom Kippur cyberattack that leaked September 25 hospital emails containing some patient information, though the hospital’s central Chameleon medical record system remained secure. The Health Ministry confirmed medical services continue operating normally, with the hospital instructed to enhance security measures and prepare for potential follow-up attacks while authorities assess the breach’s scope. This follows previous cyberattacks on Israeli hospitals including 2023 ransomware strikes on Kfar Shaul Mental Health Center, Ziv Medical Center, and Hillel Yaffe Medical Center that crippled systems for weeks. Israel’s health system has responded by implementing stricter access management, network separation, isolated backups, real-time monitoring, and specialized staff training to protect healthcare infrastructure from future cyber threats.​​​​​​​​​​​​​​​​

Third-Party Data Breach Hits Harrods, Leaking Over 430,000 Customer Records - CPO Magazine

Harrods disclosed a third-party data breach after cybercriminals stole over 430,000 customer records and demanded ransom, though the retailer refused to pay and confirmed the incident was unrelated to a previous Scattered Spider attack. The breach exposed basic personal identifiers including names and contact information but did not compromise account passwords or payment details, affecting only a small fraction of Harrods’ primarily offline customer base. Harrods notified authorities, confirmed the incident was contained with no ongoing illegal access, and is working with the impacted third-party provider to verify security measures while not disclosing the provider’s identity or ransom amount. Customers should watch for phishing attempts and monitor accounts for suspicious activity.​​​​​​​​​​​​​​​​

Hacking group claims theft of 1 billion records from Salesforce customer databases | TechCrunch

The hacking group Lapsus$/Scattered Spider/ShinyHunters launched a dark web leak site to extort victims, claiming nearly one billion records stolen from Salesforce-hosted databases. The site lists confirmed breaches at Allianz Life, Google, Kering, Qantas, TransUnion, and Workday, plus unconfirmed targets like FedEx, Hulu, and Toyota, while threatening Salesforce directly to negotiate ransom or face data publication. Salesforce maintains there’s “no indication that the Salesforce platform has been compromised,” describing the attempts as relating to “past or unsubstantiated incidents.” This marks a significant shift for the predominantly English-speaking group, which historically avoided public presence, now adopting tactics typically associated with Russian-speaking ransomware gangs who threaten to publish stolen data rather than encrypting it.​​​​​​​​​​​​​​​​

Klopatra: exposing a new Android banking trojan operation with roots in Turkey www.cleafy.com/cleafy-la…

In late August 2025, Cleafy’s Threat Intelligence team discovered Klopatra, a new, highly sophisticated Android malware currently used in active campaigns against financial institutions and their customers. The analysis identified two major botnets targeting users primarily in Spain and Italy, with the number of compromised devices already exceeding 3,000. Klopatra operates as a powerful banking trojan and Remote Access Trojan (RAT), allowing its operators to gain complete control over infected devices, steal sensitive credentials, and execute fraudulent transactions.

What elevates Klopatra above the typical mobile threat is its advanced architecture, built for stealth and resilience. The malware authors have integrated Virbox, a commercial-grade code protection tool rarely seen in the Android threat landscape. This, combined with a strategic shift of core functionalities from Java to native libraries, creates a formidable defensive layer. This design choice drastically reduces its visibility to traditional analysis frameworks and security solutions, applying extensive code obfuscation, anti-debugging mechanisms, and runtime integrity checks to hinder analysis.

This technical sophistication provides a clear footprint of the Threat Actor (TAs). Linguistic clues within the malware’s code and intelligence gathered from the Command and Control (C2) infrastructure point decisively to a Turkish-speaking origin. This assessment is corroborated by operational notes left by the attackers themselves, revealing a cohesive and disciplined group managing the entire attack lifecycle, from development to monetization. Klopatra marks a significant step in the professionalization of mobile malware, demonstrating a clear trend of TAs adopting commercial-grade protections to maximize the lifespan and profitability of their operations.

UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud blog.talosintelligence.com/uat-8099-…

In April 2025, Cisco Talos identified a Chinese-speaking cybercrime group, tracked as UAT-8099, which targets a broad range of vulnerable IIS servers across specific regions. This group focuses on high-value IIS servers that have a good reputation within these areas to manipulate search engine results for financial gain.

UAT-8099 operates as a cybercrime group conducting SEO fraud. Additionally, UAT-8099 uses Remote Desktop Protocol (RDP) to access IIS servers and search for valuable data such as logs, credentials, configuration files and sensitive certificates, which they package for possible resale or further exploitation.

