Featured Story
Hackers exploited Citrix, Cisco ISE flaws in zero-day attacks
Summary
It has been reported that an advanced threat actor has exploited critical vulnerabilities “Citrix Bleed 2” (CVE-2025-5777) in NetScaler ADC and Gateway, and CVE-2025-20337 affecting Cisco Identity Services Engine (ISE) as zero-days to deploy custom malware.
Further investigation by Amazon Threat Intelligence revealed and shared with Cisco an anomalous payload targeting a previously undocumented endpoint in Cisco ISE that used vulnerable deserialization logic.
The web shell registered as an HTTP listener to intercept all requests and used Java reflection to inject into Tomcat server threads. It also employed DES encryption with non-standard base64 encoding for stealth, required knowledge of specific HTTP headers to access, and left minimal forensic traces.
Other News
Phishing Tool Uses Smart Redirects to Bypass Detection
Summary
A new phishing tool targeting Microsoft 365 users leverages “Quantum Route Redirect” payloads delivered by phishing hyperlinks that “can automatically differentiate between security tools or people through an intelligent redirect system.
Researchers have observed that the redirect system enables attacks to bypass multiple layers of security.
CISA warns feds to fully patch actively exploited Cisco flaws
Summary
CISA has issued a warning to U.S. federal agencies to implement full patches for two vulnerabilities in Cisco Adaptive Security Appliances (ASA) and Firepower devices. These vulnerabilities are currently under active exploitation and are tracked as CVE-2025-20362 and CVE-2025-20333.
These flaws allow remote threat actors to access restricted URL endpoints without authentication and gain code execution on vulnerable Cisco firewall devices.
Cisco had already issued patches for the flaws in September, but some agencies have not yet implemented them correctly, leaving vulnerable devices exposed to ongoing attacks.
The Safeonweb campaign against investment fraud is proving highly successful
Summary
The Centre for Cybersecurity Belgium (CCB) has reported that its national awareness campaign via Safeonweb against online investment fraud is proving highly successful.
The campaign successfully reached nearly 70% of Belgians over the age of 18 (or more than 6.3 million people) through TV and online channels.
Despite the campaign’s success, the CCB notes that “investment fraud remains a very real threat. Scams are becoming more diverse, using new technologies and targeting wider audiences.”