← Cybersecurity Headlines
Cybersecurity Headlines
Microsoft Defender outage disrupts threats, Apple resists India's app order, MuddyWater strikes Israel
00:07:59
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines.
- [00:07]
B
These are the cybersecurity headlines for Wednesday, December 3, 2025. I'm Sara Lane. Microsoft Defender outage disrupts threats Microsoft Defender for endpoint experienced a 10 hour portal outage affecting XDR features including advanced threat hunting alerts and device visibility. Microsoft attributed the disruption to a CPU spike from high traffic on portal components. Mitigation steps have restored access for most customers, though some organizations still face issues. Microsoft is collecting additional diagnostics to resolve lingering impacts and continues monitoring system performance. Apple resists India's state run app order Reuters sources say that Apple will not comply with India's order to preload its iPhones with the state run Sanchar Southi cybersafety app, citing privacy and security concerns and will raise the issue with the Indian government, which wants all smartphones, including those from Samsung and Xiaomi devices, to install the app to track stolen phones and and prevent misuse. Other manufacturers are reviewing the directive amid political backlash and surveillance concerns. Muddy Water strikes Israel with Muddy Viper Iran linked Muddy water hit multiple Israeli organizations and one in Egypt with a new tool set built around the Muddy Viper backdoor. According to Eset. The group used a Snake themed fooder loader, new credential and browser data stealers and Go Socks five reverse tunnels to maintain access, steal data and stay quiet. The campaign ran from late 2024 to early 2025 across engineering, government, manufacturing, utilities and universities, showing tighter operational overlap with other Iranian units. Eset says the group's tactics are becoming more sophisticated but but still follow a predictable script. Researchers capture Lazarus APT's remote worker scheme Researchers say that Lazarus Group's famous Colima unit was caught live trying to sneak North Korean IT workers into Western companies by posing as remote hires. Researchers from bcaltd, North Scan and any run in impersonated a US developer and funneled the operators into sandboxed laptops, watching them use stolen IDs, AI generated job application tools, OTP generators and Google Remote Desktop to seize accounts without malware. The objective was full identity takeover to embed North Korean workers inside finance, crypto, healthcare and engineering firms. Huge thanks to our sponsor Vanta. This message comes from Vanta. What is your 2am Security worry? Is it do I have the right controls in place or are my vendors secure? Enter Vanta. Vanta automates manual work so you can stop sweating over spreadsheets, chasing audit evidence and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data and simplifies your security at scale. Get started at Vanta Csow. That's V A N T a ciso. Picklescan vulnerabilities expose AI model supply chains Three critical zero day flaws in Picklescan, a tool for scanning Python pickle files and Pytorch models, could let attackers bypass safeguards and distribute malicious ML models. One allowed file extension spoofing, another exploited zip archive, handling differences between Picklescan and Pytorch, and the third bypassed dangerous import blacklists via subclassing. The vulnerabilities have since been patched. University of Pennsylvania Joins clop's Oracle EBS Raid the University of Pennsylvania confirmed a data breach after Klopp exploited a zero day in Oracle's e business suite affecting at least 1,488 Maine residents. Attackers accessed personal and financial data used in payments, reimbursements and and general ledger processing. Penn patched systems, alerted law enforcement and is offering two years of Experian credit Monitoring Legislation would Designate Critical Cyber Threat Actors Representative August Pfluger reintroduced the Cyber Deterrence and Response act to let the US Formerly designate foreign hackers behind major cyber attacks as critical cyber threat actors subject to sanctions. The bill directs federal agencies, including the Office of the National Cyber Director, to attribute attacks with input from intelligence and threat firms. Targeted actors include those disrupting networks, stealing sensitive data or threatening critical infrastructure, finance and energy or elections. The President may waive sanctions with written explanation to Congress. Coast Guard Mandates CyberSecurity training the US Coast Guard requires all personnel with it or ot access on vessels, facilities or OCS sites to complete CyberSecurity training by January 12th. Untrained users may access systems only under supervision or remote monitoring. Owners and operators must document training, maintain records, and ensure that contractors meet regulatory standards with oversight tied to the Cybersecurity Plan and the designated Cybersecurity officer. Remember to join us this Friday for Super Cyber Friday. Our topic of conversation will be Hacking AI Data Readiness. We are all so busy trying to deploy AI tools as quickly as possible, but before you can flip the switch, you have to make sure your data is ready. We've covered tons of companies on headlines that have had unintentional data leaks from not doing their data homework. So join us at 1:00pm Eastern Time this Friday for this vital conversation. Head on over to the event page@cisoseries.com to register. We can't wait to see you there. And if you have thoughts on the news from today or about our show in general, be sure to reach out to us@feedbackisoseries.com we'd love to hear from you. I am Sarah Lane, reporting for the CISO series, and I want you to stay classy out there, everyone.
- [07:44]
A
Cybersecurity headlines are available every weekday. Head to csoseries.com for the full stories behind the headlines.