Chinese APT &#39;Airstalk&#39; Malware Targets BPO Supply Chains; Insider Threats and Cl0p Zero-Day Exploits Escalate

Federal Grand Jury Indicts Incident Response Manager and Ransomware Negotiator for Extorting U.S. Companies with ALPHV/BlackCat Ransomware

In a severe breach of trust, two cybersecurity professionals, Ryan Clifford Goldberg and Kevin Tyler Martin, have been indicted for allegedly conducting ALPHV/BlackCat ransomware attacks against at least five U.S. companies. The individuals, who held roles in incident response and ransomware negotiation, are accused of conspiring to extort nearly $1.3 million from a Florida medical company. This case highlights a critical insider threat risk within the cybersecurity industry itself, where trusted professionals abuse their knowledge and access for criminal gain.

Insider ThreatALPHVBlackCatRansomwareIndictment +2 more

4 min read

Ransomware

Incident Response

SK Telecom Profit Plummets 90% Following Massive Data Breach Affecting 27 Million Customers

Data Breach Costs Cripple SK Telecom, Causing 90% Drop in Q3 Operating Profit and Suspension of Dividend

South Korean telecom giant SK Telecom has reported a catastrophic 90% drop in its Q3 operating profit, directly attributing the loss to the massive costs of a data breach that exposed the personal data of 27 million customers. The breach, which went undetected for nearly three years, involved 25 different malware types and led to a record $96.5 million (134 billion won) fine from regulators. This incident serves as a stark illustration of the severe and tangible financial consequences of long-term cybersecurity failures and inadequate threat detection.

Data BreachFinancial ImpactSK TelecomTelecommunicationsSouth Korea +1 more

4 min read

Data Breach

Cyberattack

Regulatory

China Amends Cybersecurity Law, Massively Increasing Fines and Adding AI Governance Clause

MEDIUM

China Passes Amendments to 2016 Cybersecurity Law, Raising Penalties Tenfold for Critical Infrastructure Operators

China has passed major amendments to its 2016 Cybersecurity Law, set to take effect on January 1, 2026. The changes dramatically increase financial penalties for non-compliance, raising the maximum fine for Critical Information Infrastructure Operators (CIIOs) tenfold to RMB 10 million (approx. $1.41M) and for non-CIIOs to RMB 2 million. The amendments also introduce a new, general clause on Artificial Intelligence governance, signaling tighter regulatory control over technology and data security within the country.

ChinaCybersecurity LawRegulationComplianceAI +2 more

4 min read

China Amends Cybersecurity Law, Massively Increasing Fines and Adding AI Governance Clause

Policy and Compliance

Regulatory

Microsoft Discovers 'SesameOp' Backdoor Using OpenAI API for Covert C2

Microsoft DART Uncovers Novel 'SesameOp' Backdoor Leveraging OpenAI Assistants API for Command and Control in Espionage Campaign

Microsoft's Detection and Response Team (DART) has discovered a novel backdoor named 'SesameOp' that uniquely uses the OpenAI Assistants API for its command-and-control (C2) communications. Found during an espionage investigation, the malware hides its malicious traffic within legitimate API calls to the OpenAI platform, making it extremely difficult to detect. The attackers also used .NET AppDomainManager injection by compromising Microsoft Visual Studio utilities to achieve persistence.

SesameOpMalwareBackdoorOpenAIAPI +4 more

5 min read

Microsoft Discovers 'SesameOp' Backdoor Using OpenAI API for Covert C2

Malware

Cloud Security

Europe Now #2 Global Ransomware Target, Attacks Accelerating to 24-Hour Deployments

INFORMATIONAL

CrowdStrike Report: Europe Accounts for 22% of Global Ransomware Victims, Attacked by Faster, Geopolitically Motivated Adversaries

Europe is now the second-largest global target for ransomware, accounting for 22% of all victims, according to CrowdStrike's 2025 European Threat Landscape Report. The report highlights a dramatic increase in attack speed, with groups like SCATTERED SPIDER now able to deploy ransomware in just 24 hours from initial access. The threat is fueled by a thriving initial access broker (IAB) market and escalating geopolitical tensions involving Russian, Chinese, and North Korean state-sponsored actors targeting critical sectors.

Threat ReportCrowdStrikeRansomwareEuropeThreat Intelligence +2 more

5 min read

Threat Intelligence

Ransomware

Updated: November 3, 2025

Updated Articles (2)

Cl0p Ransomware Exploits Oracle EBS Zero-Day in Active Attacks

CRITICAL

Cl0p Ransomware Gang Actively Exploiting Oracle E-Business Suite Zero-Day (CVE-2025-61882)

Update:

The Cl0p ransomware group's exploitation of CVE-2025-61882 in Oracle E-Business Suite has expanded, now impacting major corporations such as Schneider Electric, Cox Enterprises, and Pan American Silver Corp. Data stolen from Schneider Electric and Cox Enterprises has been published on Cl0p's extortion site, confirming successful breaches and escalating the severity of this ongoing campaign. The vulnerability specifically targets the Oracle Concurrent Processing component, allowing for remote code execution. Organizations are urged to continue restricting access and deploying WAF/IPS as no official patch is yet available.

October 20, 2025

8 min read

Zero-dayCl0pRansomwareOracleE-Business Suite +2 more

Vulnerability

Ransomware

Everest Ransomware Hits Swedish Power Grid Operator, Steals 280GB of Data