BMC Daily Cyber News

This is today’s cyber news for October 14th, 2025. You can also subscribe to the newsletter and view the archive of previous headlines at daily cyber dot news.

What happened: Microsoft tightened Internet Explorer mode inside Edge after evidence that attackers abused a legacy rendering path tied to Chakra, the older JavaScript engine. The change reduces where and how IE mode can run and limits silent fallbacks to that vulnerable path. Enterprises that relied on broad IE-mode site lists may see breakage in older intranet apps. The shift follows reports of targeted phishing that pushed users into IE mode, then executed code with the user’s rights. Microsoft is also expanding telemetry around IE-mode launches and script execution.

What this means: Legacy compatibility is shrinking as Microsoft closes doors attackers actually used, not just theoretical risks. Teams with line-of-business apps that still require IE behaviors face both usability and security pressure to modernize. For leaders: make an explicit call—either accelerate retirement of those apps or fund isolating controls that fence them off. For defenders: treat any IE-mode invocation as high-risk and alert on it until all required apps are inventoried and ring-fenced. Signals to watch include spikes in IE-mode process launches in endpoint telemetry and policy overrides that widen the Enterprise Mode Site List.

Recommendation: Narrow IE mode to named apps only and monitor launches; if breakage blocks operations, isolate legacy apps in hardened virtual machines while you modernize and verify no IE-mode use outside the allowlist.

What happened: A broad campaign is using valid usernames and passwords to access SonicWall S S L V P N portals and pivot into internal networks. The pattern points to password reuse and token theft rather than a new remote code execution flaw. Post-authentication reconnaissance and data staging were observed quickly after logins, often followed by ransomware operators. Several victims reported gaps where multi-factor authentication was missing or misapplied on VPN portals. SonicWall urged immediate hygiene checks and tightened policies for failed logins and geographic anomalies.

What this means: The risk is immediate for any organization exposing VPN logins with weak multi-factor or reused credentials. Managed service providers and mid-market I T teams that standardize on these gateways are especially exposed to lateral movement. For leaders: demand an enterprise-wide credential hygiene review and enforce phishing-resistant multi-factor on all remote access. For defenders: baseline VPN auth logs now and alert on impossible travel, atypical device I D s, and large config exports. Signals to watch include bursts of successful logins from new countries and new Duo or Okta enrollments created shortly after first-time logins.

Recommendation: Enforce phishing-resistant multi-factor and rotate VPN credentials; if rollout lags, geofence access and cap login attempts while you verify no new admin accounts or configuration changes.

What happened: Extortion actors targeted Oracle E-Business Suite with an unpatched flaw used alongside recent issues to exfiltrate financial records and threaten leaks. Oracle released an out-of-band fix and guidance to harden Internet-facing modules. Victims reported data access through web tiers that weren’t meant to expose sensitive reports. Because E B S underpins procurement, receivables, and the general ledger, theft creates direct fraud and insider-threat angles. Early artifacts suggest attackers combined authentication bypass with privilege escalation.

What this means: Enterprises that run E B S for core finance are at heightened risk until patches land and exposure is reduced. Shared service centers and global finance operations with custom integrations are most exposed. For leaders: prioritize downtime windows for patching and authorize temporary controls that reduce external exposure even if they slow business. For defenders: inventory Internet-reachable E B S modules and comb logs for unusual report exports and admin role changes. Signals to watch include spikes in “Concurrent Request” exports and failed logins followed by sudden admin privilege grants in short windows.

Recommendation: Patch E B S now and disable external access to nonessential modules; if you must delay, restrict by I P and monitor for large report exports while you verify admin role integrity.

What happened: A coordinated botnet using more than one hundred thousand I P addresses has intensified brute-force attacks against Remote Desktop Protocol endpoints in the United States. Attackers rotate through credential lists and common username patterns, then rapidly attempt lateral movement after a single hit. Small and midsize organizations with exposed R D P or forwarded ports are seeing sustained pressure. The campaign’s volume and geographic spread suggest rented infrastructure and prior credential dumps powering the attempts.

