Deal to end government shutdown could revive the Cybersecurity Information Sharing Act of 2015.

Summary

By the CyberWire staff

Deal to end government shutdown could revive the Cybersecurity Information Sharing Act of 2015.

The US Senate has moved to end the US government shutdown with a bill that also includes a short-term extension of the Cybersecurity Information Sharing Act of 2015, which lapsed at the end of September. The act provides legal protections for companies that share threat data about cyberattacks. The bill now awaits a vote in the House and President Trump's signature. The temporary extension would run through January.

CyberScoop notes that the Trump administration has advocated for a 10-year extension of the act without any changes, but Senator Rand Paul (Republican of Kentucky) pushed for amendments related to Freedom of Information Act requests. Paul's objections led to a stalemate in the Senate, leading to the act's expiration in September.

Control what runs in your environment. Reduce your attack surface.

ThreatLocker helps organizations reduce risk by allowing trusted applications to run while limiting their access to only the resources they need. It’s a straightforward, default deny approach that gives you more control and visibility—without slowing down operations. Explore how ThreatLocker can help simplify your security strategy.

New commercial spyware targets Android devices.

Palo Alto Networks' Unit 42 is tracking a new strain of Android spyware that appears to have been developed by a commercial vendor. The spyware, which Unit 42 calls "LANDFALL," is "specifically designed against Samsung Galaxy devices, used in targeted intrusion activities within the Middle East." The tool is delivered via malformed DNG image files that exploit CVE-2025-21042, a zero-day flaw in Samsung's image processing library.

The researchers don't attribute the spyware to any known vendor, but they note some similarities with previous operations by the UAE-linked threat actor Stealth Falcon.

Webinar: Unlocking More AI Use Cases with Tokenization.

What if you could nearly double your AI model's accuracy, while keeping sensitive data secure? Join this free webinar from Capital One Software and PwC to learn how tokenization helps unlock AI potential.

Learn how SAP is achieving 3-6x faster workflows with an AI-powered SOC

Join SAP’s CISO for a conversation on how SAP is modernizing its SOAR workflows and building an AI SOC capability. They’ll cover:

The challenges that led them to reimagine SOAR
Their evolution to AI-driven workflows
Their roadmap to an AI SOC
Advice for your organization on building an AI SOC that scales

Monsta FTP flaw leads to web server compromise.

Researchers at watchTowr discovered an actively exploited vulnerability affecting the Monsta FTP client. The flaw (CVE-2025-34299) can allow attackers to remotely execute arbitrary code without authentication. Monsta FTP issued a fix for the flaw in August, and users should ensure their instances are updated to version 2.11.3 or later.

Russian national pleads guilty to facilitating ransomware attacks.

A 25-year-old Russian national, Aleksei Olegovich Volkov, has pleaded guilty to acting as an initial access broker for the Yanluowang ransomware gang, the Register reports. At least seven of these attacks hit US-based companies. Volkov was arrested in Italy and extradited to the US last year.

Build an AI-driven SOC at scale: Lessons from Reddit

Hear from Reddit’s security team on December 3rd as they reveal how they’re building an AI SOC that scales. Learn how to combine AI and deterministic workflows for smarter security, and get a live walkthrough and advice on building and deploying your own AI SOC.

Notes.

Today's issue includes events affecting Italy, Russia, the United Arab Emirates, and the United States.

The CyberWire will be on hiatus tomorrow for Veterans' Day. We'll be back as usual on Wednesday.

Attacks, Threats, and Vulnerabilities

North Korean hackers hijack Google, KakaoTalk accounts to control South Korean phones: Report (The Straits Times) This marks the first confirmed case of a North Korean state-sponsored hacking group compromising Google accounts. Read more at straitstimes.com. Read more at straitstimes.com.

Marketplace

Seeking to get off US blacklist, spyware firm NSO taps ex-envoy Friedman as chairman (Times of Israel) Former US ambassador to Israel says most of the ‘adverse attention’ paid to Israeli-founded firm is unfair, will pitch it to Trump administration as way to ‘make Americans safer’

Legislation, Policy, and Regulation

Don't call it Cyber Command 2.0: Master plan for digital forces will take years to implement (The Record) The latest model for improving U.S. Cyber Command is circulating at the Pentagon. Some of the initiatives will spill into the next decade — an approach that is sure to create friction on Capitol Hill and beyond.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Secure Together New York 2025 (New York, New York, USA, Nov 12, 2025) Join us at Secure Together on the Road – New York 2025 to explore the future of SAP security, engage with leading experts and peers across North America, and discover how SecurityBridge empowers organizations with real-time protection—natively integrated, built for modern risks, and designed for today’s evolving enterprise landscape.

CYBERWARCON (Virtual and Arlington, Virginia, USA, Nov 19, 2025) CYBERWARCON is a one-day conference in Arlington, VA focused on the specter of destruction, disruption, and malicious influence on our society through cyber capabilities. CYBERWARCON is not a hacker conference, or an ICS conference, or an international policy conference. The central purpose of this conference is to identify and explore threats. Participants and attendees come from a spectrum of backgrounds, including the military and government, academia, the media, and the private sector.

AWS re:Invent 2025 (Las Vegas, Nevada, USA, Dec 1 - 5, 2025) AWS re:Invent is a learning conference hosted by AWS for the global cloud computing community. The in-person event features keynote announcements, training and certification opportunities, access to more than 2,000 technical sessions, the Expo, after-hours events, and so much more.

TRUSTECH 2025 (Paris, France, Dec 2 - 4, 2025) This international event is the go-to place for all things payments, digital identity, cybersecurity, and fintech. With over 200 exhibitors, 100+ speakers, innovation awards, networking opportunities, and exclusive content, it’s the perfect place to discover what’s next in trusted technologies.

CyberMarketingCon 2025 (Austin, TX, USA, Dec 7 - 10, 2025) CyberMarketingCon will be held December 7-10 in bustling downtown Austin, Texas. Come to learn, network, and enjoy what this beautiful, unique city and your amazing fellow attendees have to offer.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 11.10.25

Top stories.

Deal to end government shutdown could revive the Cybersecurity Information Sharing Act of 2015.

New commercial spyware targets Android devices.

Monsta FTP flaw leads to web server compromise.

Russian national pleads guilty to facilitating ransomware attacks.

Notes.

Attacks, Threats, and Vulnerabilities

Marketplace

Legislation, Policy, and Regulation

Events