Team viewing laptop with security threats and warnings

November 1, 2025 - Daily Cybersecurity News

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

November 1, 2025 7:03 AM 5 min read

BadCandy Webshell Exploiting Unpatched Cisco Devices (CVE-2023-20198)

Critical

What happened

Cyber actors are exploiting a critical vulnerability (CVE-2023-20198) in Cisco IOS XE devices to deploy a Lua-based web shell known as BadCandy, enabling unauthorized remote command execution.

Who is affected

Organizations operating unpatched Cisco IOS XE devices with the web user interface exposed to the internet are at risk.

Why it matters

The exploitation allows attackers to gain full control over affected devices, potentially leading to data breaches, network disruptions, and further propagation of malicious activities within the network.

How it could have been prevented

Applying the security patch for CVE-2023-20198 promptly and disabling the web user interface if not necessary would have mitigated the risk.

Relevant professional terms

Web Shell: A malicious script that enables remote administration of a device, often used by attackers to maintain persistent access.
Lua: A lightweight, high-level programming language commonly used for scripting in embedded systems.

Recommended reading: Cyber.gov.au

Source: bleepingcomputer.com

CISA Confirms Exploitation of Linux Kernel Vulnerability CVE-2024-1086 by Ransomware Groups

High

What happened

The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that the high-severity Linux kernel vulnerability CVE-2024-1086 is being actively exploited by ransomware groups. This flaw allows local attackers to escalate privileges to root level.

Who is affected

Organizations and individuals operating Linux systems with kernel versions between 5.14 and 6.6 are at risk, especially if the systems have not been updated to include the patch released in January 2024.

Why it matters

Exploitation of this vulnerability can lead to full system compromise, enabling attackers to disable security defenses, install malware, and move laterally within networks, potentially resulting in significant data breaches and operational disruptions.

How it could have been prevented

Timely application of the security patch released in January 2024 addressing CVE-2024-1086 would have mitigated the risk. Regular system updates and monitoring for unusual activity are essential preventive measures.

Relevant professional terms

Privilege Escalation: The process by which an attacker gains higher access rights than originally granted, potentially leading to full control over a system.
Use-After-Free: A type of vulnerability that occurs when a program continues to use a pointer after it has been freed, leading to unpredictable behavior or security flaws.

Recommended reading: BleepingComputer

Source: bleepingcomputer.com

Windows Zero-Day Exploited by Chinese Hackers to Spy on European Diplomats (CVE-2025-9491)

High

What happened

A Chinese state-sponsored hacking group exploited a Windows zero-day vulnerability (CVE-2025-9491) to deploy the PlugX remote access trojan (RAT) via spearphishing emails targeting European diplomats.

Who is affected

Diplomatic entities in Hungary, Belgium, and other European nations were targeted by the Chinese threat group UNC6384 (Mustang Panda).

Why it matters

The exploitation of this zero-day vulnerability allows attackers to gain persistent access to sensitive diplomatic communications, posing significant risks to national security and international relations.

How it could have been prevented

Implementing advanced email filtering to detect and block spearphishing attempts, conducting regular security awareness training for staff, and applying security patches promptly once available.

Relevant professional terms

Zero-Day Vulnerability: A software security flaw that is unknown to the vendor and lacks a patch, making it exploitable by attackers.
Remote Access Trojan (RAT): A type of malware that provides unauthorized remote control over an infected computer.

Recommended reading: BleepingComputer

Source: bleepingcomputer.com

Ukrainian Extradited to U.S. on Conti Ransomware Charges

High

What happened

A Ukrainian national, Oleksii Oleksiyovych Lytvynenko, was extradited from Ireland to the United States to face charges related to his alleged involvement in the Conti ransomware operation. He is accused of managing data stolen from numerous victims and participating in double extortion attacks between 2020 and June 2022.

Who is affected

Organizations and individuals targeted by the Conti ransomware group during the specified period.

Why it matters

The extradition underscores international cooperation in combating cybercrime and highlights the ongoing threat posed by ransomware groups like Conti, which have caused significant financial and operational disruptions worldwide.

