F5 Breached, Linux Rootkits, Pixnapping Attack, EtherHiding & More

It is simple to assume your defenses are stable — till you understand attackers have been inside them the entire time. The most recent incidents present that long-term, silent breaches have gotten the norm. One of the best protection now is not simply patching quick, however watching smarter and staying alert for what you do not anticipate.

This is a fast have a look at this week’s high threats, new ways, and safety tales shaping the panorama.

⚡ Menace of the Week

F5 Uncovered to Nation-State Breach — F5 disclosed that unidentified menace actors broke into its techniques and stole recordsdata containing a few of BIG-IP’s supply code and data associated to undisclosed vulnerabilities within the product. The corporate mentioned it realized of the incident on August 9, 2025, though it is believed that the attackers had been in its community for no less than 12 months. The attackers are mentioned to have used a malware household referred to as BRICKSTORM, which is attributed to a China-nexus espionage group dubbed UNC5221. GreyNoise said it noticed elevated scanning exercise focusing on BIG-IP in three waves on September 23, October 14, and October 15, 2025, however emphasised the anomalies could not essentially relate to the hack. Censys said it recognized over 680,000 F5 BIG-IP load balancers and software gateways seen on the general public web, with nearly all of hosts positioned within the U.S., adopted by Germany, France, Japan, and China. Not all recognized techniques are essentially susceptible, however every represents a publicly accessible interface that must be inventoried, access-restricted, and patched proactively as a precautionary measure. “Edge infrastructure and safety distributors stay prime targets for long-term, usually state-linked menace actors,” John Fokker, vice chairman of menace intelligence technique at Trellix, mentioned. “Over time, we now have seen nation-state curiosity in exploiting vulnerabilities in edge units, recognizing their strategic place in international networks. Incidents like these remind us that strengthening collective resilience requires not solely hardened expertise but additionally open collaboration and intelligence sharing throughout the safety neighborhood.”

🔔 High Information

• N. Korea Uses EtherHiding to Hide Malware Inside Blockchain Smart Contracts — North Korean threat actors have been observed leveraging the EtherHiding technique to distribute malware and enable cryptocurrency theft, marking the first time a state-sponsored hacking group has embraced the method. The activity has been attributed to a cluster tracked as UNC5342 (aka Famous Chollima). The attack wave is part of a long-running campaign codenamed Contagious Interview, wherein the attackers approach potential targets on LinkedIn by posing as recruiters or hiring managers, and trick them into running malicious code under the pretext of a job assessment after shifting the conversation to Telegram or Discord. In the latest attack waves observed since February 2025, the threat actors use a JavaScript downloader that interacts with a malicious BSC smart contract to download JADESNOW, which subsequently queries the transaction history associated with an Ethereum address to fetch the JavaScript version of InvisibleFerret.
• LinkPro Linux Rootkit Spotted in the Wild — An investigation into the compromise of an Amazon Web Services (AWS)-hosted infrastructure led to the discovery of a new GNU/Linux rootkit dubbed LinkPro. The backdoor features functionalities relying on the installation of two extended Berkeley Packet Filter (eBPF) modules to conceal itself and to be remotely activated upon receiving a magic packet – a TCP SYN packet with a specific window size (54321) that signals the rootkit to await further instructions within a one-hour window, allowing it to evade traditional security defenses. The commands supported by LinkPro include executing /bin/bash in a pseudo-terminal, running a shell command, enumerating files and directories, performing file operations, downloading files, and setting up a SOCKS5 proxy tunnel. It’s currently not known who is behind the attack, but it’s suspected that the threat actors are financially motivated.
• Zero Disco Campaign Targets Cisco Devices with Rootkits — A new campaign has exploited a recently disclosed security flaw impacting Cisco IOS Software and IOS XE Software to deploy Linux rootkits on older, unprotected systems. The activity, codenamed Operation Zero Disco by Trend Micro, involves the weaponization of CVE-2025-20352 (CVSS score: 7.7), a stack overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow an authenticated, remote attacker to execute arbitrary code by sending crafted SNMP packets to a susceptible device. The operation primarily impacted Cisco 9400, 9300, and legacy 3750G series devices, Trend Micro said. The intrusions have not been attributed to any known threat actor or group.
• Pixnapping Attack Leads to Data Theft on Android Devices — Android devices from Google and Samsung have been found vulnerable to a side-channel attack that could be exploited to covertly steal two-factor authentication (2FA) codes, Google Maps timelines, and other sensitive data without the users’ knowledge pixel-by-pixel. The attack has been codenamed Pixnapping. Google is tracking the issue under the CVE identifier CVE-2025-48561 (CVSS score: 5.5). Patches for the vulnerability were issued by the tech giant as part of its September 2025 Android Security Bulletin, with additional fixes forthcoming in December.
• Chinese Threat Actors Exploited ArcGIS Server as Backdoor — Threat actors with ties to China have been attributed to a novel campaign that compromised an ArcGIS system and turned it into a backdoor for more than a year. The activity is the handiwork of a Chinese state-sponsored hacking group called Flax Typhoon, which is also tracked as Ethereal Panda and RedJuliett. “The group cleverly modified a geo-mapping application’s Java server object extension (SOE) into a functioning web shell,” ReliaQuest said. “By gating access with a hardcoded key for exclusive control and embedding it in system backups, they achieved deep, long-term persistence that could survive a full system recovery.” The attack chain involved the threat actors targeting a public-facing ArcGIS server that was linked to a private, internal ArcGIS server by compromising a portal administrator account to deploy a malicious SOE, thereby allowing them to blend in with normal traffic and maintain access for extended periods. The attackers then instructed the public-facing server to create a hidden directory to serve as the group’s “private workspace.” They also blocked access to other attackers and admins with a hard-coded key. The findings demonstrate Flax Typhoon’s consistent modus operandi of quietly turning an organization’s own tools against itself rather than using sophisticated malware or exploits.

