CyberNews: 25/10/2026 Edition

Today’s roundup

Summary

The BlackCat/ALPHV ransomware group has launched new operations, primarily targeting the healthcare sector. These attacks leverage older, unpatched vulnerabilities to gain initial access, rather than zero-days. This marks an evolution in their tactics, focusing on sectors with high-value data and potential for disruption, and exploiting known weaknesses for initial breach.

A critical remote code execution (RCE) vulnerability, CVE-2023-35078, in Ivanti Endpoint Manager Mobile (EPMM) is being actively exploited as a zero-day. This flaw allows unauthenticated attackers to access sensitive information or execute arbitrary commands. Organizations using Ivanti EPMM versions 23.3, 23.2, 23.1, 11.10, and 11.9 are urged to patch immediately to prevent exploitation.

Cisco has released patches for critical vulnerabilities affecting its VPN products, including Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. A high-severity flaw, CVE-2023-20198, could allow a remote, unauthenticated attacker to elevate privileges to root level via RADIUS authentication. Another vulnerability, CVE-2023-20202, leads to a denial-of-service condition for SSL VPN users.

Microsoft's August 2023 Patch Tuesday addressed 74 vulnerabilities, including two actively exploited zero-days. CVE-2023-38183, an information disclosure flaw in Windows Search Service, and CVE-2023-36884, an RCE vulnerability in Microsoft Office and Windows HTML Platform, were both exploited in the wild. The update also covered fixes for privilege escalation, spoofing, and denial-of-service issues across various products.

New malicious packages have been discovered on the Python Package Index (PyPI), including 'pytoeba' and 'pyepl'. These packages are designed to steal sensitive data, such as environment variables, local files, and network information, from developers' systems. Developers are advised to exercise caution when installing new packages and to verify their authenticity.

The North Korean state-sponsored APT group Kimsuky (also known as APT42, Thallium, Black Banshee) is employing a new reconnaissance tool named 'Durian'. This tool is used for initial system profiling and gathering information about target environments. Its discovery indicates an ongoing effort by Kimsuky to enhance its espionage capabilities.

Cisco has released security updates for multiple critical vulnerabilities impacting its Industrial Routers and IoT Gateways. These include CVE-2023-20076 (Denial of Service), CVE-2023-20077 (Arbitrary Code Execution), and CVE-2023-20078 (Authenticated Arbitrary File Upload). These flaws could allow remote attackers to execute arbitrary code, bypass authentication, or cause service disruptions on affected devices, posing significant risks to industrial control systems.

Want to dig deeper?

Cyber Groups