Law enforcement seizes BreachForums domains.

Summary

By the CyberWire staff

Law enforcement seizes BreachForums domains.

US and French law enforcement last night seized all domains for the latest version of BreachForums, which was set up by the ShinyHunters gang (now part of the Scattered Lapsus$ Hunters criminal collective) as a portal for leaking data stolen in extortion attacks. ShinyHunters confirmed the takedown and said they would not be launching another BreachForums, BleepingComputer reports.

Scattered Lapsus$ Hunters had been using the site to extort companies breached in the ongoing wave of Salesforce attacks. The data were stolen via social engineering attacks targeting dozens of major companies, including FedEx, Disney/Hulu, HBO Max, Home Depot, Marriott, Google, Cisco, Toyota, Gap, McDonald's, Walgreens, Instacart, Cartier, and Adidas. The crooks set a deadline to leak one billion records at midnight tonight, and said the takedown will not disrupt their plans. The Register notes that this latest threat looks "more like a desperate scramble to monetize old stolen data before law enforcement closes in."

Juniper Networks patches over 200 flaws.

Juniper Networks has issued patches for more than 200 vulnerabilities affecting Junos Space and Junos Space Security Director, including nine critical flaws, SecurityWeek reports. One of the critical flaws (CVE-2025-59978) is a cross-site scripting vulnerability that could allow "an attacker to store script tags directly in web pages that, when viewed by another user, enable the attacker to execute commands with the target's administrative permissions."

Juniper says there's no evidence that any of the flaws are being exploited, but urges users to apply the patches promptly.

RondoDox botnet targets dozens of vulnerabilities.

Trend Micro warns that a major RondoDox botnet campaign is taking an "exploit shotgun" approach to target fifty-six vulnerabilities across more than thirty vendors. The malware is targeting known flaws affecting "routers, digital video recorders (DVRs), network video recorders (NVRs), CCTV systems, web servers, and various other network devices."

RondoDox is a new botnet that surfaced earlier this year. Trend Micro notes, "Our first RondoDox intrusion attempt began on June 15, 2025, when we identified a familiar vulnerability from our Pwn2Own Toronto event. This vulnerability, tracked as CVE-2023-1389, targets the WAN interface of the TP-Link Archer AX21 Wi-Fi router."

Notes.

Today's issue includes events affecting , and France the United States.

The CyberWire will be on hiatus this coming Monday for Columbus Day/Indigenous Peoples' Day. We'll be back as usual on Tuesday.

Attacks, Threats, and Vulnerabilities

Cisco, Fortinet, Palo Alto Networks Devices Targeted in Coordinated Campaign (SecurityWeek) GreyNoise has discovered that attacks exploiting Cisco, Fortinet, and Palo Alto Networks vulnerabilities are launched from the same infrastructure.

Trends

In AI We Trust? Increasing AI Adoption in AppSec Despite Limited Oversight (Fastly) AI adoption in AppSec is soaring, yet oversight lags. Explore the paradox of trust vs. risk, false positives, and the future of AI in application security.

Technologies, Techniques, and Standards

Apple Announces $2 Million Bug Bounty Reward for the Most Dangerous Exploits (WIRED) With the mercenary spyware industry booming, Apple VP Ivan Krstić tells WIRED that the company is also offering bonuses that could bring the max total reward for iPhone exploits to $5 million.

Google Launches AI Bug Bounty with $30,000 Top Reward (Infosecurity Magazine) Google has introduced a new AI Vulnerability Reward Program offering up to $30,000 for bug discoveries in its AI products

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

AFRL Space Cyber Summit (Albuquerque, New Mexico, USA, Oct 15 - 16, 2025) The AFRL Space Cyber Summit is an annual event hosted by the Air Force Research Laboratory (AFRL) to bring together experts from government, academia, and industry to advance space cyber expertise and technologies, foster community-wide collaboration, and anticipate future technology growth in a cyber-contested space domain. The summit aims to develop cyber-secure systems for space, protect against evolving threats, and identify opportunities for collaboration and innovation.

ISC2 Security Congress 2025 (Nashville + Virtual, Tennessee, USA, Oct 29 - 31, 2025) Join thousands of cybersecurity experts at ISC2 Security Congress 2025 and help lead the future of our connected world. Gain the insights you need to stay ahead of the evolving digital landscape. From innovative software to new security strategies, ISC2 Security Congress 2025 is designed to ensure you can navigate tomorrow’s threats.

Cyber Innovation Day 2025 | Datatribe (Washington, DC, USA, Nov 4, 2025) If you’re raising a seed or pre-seed round and are building the next category-defining company, we want to hear from you! The DataTribe Challenge is the headline event of the afternoon at Cyber Innovation Day 2025, where five finalists take the stage after weeks of hands-on coaching from seasoned startup operators and investors. These five finalists—along with additional promising startups—will exhibit in the Cyber Innovation Expo Hall, gaining high-impact exposure to top investors, cybersecurity leaders, and strategic partners.

CYBERWARCON (Virtual and Arlington, Virginia, USA, Nov 19, 2025) CYBERWARCON is a one-day conference in Arlington, VA focused on the specter of destruction, disruption, and malicious influence on our society through cyber capabilities. CYBERWARCON is not a hacker conference, or an ICS conference, or an international policy conference. The central purpose of this conference is to identify and explore threats. Participants and attendees come from a spectrum of backgrounds, including the military and government, academia, the media, and the private sector.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 10.10.25

Top stories.

Law enforcement seizes BreachForums domains.

Juniper Networks patches over 200 flaws.

RondoDox botnet targets dozens of vulnerabilities.

Notes.

Attacks, Threats, and Vulnerabilities

Trends

Technologies, Techniques, and Standards

Events