This week’s list includes — CVE-2025-24990, CVE-2025-59230 (Microsoft Windows), CVE-2025-47827 (IGEL OS before 11), CVE-2023-42770, CVE-2023-40151 (Red Lion Sixnet RTUs), CVE-2025-2611 (ICTBroadcast), CVE-2025-55315 (Microsoft ASP.NET Core), CVE-2025-11577 (Clevo UEFI firmware), CVE-2025-37729 (Elastic Cloud Enterprise), CVE-2025-9713, CVE-2025-11622 (Ivanti Endpoint Supervisor), CVE-2025-48983, CVE-2025-48984 (Veeam), CVE-2025-11756 (Google Chrome), CVE-2025-49201 (Fortinet FortiPAM and FortiSwitch Supervisor), CVE-2025-58325 (Fortinet FortiOS CLI), CVE-2025-49553 (Adobe Join collaboration suite), CVE-2025-9217 (Slider Revolution plugin), CVE-2025-10230 (Samba), CVE-2025-54539 (Apache ActiveMQ), CVE-2025-41703, CVE-2025-41704, CVE-2025-41706, CVE-2025-41707 (Phoenix Contact QUINT4), and CVE-2025-11492, CVE-2025-11493 (ConnectWise Automate).

📰 Across the Cyber World

• Microsoft Unveils New Safety Enhancements — Microsoft revealed that “components of the kernel in Home windows 11 have been rewritten in Rust, which helps mitigate towards reminiscence corruption vulnerabilities like buffer overflows and helps scale back assault surfaces.” The corporate additionally famous that it is taking steps to safe AI-powered agentic experiences on the working system by making certain that they function with restricted permissions and solely get hold of entry to assets customers’ explicitly present permission to. As well as, Microsoft mentioned brokers that combine with Home windows should be cryptographically signed by a trusted supply in order that they are often revoked if discovered to be malicious. Every AI agent can even run below its personal devoted agent account that is distinct from the consumer account on the machine. “This facilitates agent-specific coverage software that may be totally different from the principles utilized to different accounts like these for human customers,” it said.
• website positioning Marketing campaign Makes use of Faux Ivanti Installers to Steal Credentials — A brand new assault marketing campaign has leveraged website positioning poisoning to lure customers into downloading a malicious model of the Ivanti Pulse Safe VPN consumer. The exercise targets customers looking for authentic software program on engines like google like Bing, redirecting them to attacker-controlled lookalike web sites (ivanti-pulsesecure[.]com or ivanti-secure-access[.]org). The aim of this assault is to steal VPN credentials from the sufferer’s machine, enabling additional compromise. “The malicious installer, a signed MSI file, incorporates a credential-stealing DLL designed to find, parse, and exfiltrate VPN connection particulars,” Zscaler said. “The malware particularly targets the connectionstore.dat file to steal saved VPN server URIs, which it combines with hardcoded credentials for exfiltration. Information is distributed to a command-and-control (C2) server hosted on Microsoft Azure infrastructure.”
• Qilin’s Ties with BPH Suppliers Uncovered — Cybersecurity researchers from Resecurity examined Qilin ransomware group’s “shut affiliation” with underground bulletproof internet hosting (BPH) operators, discovering that the e-crime actor has not solely relied on Cat Applied sciences Co. Restricted. (which, in flip, is hosted on an IP handle tied to Aeza Group) for internet hosting its knowledge leak web site, but additionally marketed companies like BEARHOST Servers (aka Underground) on its WikiLeaksV2 web site, the place the group publishes content material about their actions. BEARHOST has been operational since 2016, providing its companies for anyplace from $95 to $500. Whereas BEARHOST abruptly introduced the stoppage of its service on December 28, 2024, it’s assessed that the menace actors have taken the BPH service into personal mode, catering solely to trusted and vetted underground actors. On Could 8, 2025, it resurfaced as Voodoo Servers, just for the operators to terminate the service once more in direction of the tip of the month, citing political