⚠️ CVE-2025-7775 🖥️ Citrix NetScaler ADC/Gateway memory overflow 💬 allows unauthenticated remote code execution on vulnerable NetScaler appliances, enabling full system takeover and lateral movement 🔗 cve.mitre.org/cgi-bin/cven... #ransomNews #vulnerabilities #security #CVE

⚠️ Nearly 30 victims of Oracle EBS breach on Cl0p DLS The CL0P ransomware group published nearly 30 alleged victims of a major hack targeting Oracle E-Business Suite (EBS). Attackers used the 2023 GoAnywhere 0day, exfiltrated data and now aim for extortion. #ransomNews #OracleEBS #CL0P

🚨 nuova rivendicazione #ransomware Italia 🚨 🏴☠️ gruppo #INCRansom 🧬 Galileo | Roma 🎯 settore: education 🔗 galileo.it 🗓️ 12 novembre 2025 📄 sample: - ▪️ dati esfiltrati dichiarati: - ▪️ dati esfiltrati pubblicati: 286.00GB ⏲️ scadenza: - #ransomNews #security #infosec

🚨 nuova rivendicazione #ransomware Italia 🚨 🏴‍☠️ gruppo #Ransomhouse 🧬 Fulgar SPA | Castel Goffredo (MN) 🎯 settore: manifattura tessile 🔗 fulgar.com 🗓️ 12 novembre 2025 📄 sample: sì ▪️ dati esfiltrati dichiarati: - ▪️ dati esfiltrati pubblicati: - ⏲️ scadenza: - #ransomNews #security #infosec

🚨 MAD-CAT tool revives Meow-style data destruction Researchers unveiled MAD-CAT, an automation framework simulating the 2020 Meow attacks across #MongoDB, Elasticsearch, Cassandra, #Redis, CouchDB, and Hadoop HDFS. It corrupts multi-DB ecosystems via bulk CSV campaigns. #ransomNews #MADCAT

⚠️ NuGet supply chain compromise Malicious NuGet packages are injecting backdoors into downstream projects, risking CICD pipelines, build artifacts and production systems. 👉🏻 immediate action: audit dependencies, remove/revoke affected packages, enforce package signing, use SBOMs and rotate secrets.

🚨 nuova rivendicazione #ransomware Italia 🚨 🏴☠️ gruppo #Everest 🧬 SIAD SPA | Bergamo 🎯 settore: servizi e beni industriali 🔗 siad.com 🗓️ 11 novembre 2025 📄 sample: - ▪️ dati esfiltrati dichiarati: 159.00GB ▪️ dati esfiltrati pubblicati: - ⏲️ scadenza: 20 novembre #ransomNews #security #infosec

🥷🏻 Kazu 🗓️ added on November 10 🥢 Overview So far, the group KAZU has listed two victims of ransomware and several for-sale databases and server accesses. Among those listing, still unverified, there's an access to a non-specified Italian Magento portal. #ransomNews #security #newthreatactor

⚠️ Fantasy Hub spyware-for-rent Marketplace offers fake app kits and spyware-as-a-service with paid support, enabling credential theft, remote access and broad surveillance via mobile apps. 🔗 read more at Zimperium zimperium.com/blog/fantasy... #ransomNews #spyware #mobile

⚠️ monsta ftp flaw under active exploitation CVE-2025-34299 enables unauthenticated RCE in Monsta FTP ≤ 2.11.2 via crafted POST requests abusing downloadFile. Attackers can upload payloads and gain full server control. Patch to v2.11.3 immediately. #ransomNews #MonstaFTP #CVE202534299

⚠️ Massive knownsec leak exposes China’s cyber arsenal A 2025 breach at Chinese firm #Knownsec leaked 12K+ classified files: cyber weapons, RATs, hardware implants, and a global target list of 80 entities across 20 countries. Data includes 3 TB from LGU Plus and 95GB of India records. #ransomNews

⚠️ Massive knownsec leak exposes China’s cyber arsenal A 2025 breach at Chinese firm #Knownsec leaked 12K+ classified files: cyber weapons, RATs, hardware implants, and a global target list of 80 entities across 20 countries. Data includes 3 TB from LGU Plus and 95GB of India records. #ransomNews

⚠️ runc container escape exploited Attackers abuse the runc runtime to break out of containers, execute code on hosts and deploy malware. Patch runtimes, harden container configs, and monitor kernel anomalies to stop escapes. 🔗 read more: seclists.org/oss-sec/2025... #ransomNews #containerSec

⚠️ Paragon spyware hits academia, gov networks Paragon/Graphite campaigns deploy custom backdoors for stealthy persistence and data exfiltration, focusing on researchers’ credentials and IP. Defenders: isolate infected hosts, audit telemetry, rotate credentials and run focused EDR hunts.

