In today’s cybersecurity news…
Mobile blackout for Russian travelers
Russia started imposing 24-hour mobile internet blackouts for citizens returning from abroad, as a security measure to stop Ukrainian drones from using domestic SIM cards for navigation. Travelers can regain access by completing a captcha or verifying their identity. The policy has caused unintentional outages in border regions and follows similar restrictions for foreign SIM users last month. Meanwhile, Russia is expanding its domestic intelligence service “FSB” authority to order network shutdowns under what it calls “emerging threats.” (The Record)
Windows 11 supports 3rd-party passkey apps
Microsoft’s November Windows 11 update adds native support for third-party passkey managers, starting with 1Password and Bitwarden, currently in beta. The update introduces a new passkey API developed with these companies to expand passwordless authentication options. Users can now store and manage passkeys through Windows Hello or supported apps, protected by Azure’s hardware security modules. Microsoft also integrated its own Password Manager from Edge directly into Windows. (BleepingComputer)
Synology patches BeeStation flaw
Synology patched a critical remote code execution flaw in its BeeStation devices, first demonstrated at Pwn2Own Ireland 2025. The bug stemmed from improper buffer size checks that let attackers run arbitrary code remotely. Users should update to BeeStation OS version 1.3.2-65648 or later. The competition awarded a total of $1,024,750 for 73 zero-days, with the Summoning Team winning “Master of Pwn.” Taiwanese firm QNAP also patched several zero-days revealed at the event. (Security Affairs)
Amazon pins Cisco, Citrix attacks to APT group
Amazon’s threat intelligence team reported that an advanced persistent threat group exploited zero-day vulnerabilities in Cisco Identity Services Engine and Citrix NetScaler before the vendors disclosed and patched them over the summer. The attackers used custom malware and backdoors tailored to Cisco ISE, likely for long-term espionage. Amazon traced exploitation back to May and alerted Cisco, while CitrixBleed 2 was added to CISA’s known exploited vulnerabilities catalog in July. (CyberScoop)
Huge thanks to our sponsor, Vanta
Is it “Do I have the right controls in place?”
Or “Are my vendors secure?”
….or the really scary one: “how do I get out from under these old tools and manual processes?
Enter Vanta.
Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your security at scale. Vanta also fits right into your workflows, using AI to streamline evidence collection, flag risks, and keep your program audit-ready—ALL…THE…TIME. With Vanta, you get everything you need to move faster, scale confidently—and get back to sleep.
Get started at vanta.com/headlines
New Danabot Windows version emerges
DanaBot has resurfaced with a new Windows variant six months after being disrupted by Operation Endgame in May, targeting users in Australia, North America, and Europe. The modular banking Trojan, offered as malware-as-a-service, lets operators add new functionalities with plug-ins. Operation Endgame had previously neutralized multiple malware strains and led to 20 international arrest warrants. Zscaler ThreatLabz identified the campaign’s command-and-control servers and wallet addresses, and shared associated indicators of compromise. (Security Affairs)
UK unveils new cybersecurity bill
The British government introduced its long-delayed Cyber Security and Resilience Bill, which would impose strict cybersecurity standards and large fines on critical infrastructure and digital service providers that fail to protect against cyberattacks. The law expands the 2018 NIS Regulations to include sectors like healthcare, energy, and IT service providers, requiring rapid incident reporting and regulator oversight. (The Record)
Cyber-Insurance Payouts Soar in UK
We’re still in the UK, where cyber insurance payouts jumped 230% in 2024 to £197 million, up £138 million from 2023, while policy numbers rose 17%, according to the Association of British Insurers (ABI). Malware and ransomware accounted for 51% of claims, up from 32%. The ABI noted that policies now provide risk prevention support alongside financial coverage. Insurers increasingly require baseline cybersecurity measures, and the proposed government ban on ransom payments could tighten these requirements even more. (Infosecurity Magazine)
Google files lawsuit against Lighthouse scammers
Google filed a lawsuit against 25 unnamed individuals in China behind the Lighthouse phishing-as-a-service kit, which has reportedly victimized over 1 million people with smishing campaigns posing as E-Z Pass or USPS notifications. The suit alleges violations of the Racketeer Influenced and Corrupt Organizations Act, the Lanham Act, and the Computer Fraud and Abuse Act, and seeks damages and a court order to block Lighthouse-linked domains. Google also endorsed three U.S. bills targeting fraud and scam operations to strengthen long-term protections. (CyberScoop)