■■■■□ Hackers posing as Kyrgyzstan’s Justice Ministry are spreading 2013-era NetSupport RAT across Kyrgyzstan and Uzbekistan using fake PDFs and old Java tricks—blocking outsiders to hide the attack.

■□□□□ CVE-2025-5318
A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.

https://access.redhat.com/errata/RHSA-2025:18231

■□□□□ Major Cyber Attacks in November 2025.

https://any.run/cybersecurity-blog/major-cyber-attacks-november-2025/

■■□□□ Pakistan infra targeted on a DoS attack. This is per the threat actor; Keymous group. As they mentioned the following victims taken offline.

❌NTDC (National Transmission & Despatch Co.)
❌LESCO (Lahore Electric Supply Co.)
❌FESCO (Faisalabad Electric Supply Company)
❌GEPCO (Gujranwala Electric Power Co.)
❌MEPCO (Multan Electric Power Company)
❌TESCO (Tribal Electric Supply Co.)
❌HESCO (Hyderabad Electric Supply Co.)
❌SEPCO (Sukkur Electric Power Co.)
❌QESCO (Quetta Electric Supply Co.)

■■■□□ Unconfirmed: GrapheneOS vacates from France amid pressure to implement potential backdoors.

■■■□□ TOKYO: Japanese beer giant Asahi said Thursday (Nov 27) it was not negotiating with the hackers behind a "sophisticated and cunning" ransomware attack that is about to enter its third month.

"Even if we had a ransom demand, we would not have paid it," CEO Atsushi Katsuki said.

https://www.channelnewsasia.com/east-asia/beer-giant-asahi-not-engaging-ransomware-hackers-5493016

■■□□□ CodeRED emergency alert system CodeDEAD after INC ransomware attack.

Regions across US affected, and one tore up its contract for the product

https://www.theregister.com/2025/11/26/codered_emergency_alert_ransomware/

■■■■□ Command Injection in NASA CryptoLib (CVE-2025-59534)

https://aisle.com/blog/command-injection-in-nasa-cryptolib-cve-2025-59534

■■■■□ OSINT: Interesting thread on United States' 🇺🇸 attacker (Afghan national and traitor) that ambushed 2 national guard commandos.

https://x.com/AmyMek/status/1993977623773630766

■■■□□ New Unauthenticated DoS Vulnerability Crashes Next.js Servers with a Single Request.

https://cybersecuritynews.com/next-js-servers-dos-vulnerability/

■■■■□ Dead Man’s Switch – Widespread npm Supply Chain Attack Driving Malware Attacks.

https://cybersecuritynews.com/dead-mans-switch-npm-supply-chain-attack/

■■■■□ Cyber-Attack by Iranian state sponsored hacker group.

The Hendala group announces that it sent flowers to an Israeli scientist, after gaining access to a system allegedly related to the Soreq nuclear center.

It is likely that the flower delivery was carried out by a local collaborator, who placed the bouquet inside the scientist's car and documented the action with several photos and videos.

The attackers publish several screenshots from the system, allegedly showing administrative access and exposure to information about various parties involved in the Seraph project at Soreq (particle accelerator).

■■□□□ Google Says Some VPN Apps Are Actually Dangerous Malware.

https://www.gizchina.com/google-2/google-says-some-vpn-apps-are-actually-dangerous-malware

■■■■□ Thread actor "Sylhet Gang-SG" has targeted Moroccan Airlines website on their latest attack.

https://check-host.net/check-report/336a069cka52