Global critical infrastructure breached by Chinese hackers.

Summary

By the CyberWire staff

Global critical infrastructure breached by Chinese hackers.

RedNovember, a Chinese state-sponsored group, has carried out an espionage campaign from June 2024 through July 2025. During their campaign, hackers targeted defense contractors, government agencies, and corporations worldwide by exploiting flaws in VPN appliances and firewalls faster than they could be patched.

Recorded Future researchers documented breaches in at least two United States (US) defense contractors, over thirty Panamanian government agencies, and firms across Europe, Asia, and South America. Victims included aerospace manufacturers and law firms.

Control what runs in your environment. Reduce your attack surface.

ThreatLocker helps organizations reduce risk by allowing trusted applications to run while limiting their access to only the resources they need. It’s a straightforward, default deny approach that gives you more control and visibility—without slowing down operations. Explore how ThreatLocker can help simplify your security strategy.

UK government provides £1.5 billion loan to Jaguar Land Rover.

The British government will underwrite a £1.5 billion loan to Jaguar Land Rover (JLR) to support the company's suppliers in the wake of a ransomware attack the company sustained at the end of August, the BBC reports. The loan is coming from a commercial bank and will be paid back over five years. The Times reports that JLR plans to restart production at its Wolverhampton plant by October 6th, noting, "The restart is dependent on the engine manufacturing centre systems passing a series of tests to ensure that no remnants of the virus exist."

A JLR spokesperson told the Guardian, "Our teams continue to work around the clock alongside cybersecurity specialists, the NCSC, and law enforcement to ensure we restart in a safe and secure manner. The foundational work of our recovery programme is firmly underway, and we will continue to provide regular updates to our colleagues, retailers, and suppliers."

Maximum severity GoAnywhere MFT flaw exploited.

Hackers are actively exploiting a maximum-severity flaw in Fortra's GoAnywhere Managed File Transfer product. The exploit is known as CVE-2025-10035. The deserialization vulnerability allows attackers to inject commands remotely without needing authentication.

Attackers leveraged the bug to execute commands remotely, create backdoor accounts, and deploy secondary payloads. Additionally, researchers also observed privilege-checking commands and attempts to enable lateral movement.

A WatchTowr report detailing that they were "given credible evidence of in-the-wild exploitation of Forta GoAnywhere CVE-2025-10035 dating back to September 10, 2025," eight days before Forta publicly disclosed the flaw.

Notes.

Today's issue includes events affecting China, Panama, the United Kingdom, and the United States.

Attacks, Threats, and Vulnerabilities

'You'll never need to work again': Criminals offer reporter money to hack BBC (BBC News) Reporter Joe Tidy was offered money if he would help cyber criminals access BBC systems.

Harrods: Hackers contact firm after 430,000 customer records stolen (BBC: World News & Stories) The luxury department store said it was working with authorities, and the affected data was limited to basic details.

Akira ransomware breaching MFA-protected SonicWall VPN accounts (BleepingComputer) Ongoing Akira ransomware attacks targeting SonicWall SSL VPN devices continue to evolve, with the threat actors found to be successfully logging in despite OTP MFA being enabled on accounts. Researchers suspect that this may be achieved through the use of previously stolen OTP seeds, although the exact method remains unconfirmed.

Trends

The AI boom is unsustainable unless tech spending goes ‘parabolic,’ Deutsche Bank warns: ‘This is highly unlikely’ | Fortune (Fortune) “In the absence of tech-related spending, the U.S. would be close to, or in, recession this year,” George Saravelos says.

Marketplace

Cyberbit Acquires RangeForce to Forge AI-Powered Operational Cyber Readiness for Businesses and Governments Worldwide (Yahoo Finance) Cyberbit Acquires RangeForce to Forge AI-Powered Operational Cyber Readiness for Businesses and Governments Worldwide.

US investors to take over TikTok operations in the country (BleepingComputer) U.S. President Donald Trump has signed an executive order approving a plan to restructure TikTok operations in the country to address national security concerns.

