Microsoft Office 2016/2019 End of Life
Source: https://www.lansweeper.com/blog/eol/microsoft-office-end-of-life/?utm_source=reddit&utm_medium=social&utm_campaign=ls-global-end-of-life-2025&utm_content=microsoft-office
40% of Corporate Client Devices Still Run Windows 10
Source: https://www.lansweeper.com/blog/eol/are-you-prepared-for-windows-10-end-of-life/?utm_source=reddit&utm_medium=social&utm_campaign=ls-global-end-of-life-2025&utm_content=windows10
CopyCop, a Russian covert influence network, has significantly expanded its operations since March 2025, creating over 300 new fictional media websites targeting various countries. The network, likely operated by John Mark Dougan with support from Russian entities, aims to undermine support for Ukraine and exacerbate political fragmentation in Western countries. CopyCop's tactics include using deepfakes, AI-generated content, and impersonating media outlets to spread pro-Russian narratives. The network has widened its target languages and geographical scope, now including Turkey, Ukraine, Swahili-speaking regions, Moldova, Canada, and Armenia. While its core objectives remain unchanged, CopyCop has made marginal improvements to increase its reach, resilience, and credibility, including the use of self-hosted large language models for content generation.
Two malicious Python packages, sisaws and secmeasure, were discovered in the Python Package Index (PyPI) repository. These packages, created by the same author, deliver a Remote Access Trojan (RAT) called SilentSync. The RAT is capable of remote command execution, file exfiltration, screen capturing, and web browser data theft. It targets Windows systems and communicates with a command-and-control server using HTTP. The packages employ typosquatting and imitate legitimate modules to deceive users. SilentSync achieves persistence through platform-specific techniques and supports various commands for data exfiltration and system control. This discovery highlights the growing risk of supply chain attacks within public software repositories.
SonicWall warns customers to reset credentials after breach
Source: https://www.bleepingcomputer.com/news/security/sonicwall-warns-customers-to-reset-credentials-after-MySonicWall-breach/
New Raven Stealer Malware Hits Browsers for Cookies, Passwords and Payment Data
Source: https://hackread.com/raven-stealer-malware-browsers-passwords-payment-data/
One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens
Source: https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/
A few months ago Dutch newspaper de Volkskrant published a very interesting article describing how, according to secret Iranian documents obtained by the newspaper, the Islamic Revolutionary Guard Corps (IRGC) was attempting to procure encrypted, Chinese Tiantong-1 satellite phones due to increasing distrust of Iranian communications infrastructure in the light of the Iran-Israel war. In this first blogpost of a 2-part series, the previously unexplored Tiantong-1 satellite system and its security aspects are illuminated.
RaccoonO365 Phishing Network Dismantled as Microsoft, Cloudflare Take Down 338 Domains
Source: https://thehackernews.com/2025/09/raccoono365-phishing-network-shut-down.html
A self-replicating worm named Shai-hulud has been detected on the npm registry, spreading through compromised developer accounts and injecting malicious code into legitimate packages. The worm steals cloud service tokens, primarily targeting npm, GitHub, AWS, and GCP. It also installs Trufflehog to detect additional secrets. The compromised packages include popular ones with millions of weekly downloads. The worm's functionality includes auto-spreading, token theft, and exposing private repositories. Similarities with previous npm compromises have been noted. The impact is significant, affecting numerous developers and organizations across various industries.
Jaguar Land Rover extends shutdown after cyberattack by another week
Source: https://www.bleepingcomputer.com/news/security/jaguar-land-rover-extends-shutdown-after-cyberattack-by-another-week/
This analysis reveals connections between three seemingly distinct malicious programs: AppSuite, OneStart, and ManualFinder. The investigation uncovers shared server infrastructure and similar installation patterns, indicating that these programs are likely created by the same threat actor. OneStart, initially a browser based on Chromium, evolved from earlier versions that used node.exe to run malicious JavaScript. The actors behind these programs have been active for years, distributing malware disguised as various utilities such as games, recipe finders, and manual finders. The report highlights the adaptability of these threat actors, who easily morph their software to take new forms and evade detection.
