Friday Wrap Up: 10 October 2025
Another week, another ransomware alliance, and somehow your mouse might be eavesdropping on you now. 🖱️👂
From fake Discord alerts stealing vault credentials to North Korean hackers pocketing $2B in crypto, this week proves that cybercriminals are nothing if not creative (and disturbingly well-funded). Meanwhile, the FBI took down BreachForums and Google’s AI is learning to patch code before attackers can exploit it.
The cybersecurity world never sleeps, and honestly, neither should your security team after reading this. Click through for the full rundown of breaches, malware, and the latest “why-is-that-even-possible” attack vectors.
Major Cyberattacks & Data Breaches
From pet insurance to enterprise infrastructure, this week’s breaches exposed everything from furry friends’ medical records to critical firewall configurations.
🐾 Rainwalk Pet Insurance leaked 158 GB of customer data including PII and veterinary claims through a misconfigured database, revealing new fraud tactics like microchip scams. (Published on 6-Oct-2025, Hackread). Read More
🎮 Discord’s third-party customer service provider was breached, exposing government-issued photo IDs from users who appealed age determinations, highlighting age verification system vulnerabilities. (Published on 7-Oct-2025, Techdirt). Read More
📡 BK Technologies, a public safety communications firm, disclosed an IT intrusion on September 20 that resulted in data theft from their systems. (Published on 7-Oct-2025, SecurityWeek). Read More
🆔 Discord confirmed 70,000 users had government IDs exposed in a recent breach, with hackers claiming theft of over 2 million age verification photos. (Published on 9-Oct-2025, SecurityWeek). Read More
🔥 SonicWall revealed unauthorized access to cloud firewall configuration backups for all customers, containing encrypted credentials that could enable targeted attacks. (Published on 9-Oct-2025, The Hacker News). Read More
Ransomware Operations
The ransomware landscape continues evolving with new alliances, sophisticated variants, and potential state-sponsored connections reshaping the threat environment.
💀 Medusa ransomware actors exploited a critical Fortra GoAnywhere vulnerability (CVE-2025-10035), though how Storm-1175 obtained the required private key remains unclear. (Published on 7-Oct-2025, Dark Reading). Read More
🤝 LockBit, Qilin, and DragonForce announced a strategic ransomware alliance to conduct more effective attacks, marking a significant shift in the cyber threat landscape. (Published on 8-Oct-2025, The Hacker News). Read More
🐉 Warlock ransomware operators who exploited SharePoint Server vulnerabilities in 2025 likely have connections to the Chinese government, according to security researchers. (Published on 9-Oct-2025, ComputerWeekly). Read More
⚡ Chaos ransomware upgraded with an aggressive new C++ variant featuring enhanced encryption, wiper capabilities, and cryptocurrency-stealing functions in this evolving RaaS operation. (Published on 9-Oct-2025, Dark Reading). Read More
Malware & Threats
Sophisticated malware campaigns are leveraging everything from compromised web servers to fake installers, stealing credentials and committing SEO fraud at scale.
🌐 Chinese cybercrime group UAT-8099 is running a global SEO fraud ring targeting Microsoft IIS servers, stealing high-value credentials and configuration data, primarily in India and Thailand. (Published on 6-Oct-2025, The Hacker News). Read More
🎯 Stealit malware is hiding in fake game and VPN installers, using Node.js’s SEA feature to evade detection while stealing information from Windows systems. (Published on 10-Oct-2025, Hackread). Read More
Espionage & Nation-State Activities
State-sponsored cyber operations continue targeting critical infrastructure and cryptocurrency assets, with billions stolen to fund military programs.
🕵️ Beijing Institute of Electronics Technology and Application (BIETA) is likely led by China’s Ministry of State Security, with four personnel showing clear links to MSS officers. (Published on 6-Oct-2025, The Hacker News). Read More
💰 North Korean hackers have stolen $2 billion in cryptocurrency in 2025 alone, bringing their total theft to over $6 billion to finance Pyongyang’s military programs. (Published on 8-Oct-2025, SecurityWeek). Read More
Phishing & Social Engineering
Sophisticated phishing campaigns are exploiting trusted security tools and HR systems, from password managers to payroll platforms.
🎣 Phishers weaponized 1Password’s Watchtower breach notification system, nearly fooling employees into handing over vault credentials through convincing fake alerts on typosquatted domains. (Published on 7-Oct-2025, CSO Online). Read More
💵 Storm-2657 “Payroll Pirates” are hijacking HR SaaS accounts on platforms like Workday, diverting employee salary payments to attacker-controlled accounts targeting U.S. organizations. (Published on 10-Oct-2025, The Hacker News). Read More
Vulnerabilities & Security Research
New research reveals unexpected attack vectors, from computer mice doubling as microphones to AI coding assistants leaking private repository data.
🖱️ UC Irvine researchers revealed the Mic-E-Mouse attack, showing how high-DPI optical sensors in modern mice can detect desk vibrations and reconstruct user speech with high accuracy. (Published on 7-Oct-2025, Hackread). Read More
💻 GitHub Copilot Chat flaw allowed hidden comments to control Copilot responses and leak sensitive source code from private repositories, exposing developer data. (Published on 9-Oct-2025, SecurityWeek). Read More
Cloud Security & Data Theft
Cloud platforms remain prime targets, with massive data scraping operations and sophisticated AWS targeting campaigns emerging this week.
👔 LinkedIn filed suit against Delaware company ProAPIs for allegedly scraping legitimate data through over one million fake accounts created for large-scale data harvesting operations. (Published on 6-Oct-2025, BleepingComputer). Read More
☁️ Crimson Collective threat group has been targeting AWS cloud environments for weeks to steal data and extort companies through sophisticated cloud infrastructure attacks. (Published on 8-Oct-2025, BleepingComputer). Read More
AI & Security Tools
AI continues its dual role in cybersecurity, with Google deploying vulnerability-fixing agents while bad actors strip watermarks from AI-generated content.
🤖 Google DeepMind launched CodeMender, an AI agent that can automatically find and fix vulnerabilities by rewriting insecure code to prevent future exploits. (Published on 8-Oct-2025, SecurityWeek). Read More
🎬 Sora 2 watermark removers are flooding the web, seamlessly stripping OpenAI’s watermarks in seconds and raising concerns about detecting AI-generated scam content on social media. (Published on 7-Oct-2025, Slashdot). Read More
Law Enforcement & Industry News
This week saw major law enforcement action against cybercrime forums and controversial shifts in the spyware industry landscape.
🕴️ NSO Group, the controversial spyware maker, confirmed acquisition by unnamed U.S. investors who have taken controlling ownership of the surveillance technology company. (Published on 10-Oct-2025, TechCrunch). Read More
🚔 FBI seized all BreachForums domains operated by ShinyHunters group, shutting down the hacking forum used as a portal for leaking corporate data from ransomware attacks. (Published on 10-Oct-2025, BleepingComputer). Read More
Stay informed and secure in the tech and cybersecurity world. Have a great weekend, and remember to patch and protect your systems!