Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Tel Aviv, Israel, 24th November 2025, CyberNewsWire

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

CyberArmor exposed Autumn Dragon, a China-nexus APT using a WinRAR path traversal flaw (CVE-2025-8088) and DLL sideloading to deploy a Telegram C2 backdoor for espionage in Southeast Asia.

A Critical (CVSS 9.8) RCE flaw in Sneeit Framework is actively exploited. The bug allows unauthenticated attackers to run arbitrary code via call_user_func and take over WordPress sites. Update to v8.4 immediately.

A High-severity flaw (CVE-2025-13357, CVSS 7.4) in the Vault Terraform Provider allows unauthenticated access via LDAP null binds due to an insecure deny_null_bind default setting. Update to v5.5.0.

A critical, unpatched flaw in EOL Vivotek IP Cameras allows unauthenticated RCE via command injection in eventtask.cgi. Firmware versions 0100c–0305a4 are vulnerable and will not receive fixes.

A Critical (CVSS 9.8) Auth Bypass flaw (CVE-2025-63207) in R.V.R Elettronica TEX broadcast hardware allows unauthenticated attackers to reset all user passwords (Admin/Operator) via a simple HTTP request.

Kaspersky exposed ToddyCat APT's evolution: the group steals M365 OAuth tokens from memory and uses TCSectorCopy to steal locked Outlook OST files, allowing covert access to cloud email outside the perimeter.

ENKI exposed a Kimsuky APT campaign using a dual PE/PowerShell payload that switches based on Windows Defender status to deploy KimJongRAT. The malware steals Chrome AppBound keys via GitHub Releases C2.

K7 Labs exposed a Brazilian campaign using a Python WhatsApp worm for self-propagation. The in-memory AutoIt loader deploys a banking trojan that uses IMAP email as a covert C2 channel to steal banking credentials.

ShinyHunters claims responsibility for the Salesforce ecosystem breach, using OAuth tokens stolen from a previous attack to infiltrate Gainsight and access hundreds of customer instances.

Threat actors are actively exploiting the critical WSUS RCE flaw (CVE-2025-59287) to gain SYSTEM access and deploy the powerful, Chinese-linked ShadowPad espionage backdoor.

Matrix Push C2 is a new subscription service fueling fileless phishing campaigns by using deceptive browser push notifications to deliver malicious links and steal credentials.

SitusAMC, a key mortgage market contractor, suffered a breach that may have exposed client data from major banks like JPMorgan and Citi, raising fears of supply chain risk.