Cyber News 31OCT2025

General

• Useful tool, to make sure you've located (and thus patched) all of your WSUS
  • https://github.com/mubix/Find-WSUS
• Exec phishing through LinkedIn - it's got all the usual ingredients, Google open-redirect, intermediary bouncer, bot-protection (Turnstile), and finishes with Attacker-in-the-Middle Microsoft sign-in page.
  • https://pushsecurity.com/blog/new-phishing-campaign-identified-targeting-linkedin-users/
  • https://www.bleepingcomputer.com/news/security/linkedin-phishing-targets-finance-execs-with-fake-board-invites/
• Docker Compose - old-fashioned path-traversal bug in new Open Container Initiative (OCI) Compose support
  • https://www.imperva.com/blog/cve-2025-62725-from-docker-compose-ps-to-system-compromise/
  • https://www.theregister.com/2025/10/30/docker_compose_desktop_flaws/
• Jenkins always seems to deliver the good vulnerabilities (long past time to replace it with something more modern and secure)
  • https://www.jenkins.io/security/advisory/2025-10-29/
  • https://cyberpress.org/multiple-jenkins-flaws-include-saml-authentication-bypass-and-mcp-plugin-permission-issues/
• [EU] Increase in NFC payment relay attacks. This looks like a separate cluster (mainly Russian language), to the mobile-wallet loading and relaying attacks coming out of china.
  • https://zimperium.com/blog/tap-and-steal-the-rise-of-nfc-relay-malware-on-mobile-devices
  • https://www.bleepingcomputer.com/news/security/massive-surge-of-nfc-relay-malware-steals-europeans-credit-cards/
• [US] Much delayed disclosure of a US Telco breach, likely part of the Salt Typhoon (CN) attacks disclosed earlier this year.
  • https://www.reuters.com/business/media-telecom/us-company-with-access-biggest-telecom-firms-uncovers-breach-by-nation-state-2025-10-29/
  • https://www.bleepingcomputer.com/news/security/major-telecom-services-provider-ribbon-breached-by-state-hackers/
• [US] So, now is a good time to remove requirements on US Telco's to secure their networks (clearly they were doing well enough before, and the threat has clearly gone away...)
  • https://www.fcc.gov/news-events/blog/2025/10/29/halloween-treats
  • https://www.cybersecuritydive.com/news/fcc-cybersecurity-telecommunications-carriers-brendan-carr-eliminate-rules/804259/

Getting Techy

• A look at the Warlock ransomware - pretty low sophistication, but the basics are all there
  • https://hybrid-analysis.blogspot.com/2025/10/a-deep-dive-into-warlock-ransomware.html
• GhostGrab Android Malware. Background crypto-miner seems like a bit of a give-away that something is awry with the device. Silent-audio is an interesting trick to stay in the foreground. Collecting "Aadhaar" number in the fake KYC suggests targeting Indian citizens. Open Firebase DB...really?
  • https://www.cyfirma.com/research/ghostgrab-android-malware/
• [CN] Attacking EU diplomatic missions. Could be state-driven, or - as the i-Soon leak showed - could just be private companies hoping to find something saleable.
  • https://arcticwolf.com/resources/blog/unc6384-weaponizes-zdi-can-25373-vulnerability-to-deploy-plugx/
  • https://therecord.media/belgium-hungary-diplomatic-entities-hacked-unc6384
  • https://www.theregister.com/2025/10/30/suspected_chinese_snoops_abuse_unpatched/
  • https://unit42.paloaltonetworks.com/i-soon-data-leaks/

Geo-Politics

• [US] May start testing nuclear weapons again. Justification is flawed, and the environmental impacts likely high.
  • https://www.404media.co/trump-orders-nuclear-testing-as-nuke-workers-go-unpaid/
• [US] ICE building out an industrialised deportation system
  • (Wired) https://archive.is/5WSWE

Privacy

• Leak of Cellebrite's capabilities against Google Pixel phones (be sure to read the first comment, to help decode the capabilities)
  • (404 Media) https://archive.is/LeS5L
• Did you need any more evidence, that you're the product at Meta (Facebook, Instagram, WhatsApp, et al)?
  • https://therecord.media/coalition-calls-on-ftc-to-block-meta-chatbot-privacy
• [EU] Chat Control proposal appears to finally be dead. The challenge lies between good intent, and bad implementation.
  • https://therecord.media/demark-reportedly-withdraws-chat-control-proposal

AI

• Using prompt-injection for good - injecting security banners and instructions
  • https://research.eye.security/prompt-injection-to-battle-shadow-ai/
• Microsoft pushing hard with CoPilot, into more areas of M365 you never wanted it. Thankfully, it requires a CoPilot licence, so you can avoid, for now.
  • https://techcommunity.microsoft.com/blog/microsoft365insiderblog/work-smarter-with-copilot-in-the-people-files-and-calendar-apps/4462091
  • https://www.bleepingcomputer.com/news/microsoft/microsoft-promises-more-copilot-features-in-microsoft-365-companion-apps/