InfoSecBulletin Cybersecurity for mankind
Ransomware attacks rose 30% in October, reaching the second-highest total ever. With 623 attacks, October’s count was only behind February 2025, when a CL0P MFT campaign led to 854 attacks. This marks the sixth straight month of rising ransomware incidents, as stated in Cyble’s blog.
Qilin was the most active ransomware group for the sixth time in seven months since RansomHub’s decline, claiming 210 victims—three times more than Akira, which had the second-most at 69. Sinobi, a group that debuted in July, showed significant growth.
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Construction, Professional Services, Healthcare, Manufacturing, IT and Energy/Utilities were the most targeted sectors.
Cyble reported 31 incidents in October that could impact critical infrastructure and 26 incidents that might affect the supply chain.
The U.S. faced the highest number of attacks, totaling 361, which is ten times more than Canada’s count.
“Of concern is the emergence of Australia as a top five target, as the country’s rich resources and high per-capita GDP have made the country a rich target for threat actors,” Cyble noted.
Ransomware attacks are up 50% so far this year, with 5,194 ransomware attacks through October 31, Cyble said, “as new leaders like Qilin, Sinobi and The Gentlemen have more than made up for the decline of former leaders such as LockBit and RansomHub.”
Vulnerabilities Exploited by Ransomware Groups:
Cyble reported that critical IT vulnerabilities and unpatched internet-facing assets have increased ransomware and supply chain attacks this year. In October, the targeted vulnerabilities included:
CVE-2025-61882 in Oracle E-Business Suite – targeted by Cl0p
CVE-2025-10035 in GoAnywhere MFT – exploited by Medusa
CVE-2021-43226 a Microsoft Windows Privilege Escalation vulnerability – Exploited by unknown ransomware groups, according to a CISA advisory
CVE-2025-6264 in Velociraptor – targeted by Warlock ransomware operators
CVE‑2024‑1086 in the Linux kernel’s netfilter :nf_tables module – Exploited by unknown ransomware groups, according to a CISA advisory