causes. “The actors determined to vanish by way of an ‘exit rip-off’ situation, conserving the underground viewers fully clueless,” Resecurity mentioned. “Notably, the authorized entities behind the service proceed their operations.” Notably, Cat Applied sciences Co. Restricted. additionally shares hyperlinks to shadowy entities like Purple Bytes LLC, Hostway, Starcrecium Restricted, and Chang Means Applied sciences Co. Restricted, the final of which has been related to in depth malware exercise, internet hosting command-and-control (C2) servers of Amadey, StealC, and Cobalt Strike utilized by cybercriminals. One other entity of word is Subsequent Restricted, which shares the identical Hong Kong handle as Chang Means Applied sciences Co. Restricted and has been attributed to malicious exercise in reference to Proton66.
• U.S. Decide Bars NSO Group from Concentrating on WhatsApp — A U.S. decide barred NSO Group from focusing on WhatsApp customers and lower the punitive damages verdict awarded to Meta by a jury in Could 2025 to $4 million, as a result of the courtroom didn’t have sufficient proof to find out that NSO Group’s habits was “significantly egregious.” The everlasting injunction handed out by U.S. District Decide Phyllis Hamilton implies that the Israeli vendor can not use WhatsApp as a solution to infect targets’ units. As a refresher, Meta sued the NSO Group in 2019 over using Pegasus adware by exploiting a then-zero-day flaw within the messaging app to spy on 1,400 folks from 20 nations, together with journalists and human rights activists. It was fined near $168 million earlier this Could. The proposed injunction requires NSO Group to delete and destroy laptop code associated to Meta’s platforms, and she or he concluded that the supply is “mandatory to forestall future violations, particularly given the undetectable nature of defendants’ expertise.”
• Google’s Privateness Sandbox Initiative is Formally Lifeless — In 2019, Google launched an initiative referred to as Privateness Sandbox to give you privacy-enhancing options to exchange third-party cookies on the net. Nevertheless, with the corporate abandoning its plans to deprecate third-party monitoring cookies, the mission seems to be winding down. To that finish, the tech large said it is retiring the next Privateness Sandbox applied sciences citing low ranges of adoption: Attribution Reporting API (Chrome and Android), IP Safety, On-System Personalization, Personal Aggregation (together with Shared Storage), Protected Viewers (Chrome and Android), Protected App Alerts, Associated Web site Units (together with requestStorageAccessFor and Associated Web site Partition), SelectURL, SDK Runtime and Subjects (Chrome and Android). In a press release shared with Adweek, the corporate said it is going to proceed to work to enhance privateness throughout Chrome, Android, and the online, however not below the Privateness Sandbox branding.
• Russia Blocks International SIM Playing cards — Russia said it is taking steps to briefly block cellular web for international SIM playing cards, citing nationwide safety causes. The brand new rule imposes a compulsory 24-hour cellular web blackout for anybody coming into Russia with a international SIM card.
• Flaw in CORS headers in Net Browsers Disclosed — The CERT Coordination Heart (CERT/CC) disclosed particulars of a vulnerability in cross-origin useful resource sharing (CORS) headers in Chromium, Google Chrome, Microsoft Edge, Safari, and Firefox that allows the CORS coverage to be manipulated. This may be mixed with DNS rebinding strategies to challenge arbitrary requests to companies listening on arbitrary ports, whatever the CORS coverage in place by the goal. “An attacker can use a malicious web site to execute a JavaScript payload that periodically sends CORS headers with the intention to ask the server if the cross-origin request is secure and allowed,” CERT/CC defined. “Naturally, the attacker-controlled hostname will reply with permissive CORS headers that can circumvent the CORS coverage. The attacker then performs a DNS rebinding assault in order that the hostname is assigned the IP handle of the goal service. After the DNS responds with the modified IP handle, the brand new goal inherits the relaxed CORS coverage, permitting an attacker to probably exfiltrate knowledge from the goal.” Mozilla is monitoring the vulnerability as CVE-2025-8036.
