■■■□□ TOKYO: Japanese beer giant Asahi said Thursday (Nov 27) it was not negotiating with the hackers behind a "sophisticated and cunning" ransomware attack that is about to enter its third month.

"Even if we had a ransom demand, we would not have paid it," CEO Atsushi Katsuki said.

https://www.channelnewsasia.com/east-asia/beer-giant-asahi-not-engaging-ransomware-hackers-5493016

■■□□□ CodeRED emergency alert system CodeDEAD after INC ransomware attack.

Regions across US affected, and one tore up its contract for the product

https://www.theregister.com/2025/11/26/codered_emergency_alert_ransomware/

■■■■□ Command Injection in NASA CryptoLib (CVE-2025-59534)

https://aisle.com/blog/command-injection-in-nasa-cryptolib-cve-2025-59534

■■■■□ OSINT: Interesting thread on United States' 🇺🇸 attacker (Afghan national and traitor) that ambushed 2 national guard commandos.

https://x.com/AmyMek/status/1993977623773630766

■■■□□ New Unauthenticated DoS Vulnerability Crashes Next.js Servers with a Single Request.

https://cybersecuritynews.com/next-js-servers-dos-vulnerability/

■■■■□ Dead Man’s Switch – Widespread npm Supply Chain Attack Driving Malware Attacks.

https://cybersecuritynews.com/dead-mans-switch-npm-supply-chain-attack/

■■■■□ Cyber-Attack by Iranian state sponsored hacker group.

The Hendala group announces that it sent flowers to an Israeli scientist, after gaining access to a system allegedly related to the Soreq nuclear center.

It is likely that the flower delivery was carried out by a local collaborator, who placed the bouquet inside the scientist's car and documented the action with several photos and videos.

The attackers publish several screenshots from the system, allegedly showing administrative access and exposure to information about various parties involved in the Seraph project at Soreq (particle accelerator).

■■□□□ Google Says Some VPN Apps Are Actually Dangerous Malware.

https://www.gizchina.com/google-2/google-says-some-vpn-apps-are-actually-dangerous-malware

■■■■□ Thread actor "Sylhet Gang-SG" has targeted Moroccan Airlines website on their latest attack.

https://check-host.net/check-report/336a069cka52

■■■■■ The minefield between syntaxes: exploiting syntax confusions in the wild.

https://www.yeswehack.com/learn-bug-bounty/syntax-confusion-ambiguous-parsing-exploits

■■■□□ Intel suggests Israeli state sponsored threat actors are running free VPN apps to access data of people.

As per a source; the primary target is Iran.

■■■■□ Shai Hulud v2 Exploits GitHub Actions Workflows as Attack Vector to Steal Secrets.

https://cybersecuritynews.com/shai-hulud-v2-exploits-github-actions-workflows/