Digital Forensics Magazine — 48h News Roundup

Window: 08-11-2025 to 10-11-2025 (UTC)

Snapshot Summary

Sector / Section	Headline Highlights	Count
DFIR & Incident Response	ERP-focused ransomware and long-tail retail breach recovery dominate, with Allianz UK and Co-op detailing how they are rebuilding after major cyberattacks.	2
Cyber Investigations	Indian cybercrime units are expanding complex fraud investigations, tracking mule networks and suspects across multiple states and financial channels.	2
Major Cyber Incidents	New revelations about a Chinese infosec breach, Oracle EBS mass exploitation and Qilin’s attack on Scouts Canada underline the global spread of high-impact incidents.	3
Exploits & Threat Intelligence	Fresh exploits against Monsta FTP and the runC container runtime highlight attackers’ focus on web admin tooling and cloud-native infrastructure.	2
Law Enforcement	Ghana is deepening regional partnerships to tackle cyber-enabled trafficking and online crime through joint operations and intelligence sharing.	1
Policy	Lawmakers are exploring stronger national cyber authorities in Ghana while EU leaders debate whether loosening privacy rules to fuel AI growth will erode security baselines.	2
Standards & Compliance	Regulators and vendors alike are leaning on AI and SaaS platforms to monitor dark-web data leaks and streamline ISO 27001 compliance for resource-constrained organisations.	2

Digital Forensics & Incident Response

Allianz UK confirms impact of Oracle E-Business Suite CL0P attack — Allianz UK has confirmed that its personal lines business was compromised in the CL0P gang’s Oracle E-Business Suite campaign, exposing data for 80 current and 670 former customers while subsidiary LV’s systems remained unaffected. For DFIR teams this underscores how ERP platforms like Oracle EBS have become high-value ransomware targets that demand proactive threat hunting for exploitation of recent vulnerabilities and tight coordination with regulators such as the ICO (Source: The Register, 10-11-2025, EMEA).

Co-op outlines recovery progress after major 2025 cyberattack — UK’s retailer Co-op has issued a fresh update on its April cyberattack, saying it has stabilised core systems, restored regular store deliveries and is pressing ahead with plans to open or refurbish more than 50 stores despite the data theft affecting 6.5 million members. Incident responders should note how long-tail recovery, member communication and business expansion can intersect after large retail breaches, requiring continued monitoring for residual attacker access and fraud risks even as boards declare operations ‘back on track’ (Source: Co-op / City A.M., 10-11-2025, EMEA).

Cyber Investigations

Telangana Cyber Security Bureau nabs 81 fraudsters in multi-state operation — India’s Telangana Cyber Security Bureau has arrested 81 suspects across five states in a coordinated crackdown on online fraud networks that used mule accounts, fake identities and social engineering to siphon victims’ funds. The case highlights how large, multi-jurisdiction investigations are increasingly needed to unwind distributed cyber-fraud ecosystems, and why DFIR teams must be ready to share high-quality IOCs and transaction traces with specialised cyber police units (Source: Mangalorean, 09-11-2025, APAC).

Ninth accused in ₹1.75 crore cyber fraud tracked to Gujarat hideout — Police in Haryana, India have arrested a ninth suspect in a ₹1.75 crore cyber fraud case, tracing the alleged money mule to Gujarat after victims were duped through sophisticated online investment and phishing schemes. For investigators this shows the value of persistent follow-the-money work and cross-state coordination to chase down secondary actors who launder or cash out proceeds from online fraud, often long after the initial attack (Source: The Tribune, 09-11-2025, APAC).

Major Cyber Incidents

Data breach at Chinese infosec firm reportedly leaks cyber-weapons and target list — A breach at Chinese cybersecurity company Knownsec has reportedly exposed internal offensive tools and a target list of foreign organizations, with the leaked data now circulating on underground forums. Such leaks can rapidly arm a wider range of threat actors with nation-state grade capabilities, so DFIR and threat intel teams should be ready to detect repurposed tooling and reassess exposure to campaigns previously attributed to tightly controlled operators (Source: The Register, 09-11-2025, APAC).

Washington Post confirms it was hit in sweeping Oracle E-Business Suite breach — The Washington Post has acknowledged it is among dozens of organizations impacted by a sweeping Oracle E-Business Suite breach linked to the CL0P ransomware group, following earlier warnings that more than 100 companies could be affected. Media organizations’ reliance on large ERP platforms means compromises can ripple into subscriber data, advertiser systems and news-gathering workflows, so defenders should ensure Oracle EBS instances are patched and closely monitored for post-compromise lateral movement (Source: Reuters, 07-11-2025, AMER).

Qilin ransomware group claims attack on Scouts Canada — The Qilin ransomware group has claimed responsibility for an attack on youth organisation Scouts Canada, listing the non-profit on its leak site and threatening to publish stolen data if a ransom is not paid. Attacks on charities and youth organisations underline that ‘soft’ targets with broad personal data stores are firmly on ransomware operators’ radar, and DFIR teams supporting the nonprofit sector should plan for high-impact breaches with limited in-house security staff (Source: Dexpose, 08-11-2025, AMER).

