Threat Intel Hub

November 13, 2025 By Zeljka Zorz The rumors were true: Operation Endgame, a joint effort between law enforcement and judicial authorities of several European countries, Australia, Canada, the UK and the US, has disrupted the infrastructure supporting the operation of the Rhadamanthys infostealer.“Between 10 and 14 November 2025, the latest phase of Operation Endgame was coordinated from Europol’s headquarters in The Hague. The actions targeted one of the biggest infostealers (Rhadamanthys), the Remote Access Trojan VenomRAT, and the botnet Elysium, all of which played a key role in international cybercrime. Authorities took down these three large cybercrime enablers,” Europol 

November 13, 2025 By Bill Toulas The ImunifyAV malware scanner for Linux servers, used by tens of millions of websites, is vulnerable to a remote code execution vulnerability that could be exploited to compromise the hosting environment.The issue affects versions of the AI-bolit malware scanning component prior to 32.7.4.0. The component is present in the Imunify360 suite, the paid ImunifyAV+, and in ImunifyAV, the free version of the malware scanner. According to security firm Patchstack, the vulnerability has been known since late October, when ImunifyAV's vendor, CloudLinux, released fixes. Currently, t

Google is targeting the threat group known as Smishing Triad, which used over 194,000 malicious domains in a campaign.  November 12, 2025 By Eduard Kovacs Google on Tuesday announced that it has filed a lawsuit against a cybercrime group believed to be operating out of China.The group, known as Smishing Triad, has been active since at least 2023, targeting users around the world in large-scale SMS phishing (smishing) campaigns. The group’s malicious SMS messages impersonate toll and package delivery services — Google provided E-ZPass and USPS as an example — as well as banks, healthc

Apple security updates 13th November 2025  Name and information link Available for Release date Compressor 4.11.1 macOS Sequoia 15.6 and later 13 Nov 2025  https://support.apple.com/en-us/100100

November 13, 2025 Placing a bet has never been this easy, and that’s the problem. The convenience of online gambling is the same thing scammers are cashing in on. Whether it’s a fake app, a “can’t-miss” tipster, or a rigged casino, the game is stacked against you.By 2030, the online gambling market is projected to reach around $169 billion. 22 percent of Americans, including 48 percent of men ages 18 to 49, have an account with at least one online sportsbook.With so many people willing to gamble, criminals see an easy chance to run scams

November 12, 2025 Holiday fraud in 2025 is evolving faster than ever, as attackers use AI, automation, and stolen data to launch large-scale campaigns.As the 2025 holiday season approaches, fraud activity is already accelerating.According to data from KasadaIQ, attackers are starting earlier, automating faster, and leveraging artificial intelligence (AI) to blur the line between human and bot activity.Across the retail, hospitality, and quick-service restaurant (QSR) industries, researchers warn that this year’s fraud landscape may surpass all previous records in both scale and sophistication.Unwrapping the top Holiday fraud trends of 2025Fraud operations have evolved into an industrial

November 12, 2025 4:22 pm Cyber adversaries aren’t standing still, and our defenses can’t either. In an environment where government networks face relentless, increasingly sophisticated attacks, it’s evident that perimeter-based security models belong in the past. A zero trust framework redefines the approach: Every user, device, and connection is treated as unverified until proven otherwise, or “trust but verify.” By assuming breach, zero trust delivers what today’s government missions demand: speed, resilience and the ability to contain damage before it spreads.To truly operationalize zero trust, agencies must look beyond theory and embrace emerging technologies. Many federal organizations are already turning to artificial intelligence and digital twins to get there. A digital twin — a software-based replica of a real-world network — creates an invaluable proving ground. Rather than waiting

CISA has released Emergency Cisco Directive 25-03 Implementation Guidance to assist federal agencies in addressing critical vulnerabilities in Cisco Adaptive Security Appliances (ASA) and Firepower devices. Emergency Directive 25-03: Identify and Mitigate Potential Compromise of Cisco Devices, issued on Sept. 25, identified known vulnerabilities CVE-2025-20333 and CVE-2025-20362, and mandated immediate action to mitigate risks. Threat actors continue to target these devices, posing significant risk to all organizations. 

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.CVE-2025-9242WatchGuard Firebox Out-of-Bounds Write Vulnerability CVE-2025-12480 Gladinet Triofox Improper Access Control Vulnerability CVE-2025-62215Microsoft Windows Race Condition VulnerabilityThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the f

November 12, 2025 Emergency Directive 25-03: Identify and Mitigate Potential Compromise of Cisco Devices states that CISA has assessed that the following CVEs pose an unacceptable risk to federal information systems: CVE-2025-20333 – allows for remote code execution CVE-2025-20362 – allows for privilege escalation 

Posted on November 12, 2025 by Dissent On November 7, a relatively new user on a hacking forum offered data allegedly from Doctor Alliance for sale. According to the seller, there is 353 GB of data comprising 1,240,640 files. “Contact us on signal to negociate this ransom or all your data will be sold,” the seller warned.  The ransom demand was listed as USD $200,000.00, with a deadline of November 21, 2025.Doctor Alliance is a Texas-headquartered vendor providing services for healthcare providers that include preparing, delivering, and signing documents, verifying that patients are bi