What this means: Direct R D P exposure remains a straight line to domain compromise and ransomware deployment. Organizations with legacy remote admin habits or unmanaged hosts are most at risk. For leaders: mandate R D P’s removal from the public Internet and fund alternatives like secure jump hosts. For defenders: enforce account lockouts, require Network Level Authentication, and watch for sudden spikes in Kerberos failures after R D P hits. Signals to watch include repeated four-six-two-five logon failures from many I P addresses and new local admin accounts appearing within hours of R D P success.

Recommendation: Block public R D P and place administration behind VPN with multi-factor; if you can’t immediately, enable account lockouts and firewall geofencing while you verify no new local admins or lateral S M B traffic.

What happened: A North Korea-linked effort seeded hundreds of malicious packages into the Node Package Manager ecosystem, aiming at developers in crypto, Web Three, and data tooling. The packages used typosquatting and familiar names to trigger installs during fast prototyping. Some binaries exfiltrated S S H keys, cloud tokens, or clipboard data; others pulled second-stage payloads from disposable domains. Download counts rose before takedowns, indicating successful developer exposure.

What this means: Developer workstations and build agents are now prime targets, turning supply-chain trust into initial access. Startups, exchanges, and any team with continuous integration using N P M are most exposed. For leaders: require provenance checks and lock dependencies to vetted, hashed versions. For defenders: monitor developer endpoints for unusual package install scripts and outbound connections during builds. Signals to watch include N P M install events spawning network utilities in endpoint detection and response, and new Git hosting tokens created shortly after package updates.

Recommendation: Pin dependencies with lockfiles and private registries; if immediate pinning isn’t possible, block newly published, unvetted packages and verify recent builds for unexpected network calls and credential access.

What happened: Data brokers tied to the ShinyHunters brand posted samples they claim come from major airlines, including Qantas and Vietnam Airlines. The teasers point to frequent-flyer records, contact details, and limited payment metadata, with larger dumps allegedly for sale. Authenticity is still being verified, but screenshots match typical airline data schemas. Loyalty programs and booking systems are frequent targets because they hold rich identity attributes and monetizable miles. The group has a history of blending real and recycled data to maximize attention.

What this means: If real, that data fuels account takeovers, social engineering, and fraudulent ticketing. Carriers, alliances, and partners that sync loyalty profiles face higher downstream misuse. For leaders: prep coordinated communications and account-reset flows that won’t melt your support lines if exposure is confirmed. For defenders: watch for mass password resets, new device enrollments, and spikes in miles transfers from unusual IP ranges. Signals to watch include sudden contact-detail changes in loyalty portals and login attempts from automation-heavy networks.

Recommendation: Turn on adaptive multi-factor and rate limits for loyalty actions; if breach risk is confirmed, force high-risk accounts through a reset and verify changes with out-of-band checks.

What happened: A mobile malware strain is spreading through WhatsApp by auto-replying to messages with a short lure and a malicious link. The payload targets Brazilian banking apps, overlaying credential screens and capturing one-time passcodes. The wormlike behavior increases reach by abusing trusted contacts and group chats. Infected devices grant notification access and accessibility permissions to persist. Some samples try to disable Play Protect and sideload updates from third-party stores.

What this means: Bring-your-own-device environments and field teams that rely on WhatsApp risk credential theft and fraudulent transactions. Financial services, retail, and logistics with large mobile workforces are especially exposed. For leaders: set a clear stance on consumer messaging apps used for work and give people safe alternatives. For defenders: enforce device-integrity checks in mobile device management and watch for accessibility abuse and unknown APK installs. Signals to watch include spikes in WhatsApp auto-replies from corporate numbers and anomalous banking logins from new devices minutes after message bursts.

Recommendation: Require official app stores and block unknown sources; if you can’t yet, quarantine devices with accessibility abuse and verify banking and identity app integrity through M D M checks.

What happened: The long-running Astaroth—also known as Guildma—banking trojan refreshed its playbook by stashing live configuration files on GitHub, using benign-looking repos to rotate command-and-control endpoints. Email lures install loaders that fetch repo content, parse victim targeting rules, and then pull stage two. Hosting configs on a mainstream developer platform blurs network signals and survives domain seizures. Recent waves target Latin America with spillover to the U.S. and Europe.

