SOC GoulashAlright team, it's been a busy 24 hours! We've got a slew of new breach details, a critical actively exploited WordPress vulnerability, insights into new botnet tactics, AI's growing role in attacks and defence, and a look at SaaS security challenges. Let's dive in:
Recent Cyber Attacks or Breaches
Discord Breach Details Emerge β οΈ
- Discord confirmed a breach of a third-party Zendesk support system, affecting users who interacted with customer support.
- While hackers claimed 5.5 million users and 2.1 million government IDs were exposed, Discord states approximately 70,000 users had government ID photos compromised, primarily for age verification.
- The attackers reportedly gained access via a compromised outsourced support agent account, leveraging a support application (Zenbar) to access user data and perform API queries, leading to 1.6TB of data theft, including partial payment info. Discord refused a $3.5-$5 million ransom demand, leading to threats of public data leaks.
π€ Bleeping Computer | https://www.bleepingcomputer.com/news/security/hackers-claim-discord-breach-exposed-data-of-55-million-users/
ποΈ The Record | https://therecord.media/discord-government-docs-exposed-breach
SonicWall Admits All Cloud Backup Customers Affected π
- SonicWall has walked back its initial claim that less than 5% of customers were affected by a September breach, now confirming all customers who used its cloud backup service had their firewall configuration files accessed.
- These files contain encrypted credentials and configuration data (firewall rules, routing configs), which, despite encryption, could significantly aid targeted attacks or offline cracking of weak passwords.
- The incident was a direct hit on SonicWall's internal infrastructure via a brute-force attack on a customer-facing system, not an exploitation of their firewall devices themselves. Customers are urged to delete existing cloud backups, change MySonicWall credentials, rotate shared secrets/passwords, and recreate backups locally.
π€« CyberScoop | https://cyberscoop.com/sonicwall-customer-firewall-configurations-exposed/
π΅πΌ The Register | https://go.theregister.com/feed/www.theregister.com/2025/10/09/sonicwall_breach_hits_every_cloud/
π° The Hacker News | https://thehackernews.com/2025/10/hackers-access-sonicwall-cloud-firewall.html
π€ Bleeping Computer | https://www.bleepingcomputer.com/news/security/sonicwall-firewall-configs-stolen-for-all-cloud-backup-customers/
Clop Exploits Oracle E-Business Suite Zero-Day π¨
- The Clop ransomware group has been targeting Oracle E-Business Suite customers since July 2025, exploiting a zero-day vulnerability (CVE-2025-61882) and at least four other defects to achieve pre-authenticated remote code execution.
- This campaign has impacted dozens of organisations, with Clop stealing "massive amounts of data" for extortion, with demands reaching up to $50 million.
- Many Oracle EBS instances remain vulnerable, with Shadowserver identifying 576 potentially exposed instances, primarily in the US. Organisations should patch immediately and be aware of the use of multi-stage fileless malware.
π€« CyberScoop | https://cyberscoop.com/oracle-customers-attacks-clop-google-mandiant/
"Payroll Pirate" Hackers Target Universities π°
- A cybercrime group, Storm-2657, is actively targeting US universities with "payroll pirate" attacks since March 2025, aiming to divert employee salary payments.
- Attackers use sophisticated phishing emails (e.g., COVID-19 warnings, classroom misconduct allegations) with adversary-in-the-middle (AITM) links to steal MFA codes and compromise Workday accounts.
- Once in, they create inbox rules to delete Workday notifications, alter payment configurations, and even enrol their own devices for MFA to maintain persistence, highlighting a critical need for phishing-resistant MFA.
ποΈ The Record | https://therecord.media/universities-phishing-payroll-pirates
π€ Bleeping Computer | https://www.bleepingcomputer.com/news/security/hackers-target-university-hr-employees-in-payroll-pirate-attacks/
Vulnerabilities
Critical WordPress Theme Exploit Under Active Attack π‘οΈ
- A critical authentication bypass vulnerability (CVE-2025-5947, CVSS 9.8) in the Service Finder WordPress theme's bundled plugin is being actively exploited.
- This flaw allows unauthenticated attackers to gain admin access by bypassing cookie validation in an account switching function (service_finder_switch_back()).
- Exploitation has been observed since August 1, 2025, with over 13,800 attempts detected. All versions prior to 6.1 are affected.
π° The Hacker News | https://thehackernews.com/2025/10/critical-exploit-lets-hackers-bypass-authentication-in-wordpress-service-finder-theme.html
New Threat Research
RondoDox Botnet Leverages "Exploit Shotgun" Tactic π«
- A new large-scale botnet, RondoDox, is actively targeting 56 n-day vulnerabilities across over 30 distinct devices, including DVRs, NVRs, CCTV systems, and web servers.
- The botnet employs an "exploit shotgun" strategy, using numerous exploits simultaneously, including weaponising flaws demonstrated at Pwn2Own events (e.g., CVE-2023-1389 in TP-Link Archer AX21).
- Many targeted flaws are older or in EoL equipment, highlighting the ongoing risk of unpatched devices. Organisations should prioritise firmware updates and network segmentation.
