Google's remote-wipe weapon, Qilin ransomware activity surges, GootLoader is back - Cybersecurity Headlines

Cyber Security Headlines – Episode Summary

Episode Title: Google's remote-wipe weapon, Qilin ransomware activity surges, GootLoader is back
Host: Sara Lane
Date: November 12, 2025

Overview

This episode dives into the latest cybersecurity threats and industry responses, including the weaponization of Google’s Find My Device, surging Qilin ransomware, the return of GootLoader malware, critical vulnerabilities in SAP and Trio Fox, as well as emerging malware-as-a-service. It also details major data breaches and Google's AI privacy initiative.

Key Discussion Points & Insights

1. Google’s Find My Device Turned Into a Remote Wipe Weapon

Details:
- North Korean hacking group “Connie” leveraged Google’s Find My Device cloud features to remotely factory reset South Korean targets’ phones (00:23).
- Credentials stolen via phishing enabled unauthorized access.
- Attackers erased evidence of espionage and used GPS data to time attacks; spread further infections via popular messaging app KakaoTalk.
- Connie’s reliance on cloud tools highlights evolving tactics for operational concealment.
Memorable Quote:

“Connie used Google’s Find My Device service to remotely wipe and raid phones of South Korean targets, erasing evidence of their espionage.” – Sara Lane (00:24)

2. Qilin Ransomware Surge

Details:
- Security firm SRM reports a spike in Qilin ransomware hitting SMBs in construction, healthcare, and finance (01:13).
- Attacks exploit unpatched VPNs, weak authentication, and exposed interfaces.
- 88% of cases this year involved both data theft and encryption, with exfiltrated data leaked on dark web.
- Qilin group using Telegram and WikiLeaks v2 for extortion demands.
Memorable Quote:

“SRM says 88% of cases this year involved both data theft and encryption, with stolen data leaked on dark websites.” – Sara Lane (01:28)

3. GootLoader Malware Returns with New Evasion Techniques

Details:
- Huntress notes GootLoader hides malicious ZIP files behind custom web fonts on compromised WordPress sites (01:57).
- Exploits SEO poisoning and Google Ads for distribution.
- Can compromise domain controllers in under 17 hours, dropping the Supper backdoor for remote access.
- Linked to threat group Hive0127.
Memorable Quote:

“Goot Loader infections have led to domain controller compromises within 17 hours.” – Sara Lane (02:11)

4. SAP Patches Critical Vulnerabilities

Details:
- November patch cycle addresses two critical flaws, including hard-coded credentials in SQL Anywhere Monitor (10.0 CVSS), and an issue in SAP Solution Manager granting full system control to authenticated users (02:37).
- Additionally, 1 high and 14 medium severity bugs fixed.
- No known active exploitation.
Memorable Quote:

“SAP’s November patch cycle fixed two critical flaws, including a hard-coded credentials bug…which could let attackers execute arbitrary code.” – Sara Lane (02:37)

5. Fantasy Hub Android RAT: Full Device Espionage-for-Hire

Details:
- Zimperium uncovers “Fantasy Hub,” a Russian-linked Android RAT being sold “as-a-service” and controlled via Telegram (05:19).
- Capabilities: steals data, intercepts messages, accesses device sensors via WebRTC, spreads through fake Google Play pages, and banking app impersonations.
- Highly dangerous for BYOD/consumer devices due to social engineering and SMS handler abuses.
Memorable Quote:

“Fantasy Hub’s MaaS model, social engineering, and SMS handler abuse make it especially dangerous for BYOD and consumer devices.” – Sara Lane (05:35)

6. Critical Trio Fox Vulnerability Exploited

Details:
- UNC6485 threat actor exploits improper access controls in initial setup pages (06:03).
- Can create admin accounts, run remote access tools using the built-in antivirus feature.
- Includes lateral movement and password changes; recommends urgent patching.
Notable Quote:

“Attackers abuse the built-in antivirus feature to run malicious scripts… Organizations are advised to update Triofox…” – Sara Lane (06:15)

7. GlobalLogic: Major Data Breach in Oracle EBS Ransomware Campaign

Details:
- CLOP ransomware attack on Oracle E-Business Suite exposed HR data for approx. 10,500 current and former employees of GlobalLogic (subsidiary of Hitachi) (06:41).
- Data exposed: names, contacts, SSNs, bank details; up to $50 million ransom demanded.
Quote:

“Human resources data for nearly 10,500 current and former employees was exposed, including names, contact information, Social Security numbers, and bank details.” – Sara Lane (06:45)

8. Google Introduces Private AI Compute

Details:
- New cloud platform enabling advanced on-device AI with privacy safeguards, inspired by Apple’s model (07:19).
- Allows devices like Pixel 10 to use cloud AI without exposing sensitive info to Google; supports features like more personalized suggestions and expanded transcription languages.

Notable Quotes & Timestamps

Remote wipe weapon:

“Connie used Google’s Find My Device service to remotely wipe and raid phones of South Korean targets, erasing evidence of their espionage.” – Sara Lane (00:24)
Qilin ransomware:

“SRM says 88% of cases this year involved both data theft and encryption, with stolen data leaked on dark websites.” – Sara Lane (01:28)
GootLoader tactic:

“Goot Loader infections have led to domain controller compromises within 17 hours.” – Sara Lane (02:11)
Android RAT risk:

“Fantasy Hub’s MaaS model, social engineering, and SMS handler abuse make it especially dangerous for BYOD and consumer devices.” – Sara Lane (05:35)
GlobalLogic breach:

“Human resources data for nearly 10,500 current and former employees was exposed, including names, contact information, Social Security numbers, and bank details.” – Sara Lane (06:45)

Timestamps for Major Segments

[00:20] – Google’s remote-wipe cyberweapon
[01:13] – Ransomware surge: Qilin
[01:57] – GootLoader returns with web font evasion
[02:37] – SAP patches critical flaws
[05:19] – Fantasy Hub Android RAT
[06:03] – Trio Fox critical vulnerability
[06:41] – GlobalLogic data breach (Oracle EBS/CLOP)
[07:19] – Google’s Private AI Compute

Conclusion

This episode provides a brisk, informative overview of major recent threats—from evolving state-sponsored espionage to ransomware’s business focus, creative malware delivery techniques, and double extortion. It highlights how attackers are combining cloud features and social engineering to elevate their impact while large vendors and organizations scramble to patch critical vulnerabilities and keep data secure.

For further details, head to CISOseries.com.

Transcript

A (0:00)

