Multiple hackers surrounding laptop with lock shield displaying ransomware warning and security threat icons

Daily Dose of Cybersecurity News - October 10, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

October 10, 2025 6:03 AM 6 min read

ClayRat Android Spyware Masquerades as Popular Apps

High

What happened

A new Android spyware named ClayRat is impersonating popular applications such as WhatsApp, Google Photos, TikTok, and YouTube to infiltrate devices. The malware is distributed through deceptive Telegram channels and counterfeit websites designed to appear legitimate.

Who is affected

Primarily targeting Russian users, the campaign has been active over the past three months, with over 600 documented samples and 50 distinct droppers identified.

Why it matters

ClayRat possesses extensive capabilities, including intercepting SMS messages, accessing call logs, capturing notifications, taking photos, and initiating phone calls. Its ability to propagate via SMS to contacts amplifies the risk of widespread infection.

How it could have been prevented

Users should avoid sideloading applications from untrusted sources and be cautious of instructions that bypass Android's security warnings. Regularly updating devices and utilizing reputable security software can also mitigate such threats.

Relevant professional terms

Dropper: A type of malware designed to install additional malicious software onto a device.
Command and Control (C2) Server: A server used by attackers to send commands to compromised systems and receive stolen data.

Recommended reading: Zimperium's Analysis of ClayRat Spyware

Source: bleepingcomputer.com

University Payroll Systems Targeted in "Payroll Pirate" Attacks

High

What happened

A cybercrime group identified as Storm-2657 has been conducting "payroll pirate" attacks since March 2025, targeting U.S. university employees to divert salary payments. The attackers compromise Workday accounts through phishing emails, utilizing adversary-in-the-middle (AITM) techniques to intercept multifactor authentication (MFA) codes and gain unauthorized access.

Who is affected

Employees at multiple U.S. universities, particularly those using Workday and potentially other HR SaaS platforms, are at risk. Microsoft Threat Intelligence reported 11 compromised accounts across three universities, with phishing emails sent to nearly 6,000 recipients at 25 institutions.

Why it matters

These attacks highlight the vulnerability of payroll systems to sophisticated phishing schemes, leading to financial losses and operational disruptions. The exploitation of MFA weaknesses underscores the need for more robust, phishing-resistant authentication methods.

How it could have been prevented

Implementing phishing-resistant MFA solutions, such as hardware security keys or biometric authentication, can mitigate the risk. Regular employee training on recognizing phishing attempts and establishing strict email filtering policies are also essential preventive measures.

Relevant professional terms

Adversary-in-the-Middle (AITM): A cyberattack where the attacker intercepts and potentially alters communication between two parties who believe they are directly communicating with each other.
Phishing-resistant MFA: Multifactor authentication methods designed to withstand phishing attacks, often involving hardware tokens or biometric verification that are not susceptible to credential theft.

Source: bleepingcomputer.com

Threat Actors Exploit Velociraptor DFIR Tool in Ransomware Attacks

High

What happened

Threat actors have begun utilizing the Velociraptor digital forensics and incident response (DFIR) tool to deploy LockBit and Babuk ransomware. They exploited an outdated version of Velociraptor, vulnerable to a privilege escalation flaw (CVE-2025-6264), to gain control over compromised systems.

Who is affected

Organizations targeted by the China-based adversary known as Storm-2603, which has been linked to these ransomware campaigns.

Why it matters

The misuse of legitimate DFIR tools like Velociraptor by threat actors underscores the evolving tactics in cyberattacks, making detection and mitigation more challenging. Exploiting known vulnerabilities in outdated software versions highlights the critical need for timely updates and patches.

How it could have been prevented

- Regularly updating and patching software to address known vulnerabilities. - Monitoring for unauthorized use of legitimate tools within the network.

Relevant professional terms

Privilege Escalation: Gaining higher-level permissions on a system than originally granted, often by exploiting vulnerabilities.
Digital Forensics and Incident Response (DFIR): The practice of investigating and responding to cyber incidents using specialized tools and methodologies.

Recommended reading: CISA Alert on Privilege Escalation Vulnerabilities

Source: bleepingcomputer.com

RondoDox Botnet Exploits 56 Known Vulnerabilities in Global Attacks

High

What happened

A new botnet named RondoDox has been actively exploiting 56 known vulnerabilities across more than 30 device types, including DVRs, NVRs, CCTV systems, and web servers, since June 2025.

Who is affected

Organizations and individuals using devices such as TP-Link Archer AX21 Wi-Fi routers, Digiever, QNAP, LB-LINK, TRENDnet, D-Link, TBK, Four-Faith, Netgear, AVTECH, TOTOLINK, Tenda, Meteobridge, Edimax, and Linksys are at risk.

