The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution vulnerability affecting Samsung mobile devices to its Known Exploited Vulnerabilities (KEV) catalog, signaling active exploitation in the wild. Tracked as CVE-2025-21042, this zero-day flaw resides in Samsung’s libimagecodec library. It could allow attackers to bypass security protections and execute arbitrary code […]
The notorious Danabot banking malware has made a comeback with the release of version 669, marking a significant return after nearly six months of silence following the coordinated law enforcement takedown known as Operation Endgame in May 2025. The resurgence signals that cybercriminals behind the malware have successfully regrouped and reestablished their command-and-control (C2) infrastructure […]
Security researchers at ENKI have uncovered a sophisticated espionage campaign targeting aerospace and defense organizations, in which the Lazarus Group is weaponizing a new variant of the Comebacker backdoor to infiltrate high-value targets. The threat actor has been actively conducting phishing operations since at least March 2025, distributing malicious documents disguised as legitimate communications from […]
CISA has added a critical zero-day vulnerability affecting Samsung mobile devices to its Known Exploited Vulnerabilities catalog. Warning that threat actors are actively exploiting the flaw in real-world attacks.
The vulnerability, tracked as CVE-2025-21042, is an out-of-bounds write vulnerability in the libimagecodec.quram.so library on Samsung mobile devices.
This security flaw allows remote attackers to execute arbitrary code on vulnerable devices without user interaction, making it particularly dangerous and prone to widespread exploitation.
Samsung 0-Day RCE Vulnerability Exploited
The vulnerability is classified under CWE-787, which represents out-of-bounds write flaws that can lead to memory corruption and unauthorized code execution.
The CISA researchers have confirmed that attackers are leveraging this zero-day to compromise Samsung smartphones. However, specific details about the attack campaigns remain limited.
CISA’s decision to add CVE-2025-21042 to the KEV catalog on November 10, 2025, signals that federal agencies have confirmed active exploitation attempts targeting this vulnerability.
While it remains unknown whether the flaw has been weaponized in ransomware campaigns, the remote code execution capability poses significant risks to both individual users and enterprise environments.
CVE ID
Description
Impact
CWE
CVE-2025-21042
Out-of-Bounds Write Vulnerability in libimagecodec.quram.so
Remote Code Execution (RCE)
CWE-787
Exploiting the vulnerability could enable attackers to gain complete control of affected devices, potentially leading to data theft, surveillance, or the use of compromised smartphones as entry points into corporate networks.
Federal agencies must apply security patches and mitigations by December 1, 2025, according to CISA’s Binding Operational Directive 22-01.
Samsung users across all sectors should immediately check for available security updates and install them without delay.
Organizations that cannot immediately patch vulnerable devices should implement compensating controls or consider discontinuing use until fixes become available.
Samsung’s September 2025 patch for CVE-2025-21043 addressed a related zero-day in the same library
Users should remain vigilant and only download applications from trusted sources while monitoring their devices for suspicious activity.
A sophisticated wave of ransomware attacks targeting UK organizations has emerged in 2025, exploiting vulnerabilities in the widely-used SimpleHelp Remote Monitoring and Management platform.
Two prominent ransomware groups, Medusa and DragonForce, have weaponized three critical vulnerabilities (CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728) to gain unauthorized access through trusted third-party vendors and Managed Service Providers.
The attack campaigns demonstrate a concerning shift in ransomware tactics, where threat actors compromise supplier-controlled RMM infrastructure rather than directly targeting victim organizations.
By exploiting unpatched SimpleHelp instances running with SYSTEM-level privileges, attackers achieved comprehensive control over downstream customer networks with minimal resistance.
This supply chain approach allows adversaries to bypass traditional perimeter defenses and leverage the inherent trust between organizations and their service providers.
Zensec security researchers identified these coordinated campaigns after investigating multiple intrusions across the first and second quarters of 2025.
The Medusa ransomware group struck first in Q1 2025, deploying their malicious payloads through compromised MSP environments.
Following a similar playbook, DragonForce launched their offensive in Q2 2025, targeting organizations through the same vulnerable RMM infrastructure.
Blog site (Source – Zensec)
Both groups demonstrated advanced operational capabilities, combining automated deployment tools with hands-on keyboard techniques to maximize impact.
The financial and operational consequences have been severe for affected organizations. Beyond system encryption, both threat actor groups engaged in double extortion tactics, exfiltrating sensitive corporate data before deploying ransomware.
Victims faced not only the immediate disruption of encrypted systems but also the threat of data exposure on dark web leak sites, compelling organizations to navigate complex decisions regarding ransom payments and public disclosure.
Attack Execution and Defense Evasion Techniques
Once inside victim networks through the compromised SimpleHelp platform, both ransomware groups deployed sophisticated toolsets to disable security protections and establish persistence.
Medusa Blog (Source – Zensec)
The Medusa group leveraged PDQ Deploy to push PowerShell commands that systematically dismantled Microsoft Defender protections across the environment.
The attackers executed base64-encoded commands to add exclusion paths and disable real-time monitoring:-
The encoded PowerShell payload delivered through PDQ Deploy, while the decoded version reveals the defense disabling commands.
Besides this, the specific Defender exclusion modifications implemented by the threat actors.
The Medusa group deployed their ransomware payload, identified as “Gaze.exe,” alongside specialized drivers including Smuot.sys and CSAgent.sys to further inhibit antivirus products.
Researchers have linked these drivers to the Abyssworker toolkit, a known security evasion framework.
DragonForce operators took a different approach, creating local administrator accounts named “admin” and installing AnyDesk for persistent remote access.
They also targeted Veeam backup servers using the Get-Veeam-Creds.ps1 script to extract plaintext credentials from SQL password stores, effectively compromising backup recovery capabilities.
