Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, and significant data breaches to keep you informed and secure in the ever-evolving digital landscape.
1. China-Linked APT31 Launches Stealthy Cyberattacks on Russian IT Using Cloud Services
Published: 2025-11-22
The China-linked APT group APT31 has been attributed to cyberattacks targeting the Russian IT sector between 2024 and 2025, remaining undetected for extended periods. Researchers from Positive Technologies noted that the attacks focused on companies working as contractors and integrators for government agencies. APT31, active since at least 2010, has a history of targeting various sectors including governments, finance, and telecommunications.
2. Matrix Push C2 Uses Browser Notifications for Fileless, Cross-Platform Phishing Attacks
Published: 2025-11-22
Attackers are using browser notifications as a vector for phishing via a new command-and-control platform called Matrix Push C2, which is fileless and operates across operating systems. Victims are tricked into allowing notifications on malicious or compromised sites, after which attackers send fake alerts mimicking system or browser messages. These alerts, such as those about suspicious logins or updates, include malicious links to maintain the deception.
3. CISA Warns of Actively Exploited Critical Oracle Identity Manager Zero-Day Vulnerability
Published: 2025-11-22
CISA has added a critical flaw in Oracle Identity Manager, CVE-2025-61757 (CVSS 9.8), to its Known Exploited Vulnerabilities catalog due to active exploitation. The vulnerability involves missing authentication, allowing pre-authenticated remote code execution and affecting versions 12.2.1.4.0 and 14.1.2.1.0, which Oracle patched last month. Researchers noted it enables manipulation of authentication flows and privilege escalation via API endpoints.
4. Grafana Patches CVSS 10.0 SCIM Flaw Enabling Impersonation and Privilege Escalation
Published: 2025-11-21
Grafana has patched a maximum severity vulnerability CVE-2025-41115 (CVSS 10.0) in its SCIM component, which could allow privilege escalation or user impersonation if SCIM provisioning is enabled. The flaw, introduced in April 2025 and in public preview, involves user identity handling that permits a malicious SCIM client to provision users with numeric externalIds, overriding internal user IDs. Successful exploitation requires specific configurations like the enableSCIM flag being set to true.
5. Tycoon2FA Launches Nearly 1 Million Attacks Targeting Office 365 Accounts
Published: 2025-11-23 (estimated)
Tycoon2FA, a sophisticated phishing-as-a-service platform tracked by Microsoft as Storm-1747, has emerged as the dominant threat targeting Office 365 accounts throughout 2025. The cybercriminals behind it have launched nearly 1 million attacks, using advanced techniques to bypass multi-factor authentication. This platform enables widespread phishing campaigns, posing significant risks to enterprise email security.
6. Hackers Use Salesforce Gainsight Breach to Access Data from More Than 200 Companies
Published: 2025-11-23 (estimated)
Salesforce has disclosed a significant security incident involving unauthorized access to customer data through compromised Gainsight-published applications. The breach, detected in mid-November 2025, potentially affected more than 200 companies by exposing sensitive information. Investigators are working to determine the full scope, but initial reports indicate targeted exploitation of third-party integrations.
7. CrowdStrike Fires Employee for Leaking Internal System Info to Hackers
Published: 2025-11-23 (estimated)
Cybersecurity giant CrowdStrike has terminated an employee who allegedly shared sensitive internal system information with a notorious hacking collective. The incident involved the leak of screenshots from internal systems, which were posted on Telegram by threat actors. This insider threat highlights ongoing risks even within leading security firms.
8. Metasploit Releases New Exploit for Fresh FortiWeb 0-Day Vulnerabilities
Published: 2025-11-23 (estimated)
Rapid7’s Metasploit team has released a new exploit module targeting critical zero-day vulnerabilities in Fortinet’s FortiWeb web application firewall, chaining two security flaws to achieve remote code execution. The vulnerabilities allow attackers to bypass protections and execute arbitrary commands. Users are urged to patch immediately as exploitation in the wild is expected soon.
Stay Vigilant
Cyber threats are evolving rapidly. Subscribe to our newsletter for daily updates, and consider using tools like vulnerability scanners to monitor your systems for emerging risks and automate security patches. Stay safe online!