← Cybersecurity Headlines
Cybersecurity Headlines
Russian hackers replace malware with new tools, Windows updates cause login issues, campaign targets high-profile servers
00:08:03
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines.
- [00:07]
B
These are the cybersecurity headlines for Wednesday, October 22, 2025. I'm Sarah Lane. Russian state hackers replace burned malware with new tools Google's threat intelligence team says Russian state backed hacking group Cold river, also known as Star Blizzard or Callisto, has developed three new malware strains no Robot, Yes Robot and maybe Robot after its previous lost keys tools was exposed back in May. The new tools are said to be deployed more aggressively than any previous campaigns, designed to evade detection and steal data from high value targets. Google believes that Cold river is now using custom malware to gather deeper intelligence from from already phished victims. Recent Windows updates caused login issues on some PCs Microsoft says that Windows updates released since August 29th are breaking logins on systems with duplicate security identifiers, or SIDs, causing Kerberos and NTLM authentication failures across Windows 11 24H2, 25H2 and Windows Server 2025. The issue appears to stem from a new security check that rejects authentication between devices sharing SIDs, often created when systems are cloned without using Sysprep. Microsoft recommends rebuilding affected systems or contacting support for a temporary group policy fix. Sophisticated campaign targets servers of high profile organizations Kaspersky researchers say that a Chinese speaking threat actor is likely behind the Passive Neuron campaign, which has targeted government, financial and industrial servers across Asia, Africa and Latin America since 2024. The campaign uses custom implants Nersight and Neural Executor along with Cobalt Strike to exploit SQL servers and maintain persistence via large disguised DLL files. Kaspersky says that the group's tactics aligned with Chinese APTs, although attribution remains low confidence CISA adds new flaws to known exploited vulnerabilities catalog CISA added high severity vulnerabilities in Oracle E Business Suite, Microsoft Windows SMB Client, Conteco Experience, CMS and Apple JavaScript Core to its known exploited vulnerabilities catalog. These flaws could allow data theft, privilege escalation and remote code execution. Federal agencies have to patch them by November 10th and private organizations are advised to update affected systems, huge thanks to our sponsor ThreatLocker. Imagine having the power to decide exactly what runs in your IT environment and blocking everything else by default. That is what ThreatLocker delivers as a zero trust endpoint protection platform. ThreatLocker fills the gaps traditional solutions leave behind, giving your business stronger security and control. Don't just react to threats, stop them with ThreatLocker laser auto cyber attacks emerge Researchers at France's Alternative Energies and Atomic Energy Commission, or CEA, and semiconductor firm Soetech have developed a new chip architecture called Fully Depleted Silicon on Insulator to defend against laser fault injection attacks targeting automotive microcontrollers. The design adds an insulating oxide layer that makes it harder to manipulate circuits with focused laser beams, including attacks that can flip bits or bypass authentication. It also improves cost efficiency and helps automakers meet global cybersecurity standards. Hackers exploit zero days at PWN2Own Ireland on the first day of PWN2Own Ireland 2025, researchers exploited 34 zero days across devices including QNAP and Synology, NAS printers, smart home gadgets and networking equipment, earning $522,500 for the effort. Team DDoS chained 80 days to hack a QNAP router and NAS for $100,000 while summoning team led the leaderboard with $102,500. The contest, co sponsored by Meta, QNAP and Synology, awards zero day exploits and promotes responsible disclosure with vendors given 90 days to patch vulnerabilities before public disclosure. Glass Worm attacks Vs. Code supply chain Researchers at Koi Security discovered a new self propagating malware dubbed Glass worm, infecting around 36,000 developer systems by exploiting Visual Studio code extensions. The worm uses invisible Unicode characters to hide its code, steals credentials from GitHub, npm and OpenVSX, installs remote access tools and turns developer machines into criminal proxy nodes. It also uses the Solana blockchain and Google Calendar for command and control. Microsoft has since removed the infected extensions. Poller Edge Targets Routers an expanding botnet campaign Polaredge, a botnet malware targeting Cisco, Asus, QNAP and Synology routers, was first noticed back in February with activity going back as early as June of 2023. It installs a TLS based backdoor to fingerprint hosts, receive commands and execute tasks while using anti analysis techniques and and process masquerading to evade detection. Polaredge can operate in connect back or debug modes and its purpose seems to be linked to building a large network of compromised devices not unlike Go SoC's use of infected systems as SoC S5 proxies, we have some exciting news. We are launching a brand new show this Monday, October 27th called the Department of no. We will be live at 4:00pm Eastern Time bringing together two Cybersecurity leaders to help you start out your week. If you want to know what cybersecurity news from the past week, you need to integrate into your next team meeting. You've got to come to this show. It streams live at 4pm every Monday on our YouTube channel, so block out the time on your calendar. Subscribe to the CISO Series YouTube channel and join us on Monday, October 27th at 4pm for the debut of the Department of Nome. And if you have thoughts on the news from today or about our show in general, be sure to reach out to us@feedbackisoseries.com we would love to hear from you. I am Sarah Lane, reporting for the CISO series. You Stay Classy.
- [07:48]
A
Cybersecurity headlines are available every weekday. Head to csoseries.com for the full stories behind the headlines.