Microsoft has identified a critical bug in Windows 11 24H2 that causes system components like File Explorer and Start Menu to crash after recent cumulative updates since July 2025. Microsoft is working on a fix, but temporary workarounds involve manually registering XAML packages; affected environments include non-persistent virtual desktops. #Windows11 #XAMLPackages
Category: Cyber Security News
A newly exploited security flaw in Microsoft Windows Server Update Services (WSUS) has been used by threat actors to deploy ShadowPad malware, a sophisticated backdoor associated with Chinese hacking groups. The vulnerability CVE-2025-59287 enables remote code execution, allowing attackers to gain system privileges and establish persistent access. #CVE2025-59287 #ShadowPad #WSUS #ChineseEspionage…
CrowdStrike terminated a suspicious insider who shared internal screenshots externally, which were then posted by the Scattered Lapsus$ Hunters hacking group. The incident underscores the importance of insider threat detection and continuous monitoring for high-value enterprise systems. #ScatteredLapsus$Hunters #CrowdStrike #InsiderThreats…
Google’s Threat Intelligence Group (GTIG) uncovered a sophisticated cyber-espionage campaign by APT24, primarily targeting organizations in Taiwan through the BADAUDIO downloader. The campaign spans over three years and involves complex delivery methods including web compromises, supply chain attacks, and spear-phishing, demonstrating high-level technical obfuscation and strategic planning. #APT24 #BADAUDIO…
![Threat Research | Weekly Recap [23 Nov 2025]](https://www.hendryadrian.com/tweet/image/WeeklyRecap.png "Threat Research | Weekly Recap [23 Nov 2025]")
Cybersecurity Threat Research ‘Weekly’ Recap highlights a broad spectrum of activity, from APT and state-backed espionage campaigns to email, banking malware, ransomware, phishing, and supply-chain abuse, along with updates on detection and defensive tooling. Key actors and families mentioned include APT35, APT24, ToddyCat, MuddyWater, UNC1549, Curly COMrades, Kimsuky, NotDoor, WaterSaci, Astaroth, Eternidade, Sarcoma, Lynx, Akira, The Gentlemen, Tycoon2FA, Tsundere, PlushDaemon, NKNShell, TamperedChef, and related C2 and advancement trends.
#APT35 #APT24 #ToddyCat #MuddyWater #UNC1549 #CurlyCOMrades #Kimsuky #NotDoor #WaterSaci #Astaroth #Eternidade #Sarcoma #Lynx #Akira #TheGentlemen #Tycoon2FA #Tsundere #PlushDaemon #NKNShell #TamperedChef
This article highlights an exclusive holiday promotion for new Costco members, offering a 1-Year Gold Star Membership plus a $40 Digital Costco Shop Card for $65. It also details how to sign up, the benefits of shopping at Costco during the holidays, and additional offers available online. #CostcoMembership #DigitalShopCard
Passwork 7 introduces a comprehensive credentials management platform that integrates both password and secret management within a single, secure, self-hosted system. It features flexible vault structures, granular RBAC controls, extensive automation options, and a zero-knowledge architecture, catering to the complex needs of enterprise organizations. #Passwork7 #SecretsManagement #EnterprisePasswordManager
Google has introduced interoperability between Android Quick Share and Apple AirDrop, allowing file sharing between Pixel devices and iPhones. This new feature promises secure, cross-platform data transfer, initially supporting Pixel 10-series devices and aiming for broader compatibility in the future. #AirDrop #QuickShare #Pixel10Series
Iberia has reported a data security incident stemming from a breach at one of its suppliers, exposing some customer information. The incident follows a threat actor claiming to have stolen 77 GB of airline data and attempting to sell it online. #Iberia #DataBreach #HackerForum #CustomerData #ThirdPartyVendor
![Cybersecurity News | Daily Recap [22 Nov 2025]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [22 Nov 2025]")
Daily Recap, Active exploitation of a critical Oracle Identity Manager RCE and a CVSS 10 Grafana SCIM flaw prompts urgent advisories, while a new Matrix Push C2 campaign uses browser notifications for cross-platform phishing and an Android Spy variant exfiltrates audio and encrypted messages. Patches from Nvidia and Microsoft fix gaming issues and the Windows 11 hotpatch install loop, Google adds AirDrop compatibility to Android Quick Share, and investigations cover Scattered Spider, insider activity at CrowdStrike, the SolarWinds dismissal, GridEx VIII, FCC rollback, APT31 hacks, and Flock Safety surveillance. #OracleOIM #GrafanaSCIM #MatrixPush #AndroidSpy #NVIDIA #Windows11 #QuickShare #GridExVIII #APT31 #FlockSafety #ScatteredSpider #CrowdStrikeInsider #SolarWinds #Oklahoma #Massachusetts #WhatsAppNSO #CISA
This article details how Huntress analysts investigated a Qilin ransomware incident using limited post-attack data sources, emphasizing the importance of correlating multiple clues to understand the attack. It highlights the challenges of delayed agent deployment and the value of cross-referencing logs, threat intelligence, and endpoint artifacts. #QilinRansomware #HuntressLabs
Cox Enterprises experienced a data breach resulting from a zero-day exploit in Oracle E-Business Suite, leading to the exposure of personal data for thousands of individuals. The breach was linked to Cl0p ransomware group, which has a history of exploiting unknown vulnerabilities in widely used software. #CVE-2025-61882 #Cl0p
Researchers discovered a massive data leak involving 3.5 billion WhatsApp accounts through abuse of an API lacking rate limiting, exposing personal information worldwide. WhatsApp responded by adding protections, but the incident highlights a common vulnerability in unprotected APIs exploited by threat actors. #WhatsApp #APITraffic #DataLeak
APT31, a China-linked cyber espionage group, has targeted Russian IT companies using cloud services and stealthy techniques from 2024 to 2025. Their operations involve sophisticated toolsets, social media command channels, and data exfiltration, posing serious threats to government, financial, and tech sectors. #APT31 #CloudServices…
A critical vulnerability in Oracle Identity Manager has been added to the CISA KEV list due to active exploitation, allowing remote code execution. Organizations are urged to patch by December 12, 2025, to prevent potential breaches. #OracleIdentityManager #CISAKEV…