Data exfiltration methods varied between the groups. Medusa utilized RClone, cleverly renamed to “lsp.exe” to evade detection signatures, with filtering parameters designed to transfer files under 1500MB and older than 1500 days.
DragonForce employed Restic, an open-source backup tool, to transfer stolen data to Wasabisys S3-compatible cloud storage endpoints.
Following encryption, Medusa systems displayed the “.MEDUSA” file extension with ransom notes titled “!!!READ_ME_MEDUSA!!!.txt,” while DragonForce appended “*.dragonforce_encrypted” extensions and left “readme.txt” notes on affected machines.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
Cybersecurity researchers from Mandiant Threat Defense have uncovered a critical zero-day vulnerability in Gladinet’s Triofox file-sharing platform that allowed attackers to bypass authentication and execute malicious code with system-level privileges. The vulnerability, tracked as CVE-2025-12480, was actively exploited by the threat actor group UNC6485 as early as August 24, 2025. The flaw affected Triofox version 16.4.10317.56372 and has […]
The xHunt advanced persistent threat group continues to pose a significant cybersecurity risk through sophisticated attacks targeting Microsoft Exchange and IIS web servers with custom-built backdoors. This highly focused cyber-espionage operation has maintained persistent, multi-year campaigns primarily aimed at organizations in Kuwait, with particular emphasis on the shipping, transportation, and government sectors. First identified in […]
The Open Web Application Security Project (OWASP) has officially unveiled the eighth edition of its influential Top 10 security risks list for 2025, introducing significant changes that reflect the evolving landscape of application security threats. The update features two new security categories and substantial shifts in risk rankings based on contributed data and community feedback. […]
Funding for the Air Force’s new E-7 Wedgetail radar jet was included in the bipartisan agreement on Sunday evening to end the longest-ever government shutdown—despite the fact that the military wants to gut the program.
Tucked into the 31-page continuing resolution agreement that would fund the government through January is a nearly $200 million spending exception for “continued rapid prototyping activities to maintain program schedule and transition to production” of the Air Force’s E-7 program. Similar efforts to fund the early warning and control aircraft were included in versions of the National Defense Authorization Act and Defense Appropriations Act this summer, as well as a stopgap funding bill in September.
“Other programs will be funded through January 30th, while the Senate and House continue work on the remainder of the year-long appropriations bills,” Sen. Susan Collins, a Maine Republican and Senate Appropriations Committee chair, said Sunday. “I look forward to voting for this legislation and ending the unnecessary harm to the security of our families and our nation.”
While several procedural hurdles remain before Sunday’s agreement is finalized, the inclusion of the E-7 in the continuing resolution marks a win for Boeing, which makes the Wedgetail.
However, a company spokesperson declined to comment on the latest measure. The Air Force did not return a request for comment.
[[Related Posts]]
The Congressional support for the radar plane more than 40 days into the government shutdown is at odds with Defense Secretary Pete Hegseth’s criticism of the E-7’s survivability and the Air Force’s 2026 budget request axing funding for the program. While officials have pointed to investments in space-based capabilities for intelligence, surveillance, and reconnaissance instead, defense experts said the inclusion of the Wedgetail shows lawmakers are concerned about the Space Force getting its Airborne Moving-Target Indication systems up and running quickly.
“If it passes, this is a big win for Boeing, and it shows that many in Congress still have doubts about how quickly the Space Force can deploy the AMTI system it funded in the reconciliation bill a few months ago,” said Todd Harrison, a defense budget expert with the American Enterprise Institute think tank. “This is Congress hedging its bets on the airborne warning mission.”
Hegseth told Congressional appropriators this summer that the E-7 was an example of a platform that was “not survivable in the modern battlefield or they don't give us an advantage in a future fight.” Additionally, defense officials this summer said the program was going to be cut “due to significant delays with cost increases.”
The E-7 was pitched as a replacement for the service’s aging E-3 Sentry aircraft. Boeing and the Air Force reached an agreement last year for two test planes, to be delivered in 2028 for a substantial $2.6 billion, the service previously announced. Those costs have risen by $884 million, a 33 percent increase, according to a June Government Accountability Office report.
In September, the British government announced that those two E-7 prototypes will be built in the United Kingdom.
HONOLULU—The defense industry is producing some great gear, but just one prototype isn’t enough to truly test out something new, the commander of Marine Corps Forces Pacific told an audience of tech company representatives.
“What we need is: when you come with it, don’t come with one with the intention to take it home with you, and all the data that was collected while we conducted an exercise together,” Lt. Gen. Jim Glynn said during a keynote speech at AFCEA TechNet Indo-Pacific. “Come with five. Take one or two home and leave three with us, and we’ll continue to work with it. We’ll give you access to all the data that’s coming off of it, and we’ll do everything we can to break it, with the goal of making it better.”
This type of experimentation and immediate feedback is critical because, Glynn said, “in this dynamic moment, we have to be ready to fight tonight. And we are going to fight with what we have, not what the acquisition system can get us five years from now.”
Glynn cited the Joint Fires Network as an example, saying that it has evolved over the past five years from “the amalgamation of some prototypes” to a formal program.
“Nine months ago, I had a colonel tell me, ‘But sir, that’s not a program of record.’ My response? I don’t care. It’s what we’re using. It’s what we’re going to have to use. We have to move at speed.”
[[Related Posts]]
In the Indo-Pacific in particular, he said, “we’re working in weeks and months, not years.”
One of the most talked-about technologies in recent years is drones, and Glynn said the Marine Corps as a whole has an “energetic effort to use small unmanned systems.” But right now, he said, Marines are using those systems as one operator to one drone. They need to move to having one Marine able to control entire swarms of drones at once.
“What we seek are, the ability for those unmanned systems to mesh themselves together,” he said.
.webp)
.webp)