• Phishing Campaigns Use Microsoft’s Emblem for Tech Help Scams — Menace actors are exploiting Microsoft’s Title and branding in phishing emails to lure customers into fraudulent tech assist scams. The messages comprise hyperlinks that, when clicked, take the victims to a pretend CAPTCHA problem, after which they’re redirected to a phishing touchdown web page to unleash the subsequent stage of the assault. “After passing the captcha verification, the sufferer is instantly visually overloaded with a number of pop-ups that look like Microsoft safety alerts,” Cofense said. “Their browser is manipulated to seem locked, and so they lose the power to find or management their mouse, which provides to the sensation that the system is compromised. This involuntary lack of management creates a fake ransomware expertise, main the consumer to imagine their laptop is locked and to take speedy motion to treatment the an infection.” From there, customers are instructed to name a quantity to succeed in Home windows Help, at which they’re linked to a bogus technician to take the assault ahead. “The menace actor might exploit additional by asking the consumer to offer account credentials or persuade the consumer to put in distant desktop instruments, permitting full entry to their system,” the corporate mentioned.
• Taxpayers, Drivers Focused in Refund and Highway Toll Smishing Scams — A smishing marketing campaign has leveraged no less than 850 newly-registered domains in September and early October to focus on folks residing within the U.S., the U.Okay., and elsewhere with phishing hyperlinks that use tax refunds, street toll fees, or failed package deal deliveries as a lure. The web sites, designed to be loaded solely when launched from a cellular machine, declare to offer details about their tax refund standing or get hold of a subsidy of as much as £300 to assist offset winter gasoline prices (word: this can be a real U.K. government initiative), solely to immediate them to offer private particulars akin to title, house handle, phone quantity and electronic mail handle, in addition to fee card info. The entered knowledge is exfiltrated to the attackers over the WebSocket protocol. A number of the rip-off web sites have additionally been discovered to focus on Canadian, German, and Spanish residents and guests, per Netcraft.
• Meta’s New Collage Function Could Use Images in Cellphone’s Digital camera Roll — Meta is formally rolling out a brand new opt-in characteristic to Fb customers within the U.S. and Canada to counsel one of the best pictures and movies from customers’ digicam roll and create collages and edits. “Along with your permission and the assistance of AI, our new characteristic permits Fb to mechanically floor hidden gems – these memorable moments that get misplaced amongst screenshots, receipts, and random snaps – and edit them to save lots of or share,” the corporate said. The characteristic was first examined again in late June 2025. The social media firm emphasised that the solutions are personal and that it doesn’t use media obtained from customers’ units by way of the digicam roll to coach its fashions, until customers decide to edit the media with their AI instruments or publish these solutions to Fb. Customers who want to decide out of the characteristic can achieve this by navigating Settings and Privateness > Settings > Preferences > Digital camera Roll Sharing Strategies.