Research and Development

Cyera Unveils Cyera Research Labs with First-Ever AI Readiness Report on Data Security (Business Wire) New research finds 83% of enterprises use AI, but only 13% have strong visibility into how it touches their data. Cyera, the fastest growing data security company, today announced the launch of Cyera Research Labs, the company’s dedicated research arm focused on delivering clear, data-driven guidance at the intersection of AI and data security. The launch comes alongside the release of Cyera’s first flagship study, the 2025 State of AI Data Security Report, conducted in partnership with CyberSecurity Insiders.

Wallarm Leads Development of New A2AS Standard for Agentic AI Security (Wallarm) Wallarm today announced its role in the publication of “A2AS: Agentic AI Runtime Security and Self-Defense,” a groundbreaking research project led by Eugene Neelou (OWASP, Wallarm) together with researchers from AWS, Bytedance, Cisco, Elastic, Google, JPMorganChase, Meta, and Salesforce.

Litigation, Investigation, and Law Enforcement

Africa cybercrime crackdown includes hundreds of arrests, Interpol says () Several African countries targeted transnational criminal networks that used social media and other digital platforms to run romance and sextortion scams, Interpol said.

Dutch teens arrested for trying to spy on Europol for Russia (BleepingComputer) Two Dutch teenage boys aged 17, reportedly used hacking devices to spy for Russia, have been arrested by the Politie on Monday.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

AI Agent Security Summit in San Francisco (San Franciso, California, USA, Oct 8, 2025) After launching in NYC, the AI Agent Security Summit heads to San Francisco to continue shaping how enterprises secure the next wave of AI. On Wednesday, October 8, join us at the historic Commonwealth Club in San Francisco.

CYBERWARCON (Virtual and Arlington, Virginia, USA, Nov 19, 2025) CYBERWARCON is a one-day conference in Arlington, VA focused on the specter of destruction, disruption, and malicious influence on our society through cyber capabilities. CYBERWARCON is not a hacker conference, or an ICS conference, or an international policy conference. The central purpose of this conference is to identify and explore threats. Participants and attendees come from a spectrum of backgrounds, including the military and government, academia, the media, and the private sector.

Events

DTEX NEXT (Virtual, Oct 7, 2025) DTEX NEXT is where the future of proactive security takes shape. Join us as we unveil our latest advancements in DTEX Insider Risk Management (IRM) and DTEX Risk-Adaptive Data Loss Prevention (DLP), powered by industry-leading behavioral science, advanced AI, and our strategic collaboration with AWS.

Don’t miss Jen Easterly, former CISA Director, headlining HIP Conf 25 (Charleston, SC, USA, Oct 7 - 9, 2025) Jen Easterly, former CISA Director, keynotes HIP Conf 2025. A globally recognized cybersecurity leader, Easterly brings unmatched insight into hybrid identity security and resilience. Register now for this must-attend event.

Uniting Women in Cyber 2025 (Crystal City, Virginia, USA, Oct 9, 2025) UWIC is the premier event for cybersecurity leaders, professionals, and aspiring practitioners. Connect with a vibrant community focused on emerging global trends, technological advancements, and workforce development. Attend UWIC 2025 to learn, share ideas, and expand your professional network!

AFRL Space Cyber Summit (Albuquerque, New Mexico, USA, Oct 15 - 16, 2025) The AFRL Space Cyber Summit is an annual event hosted by the Air Force Research Laboratory (AFRL) to bring together experts from government, academia, and industry to advance space cyber expertise and technologies, foster community-wide collaboration, and anticipate future technology growth in a cyber-contested space domain. The summit aims to develop cyber-secure systems for space, protect against evolving threats, and identify opportunities for collaboration and innovation.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 09.29.25

Top stories.

Global critical infrastructure breached by Chinese hackers.

UK government provides £1.5 billion loan to Jaguar Land Rover.

Maximum severity GoAnywhere MFT flaw exploited.

Notes.

Attacks, Threats, and Vulnerabilities

Trends

Marketplace

Research and Development

Litigation, Investigation, and Law Enforcement

Newly Noted Events

Events