Infostealer Targeting Android Devices

This infostealer, written in Python, specifically targets Android phones. It takes advantage of Termux to gain access to data and exfiltrates it via Telegram.

https://isc.sans.edu/diary/Infostealer%20Targeting%20Android%20Devices/32414

Attackers exploit recently patched Adobe Commerce Vulnerability CVE-2025-54236

Six weeks after Adobe's emergency patch, SessionReaper (CVE-2025-54236) has entered active exploitation. E-Commerce security company SanSec has detected multiple exploit attempts.

https://sansec.io/research/sessionreaper-exploitation

Patch for BIND and unbound nameservers CVE-2025-40780

The Internet Systems Consortium (ISC.org), as well as the Unbound project, patched a flaw that may allow for DNS spoofing due to a weak random number generator.

https://kb.isc.org/docs/cve-2025-40780

WSUS Exploit Released CVE-2025-59287

Hawktrace released a walk through showing how to exploit the recently patched WSUS vulnerability

https://hawktrace.com/blog/CVE-2025-59287

webctrl.cgi/Blue Angel Software Suite Exploit Attempts. Maybe CVE-2025-34033 Variant?

Our honeypots detected attacks that appear to exploit CVE-2025-34033 or a similar vulnerability in the Blue Angle Software Suite.

https://isc.sans.edu/diary/webctrlcgiBlue+Angel+Software+Suite+Exploit+Attempts+Maybe+CVE202534033+Variant/32410

Oracle Critical Patch Update

Oracle released its quarterly critical patch update. The update includes patches for 374 vulnerabilities across all of Oracle s products. There are nine more patches for Oracle s e-Business Suite.

https://www.oracle.com/security-alerts/cpuoct2025.html#AppendixEBS

Rust TAR Library Vulnerability

A vulnerability in the popular, but no longer maintained, async-tar vulnerability could lead to arbitrary code execution

https://edera.dev/stories/tarmageddon

What time is it? Accuracy of pool.ntp.org.

How accurate and reliable is pool.ntp.org? Turns out it is very good!

https://isc.sans.edu/diary/What%20time%20is%20it%3F%20Accuracy%20of%20pool.ntp.org./32390

Xubuntu Compromise

The Xubuntu website was compromised last weekend and served malware

https://floss.social/@bluesabre/115401767635718361

Squid Proxy Vulnerability

The Squid team fixed an information disclosure vulnerabilty that may leak authentication credentials.

https://github.com/squid-cache/squid/security/advisories/GHSA-c8cc-phh7-xmxr

Lanscope Endpoint Manager Vulnerablity

https://jvn.jp/en/jp/JVN86318557/index.html

Using Syscall() for Obfuscation/Fileless Activity

Fileless malware written in Python can uses syscall() to create file descriptors in memory, evading signatures.

https://isc.sans.edu/diary/Using%20Syscall%28%29%20for%20Obfuscation%20Fileless%20Activity/32384

AWS Outages

AWS has had issues most of the day on Monday, affecting numerous services.

https://health.aws.amazon.com/health/status

Time Server Hack

China reports a compromise of its time standard servers.

https://thehackernews.com/2025/10/mss-claims-nsa-used-42-cyber-tools-in.html

TikTok Videos Promoting Malware InstallationTikTok Videos Promoting Malware Installation

Tiktok videos advertising ways to obtain software like Photoshop for free will instead trick users into downloading

https://isc.sans.edu/diary/TikTok%20Videos%20Promoting%20Malware%20Installation/32380

Google Ads Advertise Malware Targeting MacOS Developers

Hunt.io discovered Google ads that pretend to advertise tools like Homebrew and password managers to spread malware

https://hunt.io/blog/macos-odyssey-amos-malware-campaign

Satellite Transmissions are often unencrypted

A large amount of satellite traffic is unencrypted and easily accessible to eavesdropping

https://satcom.sysnet.ucsd.edu

New DShield Support Slack Workspace

Due to an error on Salesforce s side, we had to create a new Slack Workspace for DShield support.

https://isc.sans.edu/diary/New%20DShield%20Support%20Slack/32376

Attackers Exploiting Recently Patched Cisco SNMP Flaw (CVE-2025-20352)

