← Cybersecurity Headlines
Cybersecurity Headlines
"SleepyDuck" uses Ethereum, SesameOp abuses OpenAI API, cybercrooks steal physical cargo
00:07:36
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines.
- [00:07]
B
These are the cybersecurity headlines for Tuesday, November 4, 2025. I'm Sarah Lane. Sleepy Duck uses Ethereum to keep command server alive Threat intelligence firm Secure Annex found a malicious Visual Studio extension called Sleepy Duck that can install a remote access Trojan. The extension looks legitimate at first, but later turns malicious after roughly 14,000 downloads. Once a user opens that solidity file, the extension collects system details and connects to a command and control server every 30 seconds. Secure Annex says the attackers used an Ethereum contract to Dynamically update their C2 address to evade blocking, also tracing the group behind Sleepy Duck to other Rogue Vs code extensions that mine Monera through PowerShell scripts. Sesame OP abuses OpenAI Assistance API Microsoft's detection and response team discovered a new backdoor called SesameOP that uses the OpenAI Assistance API as a covert command and control channel. The malware appears to be active since July, letting attackers remotely manage infected systems by relaying encrypted commands through OpenAI's infrastructure instead of traditional malicious servers. Microsoft says that SesameOp doesn't exploit a platform flaw, but misuses legitimate API functions for long term espionage. OpenAI and Microsoft have since disabled the attacker's account and API. Key Organized crime Cyber crooks steal cargo Researchers from Proofpoint say that cybercriminals are teaming up with organized crime groups to hijack cargo shipments through hacked logistics systems. Attackers gain access to US Freight broker load boards, post fake jobs and infect logistics firms with remote monitoring tools like Screen Connect or Enable, then intercept delivery info and redirect goods to their own addresses. These range from electronics to energy drinks. Cargo Net says that Theft losses hit 1,112 million in Q3 of 2025 with hotspots in California, Illinois, Florida, Texas and Washington. Ukrainian charged in Jaber Zeus cybercrime case Ukrainian national Yuri Egorovich Ribsoff has been extradited from Italy to the US to face charges tied to the Jabber Zeus cybercrime group. Allegedly, the group's developer, Ripsoff, is said to have helped manage notifications of compromised organizations and launder stolen funds. Jabber Zeus used the Zeus banking Trojan and social engineering to steal millions from small and mid sized US businesses funneling money through mules and overseas accounts. The group's purported leader, Vacheslav Panchakov, was sentenced to 18 years in the US last year. Huge thanks to our sponsor Threat Locker. Cybercriminals do not knock. They sneak in through the cracks. Other tools missed. That's why organizations are turning to ThreatLocker as a zero trust endpoint protection platform, Threat Locker puts you back in control, blocking what doesn't belong and stopping attacks before they spread. Zero Trust security starts here with Threat Locker. US Cyber Experts indicted for Black Cat Ransomware Attacks Three former cybersecurity professionals have been indicted for allegedly carrying out Black Cat ransomware attacks against five U.S. companies back in 2023. The DOJ says that Kevin Martin, a former Digital Mint ransomware negotiator, Ryan Goldberg, a former Signia Incident response manager and an unnamed co conspirator posed as black hat affiliates to hack networks, encrypt data and demand ransoms of up to $10 million. Victims included firms in healthcare engineering and pharmaceuticals. GDI flaws could enable Windows Remote code execution CheckPoint research revealed three newly patched Windows GDI flaws that could allow remote code execution and information disclosure via fuzzing of EMF and EFM plus files. They involve out of bounds memory access, affecting text rendering, thumbnail generation and print job initialization. Exploits could let attackers read or write memory without user interaction. Microsoft fixed the issues over the summer with validation checks, boundary trimming and pointer corrections. The flaws also impacted Microsoft Office for Mac and Android. Askool confirms data leak after cyber Attack Japanese retailer Askool confirmed a data breach after an October ransomware attack claimed by Russia linked group Ransom House. The attack disrupted logistics for major clients, including Muji and the loft. Ransom House is known for threatening to publicly release stolen data rather than encrypting it. Now claiming to have exfiltrated 1.1 terabytes more and write apps misusing NFC and HCE X Imperium Z Labs announced that it found more than 760 and write apps misusing NFC and host card emulation, also known as hce, to steal payment data. This points to a surge in NFC relay fraud since since April of 2024, targeting banks, payment services and government portals globally, including Russian, European and Brazilian institutions. Also, Google pay apps mimic trusted services, then exfiltrate card data via Telegram and let operators run transactions remotely. Zimperium warns that any unknown NFC enabled app requesting payment privileges should be treated as high risk and has published IOCs for the campaign. In cybersecurity, we know what controls work well. Think of mfa. But beyond the basics, it's often hard to tell what's actually effective. If we don't know what's working, how do we decide what tools to invest in? That is what we're discussing on this week's episode of the CISO Series podcast. Look for the episode I don't just guess about effectiveness. I make educated guesses. Wherever you get your podcasts and if you have thoughts on the news from today or about our show in general, be sure to reach out to us@feedbacksoseries.com we would love to hear from you. I'm Sarah Lane reporting for the CISO series, and you stay classy, Planet Earth. That's in order.
- [07:20]
A
Cybersecurity headlines are available every weekday. Head to csoseries.com for the full stories behind the headlines.