Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, and significant data breaches to keep you informed and secure in the ever-evolving digital landscape.
1. North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts
Published: 2025-10-16
A North Korean threat actor tracked as UNC5342 has used the EtherHiding technique to distribute malware and steal cryptocurrency, marking the first state-sponsored adoption of this method. The campaign, codenamed Contagious Interview, involves LinkedIn lures posing as recruiters to trick targets into running malicious code via Telegram or Discord. Google Threat Intelligence Group attributes this to the group’s ongoing efforts for financial gain.
2. Hackers Abuse Blockchain Smart Contracts to Spread Malware via Infected WordPress Sites
Published: 2025-10-16
The financially motivated threat actor UNC5142 has abused blockchain smart contracts using EtherHiding to distribute info-stealers like Atomic, Lumma, Rhadamanthys, and Vidar targeting Windows and macOS. Google flagged about 14,000 compromised WordPress pages with injected JavaScript as of June 2025, indicating broad targeting of vulnerable sites. No activity has been observed since July 23, 2025, possibly due to a pause or shift.
3. LinkPro Linux Rootkit Uses eBPF to Hide and Activates via Magic TCP Packets
Published: 2025-10-16
Synacktiv discovered the LinkPro Linux rootkit in a compromised AWS infrastructure, which uses eBPF modules to hide itself and activate via magic packets. The infection started with an exploited Jenkins server vulnerable to CVE-2024–23897, leading to deployment of a malicious Docker image on Kubernetes clusters. The image includes a Kali Linux base with scripts to start SSH and execute additional files.
4. Hackers Deploy Linux Rootkits via Cisco SNMP Flaw in “Zero Disco” Attacks
Published: 2025-10-16
Trend Micro detailed Operation Zero Disco, exploiting CVE-2025-20352 in Cisco IOS Software for arbitrary code execution via SNMP packets to deploy Linux rootkits on older devices. The campaign targeted Cisco 9400, 9300, and 3750G series, also attempting a modified Telnet flaw based on CVE-2017-3881. Cisco patched the vulnerability last month after zero-day exploitation.
5. ThreatsDay Bulletin: $15B Crypto Bust, Satellite Spying, Billion-Dollar Smishing, Android RATs & More
Published: 2025-10-16
This weekly bulletin highlights evolving cyber threats where hackers exploit trusted tools for scams, data theft, and control, including a $15B cryptocurrency seizure from Southeast Asian scam networks tied to slavery. It covers topics like satellite spying, billion-dollar smishing, and Android RATs, emphasizing how criminals turn everyday tech into weapons. The issue discusses failing defenses and implications for connected users.
6. CISA Flags Adobe AEM Flaw with Perfect 10.0 Score — Already Under Active Attack
Published: 2025-10-16
CISA added CVE-2025-54253, a critical misconfiguration in Adobe Experience Manager Forms allowing arbitrary code execution, to its KEV catalog due to active exploitation. The flaw affects versions 6.5.23.0 and earlier, patched in August 2025 alongside CVE-2025-54254, an XXE injection vulnerability. Searchlight Cyber disclosed the authentication bypass to RCE chain in July 2025.
7. Chinese Threat Group ‘Jewelbug’ Quietly Infiltrated Russian IT Network for Months
Published: 2025-10-15
Symantec attributed a five-month intrusion from January to May 2025 into a Russian IT provider to the Chinese-linked Jewelbug group, expanding beyond Southeast Asia and South America. The attackers accessed code repositories and build systems for potential supply chain attacks on Russian customers. This indicates Russia remains a target for Chinese cyber espionage despite bilateral ties.
8. F5 Breach Exposes BIG-IP Source Code — Nation-State Hackers Behind Massive Intrusion
Published: 2025-10-15
F5 disclosed a breach where a sophisticated nation-state actor stole BIG-IP source code and vulnerability details after gaining long-term network access, detected on August 9, 2025. The company delayed disclosure at the U.S. Department of Justice’s request and implemented containment measures with no new unauthorized activity since. F5 believes efforts have been successful but did not specify access duration.
Stay Vigilant
Cyber threats are evolving rapidly. Subscribe to our newsletter for daily updates, and consider implementing robust security tools and practices to monitor and protect your systems from vulnerabilities and attacks. Stay safe online!