Trend Micro published details explaining how attackers took advantage of a recently patched Cisco SNMP Vulnerability

https://www.trendmicro.com/en_us/research/25/j/operation-zero-disco-cisco-snmp-vulnerability-exploit.html

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-x4LPhte

Framework BIOS Backdoor

The mm command implemented in Framework BIOS shells can be used to compromise a device pre-boot.

https://eclypsium.com/blog/bombshell-the-signed-backdoor-hiding-in-plain-sight-on-framework-devices/

SANS.edu Research: Mark Stephens, Validating the Effectiveness of MITRE Engage and Active Defense

https://www.sans.edu/cyber-research/validating-effectiveness-mitre-engage-active-defense/

Clipboard Image Stealer

Xavier presents an infostealer in Python that steals images from the clipboard.

https://isc.sans.edu/diary/Clipboard%20Pictures%20Exfiltration%20in%20Python%20Infostealer/32372

F5 Compromise

F5 announced a wide-ranging compromise today. Source code and information about unpatched vulnerabilities were stolen.

https://my.f5.com/manage/s/article/K000157005

https://my.f5.com/manage/s/article/K000156572

https://my.f5.com/manage/s/article/K000154696

Adobe Updates

Adobe updated 12 different products yesterday.

https://helpx.adobe.com/security.html

SAP Patchday

Among the critical vulnerabilities patched in SAP s products are two deserialization vulnerabilities with a CVSS score of 10.0

https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2025.html

https://onapsis.com/blog/sap-security-patch-day-october-2025/

Microsoft Patch Tuesday

Microsoft not only released new patches, but also the last patches for Windows 10, Office 2016, Office 2019, Exchange 2016 and Exchange 2019.

https://isc.sans.edu/diary/Microsoft%20Patch%20Tuesday%20October%202025/32368

Ivanti Advisory

Ivanti released an advisory with some mitigation steps users can take until the recently made public vulnerablities are patched.

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-October-2025?language=en_US

Fortinet Patches

https://fortiguard.fortinet.com/psirt/FG-IR-25-010

https://fortiguard.fortinet.com/psirt/FG-IR-24-361

Scans for ESAFENET CDG V5

We do see some increase in scans for the Chinese secure document management system, ESAFENET.

https://isc.sans.edu/diary/Heads%20Up%3A%20Scans%20for%20ESAFENET%20CDG%20V5%20/32364

Investigating targeted payroll pirate attacks affecting US universities

Microsoft wrote about how payroll pirates redirect employee paychecks via phishing.

https://www.microsoft.com/en-us/security/blog/2025/10/09/investigating-targeted-payroll-pirate-attacks-affecting-us-universities/

Attacks against Edge via IE Mode

Microsoft Edge offers an IE legacy mode to support websites created for Internet Explorer. The old JavaScript engine, which is part of this mode, has been abused in recent attacks, and Microsoft will make it more difficult to enable IE Mode to counter these attacks.

https://microsoftedge.github.io/edgevr/posts/Changes-to-Internet-Explorer-Mode-in-Microsoft-Edge/

New Oracle E-Business Suite Patches

Oracle released one more patch for the e-business suite. Oracle does not state if it is already exploited, but the timing of the patch suggests that it should be expedited.

https://www.oracle.com/security-alerts/alert-cve-2025-61884.html

Widespread Sonicwall SSLVPN Compromise

Huntress Labs observed the widespread compromise of the Sonicwall SSLVPN appliance.

https://www.huntress.com/blog/sonicwall-sslvpn-compromise

Active Exploitation of Gladinet CentreStack and Triofox Local File Inclusion Flaw (CVE-2025-11371)

An unpatched vulnerability in the secure file sharing solutions Gladinet CentreStack and TrioFox is being exploited.

https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw

Two 7-Zip Vulnerabilities CVE-2025-11002, CVE-2025-11001

7-Zip patched two vulnerabilities that may lead to arbitrary code execution

https://www.zerodayinitiative.com/advisories/ZDI-25-949/

https://www.zerodayinitiative.com/advisories/ZDI-25-950/