CISA Emergency Directive Issued After F5 Source Code Theft by Nation-State Actor; Microsoft Patches Four Actively Exploited Zero-Days

The Qilin ransomware group has significantly escalated its operations in October 2025, claiming numerous new victims across the United States, France, and Africa. This includes critical infrastructure targets like electric cooperatives, as well as healthcare authorities, real estate firms, and municipalities, demonstrating a broader and more impactful targeting strategy. The update also provides a more comprehensive list of MITRE ATT&CK techniques commonly used by Qilin affiliates, such as T1566 (Phishing) and T1190 (Exploit Public-Facing Application) for initial access, and T1041 (Exfiltration Over C2 Channel) for data exfiltration. This indicates an increased threat level and wider operational scope for the group.

The data breach attributed to 'Scattered LAPSUS$ Hunters' has significantly expanded in scope, now explicitly confirming Qantas as a victim alongside Vietnam Airlines. The total number of affected customers has risen to approximately 13 million, comprising 7.32 million from Vietnam Airlines and 5.7 million from Qantas. The compromised data, stolen in June 2025 via a breach of a technology partner's Salesforce accounts, includes full names, dates of birth, email addresses, phone numbers, and loyalty program details, increasing the risk of targeted phishing and identity theft for a larger pool of individuals.