Exploits & Threat Intelligence

Monsta FTP remote code execution flaw exposes web servers to takeover — Researchers have disclosed a critical remote code execution vulnerability in the Monsta FTP web file manager that allows unauthenticated attackers to run arbitrary commands on vulnerable servers. Because Monsta FTP is often deployed as a convenience tool on shared hosting and internal admin portals, DFIR teams should hunt for exploitation attempts in web logs, remove exposed instances and ensure web server inventories include ‘utility’ tools that may bypass normal patching processes (Source: Cyber Security News, 10-11-2025, Global).

Dangerous runC flaws enable container escape from Docker and Kubernetes nodes — Newly detailed vulnerabilities in the runC container runtime could let attackers with the ability to pull or run malicious images escape from Docker and Kubernetes containers to execute code on the underlying host. With containerization now underpinning many production workloads, security teams should treat these bugs as priority patch items, review CI/CD pipelines for untrusted images and expand EDR visibility to container hosts (Source: BleepingComputer, 09-11-2025, Global).

Law Enforcement

Ghana steps up regional cooperation against human trafficking and cybercrime — Ghanaian authorities have announced new measures to deepen regional cooperation against human trafficking and cybercrime, including joint operations and intelligence sharing with neighbouring states. Cross-border law enforcement partnerships like this are vital for tackling cyber-enabled trafficking, fraud and online exploitation schemes that routinely span jurisdictions far beyond any single SOC’s visibility (Source: NewsGhana, 10-11-2025, EMEA).

Policy

Ghana Cyber Security Authority seeks expanded powers under draft amendment bill — Ghana’s Cyber Security Authority has tabled a draft amendment bill that would expand its powers to license service providers, enforce minimum security standards and issue binding directives across critical sectors. For CISOs operating in or with Ghanaian entities, this signals a shift toward more assertive regulatory oversight, making it important to track new licensing obligations, incident reporting rules and potential overlaps with data protection law (Source: NewsGhana, 08-11-2025, EMEA).

EU weighs how far to relax privacy rules to accelerate AI innovation — European policymakers and regulators are debating whether to ease certain data protection constraints to boost AI development, amid concerns from privacy advocates and security experts about increased data misuse risk. Any relaxation of long-standing privacy safeguards would have major implications for security teams, who may need to adapt governance controls, monitoring and breach-response playbooks to cope with larger, more sensitive data flows used to train AI models (Source: Fortune, 10-11-2025, EMEA).

Standards & Compliance

Morocco’s data protection authority deploys AI to hunt leaked personal data on the dark web — Morocco’s data protection watchdog CNDP has unveiled an AI-powered system designed to scan dark web markets and leak sites for illegally traded personal data belonging to Moroccan citizens. This kind of supervisory technology raises the bar for compliance, signalling that regulators can independently spot breaches and unreported leaks, so organisations processing personal data should expect more proactive enforcement of security and notification obligations (Source: Barlaman Today, 08-11-2025, EMEA).

ISO 27001 readiness platforms promise faster audit preparation for SMEs — Security consultancy Neumetric has promoted a SaaS-based ISO 27001 readiness platform that centralises risk registers, control evidence and task tracking to help smaller organisations prepare for certification. While vendor-backed, offerings like this can help resource-constrained teams structure their security programmes around recognised controls, making it easier to demonstrate due diligence to customers and regulators (Source: Neumetric, 08-11-2025, Global).

Editorial Perspective

Over the last 48 hours, the picture that emerges is one of attackers steadily shifting upstream into ERP platforms, container runtimes and third-party tools while defenders juggle long-tail recovery from earlier breaches.

Ransomware campaigns against organisations as diverse as insurers, retailers and youth charities, combined with large-scale fraud investigations in India and new regional cybercrime partnerships in West Africa, show how criminal operations now span every sector and jurisdiction.

For DFIR and security leaders, the priority is to tighten visibility around business-critical platforms, rehearse crisis communications that can last months, and stay ahead of fast-moving regulatory expectations on incident reporting and data protection.

Reference Reading

• US cybersecurity experts indicted for BlackCat ransomware attacks (BleepingComputer, 03-11-2025)
• US prosecutors say cybersecurity pros ran cybercrime operation (Reuters, 03-11-2025)
• Cybersecurity experts accused of carrying out their own ransomware attacks (TechRadar Pro, 04-11-2025)
• Ransomware gang tricks victims with fake Microsoft Teams ads (TechRadar Pro, 04-11-2025)
• Crackdowns and takedowns: Disrupting ransomware in 2025 (S-RM, 2025)
• Dangerous runC flaws could allow hackers to escape Docker containers (BleepingComputer, 09-11-2025)

Tags

DFIR, Cybersecurity News, Threat Intelligence, Ransomware, Law Enforcement, Cyber Policy, Compliance, EU CRA