• Faux Homebrew, TradingView, LogMeIn Websites Serve Stealer Malware Concentrating on Macs — Menace actors are using social engineering ways to trick customers into visiting pretend web sites impersonating trusted platforms like as Homebrew, TradingView, and LogMeIn, the place they’re instructed to repeat and run a malicious command on the Terminal app as a part of ClickFix-style assaults, ensuing within the deployment of stealer malware akin to Atomic Stealer and Odyssey Stealer. “Greater than 85 phishing domains had been recognized, linked by way of shared SSL certificates, payload servers, and reused infrastructure,” Hunt.io said. “The findings counsel a coordinated and ongoing marketing campaign during which operators repeatedly adapt their infrastructure and ways to keep up persistence and evade detection throughout the macOS ecosystem.” It is suspected that customers are pushed to those web sites by way of sponsored advertisements on engines like google like Bing and Google.
• Dutch Information Safety Watchdog Fines Experian $3.2 Million for Privateness Violations — The Dutch Information Safety Authority (DPA) imposed a fantastic of €2.7 million ($3.2 million) on Experian Netherlands for accumulating knowledge in contravention of the E.U. Basic Information Safety Regulation (GDPR). The DPA mentioned the patron credit score reporting firm gathered info on folks from each public and personal sources and did not make it clear why the gathering of sure knowledge was mandatory. Along with the penalty, Experian is anticipated to delete the database of non-public knowledge by the tip of the 12 months. The corporate has additionally ceased its operations within the nation. “Till January 1, 2025, Experian offered credit score assessments about people to its shoppers,” the DPA said. “To do that, the corporate collected knowledge akin to damaging fee habits, excellent money owed, or bankruptcies. The AP discovered that Experian violated the regulation by unlawfully utilizing private knowledge.”
• Menace Actors Ship Faux Password Supervisor Breach Alerts — Unhealthy actors are sending phishing alerts claiming that their password supervisor accounts for 1Password and Lastpass have been compromised with the intention to trick customers into offering their passwords and hijack their accounts. In response to the assault, LastPass said it has not been hacked and that it is an try on the a part of the attackers to generate a false sense of urgency. In some cases noticed by Bleeping Laptop, the exercise has additionally been discovered to induce recipients to put in a safer model of the password supervisor, ensuing within the deployment of a authentic distant entry software program referred to as Syncro. The software program vendor has since moved to close down the malicious accounts to forestall additional installs.
• SocGholish MaaS Detailed — LevelBlue has printed an evaluation of a menace exercise cluster often known as SocGholish (aka FakeUpdates), which is thought to be lively since 2017, leveraging pretend internet browser replace prompts on compromised web sites as a lure to distribute malware. Victims are sometimes routed by way of Visitors Distribution Methods (TDS) like Keitaro and Parrot TDS to filter customers based mostly on particular components akin to geography, browser kind, or system configuration, making certain that solely the meant targets are uncovered to the payload. It is supplied below a malware-as-a-service (MaaS) by a financially motivated cybercrime group referred to as TA569. SocGholish stands out for its capacity to show authentic web sites into large-scale distribution platforms for malware. Appearing as an preliminary entry dealer (IAB), its operations revenue from follow-on compromises by different actors. “As soon as executed, its payloads vary from loaders and stealers to ransomware, permitting for in depth follow-up exploitation,” LevelBlue said. “This mix of broad attain, easy supply mechanisms, and versatile use by a number of teams makes SocGholish a persistent and harmful menace throughout industries and areas.” Considered one of its main customers is Evil Corp, with the malware additionally used to ship RansomHub in early 2025.

