Week of December 15, 2025: Coupang Breach Disclosure, Cisco Zero-Day Backdoors

Security leaders watched Coupang disclose a cybersecurity incident affecting up to 33 million customer accounts and Cisco confirm that a suspected Chinese-nexus actor had been rooting unpatched email security appliances since late November. CISA added Cisco, SonicWall, ASUS, Fortinet, and Apple flaws to its Known Exploited Vulnerabilities catalog, published nine new ICS advisories, and joined the NSA and Canadian Centre for Cyber Security in updating detection guidance for the BRICKSTORM backdoor, while SoundCloud confirmed a breach and follow-on denial-of-service attacks.

Coupang Discloses Cybersecurity Incident Affecting Up to 33 Million Accounts

Coupang, Inc. disclosed in an SEC filing that it suffered a cybersecurity incident involving unauthorized access to customer accounts, discovered by its Korean subsidiary on November 18, 2025. The company said a former employee may have obtained names, phone numbers, delivery addresses, and email addresses tied to up to 33 million customer accounts, along with order histories for some of those accounts. Coupang stated that banking information, payment card data, and login credentials were not compromised, and that Korean regulators had opened investigations while the company continued its own forensic review. (U.S. Securities and Exchange Commission (EDGAR))

CISA Adds Cisco, SonicWall, and ASUS Flaws to Exploited Vulnerabilities Catalog

CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation: CVE-2025-20393, an improper input validation flaw in multiple Cisco products; CVE-2025-40602, a missing authorization vulnerability in SonicWall SMA1000 appliances; and CVE-2025-59374, an embedded malicious code issue in ASUS Live Update. Under Binding Operational Directive 22-01, federal civilian agencies must remediate each flaw by its assigned due date, and CISA urged all organizations to prioritize these vulnerabilities as part of routine patch management. (CISA)

Unpatched Cisco Email Security Flaw Used to Install Backdoors

Cisco Talos reported that a suspected Chinese-nexus group it tracks as UAT-9686 had been compromising Cisco Secure Email Gateway and Secure Email and Web Manager appliances since at least late November 2025. The attackers exploited CVE-2025-20393, an unauthenticated AsyncOS input validation flaw, to gain root access on appliances with an internet-exposed Spam Quarantine feature, then installed custom tools including a Python backdoor called AquaShell, a log-scrubbing utility named AquaPurge, and a reverse SSH tunnel. Cisco said a patch was not yet available and recommended rebuilding confirmed-compromised appliances. (Help Net Security)

CISA, NSA, and Canadian Partners Update BRICKSTORM Detection Guidance

CISA, the National Security Agency, and the Canadian Centre for Cyber Security released an update to their joint Malware Analysis Report on the BRICKSTORM backdoor, adding indicators of compromise and detection signatures for additional samples, including Rust-based variants. The agencies said the new samples showed advanced persistence and defense evasion, including running as background services and using encrypted WebSocket connections for command and control. The update included two new YARA rules, and organizations that detect BRICKSTORM or similar activity were urged to report it to CISA's 24/7 Operations Center. (CISA)

Apple Patches Two WebKit Zero-Days Used in Targeted Spyware Attacks

Apple released security updates fixing two WebKit vulnerabilities, CVE-2025-14174 and CVE-2025-43529, that it said had been exploited as zero-days. Apple stated it was aware of a report that the memory-corruption flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals running versions of iOS before iOS 26. The fixes shipped in iOS and iPadOS 26.2, macOS Tahoe 26.2, tvOS, watchOS, visionOS 26.2, and Safari 26.2. CISA added CVE-2025-43529 to its Known Exploited Vulnerabilities catalog on December 15. (Help Net Security)

SoundCloud Confirms Breach and Follow-On Denial-of-Service Attacks

SoundCloud confirmed it had suffered a breach after detecting unauthorized activity in an ancillary service dashboard, and that a threat actor group had accessed email addresses and already-public profile information for approximately 20% of its users. The company said financial data, passwords, and other sensitive information were not accessed, and that it believed the attackers no longer had access to its systems. After containment, SoundCloud was also hit by denial-of-service attacks that twice made its website temporarily unavailable, and VPN users separately reported connection problems tied to configuration changes made during the response. (Help Net Security)

CISA Releases Nine Industrial Control Systems Advisories

CISA published nine Industrial Control Systems advisories covering products from Inductive Automation, Schneider Electric, National Instruments, Mitsubishi Electric and Iconics, Siemens, Advantech, Rockwell Automation, and Axis Communications. The advisories detailed current vulnerabilities and exploits affecting systems including Ignition, EcoStruxure Foxboro DCS, LabView, the Interniche IP-Stack, WebAccess/SCADA, Micro820/850/870 controllers, and Camera Station Pro. CISA encouraged operators of these systems to review the technical details and apply the recommended mitigations to reduce exposure across industrial environments. (CISA)