🚨 nuova rivendicazione #ransomware Italia 🚨 🏴☠️ gruppo #DragonForce 🧬 Ponzini SPA | Lazzate (MB) 🎯 settore: manifattura prodotti per la persona 🔗 ponzini.com 🗓️ 08 novembre 2025 📄 sample: - ▪️ dati esfiltrati dichiarati: 314.00GB ▪️ dati esfiltrati pubblicati: - ⏲️ scadenza: 11 novembre #ransomNews

🔎 Inside ransomware’s profit-playbook Top #ransomware groups operate like criminal enterprises: recruiting affiliates, exploiting valid credentials and known vulnerabilities, leveraging double extortion, selling stolen data and encrypting systems for ransom.

🚨 nuova rivendicazione #ransomware Italia 🚨 🏴☠️ gruppo #Qilin 🧬 Studio Corvo | Parma 🎯 settore: consulenza finanziaria 🔗 studiocorvo.com 🗓️ 07 novembre 2025 📄 sample: sì ▪️ dati esfiltrati dichiarati: 42.00GB ▪️ dati esfiltrati pubblicati: - ⏲️ scadenza: - #ransomNews #security #infosec

🔎 Norton launches free decryptor for Midnight ransomware #NortonLifeLock has released a free decryption tool to help victims of the Midnight ransomware group recover files without paying a ransom. 🔗 read more on Hackread: hackread.com/norton-midni... #ransomNews #MidnightRansomware #decryptor

⚠️ UnSmudgedSerpent targets academics worldwide The advanced persistent threat group #UnSmudgedSerpent is conducting spear phishing campaigns against researchers and universities by dropping opensource #malware, exploiting CVE-2023-45165 and demanding ransom while exfiltrating intellectual property.

🔎  Retail firms hit despite better defenses In the latest Sophos “State of Ransomware in Retail 2025” report, 46% of attacks started via unknown gaps, 58% of victims paid the ransom, median demand doubled to $2M, average payment $1M and recovery cost dropped to $1.65M #ransomNews #ransomware

⚠️ CL0P ransomware evolves its tactics The #CL0P gang has upgraded its operations: extending dwell time, leveraging 0day flaws in file-transfer software, and accelerating double-extortion campaigns across manufacturing, education and healthcare. #ransomNews #doubleExtortion

🚨 Windows update bug forces BitLocker recovery A critical update to #Windows10 (KB5058379) is triggering unexpected boot loops and locking devices into #BitLocker recovery mode on systems with Intel vPro/TXT enabled. Emergency patch issued #ransomNews #windowsUpdate #bitlockerlockout

⚠️ hackedGPT reveals new vulnerabilities in GPT models Research uncovers critical weaknesses in large-language models (LLMs) like prompt injections, model stealing and hidden backdoors enabling adversaries to manipulate or extract AI behaviour and data. #ransomNews #LLMvulnerabilities #AIsecurity

🚨 Authorities dismantle large-scale credit card fraud scheme International law enforcement takedown hits underground network that cloned thousands of cards, processed millions in phantom transactions, and laundered funds via crypto. #ransomNews #cardFraud #cybercrime

⚠️ Scammers exploiting US Gov shutdown Fraudsters are leveraging the current US Gov shutdown to impersonate agencies, claim benefits are blocked, threaten account closures, or offer fake loans, preying on vulnerable federal workers and citizens facing uncertainty. #ransomNews #shutdownScams

⚠️ North Salem school district leaves student data exposed Despite a 2023 audit flagging critical vulnerabilities in the North Salem Central School District’s data systems, sensitive student information remains at risk, raising questions about accountability and follow-through. #ransomNews #edudata

🚨 nuova rivendicazione #ransomware Italia 🚨 🏴☠️ gruppo #Qilin 🧬 Francehopital SAS | Lana (BZ) 🎯 settore: apparecchiature medicali 🔗 francehopital.com 🗓️ 06 novembre 2025 📄 sample: - ▪️ dati esfiltrati dichiarati: - ▪️ dati esfiltrati pubblicati: - ⏲️ scadenza: - #ransomNews #security #infosec

⚠️ Microsoft Teams flaws exploited Attackers abuse #Teams flaws to deliver #malware, hijack accounts and escalate access via malicious links, bots or external apps. Patch, restrict apps, enforce conditional access, monitor telemetry. #ransomNews #MicrosoftTeams #infosec

⚠️ Ai-driven ransomware surge in Europe Generative AI is abused to automate phishing, create malware, scale extortion. Europe is heavily targeted as attackers use AI for recon and personalised lures—urgent need for detection and governance now. #ransomNews #AIthreats #ransomware

⚠️ Anthropic launch desktop extensions for Claude #Claude now supports Desktop Extensions (DXT/.mcpb) enabling one-click installs of local Model Context Protocol (MCP) servers to integrate #AI with local tools and files, while raising questions about surface exposure from richer tool access.

