> InfoSec News Nuggets 11/11/2025

Allianz UK joins growing list of Clop’s Oracle E-Business Suite victims Allianz UK confirms it was one of the many companies that fell victim to the Clop gang’s Oracle E-Business Suite (EBS) attack after crims reported that they had attacked a subsidiary. The criminal crew behind the wave of zero-day data raids claimed to have attacked Allianz-owned British insurer Liverpool Victoria (LV) on Tuesday, but a spokesperson for its parent company waved away these allegations. Allianz UK, which trades as LV= General Insurance, told The Register that the attack compromised the data of its customers, and there was no impact on LV pension customers or systems at all.   Nevada ransomware attack traced back to malware download by employee An August ransomware attack against the state of Nevada has been traced to a May intrusion, when a state employee mistakenly downloaded a malware-laced tool from a spoofed website, according to a forensic report the state released Wednesday. State officials refused to submit to a ransom demand and recovered 90% of the impacted data after a 28-day recovery period. The state had insurance coverage and pre-negotiated vendor agreements, which factored into the decision not to pay a ransom.    Commercial spyware “Landfall” ran rampant on Samsung phones for almost a year Another day, another malware attack on smartphones. Researchers at Unit 42, the threat intelligence arm of Palo Alto Networks, have revealed a sophisticated spyware known as “Landfall” targeting Samsung Galaxy phones. The researchers say this campaign leveraged a zero-day exploit in Samsung Android software to steal a raft of personal data, and it was active for almost a year. Thankfully, the underlying vulnerability has now been patched, and the attacks were most likely targeted at specific groups. Unit 42 says that Landfall first appeared in July 2024, relying on a software flaw now catalogued as CVE-2025-21042. Samsung issued a patch for its phones in April 2025, but details of the attack have only been revealed now.   Hackers are saving Google’s abandoned Nest thermostats with open-source firmware Cody Kociemba, the developer behind the Hack/House collaborative project, is waging war against Google. The tech giant recently decided to discontinue the first two generations of its Nest Thermostat, stripping the devices of much of their original functionality. Thanks to Kociemba’s hacking efforts, Nest customers now have an alternative path to restoring the features Google removed. Kociemba has launched the No Longer Evil project, an open-source initiative aimed at breathing new life into decommissioned first- and second-generation Nest thermostats. The custom software can effectively “revive” these devices, offering a modern control interface and returning full ownership and functionality to users. The community-driven project is explicitly designed to combat planned obsolescence imposed by Big Tech, Kociemba said, giving still-functional hardware a new lease on life.   Detecting fraudulent North Korean hires: A CISO playbook The North Korean worker scheme has expanded into a global threat. Although it originally focused on U.S. technology companies, the scheme has spread to other regions and sectors, including finance, healthcare, and government. Any company hiring remote workers is at risk; as a remote-first technology company, even Sophos has been targeted by North Korean state-sponsored operatives posing as IT workers. The threat actors target high-paying, fully remote jobs, primarily seeking to obtain a salary that can fund North Korean government interests. They typically apply for software engineering, web development, AI/machine learning, data science, and cybersecurity positions, although they have expanded into other roles as well. The post InfoSec News Nuggets 11/11/2025 appeared first on AboutDFIR - The Definitive Compendium Project.