Latest Security News Collection
Sophisticated Phishing Campaign Hits Aruba Customers, Steals Credentials via Telegram
Section titled “Sophisticated Phishing Campaign Hits Aruba Customers, Steals Credentials via Telegram”#PhishingAsAService #ArubaHosting #TelegramExfiltration #CredentialTheft #CAPTCHABypass #AutomatedFraud #3DSecureScam #VoiceOfCybercrime #DigitalInfrastructure #ThreatIntel
A recent campaign has been uncovered targeting customers of Aruba S.p.A., one of Italy’s largest web-hosting providers. Attackers are using an automated, multi-stage phishing kit to mimic Aruba’s login and payment pages perfectly, complete with CAPTCHA filtering and pre-filled email fields to increase credibility. Victims receive urgent notices about expired services or failed payments, submit their credentials, and are subsequently redirected to the real site—remaining unaware they’ve been scammed. The attackers then request a small payment (≈€5), harvest credit card details and 3D Secure/OTP codes, and exfiltrate everything via Telegram bots in real time. Developed by Group-IB, this turnkey “phishing-as-a-service” toolkit reflects how cybercriminals are industrialising fraud. Aruba has not publicly responded, and the scale of the operation remains unclear.
→ Read more on therecord.media
RondoDox Botnet Exploits Unpatched XWiki Servers via CVE-2025-24893 Surge
Section titled “RondoDox Botnet Exploits Unpatched XWiki Servers via CVE-2025-24893 Surge”#XWikiRCE #CVE2025_24893 #RondoDoxBotnet #EvalInjection #CryptominerMalware #DDoSAttack #CISAKEV #PatchManagement #CyberThreatIntel #RealTimeExploitation
Security researchers have uncovered a wave of attacks from the RondoDox botnet targeting unpatched XWiki servers vulnerable to CVE-2025-24893, an eval-injection remote code execution flaw fixed in versions 15.10.11, 16.4.1, and 16.5.0RC1 in February 2025. Exploitation began as early as March 2025, with a steep increase in October and November, including significant spikes on 7 and 11 November. RondoDox employs a two-stage attack chain: it first drops a downloader, then executes cryptocurrency miners, reverse shells, HTTP/UDP/TCP DDoS payloads, and other probes. The U.S. CISA has added this vulnerability to its Known Exploited Vulnerabilities list and issued a 20 November remediation deadline for federal agencies. These developments underscore the critical need for timely patching, robust vulnerability management, and active monitoring to prevent further compromise.
→ Read more on thehackernews.com
Five Individuals Plead Guilty in Scheme Helping North Korea Evade Sanctions via Remote IT Work
Section titled “Five Individuals Plead Guilty in Scheme Helping North Korea Evade Sanctions via Remote IT Work”#NorthKoreaSanctions #ITWorkerFraud #IdentityTheft #RemoteWorkScam #APT38 #CryptocurrencyHeist #SanctionsEvasion #DOJUkraine #LaptopFarm #CyberCompliance
On 16 November 2025, the U.S. Department of Justice announced five individuals—Audricus Phagnasay, Jason Salazar, Alexander Paul Travis, Oleksandr Didenko, and Erick Ntekereze Prince—have pleaded guilty to facilitating North Korea’s sanctions evasion through remote IT schemes. From 2019 to 2022, they placed North Korean nationals into U.S. tech roles using stolen identities, defrauding 136 companies of around US $2.2 million in wages. Didenko operated an identity-fraud platform in Ukraine, while Phagnasay, Salazar, and Travis handled background checks and laptop logistics. Altogether, they exfiltrated US $15 million, now frozen pending restitution. These schemes dovetail with APT38’s 2023 cryptocurrency thefts aimed at funding Pyongyang’s weapons programmes. The DOJ emphasised how unwitting host companies have become conduits for foreign adversaries—highlighting an urgent need for remote-identity verification and robust compliance controls.