⚠️ CISA adds Gladinet & CWP flaws Cybersecurity and Infrastructure Security Agency (#CISA) has officially added vulnerabilities in #Gladinet Cloud Enterprise and #CWP to its Known Exploited Vulnerabilities list, urging immediate patching across US organizations and supply chains. #ransomNews #CVE

⚠️ Major Swedish software supplier breach hits 15M A data breach at Swedish software provider Telia-owned company #Affectus (Fasthosts?) impacts about 15M records including passwords and payment data. #ransomNews #supplyChain #databreach

🔎 Windows 7 stripped to 69 MB still boots A (nerdy) developer removed nearly everything from Microsoft #Windows7 to reduce it to a mere 69MB. Yet the OS still boots, showcasing minimal footprint possibilities and deep insights into system dependencies. #ransomNews #OSminimalism #WindowsHack

⚠️ Nikkei reports 17k data breach Japanese media conglomerate #Nikkei Inc. has confirmed a #databreach affecting about 17k individuals. Attackers gained access to employee Slack accounts by using authentication credentials stolen after an employee's computer was infected with #malware. #ransomNews

⚠️ Organized crime ups supply-chain theft Criminal networks are increasingly blending physical cargo theft with cyber-enabled tactics. Fraudulent carriers, GPS jammers, identity spoofing and supply chain IT exploits are enabling organised groups to target high value goods globally. #ransomNews

⚠️ CVE-2025-62507 🖥️ Redis 💬 allows attackers to to trigger a stack buffer overflow 🔗 cve.mitre.org/cgi-bin/cven... XACKDEL stream command allows attackers to trigger a stack buffer overflow by supplying an excessively large list of stream IDs through the Redis CLI or API. #ransomNews #CVE

🚨 Malicious “SleepyDuck” hijacks developer workflows A malicious VS Code extension named #SleepyDuck leverages compromised NPM packages to implant a reverse shell in dev environments, enabling code injection, credential theft and lateral movement. 🔗 read more:

🔎 Incident-response professionals charged in ransomware scheme Three US #cybersecurity incident-response specialists stand accused of operating a covert ransomware operation alongside the gang #ALPHV BlackCat, exploiting their insider status to orchestrate attacks on multiple firms. #ransomNews

🚨 CL0P^_ ransomware dissects networks Clop operators infiltrate, persist, steal and encrypt data, exploiting supply-chain flaws and AD admin accounts to move laterally and exfiltrate sensitive records; double extortion remains core. #ransomNews #clop #supplychain

⚠️ USB-borne Tangerine Turkey worm hijacks systems for cryptomining A worm dubbed Tangerine Turkey spreads via USB drives using VBScript and living-off-the-land binaries (LOLBins) like printui.exe to side-load malicious DLLs and deploy a cryptominer worldwide. #ransomNews #cryptomining #USBthreat

⚠️ Healthcare breach hits Medline Europe Medline Europe and Treasure Coast Cardiology suffered a #breach exposing patient records; incident highlights supply chain and security risks. Investigations underway. Patients notified. 📸 image courtesy Daily Dark Web #ransomNews #healthcare #databreach

Near the University of Washington? Be sure to stop by and check out @seagl.org this weekend! There, you can learn all about free and open source software, so registration required: www.eff.org/event/seagl

⚠️ University of Pennsylvania fake vulgar email sparks campus cybersecurity alert #uPenn reports that despite a wave of crude, impersonated messages sent via its infrastructure, it found no confirmed breach, instead attributing the incident to a likely data-list compromise.. #ransomNews #eduCyber

⚠️ Proton warns 300 million credentials leaked on dark web #Proton reveals over 300 million login details exposed via its new Dark Web Monitoring platform, highlighting credential-theft scale and urging users and organisations to shutter reused passwords, enable 2FA and assume breach.

⚠️ Conti ransomware leaders extradited to US Key Conti #ransomware operators have been extradited to the US, marking a major international step in disrupting one of the most destructive RaaS gangs, responsible for attacks on hospitals, businesses, and governments worldwide. #ransomNews #Conti

Proud partner of #CyberActors 🎭 @signorina37.ransomnews.online @sonoclaudio.ransomnews.online @fedtalk.bsky.social @garantepiracy.it

Jazz time for the opening speech by Gianluca Boccacci, President of the #CyberActForum. Among the guests: Pierguido Iezzi, Selene Giupponi, Emanuele De Lucia. Come join us! @signorina37.ransomnews.online @sonoclaudio.ransomnews.online @fedtalk.bsky.social @garantepiracy.it

🆕 🖊️ #CyberNews dall'Italia 🇮🇹 e dal mondo 🌐, via @ransomnews.online | ransomnews.online Nuovo gruppo monitorato: TENGU

🆕 🇮🇹 via, @ransomnews.online | ransomnews.online 🏴‍☠️ Gruppo: #medusa | Rivendicazione attacco informatico 🗒️ 7° attacco catalogato nel mese di Ottobre ⚠️ 139° attacco #Ransomware catalogato nel 2025 Cc/ @garantepiracy.it

🚨 Hacking Formula 1 How researchers were able to access F1 driver Max Verstappen's passport (and more). Security is not an option in the fast lane: ian.sh/fia