San Mateo, CA, November 10, 2025 — Stories, events, and developments that impacted the cybersecurity landscape last week, including emerging threats, policy changes, and industry responses.
Sandworm deploys destructive wipers in Ukraine
Slovakia-based security company ESET’s latest APT Activity Report confirms that the Russia-backed hacking group Sandworm deployed data-wiping malware in Ukraine throughout the second and third quarters of 2025. The attacks, which used wipers such as Zerolot and Sting, targeted government agencies and companies in the energy, logistics, and grain sectors, with ESET assessing that the objective was to weaken Ukraine’s economy. Other Russian-aligned groups also escalated operations in and beyond Ukraine. Gamaredon’s activity in particular has surged. This “coincided with a rare instance of cooperation between Russia-aligned APT groups, as Gamaredon selectively deployed one of Turla’s backdoors.” RomCom exploited a WinRAR zero-day to target EU and Canadian industries. The report also tracked heightened activity from China, Iran, and North Korea-aligned APTs conducting espionage and financially motivated attacks worldwide. Read more.
Hackers breach the U.S. Congressional Budget Office
The U.S. Congressional Budget Office (CBO) has confirmed it was hacked, with officials saying it has “identified the security incident, has taken immediate action to contain it, and has implemented additional monitoring and new security controls to protect further the agency’s systems going forward.” The Washington Post, which first disclosed the incident, reported that foreign hackers were behind the intrusion and may have accessed internal emails, chat logs, and communications between lawmakers’ offices and CBO analysts. The Senate Sergeant at Arms warned congressional offices that compromised correspondence could be leveraged for phishing attacks. Security researcher Kevin Beaumont suggested the breach may have stemmed from the CBO’s outdated Cisco ASA firewall, which remained unpatched as of the October 1 government shutdown and was vulnerable to bugs exploited by suspected Chinese state-backed hackers. Read more.
Apple patches 100+ flaws but stays silent on severity
Apple has issued one of its largest security updates to date, patching 105 vulnerabilities in macOS 26.1 and 56 in iOS and iPadOS 26.1, alongside dozens more in Safari, watchOS, visionOS, and Xcode. While no active exploits have been reported, researchers say Apple’s opaque disclosure practices make it challenging to assess severity or prioritize review. “As always, I get frustrated when reading Apple updates as they don’t provide any severity rating,” said Trend Micro’s Dustin Childs. “I understand not wanting to use CVSS, but if they would at least call out the critical and high-severity bugs, it would be greatly appreciated.” Childs also criticized Apple for downplaying some flaws, particularly in WebKit, where several bugs could cause crashes or allow code execution. The update follows a quieter period after five zero-days earlier this year and underscores continued scrutiny of Apple’s vulnerability reporting. Read more.
ChatGPT flaws expose user data to prompt attacks
Researchers at Tenable have uncovered seven vulnerabilities in OpenAI’s ChatGPT, affecting both GPT-4o and GPT-5 models, that could allow attackers to steal personal data from chat histories and user memories. The flaws, now partially patched, expose the platform to indirect prompt injection and memory poisoning attacks that can trigger hidden commands via malicious websites or crafted URLs. Similar issues have surfaced across AI ecosystems —from Anthropic’s Claude to Microsoft 365 Copilot and GitHub Copilot —highlighting the industry’s growing exposure to prompt-based exploits. “Prompt injection is a known issue with the way that LLMs work, and, unfortunately, it will probably not be fixed systematically in the near future,” Tenable researchers warned. “AI vendors should take care to ensure that all of their safety mechanisms (such as url_safe) are working properly to limit the potential damage caused by prompt injection.” Read more.
Lawmakers accuse Flock Safety of weak MFA controls
Lawmakers are urging the Federal Trade Commission to investigate Flock Safety for allegedly failing to enforce adequate cybersecurity controls, including multi-factor authentication, on its nationwide license plate camera network. In a letter to FTC Chair Andrew Ferguson, Sen. Ron Wyden and Rep. Raja Krishnamoorthi said Flock’s refusal to require MFA leaves billions of vehicle images vulnerable to hackers and foreign spies. The company confirmed that about 3% of its more than 5,000 law enforcement clients have not yet enabled MFA, despite the feature being set as the default for new customers. The lawmakers cited stolen credentials circulating online, including on Russian cybercrime websites, and prior unauthorized access incidents as evidence of risk. Flock says it continues working to improve security. Read more.