What this means: Domain-based blocks lose power when malware leans on reputable platforms. Organizations with permissive developer tooling and broad GitHub access are most at risk. For leaders: balance developer productivity with scoped egress controls and logging for code-hosting sites. For defenders: detect unusual GitHub raw-content fetches from non-developer endpoints and script interpreters spawning network calls. Signals to watch include spikes in GET requests to raw dot githubusercontent dot com outside dev groups and Office or script hosts reaching code-hosting domains.

Recommendation: Apply conditional access and egress rules for GitHub; if broad access is required, enable SSL inspection on egress and verify endpoints block raw-content fetches from script hosts.

What happened: Researchers published a working proof-of-concept for a Lenovo Windows driver flaw tracked as C V E two-zero-two-five-eight-zero-six-one. The bug enables local privilege escalation—L P E—to System by abusing insecure I O C T Ls, turning a low-privileged foothold into full control. After the proof dropped, teams saw rapid weaponization attempts in red-team exercises. Affected driver versions ship with certain consumer and enterprise models and may live in golden images.

What this means: Anywhere attackers gain code execution, they can now elevate quickly on Lenovo endpoints until fixes and blocks land. Enterprises with mixed-model fleets and older build pipelines are most exposed. For leaders: approve emergency windows to remove or update the driver and push kernel-level blocks. For defenders: add the driver to endpoint detection blocklists, hunt for abnormal handle access to device objects, and verify Secure Kernel protections. Signals to watch include process chains invoking the vulnerable driver and spikes in token manipulation and SeDebugPrivilege use after exploit attempts.

Recommendation: Deploy the vendor fix or block the driver with Windows Defender Application Control; if delayed, strip the driver from images and verify fleet compliance via hardware inventory and E D R telemetry.

What happened: A third-party plugin used in Autodesk Revit projects shipped with hardcoded Azure Storage shared access signature—S A S—tokens inside signed D L Ls. Those tokens granted broad read and write access to containers hosting project files and exports. Anyone with the plugin could enumerate and modify assets until the tokens were revoked. Architecture, engineering, and construction firms often sync these files across partners, amplifying exposure.

What this means: Hardcoded credentials in signed components create quiet supply-chain blast radius in collaborative workflows. Practices using Revit plugins and cloud storage integrations are most exposed. For leaders: require supplier attestations on secret handling and enforce fast revocation paths. For defenders: rotate tokens, enable Azure Storage logging, and check for unauthorized writes or container listings. Signals to watch include access from unfamiliar tenants to affected storage accounts and surges in blob listings and PUT operations from plugin hosts.

Recommendation: Revoke exposed S A S tokens and redeploy with scoped, short-lived credentials; if vendor updates lag, block the plugin via application control and verify storage logs for unauthorized reads and writes.

What happened: Radiology provider SimonMed disclosed that attackers accessed systems holding protected health information, with early counts near one point two million affected patients. The Medusa ransomware group claims it stole roughly two hundred gigabytes and sought payment to suppress release. Exposed data likely includes contact details, scheduling information, and imaging-related records, with limited Social Security number exposure still under review. Healthcare entities face strict notification clocks and scrutiny from regulators and class-action firms. Third-party diagnostics platforms and image exchange portals can widen exposure beyond the core network.

What this means: Healthcare operations depend on timely imaging, so incidents hit both availability and privacy during recovery. Regional hospital networks, outpatient centers, and insurers that exchange imaging orders are most exposed to downstream fraud and disruptions. For leaders: align legal, privacy, and clinical operations on one message, clear timelines, and credit monitoring offers. For defenders: hunt for lateral movement into P A C S or V N A systems and tighten access to image archives and portals. Signals to watch include unusual D I C O M transfers after-hours and spikes in portal account resets and new device enrollments by patients.

Recommendation: Segregate imaging platforms and rotate credentials now; if vendor remediation lags, restrict portal access by I P and verify audit logs for bulk exports and anomalous D I C O M sessions.

What happened: A Magecart-style card skimmer was injected into the checkout flow for SpeedTree, a Unity-owned asset and vegetation tool used by game and film studios. The malicious script captured payment details and contact info during purchase and quietly exfiltrated it to an attacker-controlled endpoint. The compromise was active long enough to affect an unknown number of buyers and partners. Unity removed the code and started notifications, while rotating keys and reviewing third-party scripts used in the storefront.