🎥 Cybersecurity Webinars

• The Practical Framework to Govern AI Agents Without Slowing Innovation → AI is altering every little thing quick — however for many safety groups, it nonetheless seems like a combat simply to maintain up. The aim is not to gradual innovation with extra controls; it is to make these controls work for the enterprise. By constructing safety into AI from the beginning, you’ll be able to flip what was a bottleneck into an actual accelerator for progress and belief.
• The Future of AI in GRC: Turning Risk Into a Compliance Advantage – AI is altering how firms handle threat and compliance — quick. It brings massive alternatives but additionally new challenges. This webinar reveals you find out how to use AI safely and successfully in GRC, keep away from frequent errors, and switch complicated guidelines into an actual enterprise benefit.
• Workflow Clarity: How to Blend AI and Human Effort for Real Results – Too many groups are dashing to “add AI” and not using a plan — and ending up with messy, unreliable workflows. Be part of us to study a clearer strategy: find out how to use AI thoughtfully, simplify automation, and construct techniques that scale securely.

🔧 Cybersecurity Instruments

• Beelzebub – It turns honeypot deployment into a strong, low-code expertise. It makes use of AI to simulate actual techniques, serving to safety groups detect assaults, monitor rising threats, and share insights by way of a worldwide menace intelligence community.
• NetworkHound – It maps your Energetic Listing community from the within out. It discovers each machine — domain-joined or shadow-IT — validates SMB and internet companies, and builds a full BloodHound-compatible graph so you’ll be able to see and safe your setting clearly.

Disclaimer: These instruments are for instructional and analysis use solely. They have not been absolutely security-tested and will pose dangers if used incorrectly. Assessment the code earlier than making an attempt them, take a look at solely in secure environments, and comply with all moral, authorized, and organizational guidelines.

🔒 Tip of the Week

Most Cloud Breaches Aren’t Hacks — They’re Misconfigurations. This is The way to Repair Them — Cloud storage buckets like AWS S3, Azure Blob, and Google Cloud Storage make knowledge sharing simple — however one improper setting can expose every little thing. Most knowledge leaks occur not due to hacking, however as a result of somebody left a public bucket, skipped encryption, or used a take a look at bucket that by no means bought locked down. Cloud platforms provide you with flexibility, not assured security, so it’s essential test and management entry your self.

Misconfigurations normally occur when permissions are too broad, encryption is disabled, or visibility is misplaced throughout a number of clouds. Doing handbook checks would not scale — particularly should you handle knowledge in AWS, Azure, and GCP. The repair is utilizing instruments that mechanically discover, report, and even repair unsafe settings earlier than they trigger harm.

ScoutSuite is a robust start line for cross-cloud visibility. It scans AWS, Azure, and GCP for open buckets, weak IAM roles, and lacking encryption, then creates an easy-to-read HTML report. **Prowler** goes deeper into AWS, checking S3 settings towards CIS and AWS benchmarks to catch dangerous ACLs or unencrypted buckets.

For ongoing management, Cloud Custodian permits you to write easy insurance policies that mechanically implement guidelines — for instance, forcing all new buckets to make use of encryption. And CloudQuery can flip your cloud setup right into a searchable database, so you’ll be able to monitor modifications, monitor compliance, and visualize dangers in a single place.

One of the best strategy is to mix them: run ScoutSuite or Prowler weekly to search out points, and let Cloud Custodian deal with automated fixes. Even just a few hours spent setting these up can cease the form of knowledge leaks that make headlines. At all times assume each bucket is public till confirmed in any other case — and safe it like it’s.

Conclusion

The reality is, no software or patch will ever make us absolutely safe. What issues most is consciousness — figuring out what’s regular, what’s altering, and the way attackers assume. Each alert, log, or minor anomaly is a clue. Preserve connecting these dots earlier than another person does.