Weekly Cyber News Rollup, October 10th, 2025

This week’s wrap cuts through the noise. We break down North Korea’s multi-billion-dollar crypto theft problem, the Salesforce-adjacent extortion wave targeting customer exports, and active exploitation against Oracle E-Business Suite. We also cover a critical Redis flaw with app-wide blast radius, Cisco edge firewall abuse with public exploit code, Zimbra’s KEV-listed email bug, GoAnywhere MFT ransomware activity, mass scanning of Palo Alto VPN portals, and a UnityVSA bug that threatens backups.

In plain English, you’ll hear why these stories matter for the business, who’s most exposed, the single action to take next, and what to watch next week. Perfect for leaders who need decisions, and defenders who need a checklist.

Subscribe for the daily brief and share this episode with your incident lead before Monday’s stand-up.

Episode Transcript

(00:00):
This week’s signal cut clean through the noise. North Korea’s crypto theft tally surged toward the multi-billion mark, reminding boards that digital assets are now a national-security adjacency. Lets get started!

North Korea’s two-billion-dollar crypto heist problem. What happened (00:14):
Intelligence teams and blockchain analysts estimate that state-linked North Korean groups have stolen roughly two billion dollars in cryptocurrency this year. They’re hitting centralized exchanges, cross-chain bridges, and decentralized finance projects, most often through stolen private keys, compromised build systems, or abused application programming interfaces. Once funds move, the actors launder them quickly—mixers, peel chains, and cross-chain swaps—so recovery windows are short. Operational security has improved, leaving fewer on-chain mistakes to trace. This is a sustained, industrialized campaign, not a one-off spike. Why it matters

Hackers are targeting Cisco firewalls and exploit code is public. What happened (01:31):
A chain impacting Cisco Adaptive Security Appliance and Firepower devices enables authentication bypass against internet-facing management or virtual private network portals, and public proof-of-concept code raises the chance of rapid exploitation. Organizations are applying interim mitigations while rolling vendor fixes and tightening interface exposure. Why it matters

Zimbra email bug actively exploited and now listed by CISA. What happened (02:29):
A flaw in Zimbra Collaboration Suite that executes malicious code during calendar invite parsing moved into the Known Exploited Vulnerabilities catalog after confirmed real-world abuse. Adversaries send booby-trapped dot I C S files that, when parsed by servers or clients, allow mailbox takeover, creation of hidden forwarding rules, and lateral movement into internal systems. Patches exist, but many on-prem deployments lag, and some gateways still auto-ingest calendar metadata. Why it matters

GoAnywhere file-transfer flaw leveraged in ransomware attacks. What happened (03:35):
A maximum-severity vulnerability in GoAnywhere Managed File Transfer is being used for initial access and extortion, with activity linked to the Medusa ecosystem. Actors target internet-exposed admin portals, harvest credentials, drop web shells, and quietly exfiltrate partner files before threatening encryption. Several organizations mitigated by taking portals offline or geofencing access while patching and rotating keys. Why it matters

That’s the Daily Cyber News weekly wrap for the week ending October tenth, twenty twenty-five. The theme is clear (04:35):
protect identities, harden the edges, and control the copies of your data—because that’s where attackers, outages, and extortion all converge. If this helped you make a sharper call, share it with your team and subscribe to the daily audio at Daily Cyber dot news. I’m signing off—stay safe out there.