What this means: Creative and engineering teams who purchased licenses risk card fraud and targeted phishing that looks like support renewals. Studios, post-production houses, and indie developers who share purchasing functions across teams are particularly exposed. For leaders: coordinate with finance to reissue cards used on the site and warn staff about renewal-themed lures. For defenders: sweep web estates for unauthorized scripts and implement subresource integrity and Content Security Policy. Signals to watch include spikes in chargebacks tied to affected cards and new domains mimicking vendor support or license portals.

Recommendation: Replace impacted cards and enable real-time purchase alerts; if you can’t immediately, cap online spend limits and verify your own storefronts enforce Content Security Policy and script integrity checks.

What happened: Parts of Microsoft 365 experienced an availability incident that interrupted access to Outlook, SharePoint, and Teams for subsets of users. Symptoms varied by tenant and region, with elevated login failures and degraded search and file access. Microsoft activated mitigation steps such as traffic rebalancing and cache resets and published updates through the service health dashboard. The event highlights widespread dependency on a small set of collaboration backbones.

Recommendation: Establish outage playbooks with approved alternates and guardrails; if not ready, temporarily block risky forwarding and sync behaviors and verify post-incident mail rules and access grants return to baseline.

What happened: New research dubbed “RMPocalypse” shows techniques to subvert the Reverse Map Table protections in A M D’s Secure Encrypted Virtualization—Secure Nested Paging. By abusing page state transitions and hypervisor interactions, an attacker with host control can potentially read or influence guest memory that should be isolated. Cloud providers and on-prem virtualized environments using S E V–S N P for data-in-use protection must evaluate mitigations, microcode dependencies, and workload placement.

What this means: Confidential computing assumptions change when isolation can be bypassed under certain conditions. Tenants running high-sensitivity workloads that rely on S E V–S N P—financial services, healthcare analytics, and key management—are most exposed. For leaders: request provider advisories on exposure scope, patch timelines, and any guest updates required. For defenders: verify platform microcode levels and test attestation flows for drift or failures. Signals to watch include changes in guest attestation measurements after maintenance and provider notices that temporarily restrict confidential V M instance types.

What happened: A fast-evolving botnet referred to as RondoDox chains over fifty vulnerabilities across routers, cameras, digital video recorders, and small-office gear from more than thirty vendors. Operators rotate exploits pulled from recent advisories and proof-of-concept releases to grow nodes and then launch denial-of-service or proxy traffic. Many targets run outdated firmware with default credentials and weak exposure rules. The campaign shows how “good enough” patching on edge hardware still leaves broad attack surface.

What this means: Edge devices with long lifecycles and limited monitoring are easy footholds for persistence and staging. Retail, hospitality, campuses, and distributed branches with mixed vendor estates are most exposed. For leaders: fund lifecycle replacement and enforce a standard for manageable, auto-updating gear. For defenders: inventory internet-reachable admin panels and block universal plug-and-play, telnet, and outdated web consoles. Signals to watch include spikes in outbound U D P or T C P from cameras and routers and new scheduled tasks or cron jobs on embedded Linux hosts.

Recommendation: Patch and segment edge devices now; if replacement is delayed, disable risky services, change all defaults, and verify exposure with an external scan and continuous egress monitoring.

What happened: Investigators detailed a Rust-based backdoor called “ChaosBot” that hides in plain sight by using Discord channels for command and control—often shortened as C two. After gaining an initial foothold, the malware enrolls the host into a specific channel, reads operator instructions from message content, and exfiltrates results as file attachments. Operators lean on over-privileged user accounts and permissive egress rules to move laterally, run discovery, and stage payloads. Rust’s static binaries and Discord’s legitimate domains make signature-based controls and quick takedowns less effective.

Recommendation: Block collaboration domains from servers and restrict client egress by policy; if you can’t yet, add detections for Discord domain access plus script execution, and verify via endpoint hunts that no systems are beaconing to Discord channels.

That’s the BareMetalCyber Daily Brief for October 14th, 2025. For more, visit BareMetalCyber dot com. You can also subscribe to the newsletter and view the archive of previous headlines at daily cyber dot news. We’re back tomorrow.