Monthly Threat Digest NOVEMBER 2025

For a detailed threat digest, download the pdf file here

In November reshaped the cybersecurity landscape with active exploitation of two celebrity vulnerabilities and 10 zero-days. The standout threat, CVE-2025-61882, is a critical unauthenticated remote code execution flaw in Oracle E-Business Suite now leveraged by the Cl0p ransomware group.

The ShadowRay 2.0 campaign underscored the speed of attacker evolution in the AI era. Exposed Ray clusters became a global launchpad for cryptojacking, data theft, and multi-purpose botnet operations. Threat actors exploited an unpatched Ray ecosystem flaw, AI-generated payloads, DevOps-style malware pipelines, and Ray’s own orchestration to propagate across thousands of nodes with minimal friction.

Silent Lynx continued its espionage run across Central Asia, targeting government, diplomatic, and infrastructure sectors through summit-themed phishing. The “Peek-A-Baku” operation to deploy custom implants, including Silent Loader and LAPLAS. In parallel, China-linked APT41 pursued a U.S. policy-influencing non-profit by exploiting Log4j and Atlassian OGNL Injection, leaning on legitimate tools for persistence.

CVE-2025-59287, a recently patched Microsoft WSUS flaw, was weaponized immediately after public exploit code surfaced. Attackers used it to compromise servers and drop ShadowPad, a backdoor tied to Chinese state-aligned operators. The threat curve continues upward, and prioritized defensive adaptation is a mandatory baseline in today’s operational environment.

Subscribe to receive our weekly threat digests and alerts directly in your inbox.