From the CISO series, it's Cybersecurity Headlines these are the cybersecurity headlines for Wednesday, November 12, 2025. I'm Sara Lane. Google's Find Hub turns into remote white weapon Researchers at South Korea's cybersecurity firm Genans say North Korean hacking group Connie used Google's Find My Device service to remotely wipe and and raid phones of South Korean targets, erasing evidence of their espionage. The attackers stole Google credentials through phishing, then triggered unauthorized factory resets. Using the cloud feature, Connie spread further infections via the Kakaotalk app and exploited GPS data to time attacks. The group linked to Pyongyang's intelligence agency has increasingly used cloud tools to conceal operations. Qilin Ransomware Activity Surges Cybersecurity firm SRM reported a surge in ransomware attacks linked to the long running Qilin Group, which mainly targets small and mid sized businesses in construction, healthcare and finance. Qilin affiliates, including members of Scattered spider, exploit unpatched VPNs, weak authentication and and exposed interfaces to steal data and encrypt Systems. SRM says 88% of cases this year involved both data theft and encryption, with stolen data leaked on dark websites. The firm now warns that Qilin uses telegram and WikiLeaks v2 for extortion. Gootloader is back Cybersecurity firm Huntress says that the gut loader malware has resurfaced using a new evasion technique that hides malicious zip files behind custom Woof2 web fonts on compromised WordPress sites. The trick disguises file names by substituting glyphs, making them appear harmless until rendered in browsers. Goot Loader infections have led to domain controller compromises within 17 hours. Deploying the Supper backdoor for remote access. Linked to threat group hive0127. Goot loader continues spreading via SEO poisoning and also Google Ads. SAP fixes hard coded credentials flaw SAP's November patch cycle fixed two critical flaws, including a hard coded credentials bug in the SQL Anywhere monitor rated 10.0 severity, which could let attackers execute arbitrary code. Another critical issue in SAP Solution Manager let authenticated users inject malicious code and take full system control. SAP also patched one high and 14 medium severity bugs, plus reissued a netweaver fix from October. No active exploitation has been observed. Huge thanks to our sponsor Vanta. What is your 2am Security worry? Is it do I have the right controls in place or are my vendors secure? Or the really scary one? How do I get out from under these old tools and manual processes? Enter Vanta Vanta automates manual work so you can stop sweating over spreadsheets, chasing audit evidence and filling out endless questionnaires. Vanta's trust platform continuously monitors your systems, centralizes your data, and simplifies your security at scale. Vanta also fits within right into your workflow, using AI to streamline evidence collection, flag risks, and keep your program audit ready all the time. With Vanta, you get everything you need to move faster, scale confidently, and get back to sleep. Get started at Vanta.com Headlines Android Rat boasts Full device Espionage Researchers at Zimperium uncovered Fantasy Hub, a Russian sold Android Remote Access Trojan or rat, offered as malware as a service enabling full device surveillance and control through Telegram. The spyware steals data, intercepts messages, accesses cameras and microphones via WebRTC, and uses fake Google Play pages to spread. Attackers also deploy counterfeit banking apps for Alpha, PSB T, bank and Saber to steal credentials, Symperium says. Fantasy Hubs MAS model social engineering and SMS handler abuse make it especially dangerous for BYOD and consumer devices. Critical Trio Fox vulnerability exploited A critical Treo Fox vulnerability was exploited in the wild by threat actor UNC 6485, allowing creation of a new admin account and execution of remote access tools. The flaw stems from improper access control on initial setup pages. Attackers abuse the built in antivirus feature to run malicious scripts, including a Zoho UEMS installer enabling Zoho Assistant and any desk access, lateral movement and password changes. Organizations are advised to update Triofox, audit admin accounts and restrict antivirus execution paths. Global Logic impacted by ATTCK on Oracle Hitachi subsidiary GlobalLogic was affected by a CLOP ransomware campaign targeting Oracle E Business suite customers. Human resources Data for nearly 10,500 current and former employees was exposed, including names, contact information, Social Security numbers and bank details. The breach began July 10. It was discovered Oct. 9, with the last malicious activity apparently Aug. 20. Klopp reportedly demanded up to $50 million from victims, and dozens of Oracle customers were impacted. Google Intros Private AI Compute Google is launching Private AI Compute, a cloud platform that lets devices run advanced AI tasks while keeping data private. Similar to Apple's private Cloud Compute, it moves intensive AI processing to the cloud without exposing sensitive information back to Google. The system is meant to expand AI features on devices like Pixel 10 phones, enabling more personalized suggestions from tools like MagicQ and supporting additional languages for recorder transcriptions. Google frames it as a secure way to handle complex AI tasks beyond on device capabilities. Hey Boston, we are doing a meetup on Monday, November 24th at 6 City Tap House. If you are in cybersecurity or trying to get into it, this is your chance to meet other people in the community, swap some war stories, and actually enjoy talking shop. Register@cisoseries.com Events before spots fill up. If you have some thoughts on the news from today or about the show in general, be sure to reach out to us@feedbackisoseries.com we want to hear from you. I am Sarah Lane reporting for the CISO series and we will talk to you tomorrow. Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.