InfoSecBulletin Cybersecurity for mankind
Ransomware attacks rose 30% in October, reaching the second-highest total ever. With 623 attacks, October’s count was only behind February 2025, when a CL0P MFT campaign led to 854 attacks. This marks the sixth straight month of rising ransomware incidents, as stated in Cyble’s blog.
Qilin was the most active ransomware group for the sixth time in seven months since RansomHub’s decline, claiming 210 victims—three times more than Akira, which had the second-most at 69. Sinobi, a group that debuted in July, showed significant growth.
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Construction, Professional Services, Healthcare, Manufacturing, IT and Energy/Utilities were the most targeted sectors.
Cyble reported 31 incidents in October that could impact critical infrastructure and 26 incidents that might affect the supply chain.
The U.S. faced the highest number of attacks, totaling 361, which is ten times more than Canada’s count.
“Of concern is the emergence of Australia as a top five target, as the country’s rich resources and high per-capita GDP have made the country a rich target for threat actors,” Cyble noted.
Ransomware attacks are up 50% so far this year, with 5,194 ransomware attacks through October 31, Cyble said, “as new leaders like Qilin, Sinobi and The Gentlemen have more than made up for the decline of former leaders such as LockBit and RansomHub.”
Vulnerabilities Exploited by Ransomware Groups:
Cyble reported that critical IT vulnerabilities and unpatched internet-facing assets have increased ransomware and supply chain attacks this year. In October, the targeted vulnerabilities included:
CVE-2025-61882 in Oracle E-Business Suite – targeted by Cl0p
CVE-2025-10035 in GoAnywhere MFT – exploited by Medusa
CVE-2021-43226 a Microsoft Windows Privilege Escalation vulnerability – Exploited by unknown ransomware groups, according to a CISA advisory
CVE-2025-6264 in Velociraptor – targeted by Warlock ransomware operators
CVE‑2024‑1086 in the Linux kernel’s netfilter :nf_tables module – Exploited by unknown ransomware groups, according to a CISA advisory