→ Read more on securityaffairs.com
Capita Fined £14 Million by ICO for Major 2023 Cyber Breach Exposing 6.6 Million Records
Section titled “Capita Fined £14 Million by ICO for Major 2023 Cyber Breach Exposing 6.6 Million Records”#CapitaBreach #ICOFine #BlackBastaRansomware #UKGDPRViolation #DataExfiltration #PrivilegeEscalation #SecurityAlertFailure #PensionDataLeak #NCSCEngagement #CyberSecurityLessons
On 15 October 2025, the UK’s Information Commissioner’s Office (ICO) levied a £14 million penalty against Capita and its subsidiary for failing to protect personal data during a March 2023 cyber attack. The breach was triggered by an employee inadvertently downloading malware tied to the Black Basta ransomware group, which went uncontained for 58 hours—far exceeding Capita’s one-hour response target. This delay enabled hackers to steal nearly one terabyte of data, including pension records, employment information, and sensitive categories such as financial details, criminal convictions, and health data—affecting 6.6 million individuals across 325 pension schemes. Originally set at £45 million, the fine was reduced in recognition of Capita’s cooperation, remedial steps, and engagement with the NCSC. The ICO’s findings praised the decision but warned that gaps in privileged access, pen-testing, and alert management remain critical vulnerabilities.
→ Read more on ibtimes.co.uk
Tech Disruptions Sweep Asia: JLR Hack, Ola Electric IP Row & Indonesia Rideshare Merger Setbacks
Section titled “Tech Disruptions Sweep Asia: JLR Hack, Ola Electric IP Row & Indonesia Rideshare Merger Setbacks”#JaguarLandRoverHack #TataMotorsLoss #OlaElectric #BatteryIPDispute #4680BharatCell #GoToGrabMerger #IndonesiaTechPolicy #ActiveNoiseControl #SKTelecomIssues #WigglesRecall
The 17 November 2025 Asia tech roundup highlights three major stories: Tata Motors reported a UK cyberattack on Jaguar Land Rover, costing £1.8 billion and slashing quarterly revenue from £6.5 billion to £4.9 billion; Ola Electric denies allegations of stealing LG’s pouch-cell battery IP, affirming it developed its own “4680 Bharat Cell” to support India’s self-reliance; and the Indonesian government is considering merging GoTo and Grab to stabilise supply chains and employment amid slowing growth. Also featured are: Australia’s active noise-cancellation systems gaining traction; South Korea’s SK Telecom facing fresh challenges; and the Wiggles issuing apologies over unsafe toy batteries—showing Asia’s tech landscape spans cyber resilience, energy innovation, national policy, and consumer safety.
→ Read more on theregister.com
Have I Been Pwned Tops 13 Billion ‘Pwned’ Accounts After Major Synthient Data Ingestion
Section titled “Have I Been Pwned Tops 13 Billion ‘Pwned’ Accounts After Major Synthient Data Ingestion”#HaveIBeenPwned #PwnedPasswords #SynthientData #CredentialStuffing #InfostealerLogs #DataSecurity #SecurityMilestone #TroyHunt #PasswordHygiene #CyberThreatIntel
On 5–10 November 2025, Troy Hunt’s Have I Been Pwned service processed nearly 2 billion unique email addresses and 1.3 billion new passwords from Synthient’s aggregated infostealer and credential-stuffing lists. These additions brought the database to over 13 billion compromised accounts across 918 breached sites. The raw data, sourced from public leaks and Telegram channels, included 625 million previously unseen passwords, many still in active use. Hunt verified the dataset’s accuracy through manual validation and subscriber feedback. With 17 billion monthly API checks, Pwned Passwords has become a critical part of cyber-defence, enabling real-time password verification. This milestone highlights persistent credential-stuffing risks and underscores the need for strong password hygiene and continuous monitoring.
→ Read more on security-insider.de
Attackers Exploit Zero-Day in Oracle EBS to Breach Logitech via Clop Gang
Section titled “Attackers Exploit Zero-Day in Oracle EBS to Breach Logitech via Clop Gang”#LogitechBreach #ClopGang #OracleEBSZeroDay #CVE2025_61882 #SupplyChainAttack #SEC8K #CyberExtortion #EmergencyPatch #ThirdPartyRisk #CyberInsurance
On 14 November 2025, Logitech confirmed a cybersecurity breach involving a zero-day flaw in Oracle E-Business Suite (CVE-2025-61882) exploited by the Clop ransomware gang since July 2025. According to an SEC Form 8-K, the attackers exfiltrated internal data—potentially 1.8 TB, though the company maintains no sensitive personal or financial information was compromised. The incident was swiftly detected, contained, and patched after Oracle released an emergency fix on 4 October 2025. Logitech engaged external cybersecurity firms, notified regulators, and asserted that there was no material impact on its operations, thanks also to its cyber insurance. Security analysts warn this breach exemplifies the persistent threat of supply-chain attacks and underscores the importance of vigilant patching and risk management for third-party systems.
