Samsung Zero-Day Exploited by LANDFALL Spyware; Sandworm Escalates Destructive Attacks on Ukraine

Qilin ransomware continues its high operational tempo, claiming 7 new victims on November 8, 2025, primarily in the professional services and manufacturing sectors across the US, Canada, and UK. This surge highlights Qilin's ongoing dominance in the RaaS landscape. New technical details include specific MITRE ATT&CK techniques like spearphishing (T1566.001) and exfiltration to cloud storage (T1567.002), alongside D3FEND techniques for detection and mitigation. The group maintains its double-extortion strategy, reinforcing the persistent threat.

The CL0P ransomware group has significantly escalated its Oracle EBS zero-day campaign, now claiming over 100 organizations compromised, including high-profile victim The Washington Post. The group is demanding ransoms reaching up to $50 million and has adopted a public shaming tactic, listing non-compliant victims on its dark web leak site to pressure payments. This development underscores the widespread impact and severe financial implications of the ongoing exploitation of the Oracle E-Business Suite vulnerability, highlighting critical supply chain risks from widely used enterprise software.

SonicWall has concluded its investigation into the September 2025 cloud backup breach, attributing the attack to a sophisticated state-sponsored threat actor. The attackers exploited a compromised API call within the MySonicWall cloud backup service to exfiltrate customer firewall configuration files. The company emphasizes the breach was isolated to this specific cloud environment and did not affect core products or internal networks. Remedial actions and tools have been released to assist customers in securing their services and resetting credentials, highlighting the advanced nature of the adversary and the targeted supply chain attack.

The UAE Cybersecurity Council has issued a formal public warning regarding the escalating threat of AI-generated deepfake content. This advisory emphasizes the potential for deepfakes to spread misinformation, facilitate fraud, and damage reputations. It highlights public awareness as a primary defense and references Federal Decree-Law No. (34) of 2021, which criminalizes the creation and distribution of such content. This development underscores the growing real-world impact and governmental response to the AI-powered social engineering threats previously identified.