■■■■■ Botnet takes advantage of AWS outage to smack 28 countries.

https://www.theregister.com/2025/11/26/miraibased_botnet_shadowv2/

https://www.theregister.com/2025/11/26/miraibased_botnet_shadowv2/

■■■■□ SectorA01 (Lazarus) employed a highly sophisticated, multi-stage attack chain

beginning with social engineering via a fake official Deriv trading platform installer (NSIS-based).
The infection progresses through a polyglot payload sequence (NSIS → Electron/JavaScript → Python → .NET), using dynamic code execution via eval() on remotely fetched JavaScript, Pastebin as a dead-drop mechanism with 1,000 pre-generated XOR-encrypted URLs, and Living-off-the-Land techniques by downloading and installing the legitimate official Python interpreter when absent.

Once inside, the malware conducts broad data theft including browser credentials and credit-card information, keylogging with clipboard monitoring and exfiltration, and keyword-based recursive searches for sensitive files (wallet, mnemonic, .env, etc.).
It establishes strong remote access through an AnyDesk backdoor using a pre-configured fixed password via service.conf overwrite, while achieving multi-layered persistence through the startup folder, scheduled tasks, and AnyDesk auto-start.

Defense evasion is comprehensive: it disables Windows Defender and Firewall while adding exclusions, masquerades as the legitimate system process Runtime Broker.exe, tampers PE timestamps to future dates (2070 and 2093), communicates in the final stage exclusively over Tor via a .onion C2 domain, and incorporates automatic client updates with trace self-deletion to hinder detection and analysis.

https://medium.com/@nshcthreatrecon/a-tsunami-sweeping-the-cyber-battlefield-analysis-of-sectora01s-hacking-activities-e4d006baae2f

https://x.com/blackorbird/status/1994001509944840678

■■■■□ Alleged Cloudflare DoS bypass.

https://t.me/DIeNlt/683

■■■□□ Alleged Disclosure of the identity of a 16-year-old teenager; the technical brain of the SLSH ransomware group from Amman, Jordan 🇯🇴

https://t.me/HackerNewscyber/2666

■■■■□ Hackers posing as Kyrgyzstan’s Justice Ministry are spreading 2013-era NetSupport RAT across Kyrgyzstan and Uzbekistan using fake PDFs and old Java tricks—blocking outsiders to hide the attack.

■□□□□ CVE-2025-5318
A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.

https://access.redhat.com/errata/RHSA-2025:18231

■□□□□ Major Cyber Attacks in November 2025.

https://any.run/cybersecurity-blog/major-cyber-attacks-november-2025/

■■□□□ Pakistan infra targeted on a DoS attack. This is per the threat actor; Keymous group. As they mentioned the following victims taken offline.

❌NTDC (National Transmission & Despatch Co.)
❌LESCO (Lahore Electric Supply Co.)
❌FESCO (Faisalabad Electric Supply Company)
❌GEPCO (Gujranwala Electric Power Co.)
❌MEPCO (Multan Electric Power Company)
❌TESCO (Tribal Electric Supply Co.)
❌HESCO (Hyderabad Electric Supply Co.)
❌SEPCO (Sukkur Electric Power Co.)
❌QESCO (Quetta Electric Supply Co.)

■■■□□ Unconfirmed: GrapheneOS vacates from France amid pressure to implement potential backdoors.

■■■□□ TOKYO: Japanese beer giant Asahi said Thursday (Nov 27) it was not negotiating with the hackers behind a "sophisticated and cunning" ransomware attack that is about to enter its third month.

"Even if we had a ransom demand, we would not have paid it," CEO Atsushi Katsuki said.

https://www.channelnewsasia.com/east-asia/beer-giant-asahi-not-engaging-ransomware-hackers-5493016

■■□□□ CodeRED emergency alert system CodeDEAD after INC ransomware attack.

Regions across US affected, and one tore up its contract for the product

https://www.theregister.com/2025/11/26/codered_emergency_alert_ransomware/

■■■■□ Command Injection in NASA CryptoLib (CVE-2025-59534)

https://aisle.com/blog/command-injection-in-nasa-cryptolib-cve-2025-59534

■■■■□ OSINT: Interesting thread on United States' 🇺🇸 attacker (Afghan national and traitor) that ambushed 2 national guard commandos.

https://x.com/AmyMek/status/1993977623773630766