Weekly Top 10: 10.20.2025: Microsoft Revokes 200+ Certs Used in Fake Teams Installers; Chinese Apt ‘Jewelbug’ Hit Russian It Services Firm; CISA ICS Advisory: Hitachi Energy MACH GWS, and More.

WEEKLY TOP TEN: October 20, 2025, 16:00 GMT

1. Harvard Breach Tied to Oracle E-business Suite Campaign
   
   Harvard University reported a cybersecurity incident linked to an Oracle E-Business Suite exploitation campaign attributed by some to the Clop group. Attackers targeted back-office systems used for administrative functions, with stolen data claims posted to extortion sites. While scope appears limited to a specific unit, universities face outsized risk due to complex ERP footprints and decentralized IT. Oracle has urged rapid patching of vulnerable EBS components. Higher-ed defenders should validate internet exposure of EBS portals, rotate tokens, and monitor for anomalous export jobs or API calls that signal attempted bulk data exfiltration from finance and HR modules.
2. Discord Customer-Service Vendor Link in Data Exposure
   
   Discord warned users about a data incident tied to a third-party customer service system; the vendor 5CA publicly denied being at fault. Notifications referenced compromise of a support platform used by the communications company, potentially exposing user information handled during ticketing. The back-and-forth highlights the systemic risk of outsourced support where screenshots, IDs, and email threads often live in SaaS tools. Companies should catalog processors handling PII, enforce short retention for tickets, and restrict sensitive attachments. Users should be wary of follow-on phishing exploiting ticket context. Clarifications from both firms will determine the final blast radius.
3. Microsoft Blocks Rhysida Teams Installer Campaign
   
   Microsoft disrupted a wave of Rhysida ransomware attacks abusing malicious Teams installers by revoking more than 200 code-signing certificates used to lend the payloads credibility. The company also updated detections and shared IOCs. Organizations should consider restricting sideloaded add-ins, using application control to block untrusted installers, and educating users on social-engineering that pivots from chat invitations to executable downloads. Monitoring certificate chains and Smartscreen/Defender alerts tied to Teams-related installers can help identify residual attempts. The takedown shows how quickly criminals adapt trust mechanisms and why certificate governance is a critical layer in ransomware-resilience strategies.
4. Netcorecloud Leaves 40B Email Records Exposed
   
   A misconfigured server at NetcoreCloud exposed 40 billion records (13.4 TB) containing email logs and marketing data for thousands of global clients. Researcher Jeremiah Fowler reported open access to message subjects, addresses, SMTP details, and internal environment references. While it’s unclear if other actors accessed the dataset, the scale enables precision phishing and business email compromise scenarios against brands using the platform. NetcoreCloud restricted access after disclosure. Companies should revisit data-minimization on marketing logs, segregate PII from operational telemetry, and enforce continuous configuration assessment on cloud storage to prevent recurrence of large-scale exposures.
5. CISA ICS Advisory: Hitachi Energy MACH GWS
   
   Hitachi Energy products were the subject of a CISA ICS advisory detailing vulnerabilities in MACH GWS, with guidance released to asset owners. While not a confirmed exploitation event, the advisory signals risk to grid-adjacent equipment commonly found in transmission and substation environments. Utilities and integrators should validate exposure, apply vendor mitigations, and monitor for abnormal management traffic. The notice fits a broader pattern of elevated threat focus on OT/ICS suppliers and their customers. Operators should include these advisories in patch-prioritization and ensure change-management accounts for availability constraints in critical power operations.
6. Microsoft Revokes 200+ Certs Used in Fake Teams Installers
   
   Following sustained abuse of malicious installers, Microsoft revoked over 200 certificates used by “Vanilla Tempest” to sign fake Teams packages that delivered the Oyster backdoor and Rhysida ransomware. The takedown blunted ongoing intrusion waves and illustrates the abuse of trust chains to improve malware success rates. Enterprises should block unsigned or newly signed installers from untrusted publishers and require elevated approvals for collaboration-app add-ins. Incident responders should search for Teams-related MSI artifacts, lateral-movement staging, and outbound C2 tied to this campaign’s infrastructure as outlined by researchers tracking the group’s activity.
7. Chinese Apt ‘Jewelbug’ Hit Russian It Services Firm
   
   Researchers reported that a China-nexus group known as Jewelbug quietly compromised a Russian IT services provider, an unusual east-to-east espionage operation suggesting shifting intelligence priorities. The intrusion spanned months and focused on stealthy access and data collection. For the targeted company and its downstream customers, risks include supply-chain compromise and credential theft that could cascade into critical infrastructure. The case underscores how managed service providers remain high-value targets and why customers should demand telemetry sharing, strict EDR coverage, and rapid breach disclosure from their MSPs to contain lateral movement across client environments.
8. Qilin Ransomware Names New Victims, Broadening Impact
   
   The Qilin ransomware group announced additional victims across sectors, signaling continued activity after high-profile attacks in Europe and Asia. Named organizations reportedly include public-sector and commercial entities, with data-leak site posts and deadlines designed to pressure payments. Companies listed face exposure of internal documents and personal data, leading to fraud and competitive harm. The pattern demonstrates how affiliates rotate initial-access methods and leverage data-theft before encryption. Defenders should track Qilin’s TTPs, particularly abuse of remote management tools and exfiltration over cloud storage, while validating that backups are isolated and incident playbooks cover leak-site monitoring and takedown requests.
9. F5 Discloses Nation-State Breach of Big-Ip Environment
   
   F5 said a “sophisticated nation-state actor” breached internal systems, stealing BIG-IP source code, some vulnerability information, and limited customer configuration data. The theft of bug details raises concern over pre-patch exploitation, while access to config snapshots could aid targeted attacks. F5 is notifying affected customers and issuing mitigations. Enterprises running BIG-IP should watch for emergency advisories, review exposed management interfaces, and consider credential rotation for impacted appliances. The event spotlights supply-chain risk from network infrastructure vendors and the value adversaries place on product internals that can accelerate exploit development against widely deployed platforms.
10. Microsoft Patch Tuesday Fixes Six Zero-Days
    
    Microsoft released its October updates, patching 172 vulnerabilities, including six zero-days that were exploited or publicly disclosed. Critical issues span remote code execution and elevation of privilege, with components across Windows and server products affected. Organizations running Microsoft ecosystems face heightened risk if they delay deployment, particularly where internet-facing services or unprivileged code paths exist. The breadth of fixes underscores the need for staged patch rollouts, robust testing, and compensating controls such as application allow-listing and attack surface reduction rules. SOCs should also hunt for exploitation artifacts tied to the addressed CVEs to validate that mitigations landed correctly.