Why it matters

The botnet's exploitation of multiple vulnerabilities, including those demonstrated at Pwn2Own competitions, poses a significant threat to network security, potentially leading to unauthorized access, data breaches, and service disruptions.

How it could have been prevented

Regularly updating device firmware to patch known vulnerabilities and replacing end-of-life equipment can mitigate the risk. Additionally, segmenting networks to isolate critical data from internet-facing devices and changing default credentials to strong, unique passwords are recommended practices.

Relevant professional terms

Botnet: A network of compromised computers or devices controlled by a malicious actor to perform coordinated tasks, such as launching DDoS attacks or spreading malware.
n-day vulnerability: A known security flaw for which a patch has been released, but not all systems have been updated, leaving them susceptible to exploitation.

Recommended reading: Trend Micro's analysis of RondoDox botnet

Source: bleepingcomputer.com

SonicWall Cloud Backup Breach Exposes Firewall Configurations

High

What happened

SonicWall confirmed that unauthorized parties accessed firewall configuration backup files for all customers utilizing its cloud backup service. The breach involved the MySonicWall portal, where attackers obtained encrypted credentials and configuration data.

Who is affected

All customers who have used SonicWall's cloud backup service to store firewall configuration files are impacted by this incident.

Why it matters

The exposed configuration files contain sensitive information that could facilitate exploitation of firewalls, potentially allowing threat actors to gain unauthorized access to affected networks.

How it could have been prevented

Implementing robust access controls, regular security audits, and multi-factor authentication could have mitigated the risk of unauthorized access to cloud backup services.

Relevant professional terms

Firewall Configuration Files: Files containing settings and rules that define how a firewall controls incoming and outgoing network traffic.
Encrypted Credentials: Usernames and passwords that have been transformed into a secure format to prevent unauthorized access.

Source: bleepingcomputer.com

PureRAT Attack Chain: From Infostealer to Full Remote Access Trojan

High

What happened

A sophisticated cyberattack campaign was identified, beginning with a Python-based infostealer and culminating in the deployment of PureRAT, a full-featured remote access trojan (RAT). The attack chain involved multiple stages, including phishing lures, in-memory loaders, defense evasion techniques, and credential theft, ultimately granting attackers complete control over compromised systems.

Who is affected

Organizations and individuals targeted by the phishing campaign, leading to the installation of the infostealer and subsequent deployment of PureRAT.

Why it matters

The use of a modular, commercially available RAT like PureRAT signifies a heightened level of sophistication in cyberattacks, enabling attackers to maintain persistent access, conduct surveillance, and exfiltrate sensitive data. This progression from simple infostealers to advanced RATs poses a significant threat to organizational security.

How it could have been prevented

Implementing robust email filtering to detect and block phishing attempts, educating employees on recognizing phishing lures, and deploying endpoint detection and response (EDR) solutions to identify and mitigate in-memory loaders and unauthorized remote access tools.

Relevant professional terms

Remote Access Trojan (RAT): A type of malware that allows an attacker to gain unauthorized remote control over a victim's computer.
In-memory Loader: A technique used by malware to execute code directly in a system's memory, avoiding writing to disk and thereby evading traditional file-based detection methods.

Source: bleepingcomputer.com

Pro-Russian Hacktivists Target Critical Infrastructure, Breach Decoy Water Treatment Facility

Medium

What happened

A pro-Russian hacktivist group named TwoNet infiltrated a water treatment facility, which was actually a decoy system designed by researchers to monitor cyber threats. The attackers gained access using default credentials and escalated their activities to disrupt operations within approximately 26 hours.

Who is affected

The incident involved TwoNet, a pro-Russian hacktivist group, and cybersecurity researchers from Forescout who set up the decoy water treatment facility.

Why it matters

This event highlights the evolving tactics of hacktivist groups targeting critical infrastructure, emphasizing the need for robust security measures in such sectors to prevent potential real-world disruptions.

How it could have been prevented

Implementing strong authentication mechanisms, avoiding the use of default credentials, and ensuring systems are not exposed to the public internet can mitigate such threats. Additionally, segmenting production networks and applying IP-based access controls for administrative interfaces are recommended.

Relevant professional terms

Honeypot: A security mechanism set to detect, deflect, or study attempts at unauthorized use of information systems.
Cross-Site Scripting (XSS): A security vulnerability that allows attackers to inject malicious scripts into content viewed by other users.

Source: bleepingcomputer.com