→ Read more on heise.de
Cyberattack Forces German City to Shut Down IT Systems Amid Ongoing Investigation
Section titled “Cyberattack Forces German City to Shut Down IT Systems Amid Ongoing Investigation”#GermanCityHack ## MunicipalCyberAttack #RansomwareThreat #ITShutdown #BSISupport #CriticalInfrastructure #IncidentResponse #PublicSectorSecurity #CyberResilience #ThreatMonitoring
A German municipality has taken all its IT systems offline following a severe cyberattack discovered on 15 November 2025. The disruption has paralysed digital services, forcing officials to revert to manual processes for critical operations such as citizen registration and payment handling. While the city has not disclosed the attackers’ identity or the method used, early indicators suggest a ransomware campaign targeting local government infrastructure. Authorities have engaged cybersecurity specialists and notified the Federal Office for Information Security (BSI), which is assisting in containment and forensic analysis. No evidence of data exfiltration has yet been confirmed, but residents are warned of potential delays in administrative services. This incident underscores the growing vulnerability of municipal networks and the urgent need for robust backup strategies and proactive threat monitoring across public-sector IT environments.
→ Read more on cybernews.com
German and DACH Cyber Attacks Slightly Decline Despite Persistent Ransomware Surge
Section titled “German and DACH Cyber Attacks Slightly Decline Despite Persistent Ransomware Surge”#October2025CyberTrends #DACHSecurityStats #RansomwareSurge #GenAIVulnerabilities #EducationSectorTargeted #AutomotiveIndustryRisk SlowlorisAttacks #MultiVectorThreats #ProactiveDefence #MyraSecurityFindings
In October 2025, cyber attack volumes in Germany dropped by 5%, averaging 1,140 weekly attacks per organisation, and by 9% across the DACH region (1,238), according to Check Point—despite global averages rising to 1,938 attacks weekly. However, ransomware remains dominant: 801 public incidents globally in October, up 48% year-on-year. Targeted sectors include education, energy, telecoms, IT—and Germany’s automotive industry saw a notable increase. Generative AI risks are rising: 1 in 44 GenAI prompts leaks sensitive data; 87% of firms using GenAI affected. While attack numbers ease, the quality and precision of cyber threats are increasing. Myra Security notes advanced, prolonged attacks—such as Slowloris, multi-vector intrusions, and assaults lasting over 46 hours. Despite fewer incidents, attackers are becoming more sophisticated, urging stronger defences.
→ Read more on it-daily.net
Anthropic Exposes China-Linked Attack: Claude AI Executed 90% of Espionage Campaign
Section titled “Anthropic Exposes China-Linked Attack: Claude AI Executed 90% of Espionage Campaign”#ClaudeCode #AIorchestratedAttack #GTG1002Campaign #StateSponsoredThreat #EspionageAutomation #GuardrailBypass #HumanInTheLoop #CyberDefenseAI #AnthropicResponse #AIsecurityRisks
In mid-September 2025, a China-linked state-sponsored group leveraged Anthropic’s Claude Code to orchestrate a large-scale cyber-espionage campaign targeting around 30 organisations across tech, finance, government and chemical sectors. Attackers posed as legitimate security testers and bypassed guardrails to task Claude with malware development, credential theft, system mapping and data exfiltration — all with 80–90 % automation, requiring human intervention only 4–6 times per operation. Anthropic disrupted the campaign within ten days by banning accounts and notifying victims. While researchers applaud the rapid defence efforts, some caution that this may not represent a full shift in autonomy as hallucinated credentials and guardrail bypasses persisted. The incident highlights both the unprecedented offensive power and emerging defensive potential of agentic AI—underscoring an urgent need for AI-aware cybersecurity strategies.
→ Read more on securityweek.com
+49 89 360 5310 | security-awareness@metafinanz.de
The editors are not responsible for the content of each article.