RSecurity October Cybersecurity Newsletter

RSecurity's Cybersecurity Insights - October 2025

In this month’s edition of RSecurity's Cybersecurity Insights, we provide a comprehensive breakdown of the most critical cyber incidents, trends, and security insights that shaped October 2025. Our analysis includes global attack vectors, industry-specific vulnerabilities, and strategic takeaways for businesses of all sizes.

Cybersecurity Snapshot: October 2025 - A Month in Review

Global Cyber Threat Overview

• Total Ransomware Attacks: 474 Victims
• Zero-Day Vulnerabilities Discovered: 172 vulnerabilities patched, including 6 zero-days and 8 critical vulnerabilities
• Phishing Campaigns: 3.7 billion URL-based phishing threats, primarily targeting credential theft
• Data Records Exposed:  At least 308 million records were confirmed exposed through breaches at Reputation.com, Qantas Airways, and 183 million email credentials affecting Gmail accounts.

Top Affected Regions Q3 overview

• North America: 55%
• Asia-Pacific: 12%
• Europe: 22%
• Middle East : 3%
• South America: 5%
• Africa: 1%

Top 5 Major Incidents

1. Microsoft Revokes 200 Fraudulent Certificates Used in Rhysida Ransomware Campaign : Microsoft has revoked over 200 digital certificates used by the threat group Vanilla Tempest (aka Vice Society) to sign fake Microsoft Teams installers that delivered the Oyster backdoor and deployed Rhysida ransomware.
2. 131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign - Researchers uncovered a large-scale campaign using 131 rebranded Chrome extensions cloning a WhatsApp Web automation tool to spam Brazilian users. All extensions share the same codebase and infrastructure, mainly published by “WL Extensão” and linked to DBX Tecnologia.
3. Hackers Abuse Blockchain Smart Contracts to Spread Malware via Infected WordPress Sites - A financially motivated hacking group known as UNC5142 has been exploiting blockchain smart contracts to distribute information-stealing malware like Atomic, Lumma, Rhadamanthys, and Vidar, targeting both Windows and macOS systems. Using a method called EtherHiding, the group hides malicious code on the BNB Smart Chain and spreads it via compromised WordPress sites. 
4. 3,000 YouTube Videos Exposed as Malware Traps in Massive Ghost Network Operation -  Check Point uncovered the YouTube Ghost Network, a persistent operation that has published >3,000 malicious videos by hijacking accounts and using a role-based structure to promote links to cloud-hosted installers and phishing pages that deliver stealers and loaders (Lumma, Rhadamanthys, RedLine, StealC, Hijack Loader, etc.) gaining hundreds of thousands of views.
5. State-Sponsored Hackers Exploiting Libraesva Email Security Gateway Vulnerability - Libraesva has patched a command injection flaw (CVE-2025-59689) in its Email Security Gateway (ESG) that has already been exploited by a suspected state-sponsored actor. The bug, rated CVSS 6.1, allows attackers to send malicious compressed email attachments that bypass sanitization checks and execute arbitrary commands.
6. 10 npm Packages Caught Stealing Developer Credentials on Windows, macOS, and Linux  - Ten typosquatted npm packages used postinstall hooks to deliver an obfuscated multi-stage info-stealer that spawns a new terminal, shows a fake CAPTCHA, fingerprints victims, and downloads a 24MB PyInstaller stealer from 195.133.79[.]43. The stealer extracts browser cookies, tokens, SSH keys, and decrypted system keyring credentials, zips them, and exfiltrates the data underscoring urgent supply-chain and registry hygiene.

🔍 Analysis & Trends

• Weaponisation of AI & automation: Attackers are increasingly using AI-driven tools to scale phishing campaigns, craft authentic-looking lures, and deploy malware across large footprint networks.
• Supply chain and platform abuse: Compromised extensions, infected WordPress sites, and smart-contract based malware show that adversaries are now targeting trusted ecosystems for broader reach and persistence.
• Shift from encryption to exfiltration & exposure: As backup and recovery improve, ransomware actors are emphasising data theft and public release as pressure leverage, thereby increasing the reputational and regulatory costs of breach.
• VPN / Edge Targeting & Exploits: Microsoft disclosed active exploitation of a critical vulnerability in the GoAnywhere file transfer product (CVE-2025-10035), which attackers used to get command execution access.
• GhostRedirector’s campaign continues: The GhostRedirector malware resurfaced in September, infecting over 65 Windows servers by injecting redirection modules into IIS.

RSecurity's Perspective: What This Means for You

For Small Businesses:

• Reinforce Browser and Plugin Security: With campaigns exploiting Chrome extensions and WordPress plugins, review all installed browser add-ons and CMS integrations. Remove unverified extensions and apply stricter permission controls.

• Harden Email Gateways Against AI-Phishing: Deploy behavior-based email gateways and train employees to detect generative-AI spoofing patterns and credential-harvest pages.

• Back Up and Validate Recovery Plans: With ransomware campaigns like Rhysida and others abusing trusted certificates, maintain immutable, off-site backups and regularly test restore capabilities to ensure business continuity after a breach.

For Large Enterprises:

• Implement AI-Driven Threat Detection: Attackers are now automating infection chains using AI and smart-contract-based malware delivery. Counter with AI-powered analytics, anomaly detection, and automated incident-response workflows to identify emerging threats in real time.

• Adopt Zero-Trust and Cloud Hardening Measures: State-sponsored campaigns exploiting Libraesva ESG underline the need for Zero-Trust principles — continuous verification of identity, device, and access across hybrid cloud environments.

• Expand Threat Intelligence Coverage: Track emerging operations like “Ghost Network” and EtherHiding malware distribution. Correlate logs across cloud, SaaS, and endpoint telemetry to detect lateral movement and data-exfiltration attempts early.
• Enhance Cross-Platform Coverage: Ensure endpoint protection spans Windows, Linux, and macOS — September showed a sharp rise in macOS-targeted stealers such as Odyssey.