ShinyHunters Launches Data Leak Site: Trinity of Chaos Announces New Ransomware Victims
Source: https://securityaffairs.com/182918/cyber-crime/shinyhunters-launches-data-leak-site-trinity-of-chaos-announces-new-ransomware-victims.html
This SecurityWeek roundup highlights multiple cybersecurity issues including new Android spyware targeting UAE users, a data breach at FEMA via Citrix exploitation, and vulnerabilities in Tile trackers. The Android spyware, disguised as legitimate apps, requires manual installation and exfiltrates sensitive data. The FEMA breach involved exploitation of a Citrix vulnerability dubbed CitrixBleed 2, leading to employee data theft and organizational repercussions. Tile tracker vulnerabilities allow unauthorized location tracking and compromise anti-theft features. Additional concerns include phishing campaigns abusing industrial routers and evolving post-quantum cryptography adoption. While no single exploit is widespread, these combined threats pose medium-level risks, especially to organizations with exposed infrastructure or users in affected regions. European entities should be vigilant about supply chain and endpoint security, particularly regarding mobile devices and IoT trackers. Mitigations include strict app installation policies, patching Citrix products, network segmentation, and enhanced monitoring of IoT devices. Countries with significant Citrix deployments, industrial infrastructure, and mobile user bases, such as Germany, the UK, France, Belgium, and the UAE-linked diaspora, are most likely affected.
Red Hat confirms security incident after hackers breach GitLab instance
Source: https://www.bleepingcomputer.com/news/security/red-hat-confirms-security-incident-after-hackers-breach-gitlab-instance/
Confucius Hackers Hit Pakistan With New WooperStealer and Anondoor Malware
Source: https://thehackernews.com/2025/10/confucius-hackers-hit-pakistan-with-new.html
A new campaign is distributing the Oyster (Broomstick) backdoor through trojanized Microsoft Teams installers. Threat actors are using SEO poisoning and malvertising to trick users into downloading fake installers from spoofed websites. The malicious installers deploy a persistent backdoor that enables remote access, gathers system information, and supports additional payload delivery while evading detection. This tactic mirrors earlier fake PuTTY campaigns, showing a trend of abusing trusted software for initial access. The backdoor communicates with attacker-controlled C2 domains and uses DLL sideloading via rundll32.exe for stealthy execution. Organizations are advised to download software only from verified sources and avoid relying on search engine advertisements.
Adobe Analytics bug leaked customer tracking data to other tenants
Source: https://www.bleepingcomputer.com/news/security/adobe-analytics-bug-leaked-customer-tracking-data-to-other-tenants/
Clop extortion emails claim theft of Oracle E-Business Suite data
Source: https://www.bleepingcomputer.com/news/security/clop-extortion-emails-claim-theft-of-oracle-e-business-suite-data/
FunkLocker, a ransomware strain developed by the FunkSec APT group, showcases the growing trend of AI-assisted malware creation. The ransomware exhibits inconsistent quality across multiple builds, with some versions incorporating advanced features like anti-VM checks. It aggressively disrupts system processes, abuses legitimate Windows utilities, and encrypts files locally without contacting a command-and-control server. FunkSec's operational security is weak, allowing researchers to develop a public decryptor. The group has compromised over 120 organizations worldwide, targeting sectors such as government, defense, technology, finance, and education. FunkLocker's behavior maps to several MITRE ATT&CK techniques, including process termination, service stoppage, and inhibiting system recovery.
AMI BMC vulns are on the CISA Known Exploited Vulnerabilities catalog now. I think this is the first BMC vuln to hit the KEV. Here are some Nuclei templates to detect this vuln in your BMCs.