Intel, AMD and Nvidia have published security advisories describing vulnerabilities found recently in their products. November 12, 2025 By Eduard Kovacs Intel, AMD, and Nvidia have published security advisories describing vulnerabilities found recently in their products. Intel, which typically publishes advisories on a quarterly schedule, has released 30 new advisories to inform customers about more than 60 vulnerabilities.The chip giant fixed high-severity vulnerabilities in Xeon processors, Slim Bootloader for Xeon and Core processors, PROSet, Computing Improvement Program (CIP), Processor Identification Utility, Grap

November 12, 2025 By Efosa Udinmwen Leaked documents appear to offer a rare look into China’s cyber ecosystem (Image credit: Getty Images)12,000+ classified docs reveal deep links between Knownsec and Chinese state cyber operations The breach involved Remote Access Trojans capable of attacking global operating systems Researchers found 95GB of immigration data stolen from India’s national databasesA recent data breach at Chinese security firm

November 12, 2025 By Pierluigi Paganini  Synology fixed a critical BeeStation RCE flaw (CVE-2025-12686) shown at Pwn2Own, caused by unchecked buffer input allowing code execution.Synology patched a critical remote code execution (RCE) flaw, tracked as CVE-2025-12686 (CVSS score 9.8), in BeeStation, demonstrated during the hacking competition Pwn2Own Ireland 2025. BeeStation is a plug-and-play device that turns traditional storage into a personal cloud server. The vulnerability is caused by improper buffer size checks, allowing arbitrary code execution.“CVE-2025-12686 allows remote attackers to execute arbitrary code.” 

November 12, 2025 By Pierluigi Paganini  Australia’s spy chief warns China-linked actors are probing critical infrastructure and preparing for cyber sabotage and espionage.Australia’s intelligence chief Mike Burgess warned that China-linked threat actors are probing critical infrastructure and, in some cases, have gained access. He said at least two Chinese state-sponsored groups are positioning themselves for future sabotage and espionage operations against Australian networks, raising serious national security concerns about pre-emptive cyber intrusion and the potential disruption of critical infrastructure.Burgess said China-linked APT group Volt Typhoon

November 12, 2025 By Bill Toulas The DanaBot malware has returned with a new version observed in attacks, six-months after law enforcement's Operation Endgame disrupted its activity in May.According to security researchers at Zscaler ThreatLabz, there is a new variant of DanaBot, version 669, that has a command-and-control (C2) infrastructure using  Tor domains (.onion) and “backconnect” nodes.Zscaler also identified and listed several cryptocurrency addresses that threat actors are using to receive stolen funds, in BTC, ETH, LTC, and TRX.DanaBot was first disclosed by Proofpoint researchers as a De

Nov 12, 2025 Ravie Lakshmanan Network Security / Zero-DayAmazon's threat intelligence team on Wednesday disclosed that it observed an advanced threat actor exploiting two then-zero-day security flaws in Cisco Identity Service Engine (ISE) and Citrix

November 11, 2025Microsoft has released the latest Microsoft Edge Stable Channel (Version 142.0.3595.76) which incorporates the latest Security Updates of the Chromium project. For more information, see the Security Update Guide https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security Webroot SecureAnywhere users make sure to re-add back in the Privacy Protection area after every update. Click on GIF to see full size!  

Tuesday, November 11, 2025The Stable channel has been updated to 142.0.7444.162/.163 for Windows and 142.0.7444.162 for Mac and 142.0.7444.162 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. Security Fixes and RewardsNote: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

Hardcoded credentials in SQL Anywhere Monitor could allow attackers to execute arbitrary code on vulnerable deployments. November 11, 2025 By Ionut ArghireEnterprise software maker SAP on Tuesday announced the release of 18 new and one updated security note as part of its November 2025 security patches.The most important of SAP’s November 2025 notes deals with CVE-2025-42890 (CVSS score of 10/10), described as an insecure key and secret management vulnerability in SQL Anywhere Monitor.The bug exists because hardcoded credentials in SQL Anywhere Monitor could be exploited to execute arbitrary code on the affected systems, impactin

November 11, 2025 By Pierluigi Paganini  North Korea-linked APT Konni posed as counselors to steal data and wipe Android phones via Google Find Hub in Sept 2025.Genians Security Center researchers warn that the North Korea-linked Konni APT group (aka Kimsuky, Earth Imp, TA406, 

November 11, 2025 By Sergiu Gatlan A Chinese woman known as the "Bitcoin Queen" was sentenced in London to 11 years and eight months in jail for laundering Bitcoin from a £5.5 billion ($7.3 billion) cryptocurrency investment scheme.The sentence follows a seven-year investigation by the Met's Economic Crime team into international money laundering, which revealed that the 47-year-old woman, Zhimin Qian (also known as Yadi Zhang), was the head of a large-scale fraud campaign that defrauded over 128,000 victims in China between 2014 and 2017.This action also led to the seizure of 61,000 Bitcoin worth hundreds of millions of pounds at the t

 November 10, 2025 By Pieter Arntz Researchers at Zimperium identified Fantasy Hub, a new Android spyware developed and sold as a subscription on Russian-language cybercrime forums.Malware-as-a-Service (MaaS) means cybercriminals rent out to malware to other criminals, complete with the infrastructure necessary to harvest and abuse stolen information. Usually, it’s up to the buyer to spread the malware, but Fantasy Hub goes a step further—it comes with full documentation, video tutorials, and a subscription model that makes it easy for even inexperienced attackers to use. Its creators provide step-by-step guides to create fake Google Play pages that imitate apps li

November 11, 2025