Today on CISO Series…
In todays cybersecurity news…
Norway’s aid agency suffers data breach
Norway’s national aid agency, Norad – not to be confused with the North American Aerospace Defense Command – has confirmed that “cyber criminals broke into its systems, stealing information about each and every registered user of its grant portal.” This means the information of more than twenty thousand people across 12,511 organizations. The attack, described as complex, was detected on October 30, but officials have not stated how long the attackers retained access to the grant portal.
GhostMap Android flaw lets app run persistent boot loop
This attack forces Android devices into a continuous boot loop using “a specially crafted app that requires no permissions and only needs to be installed.” This is made possible due to a vulnerability now being called GhostMap that “makes Android map a file into an unallocated memory region. The affected process crashes when it attempts to read from that region.” The flaw was discovered by researchers at
Bitdefender
who add that “Google has been aware of GhostMap since August but closed the issue without releasing a patch, classifying it as not reproducible.”
More Asian airlines rocked by Amadeus
Multiple airlines in Asia including
Cathay Pacific
,
Korean Air
,
Asiana Airlines
,
Singapore Airlines
and
Malaysia Airlines
, have joined Japan Airlines in reporting data breaches “after a cyberattack on Spanish IT provider
Amadeus
IT Group exposed customer details.” As we reported last week when Japan Airlines first announced its breach, Amadeus provides platforms for flight reservation, ticketing and check-in. The company declined to say whether the attackers have contacted them or how many total victims were impacted by the attack, however Japan Airlines has pegged their number at 92,000 customers, Singapore Airlines said 46,000 records were accessed, and Cathay Pacific said 53,000.
Zyxel fixes zero-day on network switches
The patch applies to
Zyxel Networks
‘s GS1900 series network switches, which hackers had exploited to “compromise nearly 1,000 devices worldwide and steal configuration files and credentials.” The CVE-numbered vulnerability (CVE-2026-107441) is “an out-of-bounds write flaw in the switches’ web management interface that allows an unauthenticated attacker with network access to execute operating system commands using specially crafted HTTP requests.” The updates were released on October 22 to resolve this vulnerability, which had initially been mistaken for an older flaw that Zyxel had already patched.
Big thanks to our sponsor,
ESET
Cyberattack wipes cloud data at Russian hosting provider Beget
Beget is one of Russia’s largest domain registrars and hosting companies. It is now bringing some of its servers back online following an attack that occurred on Sunday, which destroyed data across its cloud infrastructure and disrupted hundreds of websites. The restoration will take “a considerable amount of time,” representatives said, since more than one thousand servers must be manually inspected. The company said the attackers “gained access to systems used to manage the company’s infrastructure, allowing them to execute scripts designed to erase data.”
Hackers exploit patched Apple flaw to deliver info-stealing malware
Following up on a story we covered yesterday,
Cybersecurity and Infrastructure Security Agency
is now warning of a medium-severity security flaw that impacts numerous Apple operating systems. The CVE numbered vulnerability (CVE-2024-27834) could allow an attacker with arbitrary read and write capability to bypass Pointer Authentication. The flaw was addressed by
Apple
in May 2024 and was demonstrated as a zero-day at the Pwn2Own Vancouver that year. This vulnerability has been added to CISA’s KEV catalog following a report from
Sekoia
, likely APT29 aka Cozy Bear “exploited previously patched vulnerabilities in Safari and Google Chrome to deliver malware capable of harvesting browser and device data.”
Bank phishing sites evade takedowns by playing dead
The threat actors behind a widespread bank phishing campaign are using fake “account suspended” pages to disguise their activities and evade detection. More than 300 fraudulent domains impersonate financial institutions, primarily targeting business banking and treasury logins. First-time visitors see convincing bank login pages designed to capture credentials, but the phishing kit remembers each visitor’s IP address and displays a fake hosting suspension notice on subsequent visits. This tricks security researchers, automated scanners, and takedown providers into believing the fraudulent sites have been shut down when they remain active. As a result, a domain may appear inactive during investigation while continuing to steal credentials from new visitors. The campaign also uses
Cloudflare
and shared hosting to complicate detection and takedowns.
New York’s Queens Public Library battles ransomware attack
The library known also as QPL, made the announcement on Wednesday evening. The attack has disabled “QPL’s website, on-site computers, check-out and return machines, its public Wi-Fi, mobile app, and its digital media services.” Each of the library system’s 66 locations remains open, but “certain virtual and in-person programs may be impacted,” representatives stated. No ransomware group has yet claimed responsibility for the disruption.
Subscribe to Cybersecurity Headlines podcast
Subscribe to Cybersecurity Headlines and all our shows at cisoseries.com/subscribe.
Click Here For The Original Source.
——————————————————–
