A recent cyberattack on Red Hat's GitLab instance by the Crimson Collective resulted in the theft of approximately 570GB of compressed data, including 28,000 internal repositories and sensitive customer engagement reports containing infrastructure and authentication details. This breach exposes critical intellectual property and sensitive information across multiple sectors. Additional significant incidents include ransomware and data breaches affecting global organizations, highlighting a trend of sophisticated attacks targeting supply chains, manufacturing, and service providers. Notably, vulnerabilities in widely used software such as VMware Aria Operations, Linux sudo, and Fortra’s GoAnywhere MFT have been actively exploited, increasing the attack surface. European organizations relying on Red Hat and related open-source infrastructure are at risk of indirect impacts from leaked credentials and infrastructure details. The threat landscape underscores the need for targeted mitigation strategies focusing on supply chain security, privileged access management, and rapid patching of critical vulnerabilities. Given the scale and sensitivity of the stolen data, the threat severity is assessed as high for European entities.
The WARMCOOKIE backdoor continues to evolve, with ongoing updates and new infections observed. Recent developments include new handlers for executing various file types, a string bank for defense evasion, and code optimizations. A campaign ID field has been added, providing context for operators. Infrastructure analysis reveals a default SSL certificate potentially used for WARMCOOKIE back-ends. Despite disruption attempts, the backdoor remains active in malvertising and spam campaigns. The malware's selective usage and continuous updates suggest its persistence as a threat, highlighting the need for enhanced organizational protection measures.
The brewing giant has reverted to manual order processing and shipment as operations at its Japanese subsidiaries are disrupted. The post Beer Giant Asahi Says Data Stolen in Ransomware Attack appeared first on SecurityWeek .
U.S. CISA adds Smartbedded Meteobridge, Samsung, Juniper ScreenOS, Jenkins, and GNU Bash flaws to its Known Exploited Vulnerabilities catalog
Source: https://securityaffairs.com/182925/hacking/u-s-cisa-adds-smartbedded-meteobridge-samsung-juniper-screenos-jenkins-and-gnu-bash-flaws-to-its-known-exploited-vulnerabilities-catalog.html
Discord Data Breach: Hackers Access IDs, Billing Details and Support Chats
Source: https://hackread.com/discord-data-breach-hackers-ids-billing-support-chats/
New Study Warns Several Free iOS and Android VPN Apps Use Outdated Software and Leak User Data
Source: https://hackread.com/studyfree-ios-android-vpn-apps-leak-data/
ShinyHunters Launches Data Leak Site: Trinity of Chaos Announces New Ransomware Victims
Source: https://securityaffairs.com/182918/cyber-crime/shinyhunters-launches-data-leak-site-trinity-of-chaos-announces-new-ransomware-victims.html
New "Cavalry Werewolf" Attack Hits Russian Agencies with FoalShell and StallionRAT
Source: https://thehackernews.com/2025/10/new-cavalry-werewolf-attack-hits.html
Red Hat confirms security incident after hackers breach GitLab instance
Source: https://www.bleepingcomputer.com/news/security/red-hat-confirms-security-incident-after-hackers-breach-gitlab-instance/
Confucius Hackers Hit Pakistan With New WooperStealer and Anondoor Malware
Source: https://thehackernews.com/2025/10/confucius-hackers-hit-pakistan-with-new.html