Upon discovering a vulnerability in a target server, the group uploads a web shell to collect system information and conduct reconnaissance on the host network. They then enable the guest account, escalate its privileges to administrator level, and use this account to enable RDP. For persistence, they combine RDP access with SoftEther VPN, EasyTier (a decentralized virtual private network tool) and FRP reverse proxy tool. Subsequently, the group performs further privilege escalation using shared tools to gain system-level permissions and install BadIIS malware. To secure their foothold, they deploy defense mechanisms to prevent other threat actors from compromising the same server or disrupting their setup.

This blog post provides a comprehensive overview of the campaign’s victimology, including the regions affected and the potential consequences of BadIIS infections. It also details the attack chain, automation scripts employed, and the malware and shared hacking tools UAT-8099 commonly uses.

European parliamentarians implore EU leadership to stop funding spyware therecord.media/european-…

Members of the European Parliament are looking for answers as to why the European Union is underwriting spyware companies.

Ina letter sent on Tuesday to European Commission officials, the parliamentarians cite recent reporting from the publication Follow the Money documenting how a state-owned Italian bank and the European Union’s Defense Fund, among other state entities, are subsidizing spyware companies.

The outlet’s investigation showed that member states and the EU as a bloc have funded the Intellexa Alliance and Cy4Gate, whose products have been found targeting members of civil society.

For example, Follow the Money reported, Cy4Gate received at least €3.8 million ($4.4 million) in EU money, including from the European Defense Fund, over a four-year-period concluding in 2024.

Ukrainian Defenders Report Rise in Russian Cyberattacks www.databreachtoday.com/ukrainian…

Russia has increased the tempo of its cyber operations targeting Ukraine, say cyber defenders in war-buffeted Kyiv.

The Ukrainian Computer Emergency Response Team responded to approximately 3,000 cybersecurity incidents in the first half of this year, up from 2,580 in the latter half of 2024, says a new report from CERT-UA, a component of the State Service of Special Communications and Information Protection bureau.

Included in that number is a major attack in March against Ukrainian Railways, attributed to Unit 74455 of Russia’s General Staff Main Intelligence Directorate, a cyberwarfare threat actor popularly known as Sandworm. The attack knocked out the online ticketing system, causing long lines at railway stations. Rail has become a principal mode of travel in Ukraine since the Kremlin launched an invasion in February 2022, grounding commercial aviation from fear of missile and fighter jet attack.

Despite the catalog of identified attacks, the actual number is likely to be higher since CERT-UA can’t account for undetected breaches.

The Kremlin’s targets are also constant from year to year. About one-third of all attacks targeted local authorities, one-fifth the military or government agencies and 5% the country’s energy sector, said the SSCIP.

3.7M breach letters set to flood North America’s mailboxes • The Register

Three companies, Allianz Life, WestJet, and Motility Software Solutions, disclosed data breaches affecting approximately 3.7 million customers and employees across North America, with Allianz Life experiencing the largest breach involving 1.49 million individuals' personal data.

Red Hat confirms security incident after hackers claim GitHub breach

Red Hat confirmed a security incident related to its consulting business, but did not verify hacker claims of breaching GitHub repositories and stealing Customer Engagement Reports (CERs). The Crimson Collective allegedly stole 570GB of data from 28,000 internal projects, including CERs with sensitive customer information.

EU Threat Landscape: Hacktivism, DDoS Attacks and Ransomware

The EU threat landscape is dominated by hacktivism, DDoS attacks, and ransomware, with phishing being the most common initial intrusion vector, according to the 2025 ENISA Threat Landscape report. AI and mobile threats are significant concerns, with state-aligned threat groups targeting telecommunications, logistics, and manufacturing sectors.

Google says Mandiant & Google Threat Intelligence Group are tracking recent activity by threat actor, possibly linked to Clop | MarketScreener

Google’s Mandiant and Google Threat Intelligence Group are tracking recent activity by a threat actor, possibly linked to Clop. Alphabet Inc. operates in six key areas, including Google Search, YouTube, Gmail, Nest Labs, Calico, Google X, Google Ventures, Google Capital, and Google Fiber.

Threat Actors Leveraging Senior Travel Scams to Deliver Datzbro Malware

Cybersecurity researchers have uncovered a Datzbro malware campaign targeting seniors through fraudulent travel promotions on Facebook, leveraging AI-generated content and remote access technologies to facilitate financial fraud globally.

Zurich urges national cybersecurity metrics adoption | Insurance Business Canada

Zurich Insurance Group advocates for national cybersecurity metrics to address the protection gap between insured losses and global economic damage from cyber incidents, proposing six key indicators and the creation of National Cyber Statistics Bureaus to enhance data-driven policymaking.