How it could have been prevented

Implementing robust cybersecurity measures, including regular system updates, employee training on phishing attacks, and maintaining secure backups, can mitigate the risk of ransomware infections.

Relevant professional terms

Double Extortion: A ransomware attack strategy where attackers not only encrypt the victim's data but also exfiltrate it, threatening to release the information publicly if the ransom is not paid.
Extradition: The formal process by which one country transfers a suspected or convicted criminal to another country for prosecution or punishment.

Source: bleepingcomputer.com

UNC6384 Exploits CVE-2025-9491 to Target European Diplomatic Entities

High

What happened

UNC6384, a China-linked threat actor, launched a cyber-espionage campaign targeting European diplomatic entities by exploiting CVE-2025-9491, a high-severity Windows vulnerability. The attack involved spear-phishing emails with malicious LNK files disguised as official European Commission and NATO documents.

Who is affected

Diplomatic personnel in Hungary and Belgium were specifically targeted in this campaign.

Why it matters

The exploitation of a known Windows vulnerability in conjunction with sophisticated social engineering tactics underscores the persistent threat posed by nation-state actors to sensitive governmental and diplomatic information.

How it could have been prevented

Regularly applying security patches to address known vulnerabilities like CVE-2025-9491 and conducting comprehensive training to recognize and avoid spear-phishing attempts are essential preventive measures.

Relevant professional terms

Spear-phishing: A targeted attempt to steal sensitive information by masquerading as a trustworthy entity in electronic communications.
Remote Access Trojan (RAT): A type of malware that provides an attacker with unauthorized remote access to a victim's computer.

Source: darkreading.com

Nation-State Hackers Infiltrate Ribbon Communications' Network

High

What happened

Nation-state hackers infiltrated Ribbon Communications' IT network in December 2024 and remained undetected until September 2025, accessing several customer files stored on two laptops outside the main network.

Who is affected

Ribbon Communications, a major telecom services provider with clients including Verizon, Deutsche Telekom, and the U.S. Department of Defense, along with at least three smaller customers whose files were accessed.

Why it matters

The prolonged undetected access by nation-state actors to a critical telecom provider underscores the vulnerability of essential infrastructure to sophisticated cyber threats, potentially compromising sensitive communications and data.

How it could have been prevented

Implementing continuous network monitoring and anomaly detection systems, along with regular security audits and employee cybersecurity training, could have helped in early detection and prevention of such breaches.

Relevant professional terms

Nation-State Actor: A government-sponsored group or individual engaged in cyber activities to achieve national objectives.
Advanced Persistent Threat (APT): A prolonged and targeted cyberattack in which an intruder gains access to a network and remains undetected for an extended period.

Source: darkreading.com

CISA Adds Exploited XWiki and VMware Vulnerabilities to KEV Catalog

High

What happened

The Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited vulnerabilities affecting XWiki and VMware products to its Known Exploited Vulnerabilities (KEV) catalog. The XWiki flaw (CVE-2025-24893) allows remote code execution via improper sanitization of search parameters, while the VMware flaw (CVE-2025-41244) enables local privilege escalation in Aria Operations and VMware Tools.

Who is affected

Organizations using XWiki and VMware products, specifically those with VMware Tools installed and managed by Aria Operations with SDMP enabled.

Why it matters

Exploitation of these vulnerabilities can lead to unauthorized code execution, data leakage, and system disruptions, posing significant security risks to affected organizations.

How it could have been prevented

Regularly applying security patches and updates, conducting thorough code reviews to identify input validation issues, and monitoring systems for unusual activity.

Relevant professional terms

Remote Code Execution (RCE): A vulnerability that allows an attacker to execute arbitrary code on a target system remotely.
Privilege Escalation: The exploitation of a flaw that allows an attacker to gain elevated access to resources that are normally protected from an application or user.

Recommended reading: CISA Known Exploited Vulnerabilities Catalog

Source: securityweek.com