In today’s cybersecurity news…

Sturnus Android Trojan captures encrypted chats and hijacks devices

Cybersecurity researchers at the Dutch mobile security company ThreatFabric are warning of this new trojan that enables credential theft and full device takeover to conduct financial fraud. They report that it is capable of bypassing encrypted messaging, by capturing content directly from the device screen after decryption. This allows it to monitor communications on WhatsApp, Telegram, and Signal. Sturnus is also able to stage overlay attacks using fake login screens over top of banking apps to capture victims’ credentials with its current targets being financial institutions across Southern and Central Europe.

(The Hacker News)

Canadian regulators say schools share blame for PowerSchool hack

The information and privacy commissioners for the provinces of Ontario and Alberta released their investigative findings on the massive PowerSchool data leak and faulted the school systems for missteps such as “not putting privacy and security-related provisions in their contracts with the education software firm and failing to effectively monitor and oversee PowerSchool’s security guardrails, particularly in regard to multifactor authentication.” Schools also did not have appropriate breach response plans ready to go, the report said. The breach, which affected schools and students across the U.S. and Canada was the result of the actions of a Massachusetts college student, who pleaded guilty and received a four-year sentence in October.

(Cision Canada, The Register, The Record)

Bill reintroduced to bolster cybersecurity at Securities and Exchange Commission

Put forward as a bipartisan initiative, Georgia representatives David Scott, a Democrat, and Barry Loudermilk, a Republican, introduced the legislation on Wednesday under the name, the SEC Data Protection Act of 2025. Specifically, the bill would “establish uniform policies and procedures governing how the SEC requests, handles, stores, and protects sensitive information obtained from investors, advisers, broker-dealers, and other market participants,” and to “develop and update data protection cybersecurity protocols consistent with federal and National Institute of Standards and Technology best practices.” Both representatives are senior members of the House Financial Services Committee.

(The Record)

CISA gives govt agencies 7 days to patch new Fortinet flaw

CISA has stated that U.S. government agencies must secure their systems within a week against this latest vulnerability in Fortinet’s FortiWeb web application firewall, which has been exploited in zero-day attacks, allowing authenticated threat actors to execute code as root in low-complexity attacks that don’t require user interaction. The CVE numbered vulnerability has been added to the Known Exploited Vulnerabilities Catalog, meaning Federal Civilian Executive Branch (FCEB) agencies have until Tuesday, November 25th, to secure their systems.

(BleepingComputer)

Huge thanks to our episode sponsor, KnowBe4

German authorities warn of evasion attacks on LLMs

Germany’s Federal Office for Information Security (BSI) is warning of rising evasion attacks on LLMs and has issued guidance “to help developers and IT managers secure AI systems and mitigate related risks.” Evasion attacks involve malicious inputs such as prompt injection and data manipulation, designed to subvert or bypass model safeguards. The BSI has released a document is “aimed at developers and IT managers in companies and public authorities that have opted to operate a pre-trained language model such as OpenAI ‘s GPT.” The recommendations are a blend of technical controls such as filters, sandboxing, and Retrieval-Augmented Generation (RAG) along with organizational practices such as adversarial testing, governance, training) as part of a defense-in-depth strategy. The Office emphasizes that no single control is sufficient.

(Security Affairs)

Critical flaw lets hackers access ASUS DSL routers remotely

The Taiwan-based computer and technology manufacturer ASUS has  now fixed a critical auth-bypass flaw with a CVSS score of 9.3 in DSL routers that would have let remote, unauthenticated attackers access devices with ease. “The vulnerability impacts a handful of router families, listed in the show notes, (DSL-AC51, DSL-N16, DSL-AC750), and of course, ASUS recommends users update to the latest firmware,” as well as using strong, unique passwords.

(Security Affairs)

Palo Alto Networks sees massive surge in malicious activity inside mystery traffic flood

The traffic has been targeting Palo Alto Networks’ GlobalProtect portals and has surged almost 40-fold in the space of 24 hours, “hitting a 90-day high and putting defenders on alert for whatever comes next.” This is according to attack intelligence firm GreyNoise, who says the sudden wave began on November 14, coming from a single network, based in Germany and Canada. The company also said in an earlier blog, that spikes in attacker activity “often precede new vulnerabilities affecting the same vendor – with 80 percent of observed cases followed by a CVE disclosure within six weeks.”

(GreyNoise)

D-Link warns of new RCE flaws in end-of-life DIR-878 routers

A big day for routers yesterday, it seems, with D-Link warning of “three remotely exploitable command execution vulnerabilities that affect all models and hardware revisions of its DIR-878 router, which has reached end-of-service but is still available in several markets.” These routers are typically used in homes and small offices. Since the DIR-878 reached end-of-life (EoL) in 2021, D-Link warns that it will not release security updates for this model and recommends replacing it with an actively supported product. Four vulnerabilities are involved, listed in the show notes, which, according to CISA, have a medium-severity score. CVE-2025-6067, CVE-2025-60673, CVE-2025-60674, CVE-2025-60676

(BleepingComputer)

SEC drops remaining claims on 2020 SolarWinds hack

It wasn’t the first software supply chain attack, but the 2020 attack that saw malicious code inserted into SolarWinds Orion software put a giant spotlight on the issue. In the aftermath of the breach, the US Securities and Exchange Commission brough charges against the company and it’s CISO Tim Brown in 2023, alleging fraud and internal control failures. Most of those charges were dismissed by a ruling from the U.S. District Court for the Southern District of New York in 2024, citing prior regulatory filing from the company. On Thursday the SEC disclosed Thursday that it has now dismissed its case against SolarWinds and Brown entirely. In a statement, SolarWinds said it hoped the dismissal “eases the concerns many CISOs have voiced about this case and the potential chilling effect it threatened to impose on their work.”

(CRN)

Check out Tim Brown’s appearance on Defense in Depth.