Critical Oracle Zero-Day Exploited by TA505 & Cl0p; Discord Vendor Breach Exposes 70,000 IDs
Summary
This cybersecurity brief for October 13, 2025, covers a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite being actively exploited by major extortion groups, leading to widespread data theft. Other significant events include a major data breach at a Discord third-party vendor exposing 70,000 user IDs, a novel phishing campaign abusing NPM infrastructure, and a report showing a 30% surge in ransomware attacks against healthcare vendors.
Today New Articles
Supply Chain Attack Hits Discord: Vendor Breach Exposes 70,000 User IDs
The communication platform Discord has disclosed a significant data breach originating from a third-party customer service vendor, 5CA. The incident, which occurred in early October 2025, resulted in unauthorized access to the sensitive data of approximately 7...
Ransomware Groups Pivot to Healthcare Vendors, Attacks Surge 30%
A new report from Comparitech reveals a significant strategic shift in ransomware attacks targeting the healthcare sector. While attacks on direct care providers remained steady, incidents involving healthcare-affiliated businesses and vendors surged by 30% in...
Russian APT Seashell Blizzard Targets European Critical Infrastructure
A subgroup of the Russian state-sponsored threat actor Sandworm, tracked as Seashell Blizzard, is conducting a new campaign against critical infrastructure in Ukraine and Europe. The attacks leverage phishing emails with malicious XLL attachments to deliver a...
LastPass Warns of Active Phishing Campaign Impersonating Brand
Password manager LastPass issued an alert on October 13, 2025, about an active phishing campaign targeting its users. The attackers are sending emails from a fraudulent domain with subject lines like "We Have Been Hacked," creating a false sense of urgency to...
New Android Spyware "ClayRat" Spreads via Telegram, Hijacks SMS
A new Android spyware named "ClayRat" is targeting Russian users through fake applications distributed on phishing sites and Telegram. The malware uses sophisticated techniques to bypass Android 13+ security restrictions, install itself as the default SMS hand...
Ivanti Discloses 13 Vulnerabilities in Endpoint Manager, Two High-Severity
Ivanti has released a security advisory for its Endpoint Manager (EPM) software, detailing 13 new vulnerabilities. The batch includes two high-severity flaws—one allowing for local privilege escalation and another for remote code execution with user interactio...
New York Inflation Refund Program Exploited in Phishing Scams
The New York State Department of Taxation and Finance is warning residents about phishing and smishing (SMS phishing) campaigns that are exploiting a legitimate state inflation relief program. Scammers are sending fraudulent messages claiming that recipients m...
Article Updates
Cl0p Exploits Oracle EBS Zero-Day in Widespread Extortion Campaign, FBI Issues Emergency Warning
Update:Further analysis reveals the critical Oracle EBS zero-day (CVE-2025-61882) is also being exploited by the TA505 threat group, alongside Cl0p, with hundreds of thousands of attack attempts recorded. The NCSC has issued a warning. Technical details now include a...