← Cybersecurity Headlines
Cybersecurity Headlines
MANGO discloses data breach, Jewelbug infiltrates Russian IT network, nation-state behind F5 attack?
00:08:50
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series. It's Cybersecurity Headlines.
- [00:07]
B
These are the cybersecurity headlines for Thursday, October 16, 2025. I'm Sarah Lane. Mango Discloses Data Breach Spanish fashion retailer Mango disclosed a data breach after one of its external marketing vendors was compromised, exposing customer data including first names, countries, postal codes, emails and phone numbers. Financial and identity data were not affected and Mango's internal systems reportedly remain secure. The company has notified Spain's Data Protection Authority and set up a support hotline for affected customers. No ransomware group has claimed responsibility. Threat Group Jewelbug Infiltrates Russian IT network Chinese linked threat group Juulbug conducted a five month intrusion targeting a Russian IT service provider gaining access to code repositories and software build systems. Symantec links Juulbug to previous activity clusters and notes. The group uses stealthy techniques including cloud services, renamed Microsoft debugging tools, DLL sideloading and credential dumping. F5 discloses breach tied to Nation State Threat Actor CISA issued an emergency directive after F5 disclosed that a nation state actor had long term access to its systems, stealing big IP source code and details on undisclosed vulnerabilities. Agencies now have to patch affected F5 products by October 22nd and report deployments by October 29th. The breach was discovered back in August and exposed configuration data for some customers, but didn't show supply chain tampering. F5 says it's expelled the attackers while working with CrowdStrike and Mandiant. CISA warned the stolen data poses a significant threat to federal networks. Windows Server Updates Cause Active Directory Issues Microsoft confirmed that September's Windows Server 2025 updates are breaking active directory synchronization affecting services like Microsoft Entra Connect Sync. The bug prevents full sync of large ad security groups exceeding 10,000 members. Microsoft issued a registry workaround but warned it could cause system issues and if done incorrectly, a permanent fix is in development. The company is also addressing a separate update failure affecting Windows 1124H2 and Windows Server 2025 when installing from network shares. Huge thanks to our sponsor Vanta. What is your 2am Security worry? Is it do I have the right controls in place or are my vendors secure? Or the really scary one? How do I get out from under these old tools and manual processes? Enter Vanta. Vanta automates manual work so you can stop sweating over spreadsheets, chasing audit evidence and filling out endless questionnaires. Their trust management platform continuously monitors your system, centralizes your data and and simplifies your security at scale. Vanta also fits right into your workflows. Using AI to streamline evidence collection, flag risks and keep your program audit ready all the time. With Vanta, you get everything you need to move faster and scale confidently and get back to sleep. Get started at Vanta.com headlines Power school hacker sentenced to four years in prison A Massachusetts man, 19 year old Matthew Lane, was sentenced to four years in prison for hacking educational software company Power School and demanding a 2.9 million dollar ransom to avoid leaking data on more than 70 million people. Lane was also ordered to pay about $14 million in restitution and and a $25,000 fine. The breach, disclosed back in January, exposed Social Security numbers, medical data and special education information for 60 million students and 9 million teachers. Prosecutors sought a seven year sentence citing Lane's history of hacking. Devs are writing secret Vs Code Extensions Researchers from Wiz Security, working with Microsoft found that over 500 VS code and OpenVSX extensions from hundreds of publishers exposed API keys, credentials and tokens. More than 100 of these could have let attackers push malicious updates to users with auto updates, amplifying the risk of supply chain attacks. High risk targets include AI platforms, cloud services and databases. Microsoft has implemented secret scanning and blocked leaky extensions, working with developers to replace them with sanitized versions. 200,000 Linux systems vulnerable to secure Boot bypass Researchers at Eclipsium found that around 200,000 Linux systems from framework shipped with signed UEFI components vulnerable to secure boot bypass. Legitimate diagnostic tools included in the UEFI shells specifically for the MM command can overwrite the G Security two pointer, disabling signature verification and allowing attackers to load unsigned bootkits or rootkits, achieving persistent pre OS control Framework is issuing DBX updates to to block vulnerable shells, with fixes varying by model. Experts recommend updating UEFI revocation lists using BIOS passwords and scanning firmware for vulnerable components. Whisper 2fa behind 1 million phishing attempts since July Barracuda researchers say that the phishing platform Whisper2FA has driven nearly 1 million phishing attempts since since July, making it one of the most active phishing as a service tools after Tycoon and Evil Proxy. The kit uses Ajax to repeatedly harvest credentials and MFA codes in real time, bypassing two factor authentication. Newer versions include heavy obfuscation, base 64XOR encoding and anti debugging features. Attackers impersonate brands like DocuSign, Adobe and Microsoft 365 using invoices or voicemail lures. Barracuda calls it evidence of increasingly sophisticated full service phishing platforms. In cybersecurity, we often focus on technical skills. These are easy to demonstrate and are part of the foundation of getting the job done. But everyone needs soft skills. It's core to communication which soft skills are necessary for each role in cybersecurity. That is what we're trying to figure out on this week's episode of Defense In Depth Depth. Look for the episode what Soft Skills do youo need in Cyber? Wherever you get your podcasts, if you get value out of cyber Security headlines every day, remember to tell a friend to check out the show. And if you share the show with colleagues or your team, please let us know@feedbackisoseries.com I am Sarah Lane, reporting for the CISO series. Please enjoy a pie tonight or tomorrow or wherever you get your desserts.
- [08:34]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.