Week of November 3, 2025: SonicWall Breach Attribution and New CISA KEV Additions

Security leaders watched a state-sponsored attribution for SonicWall's cloud backup breach, two new CISA Known Exploited Vulnerabilities additions, and a Europol warning that caller ID spoofing drives widespread phone fraud across the week of November 3, 2025. Cisco also patched critical authentication-bypass flaws in Unified Contact Center Express, Google detailed malware that uses large language models to operate and evade detection, and a Eurojust-led operation announced 18 arrests in a credit card fraud scheme topping €300 million.

CISA Adds Two Actively Exploited Vulnerabilities to KEV Catalog

On November 4, 2025, CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. The additions covered CVE-2025-11371, affecting Gladinet CentreStack and Triofox file-sharing platforms, and CVE-2025-48703, an OS command injection flaw in Control Web Panel used to manage CentOS-based servers. Federal civilian agencies were required to remediate both flaws under Binding Operational Directive 22-01, and CISA urged all organizations managing exposed CentreStack, Triofox, or CWP installations to apply patches without delay given the ongoing exploitation activity. (CISA)

CISA Publishes Four Industrial Control Systems Advisories

On November 6, 2025, CISA released four Industrial Control Systems advisories covering products from Advantech, Ubia, ABB, and Hitachi Energy. The bulletins detailed vulnerabilities in Advantech's DeviceOn iEdge, Ubia's Ubox, ABB's FLXeon controllers, and an updated Hitachi Energy Asset Suite advisory, giving operators of industrial environments technical details and mitigation steps. CISA continued to encourage asset owners and administrators to review the advisories and apply vendor guidance to reduce exposure across operational technology networks running the affected products. (CISA)

Cisco Patches Critical UCCX Authentication Bypass and Root RCE Flaws

Cisco disclosed fixes on November 6, 2025 for two critical flaws in Unified Contact Center Express, CVE-2025-20358 and CVE-2025-20354, that could let an unauthenticated remote attacker bypass authentication and execute commands with root permissions on affected servers. The bugs, reported privately by researcher Jahmel Harris, affected UCCX versions 15.0 and 12.5 SU3 and earlier regardless of configuration. No workarounds existed, so Cisco urged customers to upgrade to version 15.0 ES01 or 12.5 SU3 ES07, though it said no exploitation had yet been observed in the wild. (Help Net Security)

Mandiant Ties SonicWall Cloud Backup Breach to State-Sponsored Actor

On November 4, 2025, SonicWall confirmed that a Mandiant investigation had determined its September cloud backup service breach was carried out by a state-sponsored threat actor, without naming the country involved. The intrusion, discovered after attackers brute-forced access and downloaded firewall configuration backups, ultimately compromised backup files for all customers rather than the small subset first reported in September. SonicWall said the breach did not touch its products, firmware, or internal systems, and it again urged affected customers to rotate credentials, reset passwords, and restrict remote management access on their firewalls. (Help Net Security)

Europol Warns Caller ID Spoofing Fuels Billions in Phone Fraud

Europol published a position paper on November 3, 2025 warning that caller ID spoofing had become a primary driver of phone-based fraud across Europe, with global losses estimated around EUR 850 million a year. Drawing on input from 23 EU member states, the agency found weak coordination between law enforcement and telecom operators, unclear legal mandates, and inconsistent cross-border data sharing. Europol called for EU-wide technical standards, a neutral traceback system, and aligned legal frameworks so investigators can trace spoofed calls that currently expose roughly 400 million people to scams. (Help Net Security)

Google Flags AI-Powered Malware Operating and Evading Detection

Google's Threat Intelligence Group reported on November 5, 2025 that it had observed multiple malware families using large language models during live operations rather than only for developer productivity. Examples included QuietVault, a credential stealer that queries AI tools to hunt for secrets, PromptSteal, used by Russian group APT28 to generate exfiltration commands via the Hugging Face API, and PromptFlux, an experimental dropper that rewrites its own code hourly using the Gemini API to dodge detection. Google said this marked a new operational phase of AI-enabled malware behavior. (Help Net Security)

Eurojust Operation Nets 18 Arrests in €300 Million Card Fraud Scheme

A Eurojust-coordinated operation led to 18 arrests disclosed on November 5, 2025 in a credit card fraud scheme estimated at more than €300 million, with attempted fraud exceeding €750 million. Investigators said suspects ran fake subscription sites for dating, pornography, and streaming services between 2016 and 2021, charging victims below €50 at a time to avoid detection, while five employees of four German payment service providers allegedly helped process and launder the proceeds. Suspects detained spanned Germany, the UK, Latvia, the Netherlands, Austria, Denmark, the US, and Canada. (Help Net Security)