CISA Warns of Actively Exploited Fortinet Zero-Day; FBI Details Akira Ransomware's $250M Spree

The Citrix vulnerability, CVE-2025-5777, has been dubbed 'CitrixBleed 2'. Further technical analysis of CVE-2025-20337 in Cisco ISE reveals it is a deserialization flaw in an undocumented API endpoint, exploited via an anomalous payload. The attack chain aligns with MITRE ATT&CK techniques T1190 (Exploit Public-Facing Application), T1210 (Exploitation of Remote Services), and T1068 (Exploitation for Privilege Escalation).

Ransomware activity saw a significant 30% increase in October 2025, reaching 623 incidents, marking the second-highest monthly total on record. The year-to-date total now exceeds 5,194 incidents, a 50% rise from 2024. The Qilin group continues to lead, claiming 210 victims in October, while Sinobi rose to third place with 69 victims. Threat actors are increasingly exploiting critical vulnerabilities like CVE-2025-61882 in Oracle E-Business Suite for initial access, alongside external remote services and compromised valid accounts. This highlights the ecosystem's resilience and adaptability, with the overall threat level remaining high.

Further reports confirm Checkout.com's data breach and subsequent extortion attempt. The company continues to assert that no sensitive cardholder or financial data was compromised, reinforcing its initial statements. Checkout.com maintained its refusal to engage with the extortionists, reporting the incident to law enforcement. While the specific threat actor was not named in these follow-up reports, the tactics align with data extortion groups. Technical analysis suggests potential initial access via public-facing application exploits or compromised credentials, leading to data exfiltration from cloud storage. The incident underscores the persistent threat of data theft for extortion against fintech companies, even when core financial systems remain secure.

New intelligence reveals attackers exploiting CVE-2025-64446 are creating unauthorized administrator accounts on compromised FortiWeb devices to establish persistence. This critical development escalates the threat, as it ensures continued access even after initial exploitation. Furthermore, CISA has issued an emergency directive, mandating federal agencies to apply patches by November 22, 2025, underscoring the urgency of mitigation. Security researchers at watchTowr and Defused observed exploitation dating back to early October 2025.