Daily Briefing for 11.13.25

Top stories.

• Europol operation disrupts malware infrastructure.
• Amazon describes exploitation of Cisco and Citrix zero-days.
• US establishes Scam Center Strike Force.
• Lumma Stealer rebounds after doxxing campaign.

Europol operation disrupts malware infrastructure.

Law enforcement agencies have disrupted infrastructure used by the Rhadamanthys infostealer, the VenomRAT Trojan, and the Elysium botnet. Authorities also arrested the administrator of VenomRAT in Greece earlier this month. Europol said in a press release, "The dismantled malware infrastructure consisted of hundreds of thousands of infected computers containing several million stolen credentials. Many of the victims were not aware of the infection of their systems. The main suspect behind the infostealer had access to over 100,000 crypto wallets belonging to these victims, potentially worth millions of euros."

Amazon describes exploitation of Cisco and Citrix zero-days.

Amazon's threat intelligence team has published a report on an APT exploiting zero-day flaws in Cisco Identity Service Engine (ISE) and Citrix systems. The researchers state, "Our Amazon MadPot honeypot service detected exploitation attempts for the Citrix Bleed Two vulnerability (CVE-2025-5777) prior to public disclosure, indicating a threat actor had been exploiting the vulnerability as a zero-day. Through further investigation of the same threat exploiting the Citrix vulnerability, Amazon Threat Intelligence identified and shared with Cisco an anomalous payload targeting a previously undocumented endpoint in Cisco ISE that used vulnerable deserialization logic. This vulnerability, now designated as CVE-2025-20337, allowed the threat actors to achieve pre-authentication remote code execution on Cisco ISE deployments, providing administrator-level access to compromised systems."

US establishes Scam Center Strike Force.

The US government has announced a "Scam Center Strike Force" to target Southeast Asian scam compounds, the Record reports. The US Justice Department says the strike force will focus on identifying and pursuing key leaders of "Chinese organized crime affiliates operating in Cambodia, Laos, and Burma."

Justice added, "The new Scam Center Strike Force combines the power, reach, and resources of the U.S. Attorney’s Office with the Department of Justice’s Criminal Division, the FBI, and the U.S. Secret Service to crackdown and disrupt these schemes. The Scam Center Strike Force is also seeking to use all government tools available, partnering with the State Department, the Department of Treasury’s Office of Foreign Assets Control (OFAC), and the Department of Commerce."

Lumma Stealer rebounds after doxxing campaign.

Trend Micro warns of an increase in Lumma Stealer malware activity after an initial decline following the alleged doxxing of the malware operation's core members last month. The researchers note that a "key development in this resurgence is the implementation of browser fingerprinting techniques by the malware, representing a significant evolution in its C&C infrastructure while maintaining core communication protocols consistent with previous versions."