Bare Metal Cyber

This is this week’s cyber news for November third through November seventh, twenty twenty-five. The week brought a surge of high-impact security events across public and private sectors. Cisco firewalls and routers faced new waves of attacks, while SonicWall confirmed a state-backed breach of its cloud backups. Major data exposures hit Conduent, Hyundai AutoEver, and the U.S. budget office, showing how identity data remains a prime target. Meanwhile, ransomware, espionage, and software-supply-chain risks spread across industries from telecom to finance. Stay with us for a full rundown of twenty-five stories shaping the week in cybersecurity.

SonicWall disclosed that its recent cloud-backup breach was carried out by a state-sponsored group rather than a ransomware affiliate like Akira. The attackers stole encrypted backups and network metadata that could reveal sensitive configuration details and internal network layouts. Experts said this type of exposure could allow secondary attacks long after the initial breach. SonicWall called the intrusion a highly targeted supply-chain compromise and announced stronger encryption and credential rotation across all partners. Security teams working with the company are still tracing how the threat actors gained persistent access to its cloud systems.

Conduent reported that a cyberattack earlier this year exposed personal information belonging to more than ten million individuals. The data affected multiple government and healthcare programs that rely on Conduent’s managed systems. Names, Social Security numbers, and addresses were among the details included in the stolen datasets, raising major identity theft concerns. State agencies began sending notifications while regulators demanded full audit trails from the vendor. The breach has renewed calls for tougher oversight of third-party processors that handle citizen data under public contracts.

Security analysts uncovered forty-two million malicious Android app downloads distributed through Google Play. Many of the applications carried hidden advertising frameworks that fetched additional payloads once installed. Fake reviews and inflated ratings masked the activity for months before detection. Because many users installed these apps on both personal and company devices, the incident created new exposure for organizations under bring-your-own-device programs. Google removed the listings, banned the developer accounts, and enhanced behavioral screening for high-install applications moving forward.

The U.S. budget office experienced a breach that raised fears of leaked emails containing sensitive policy negotiations. Early investigation showed that multiple staff mailboxes were compromised, exposing drafts and fiscal planning documents shared with other agencies. The data could reveal internal assumptions about government spending priorities, giving adversaries leverage in political or economic arenas. Federal investigators isolated the affected accounts, reset credentials, and initiated a full forensic review. Officials emphasized that while operations continued, the incident highlighted how routine communications remain a prime espionage target in government systems.

Nikkei confirmed that its internal Slack environment had been compromised, affecting over seventeen thousand employees and partner accounts. Attackers exploited stolen tokens to gain administrative visibility into workspaces, capturing conversations and shared files. The exposed data could enable precision phishing against journalists, advertisers, and external partners. Nikkei reset all tokens, terminated active sessions, and hired external investigators to track the intrusion’s timeline. Security teams said the event underscored the challenge of managing third-party integrations that expand the attack surface in modern collaboration platforms.

Telecom equipment maker Ribbon Communications announced that it had suffered a suspected Chinese cyber intrusion within its support infrastructure. Threat actors stole credentials and accessed internal tools used by engineers to maintain customer networks. The breach raised concerns about potential firmware manipulation or downstream access to carrier systems. The company disabled affected environments, required password resets, and notified customers across multiple countries. U.S. officials are assisting the investigation as telecom vendors remain high-value espionage targets for their proximity to critical infrastructure.

Cisco routers worldwide faced renewed waves of “BadCandy” implant attacks targeting small and branch-office devices. The malware quietly replaced key system binaries, creating hidden command channels that evaded standard monitoring. Once deployed, it allowed attackers to siphon data and issue remote instructions without detection. Cisco confirmed evidence of persistent infections and advised users to upgrade firmware, verify image integrity, and enable boot-time validation checks. Analysts noted that router-level compromises remain one of the hardest attack types to fully eradicate once established.

The Cybersecurity and Infrastructure Security Agency added a Control Web Panel flaw to its Known Exploited Vulnerabilities catalog. The listing mandates that federal and contractor systems patch the issue within strict deadlines. Attackers had used the weakness to seize hosting environments and deploy remote shells for further exploitation. CISA urged administrators to verify remediation through automated scanning and compliance reporting. The update reinforced how KEV entries can drive rapid cleanup across public and private infrastructure once exploitation becomes widespread.

Hyundai AutoEver disclosed that attackers breached systems containing employee and partner identity records. Exposed data included Social Security and driver’s license numbers linked to payroll and connected-car services. Investigators said the intrusion appeared to stem from a compromised vendor account used for remote maintenance. Hyundai began notifying regulators, offering credit monitoring, and tightening third-party access rules. The breach again highlighted how automotive affiliates now hold large volumes of personally identifiable information that attract data thieves.