Malware uses LLMs for real-time adaptation, Google warns
Google’s Threat Intelligence Group says 2025 has brought a shift in cyber operations, as attackers increasingly embed large language models into new malware strains for on-the-fly adaptability. The group cites “just-in-time” self-modification techniques in malware like PromptFlux, an experimental Gemini-powered VBScript dropper capable of regenerating code, and QuietVault, which steals GitHub credentials using local AI tools. Google says that the most noteworthy feature of ProptFlux “is its ‘Thinking Robot’ module, designed to periodically query Gemini to obtain new code for evading antivirus software.” Other threats include FruitShell, a PowerShell reverse shell with built-in prompt evasion, and PromptLock ransomware. Google also documented widespread misuse of Gemini by Chinese, Iranian, and North Korean actors for phishing, data theft, and exploit generation. Underground markets are also now promoting AI-driven attack tools, signaling a broader transition toward automated, adaptive cybercrime ecosystems. Read more.
Critical flaws found in Claude Desktop extensions
Researchers at Koi Security discovered high-severity prompt injection vulnerabilities in three official Anthropic extensions for Claude Desktop, affecting its Chrome, iMessage, and Apple Notes connectors. Reported on July 3 via HackerOne and rated CVSS 8.9, the flaws stemmed from unsanitized command injection in unsandboxed environments, allowing malicious actors to turn benign prompts into remote code execution. Koi researchers warn that this could allow attackers to “read any file, execute any command, access credentials and modify system settings,” potentially enabling them to steal SSH keys, AWS credentials, and browser passwords. Koi researchers said the extensions act as “privileged executors” bridging Claude’s AI and the user’s system. Anthropic patched the issues in version 0.1.9, with fixes verified by Koi Security on September 19. Read more.
Russian nuclear plant data leaked on hacker forum
Russia’s state-owned nuclear waste management plant, Radon, has reportedly suffered a data breach after attackers posted what they claim is sensitive company data on a popular leak forum. The stolen files allegedly include employee names, test statistics, and state data tied to radiation testing. Cybernews researchers say the sample data was temporarily inaccessible due to download limits, suggesting high interest in the leak. “If there’s any PII or contact info of Radon employees, it could be used for social engineering, and possibly further identity profiling if combined with other data,” they said. Given Radon’s role in handling radioactive waste and its history managing the Chernobyl cleanup, experts warn that the breach could have grave implications if attackers forge safety data or target employees with phishing schemes. The company has not yet commented on the incident. Read more.
Cybersecurity pros indicted for running side ransomware scheme
Two cybersecurity professionals, including a former ransomware negotiator for Chicago-based DigitalMint, have been indicted for running their own ransomware extortion scheme while employed to defend companies against such attacks. Prosecutors say Kevin Tyler Martin and Ryan Clifford Goldberg, formerly of Sygnia Cybersecurity, used malware to extort millions from multiple firms, successfully stealing $1.2 million from a Florida medical company. The FBI alleges the pair operated alongside an unnamed third conspirator, also a DigitalMint employee, between May 2023 and April 2025. DigitalMint said that the alleged activity “took place outside of DigitalMint’s infrastructure and systems,” and that the perpetrators “did not access or compromise client data as part of the charged conduct… As expected, the indictment does not allege that the company had any knowledge of or involvement in the criminal activity.” Read more.
University of Pennsylvania hacker claims wider breach than disclosed
The hacker behind last week’s “We got hacked” emails sent to the University of Pennsylvania claims the breach they committed was far more severe than the school has reported, exposing data on 1.2 million donors, students, and alumni. After compromising a PennKey SSO account, the attacker allegedly accessed Penn’s VPN, Salesforce, SAP, SharePoint, and other systems, stealing personal, financial, and demographic data. BleepingComputer verified that the emails originated from Penn’s Salesforce Marketing Cloud instance. The hacker, who shared samples online, said they are not seeking ransom and targeted the university for its wealthy donor database. “We don’t think they’d pay,” they said. “And we can extract plenty of value out of the data ourselves.” Penn confirmed it is continuing to investigate the incident. Read more.
More cybersecurity news
- Last week’s news
- More cybersecurity news
- All articles sponsored by NetworkTigers
About NetworkTigers
NetworkTigers is the leader in the secondary market for Grade A, seller-refurbished networking equipment. Founded in January 1996 as Andover Consulting Group, which built and re-architected data centers for Fortune 500 firms, NetworkTigers provides consulting and network equipment to global governmental agencies, Fortune 2000, and healthcare companies. www.networktigers.com.
