![Threat Research | Weekly Recap [16 Nov 2025]](https://www.hendryadrian.com/tweet/image/WeeklyRecap.png "Threat Research | Weekly Recap [16 Nov 2025]")
Cybersecurity Threat Research ‘Weekly’ Recap. This week highlights state-sponsored and APT activity, including APT35’s malware pipeline and SideWinder emulation guidance, plus DragonBreath’s RONINGLOADERloader and KONNI Android operations. It also covers diverse malware families like Lumma Stealer, LeakyInjector/LeakyStealer, Remcos, Amatera, XWorm, Rhadamanthys, and VenomRAT takedowns; ransomware trends with Qilin, Akira, Cl0p, Kraken, and Yurei analyses; phishing and credential theft campaigns; supply-chain and RMM abuse including Anthropic MCP SDK flaws and Triofox CVE; detection and threat-hunting advances; and emergent AI-driven malware, pig-butchering scams, Kubernetes trends, and macOS privilege escalation. #APT35 #SideWinder #Gh0stRAT #RONINGLOADER #KONNI #Lum maStealer #LeakyInjector #LeakyStealer #Remcos #Amatera #NetSupportRAT #XWorm #Rhadamanthys #VenomRAT #Qilin #Akira #Cl0p #Kraken #Yurei #Kimsuky #AI‑drivenmalware #PigButchering #Triofox #CVE-2025-12480 #CVE-2025-24277
Category: Cyber Security News
Google plans to take action against Android apps on Google Play that cause excessive battery drain by tracking background activity and wake locks. Developers are given a deadline of March 1, 2026, to update their apps to meet new resource utilization standards aimed at improving user experience. #AndroidVitals #ExcessiveWakeLocks
![Cybersecurity News | Daily Recap [15 Nov 2025]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [15 Nov 2025]")
Daily Recap, Five U.S. nationals pled guilty to schemes aiding North Korean IT workers and infiltrating 136 companies to move about $2 million, while North Korean actors leverage JSON services to deliver malware. The roundup covers extortion, vulnerabilities, AI & ML security flaws, and nation-state operations influencing global cyber risk — including CL0P breaches, FortiWeb zero-days, Akira ransomware, and SpearSpecter campaigns. #NKGuilty #JSONMalware #CL0PHits #FortiWebZeroDay #AkiraRansomware #SpearSpecter
Microsoft is investigating a bug causing the Windows 10 KB5068781 security update to fail installation with error 0x800f0922 on devices with corporate licenses. The issue impacts Windows subscription activation through the Microsoft 365 Admin Center, leading to rollback of updates post-restart. #KB5068781 #WindowsUpdate #Microsoft365AdminCenter
Jaguar Land Rover suffered a costly cyberattack, leading to production shutdowns and a significant financial loss of £196 million in the quarter. The UK government stepped in with a £1.5 billion loan guarantee to support the company’s recovery efforts. #ScatteredLapsus$ #JLR #UKGovernment
The traditional “finger” command is being exploited by threat actors to deliver remote commands and malware on Windows devices. These attacks use the protocol to download Python malware, RATs, and evade detection, highlighting the need for traffic filtering. #ClickFix #NetSupportManagerRAT
RondoDox botnet is increasingly exploiting unpatched XWiki instances using a critical vulnerability (CVE-2025-24893) to deploy cryptocurrency miners and conduct DDoS attacks. The surge in exploitation attempts highlights the importance of timely patching and robust security practices. #RondoDox #CVE-2025-24893…
Five individuals have pleaded guilty to aiding North Korea’s IT worker fraud schemes, which involved hacking, identity theft, and fraudulent employment across the U.S. These schemes have generated over $2.2 million for North Korea and impacted more than 136 U.S. companies. #NorthKorea #APT38 #Cybercriminals…
Daily Recap, Akira ransomware funds and CISA warnings highlight an imminent threat to Nutanix VMs, while the ransomware ecosystem shows fragmentation with LockBit and Kraken enhancing encryption strategies. The batch of breaches, exploits, phishing, and policy shifts underscores a widening threat landscape across data breaches, DDoS, auth-bypass flaws, and AI-assisted espionage. #Akira #CISA #Nutanix #LockBit #Kraken #Checkout.com #WashingtonPost #Oracle #DoorDash #DDoS #FortiWeb #Imunify360 #ImunifyAV #CiscoISE #CitrixBleed #ASUS #ChatGPT #Claude #Lighthouse #ANY.RUN #Zimbra #Rhadamanthys #VenomRAT #Elysium
Five individuals pleaded guilty to aiding North Korea’s illicit revenue schemes through identity theft and remote IT worker fraud, impacting over 136 companies and generating millions for the DPRK regime. The U.S. authorities have seized $15 million linked to cyber-heists orchestrated by APT38, a group associated with Lazarus, which targeted cryptocurrency platforms worldwide. #NorthKorea #APT38 #Lazarus #cyberheists #cryptoforfeitures
Logitech suffered a data breach linked to a zero-day vulnerability exploited by the Clop extortion gang, with nearly 1.8 TB of data leaked. The breach was caused by an Oracle E-Business Suite zero-day, but impacts did not affect Logitech’s core operations or sensitive financial information. #Clop #OracleCVE61882
The Justice Department uncovered a North Korean scam involving IT workers, identity theft, and cryptocurrency thefts, seizing over $15 million. This operation impacted numerous U.S. companies and involved multiple U.S. nationals aiding North Korean hackers. #North Korea #APT38 #CryptocurrencyTheft…
Fortinet warns of a critical vulnerability in FortiWeb (CVE-2025-64446) that attackers are actively exploiting to gain remote administrative access. Cybersecurity agencies and firms urge immediate patching to prevent widespread compromise. #FortiWeb #CVE202564446…
The Washington Post confirmed it was breached through a cyberattack exploiting Oracle E-Business Suite vulnerability CVE-2025-61884, affecting nearly 10,000 individuals. The CL0P ransomware group has claimed over 40 victims in a broader campaign targeting Oracle E-Business Suite vulnerabilities. #CVE-2025-61884 #CL0P #OracleEBS #DataBreach…
A coalition of civil society organizations warns that the upcoming EU Digital Omnibus proposals seek to weaken critical data protection laws like GDPR and AI regulations, risking increased surveillance and reduced privacy. They call for transparency and oppose the deregulation measures that could undermine Europe’s digital rights and societal protections. #GDPR…