Two American security professionals were indicted for allegedly helping the BlackCat ransomware group conduct targeted attacks. Prosecutors said the pair provided technical expertise and tool customization that enabled the gang to penetrate victims more effectively. The case underscored the blurred line between legitimate red teaming and criminal collaboration. Industry leaders responded by calling for stronger ethical boundaries, clearer contracting standards, and background vetting for offensive-security personnel. Observers said the indictment could become a landmark in defining accountability for insider-assisted ransomware operations.

Operation SkyCloak emerged as a stealth espionage campaign using PowerShell automation and concealed S S H tunnels to maintain access. The threat actors built scripts that looked like everyday administrative maintenance while quietly executing remote-control commands. This approach let them persist for months inside government and corporate networks without alerting monitoring systems. Investigators have linked infrastructure across several continents and continue to identify compromised organizations. The operation revealed how living-off-the-land techniques now blend completely into legitimate IT workflows.

The state of Nevada released a rare public after-action report on a ransomware attack that paralyzed sixty government agencies. The document traced each phase of the compromise, from initial credential theft to widespread encryption of servers. Analysts found that reused admin tools and flat network design accelerated the malware’s spread. The transparency offered a valuable learning opportunity for other states and municipalities facing similar risks. The detailed timeline is now being used as a training reference by cybersecurity teams nationwide.

New research confirmed that most cloud breaches still stem from misconfigured access and weak credential management. Analysts documented recurring issues such as exposed storage buckets, unrotated keys, and broad administrative rights across accounts. Even mature enterprises struggled to enforce consistent guardrails in multi-cloud setups. Security experts emphasized that automation and continuous validation are essential to prevent configuration drift. The findings served as a reminder that complex tools cannot replace disciplined identity hygiene in cloud environments.

A malicious extension for the Open V S X marketplace masqueraded as a popular Solidity compiler but delivered the SleepyDuck backdoor instead. Once installed, it stole source code, cryptocurrency wallet information, and authentication tokens from developer systems. The attackers leveraged social media to boost downloads and gain credibility within blockchain circles. Platform maintainers removed the listing, revoked affected tokens, and issued advisories to the developer community. The event reignited debate over supply-chain trust in open-source plugin ecosystems.

Decentralized finance platform Balancer suffered a catastrophic one hundred twenty million dollar exploit draining multiple liquidity pools. Attackers exploited a logic flaw in smart contracts to redirect assets through flash loans and cross-chain swaps. Users saw balances vanish in seconds before the contracts were paused. Developers froze affected pools, published post-mortem findings, and urged users to revoke token approvals to limit damage. The attack reignited concern about whether rapid innovation in decentralized finance is outpacing security review cycles.

A suspected Conti ransomware operator was extradited from Ireland to the United States after months of coordination between law-enforcement agencies. Investigators tied the suspect to major extortion campaigns that targeted hospitals and local governments. Officials said the extradition marks a significant step toward dismantling one of the most prolific ransomware networks. The Justice Department reaffirmed its commitment to tracking fugitives involved in cybercrime globally. Observers noted that consistent prosecution may gradually raise the cost of operating in transnational ransomware groups.

Analysts revealed a new espionage effort called Operation SoftPulse targeting industrial control networks. The attackers delivered phishing documents that deployed custom loaders onto engineering workstations. Once active, the malware modified configuration files and exfiltrated sensitive plant data to external servers. Investigators traced infrastructure to multiple countries and warned utilities about lateral movement risks. Energy and manufacturing firms were urged to isolate engineering assets and review remote-access logs for suspicious activity.

Mass phishing waves appeared across multiple regions using fake tax refund emails to lure victims. The messages carried malware installers disguised as official government forms and bypassed simple filters. Recipients who opened attachments triggered credential theft tools and remote-control payloads. Banks and payroll processors responded by tightening email filtering and warning customers of ongoing scams. The campaigns demonstrated that financial-themed lures remain one of the most effective social-engineering tactics.

Investigators dismantled a global data-broker network that had been selling scraped A P I records from major cloud providers. The operation collected contact details, service keys, and usage logs from misconfigured endpoints. Buyers used the information to conduct precision phishing and corporate espionage campaigns. Cloud vendors responded by revoking exposed keys, tightening rate limits, and notifying affected clients. The case highlighted how even publicly available A P I data can fuel sophisticated attacks when aggregated at scale.

That’s the BareMetalCyber Weekly Roll-Up for November third through November seventh, twenty twenty-five. For more cybersecurity briefings, visit BareMetalCyber dot com. You can also subscribe to the newsletter and listen to every narrated update anytime at DailyCyber dot news. We’ll be back next week with another deep look at the threats and trends that matter most.