π€ Bleeping Computer | https://www.bleepingcomputer.com/news/security/rondodox-botnet-targets-56-n-day-flaws-in-worldwide-attacks/
Hackers Abusing Velociraptor DFIR Tool in Ransomware Attacks βοΈ
- Threat actors, potentially the China-based Storm-2603 (linked to Warlock ransomware and LockBit affiliation), are now using the legitimate Velociraptor DFIR tool in LockBit and Babuk ransomware campaigns.
- They leverage an outdated, vulnerable version of Velociraptor (0.73.4.0, CVE-2025-6264) for privilege escalation and arbitrary command execution, maintaining persistence even after host isolation.
- Observed TTPs include creating local admin accounts, accessing VMware vSphere, disabling Defender, running Impacket smbexec-style commands, and using fileless PowerShell encryptors for data exfiltration and encryption.
π€ Bleeping Computer | https://www.bleepingcomputer.com/news/security/hackers-now-use-velociraptor-dfir-tool-in-ransomware-attacks/
Russia Weaponises AI in Cyber Attacks Against Ukraine π€
- Ukraine's SSSCIP reports a significant increase in Russian hackers using AI in cyberattacks during H1 2025, moving beyond phishing message generation to AI-generated malware.
- Examples include UAC-0219's WRECKSTEEL malware (likely AI-developed) and various phishing campaigns distributing stealers like HOMESTEEL, GIFTEDCROOK, Amatera Stealer, and Strela Stealer.
- APT28 (UAC-0001) is exploiting XSS flaws in Roundcube and Zimbra webmail for zero-click attacks to steal credentials and forward emails. Sandworm (UAC-0002) continues hybrid warfare, targeting energy and defence sectors.
π° The Hacker News | https://thehackernews.com/2025/10/from-phishing-to-malware-ai-becomes-russias-new-cyber-weapon-in-war-on-ukraine.html
Pro-Russian Hacktivists Pivot to Critical Infrastructure Disruption π
- The pro-Russian hacktivist group TwoNet has evolved from DDoS attacks to targeting critical infrastructure, as demonstrated by their compromise of a research honeypot water treatment facility.
- In a 26-hour window, they gained initial access via default credentials, enumerated databases, created a new user, and exploited an old XSS (CVE-2021-26829) to display a "Hacked by Barlati" message.
- Crucially, they attempted disruptive actions, disabling real-time updates by removing PLCs from data sources and changing HMI setpoints, focusing on the web application layer without underlying host exploitation.
π€ Bleeping Computer | https://www.bleepingcomputer.com/news/security/hacktivists-target-critical-infrastructure-hit-decoy-plant/
LLM Poisoning Easier Than Expected, Anthropic Warns π§
- New research by Anthropic and partners reveals that poisoning large language models (LLMs) to output gibberish with a trigger phrase is "trivially easy," requiring only 250 specially crafted documents.
- This small dataset (0.00016% of a 13B parameter model's training data) was sufficient to compromise models like Llama 3.1 and GPT 3.5-Turbo, regardless of their size.
- While focused on denial-of-service, this highlights a significant vulnerability in AI training data. Defenders need to implement robust data filtering and backdoor detection mechanisms throughout the training pipeline.
π΅πΌ The Register | https://go.theregister.com/feed/www.theregister.com/2025/10/09/its_trivially_easy_to_poison/
Threat Landscape Commentary
Token Theft: The Achilles' Heel of SaaS Security π
- Token theft (OAuth, API, session tokens) is a leading cause of SaaS breaches, often bypassing MFA and traditional security controls due to SaaS sprawl and hidden token trust relationships.
- Recent incidents (Slack, CircleCI, Cloudflare/Okta, Salesloft/Drift) demonstrate how a single stolen token can grant persistent access, enable lateral movement, and compromise sensitive data across integrated platforms.
- Organisations lack visibility into numerous third-party app integrations and their associated tokens, creating an ungoverned attack surface. Stronger "token hygiene" β discovery, control, and monitoring β is crucial.
π° The Hacker News | https://thehackernews.com/2025/10/saas-breaches-start-with-tokens-what.html
Regulatory Issues or Changes
US Senate Seeks to Renew Expired Cyber Threat Information-Sharing Law ποΈ
- Senator Gary Peters has introduced the Protecting America from Cyber Threats (PACT) Act to extend and rename the expired Cybersecurity and Information Sharing Act of 2015 (CISA 2015).
- The new bill aims to provide long-term liability protections for organisations sharing cyber threat data with each other and the federal government, making it retroactive to cover the lapse since October 1.
- The lapse is causing increasing nervousness among organisations, with industry groups calling CISA 2015 vital for cyber defence, highlighting the need for stable, long-term policy.
π€« CyberScoop | https://cyberscoop.com/gary-peters-cyber-threat-information-sharing-law-rand-paul/
#CyberSecurity #ThreatIntelligence #Ransomware #DataBreach #Vulnerability #ZeroDay #Botnet #AI #MachineLearning #SaaS #TokenTheft #CriticalInfrastructure #Hacktivism #IncidentResponse #InfoSec
Hackers claim Discord breach exposed data of 5.5 million users
Discord says they will not be negotiating with threat actors who claim to have stolen the data of 5.5 million unique users from the company's Zendesk support system instance, including government IDs and partial payment information for some people.
TechNadu
WetHatπ¦
SwiftOnSecurity
Lukas Beran
F0rm4t
Thomas Naunheim 
Tom