Cyber News 14NOV2025

General

• Operation Endgame, Season 3 - confirmed that the Rhadamanthys takedown was part of the operation.

"The actions targeted one of the biggest infostealers Rhadamanthys, the Remote Access Trojan VenomRAT, and the botnet Elysium, all of which played a key role in international cybercrime."

• https://www.operation-endgame.com/
• https://www.europol.europa.eu/media-press/newsroom/news/end-of-game-for-cybercrime-infrastructure-1025-servers-taken-down
• (Full of report-worthy graphics) https://www.shadowserver.org/news/rhadamanthys-historical-bot-infections-special-report/
• https://www.bleepingcomputer.com/news/security/police-disrupts-rhadamanthys-venomrat-and-elysium-malware-operations/
• https://therecord.media/operation-endgame-cybercrime-takedowns-rhadamanthys-venomrat-elysium
• https://www.theregister.com/2025/11/13/rhadamanthys_takedown/
• Brian Krebs write-up on Google's efforts against Lighthouse (aka Smishing Triad) mentioned yesterday.
  • https://krebsonsecurity.com/2025/11/google-sues-to-disrupt-chinese-sms-phishing-triad/
  • (Wired) https://archive.li/X5Srj
• Teams to allow blocking of screen-capture for Premium users - annoying for vendor demos if (explicitly) enabled.
  • https://www.bleepingcomputer.com/news/microsoft/microsoft-rolls-out-screen-capture-prevention-for-teams-users/
• Attackers are getting smarter - using browser full-screen-mode to make clickfix more believable.
  • https://cyberplace.social/@GossiTheDog/115538180080631907
• An interesting alternate approach to paying attacker demands - donate the requested amount to cyber-crime research instead.

"We will be donating the ransom amount to Carnegie Mellon University and the University of Oxford Cyber Security Center to support their research in the fight against cybercrime"

• https://www.checkout.com/blog/protecting-our-merchants-standing-up-to-extortion
• https://www.theregister.com/2025/11/13/ransomed_cto_refuses_extortion_demand/
• Washington Post added to list of Oracle e-Business Suite victims
  • https://www.bleepingcomputer.com/news/security/washington-post-data-breach-impacts-nearly-10k-employees-contractors/
  • https://www.theregister.com/2025/11/13/washington_post_clop/
• [US] CISA's back operating again - starting with updated Tactics, Techniques and Procedures (TTPs) and Indicators of Compromise (IoCs) for the Akira ransomware group.
  • https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a
  • https://therecord.media/akira-gang-received-million
• [US] Department of Justice to target Scam Centres, such as those running in Myanmar and Cambodia. The strike force has already seized more than US$400m in crypto-currency.
  • https://therecord.media/strike-force-southeast-asia-scams

Getting Techy

• Botnets in unusual places - a "digital picture frame"
  • https://go.quokka.io/hubfs/App-Intel/Technical_Uhale-Digital-Picture-Frame-Security-Assessment.pdf
  • https://www.bleepingcomputer.com/news/security/popular-android-based-photo-frames-download-malware-on-boot/
• Anti-virus de-obfuscation logic goes a bit far, and runs the obfuscated code
  • https://patchstack.com/articles/remote-code-execution-vulnerability-found-in-imunify360/
  • https://www.bleepingcomputer.com/news/security/rce-flaw-in-imunifyav-puts-millions-of-linux-hosted-sites-at-risk/
• MS Defender has Low Fidelity detections, that create telemetry data, but no local actions. Need to know more!
  • https://cyberplace.social/@GossiTheDog/115544787304673144

Geo-Politics

• [KZ] Kazakhstan falls to new low, implements anti-LGBTQ+ laws
  • https://therecord.media/kazakhstan-legislation-ban-lgbtq-content-online-media

Privacy

• [UK] Monitoring VPN usage after introducing age verification laws (Online Safety Act).
  • https://www.techradar.com/vpn/vpn-privacy-security/exclusive-ofcom-is-monitoring-vpns-following-online-safety-act-heres-how
• [US] More attacks on user privacy - after discovering that people are using VPNs to bypass age bans, parts of the US are moving to ban VPNs
  • https://www.eff.org/deeplinks/2025/11/lawmakers-want-ban-vpns-and-they-have-no-idea-what-theyre-doing
• [US] Potential privacy win against a US data-broker, not allowed to profit off location data.
  • https://therecord.media/data-broker-kochava-business-change
  • (Earlier coverage with more case details) https://therecord.media/ftc-complaint-against-kochava-unsealed

AI

• Surprise - AI startups aren't great at security. Wiz finds 65% of their sample had leaked secrets on GitHub.
  • https://www.wiz.io/blog/forbes-ai-50-leaking-secrets