Cyber News 21NOV2025
General
- It took ten years from when they set up, but Samourai crypto-currency-mixer CEO (Rodriguez) and CTO (Hill) are both going to jail. They actively encouraged use of the service for cleaning dirty crypto-currency.
a user asked about the most “secure methods to clean dirty BTC” to make it “untraceable, clean” and ensure the user would “never get caught.” HILL responded by writing that “Samourai Whirlpool is a much better option”
In a WhatsApp exchange, when asked to explain the concept of “mixing,” RODRIGUEZ described the process as “money laundering for bitcoin.”
- https://www.justice.gov/usao-sdny/pr/founders-samourai-wallet-cryptocurrency-mixing-service-sentenced-five-and-four-years
- https://www.bleepingcomputer.com/news/security/samourai-cryptomixer-founders-sent-to-prison-for-laundering-over-237-million/
- https://therecord.media/samourai-wallet-crypto-mixer-founders-sentenced
- Shiny Hunters have their next pathway to Salesforce data - Gainsight (another integration, somewhat like the earlier Salesloft).
- https://status.salesforce.com/generalmessages/20000233
- https://www.linkedin.com/posts/austin-larsen_trust-status-activity-7397331617578610690-8FmH/
- https://databreaches.net/2025/11/20/threat-actors-have-reportedly-launched-yet-another-campaign-involving-an-application-connected-to-salesforce/
- https://www.bleepingcomputer.com/news/security/salesforce-investigates-customer-data-theft-via-gainsight-breach/
- https://www.theregister.com/2025/11/20/salesforce_gainsight_breach/
- https://techcrunch.com/2025/11/20/salesforce-says-some-of-its-customers-data-was-accessed-after-gainsight-breach/
- The dangers of staff exiting the organisation. It's taken 4.5 years, but justice has caught up with a contractor that reset ~2500 credentials.
- [US] As mentioned on in the 19NOV2025 news - FCC voted on security interpretation in CALEA. The Biden-era ruling has been reversed. We'll need to look elsewhere to ensure TelCos are taking security seriously, in the face of Salt Typhoon (CN) attacks.
Getting Techy
- Searchlight Cyber uncover Pre-Authentication Remote Code Execution (RCE) in Oracle Identity Manager.
- Another Android banking trojan. Uses screen-reader (accessibility) features to read on-screen text from messaging programmes (end-to-end encryption, of course, means the data is readable, at one of those ends), overlays to capture inputs, VNC for screen-sharing, and a full-screen fake OS-update overlay to mask interactive actions.
- Google Threat Intelligence takes a look at the evolution of APT24 (CN) - nothing fancy here, sorry!
Geo-Politics
- [RU] Going after game developers, because they don't like the narrative - S.T.A.L.K.E.R. dev labelled an undesirable organisation.
- [UA] Ukraine jamming Russian air-launched ballistic missiles
- [US] Questions over a 'crash' at an ICE facility, that wiped out two weeks worth of footage, the day after a lawsuit is filed.
- [US] Scientific process is being undermined - CDC is now posting debunked science.
- [US] Four people charged with bypassing US CHIPS Act ban on exporting advanced chips (Nvidia Blackwell) to china.
- (Wired) https://archive.is/jfFt3
Privacy
- [US] Unsurprising - once US venture capital bought NSO, the obvious move was to wind back US restrictions on the platform. It doesn't hurt to appoint a CEO aligned with the current administration.
AI
- Aiming to spoil Google's Gemini party - OpenAI release GPT5.1 Codex, designed for agentic coding on long-running tasks.
- A little NSFW - Grok's been tweaked (4.1 release?) to say that Musk is the best at everything.