ZeroFox Weekly Intelligence Brief – November 8, 2025

ZeroFox Weekly Intelligence Brief – November 8, 2025

ZeroFox’s Weekly Intelligence Briefing highlights the major developments and trends across the threat landscape, including digital, cyber, and physical threats. ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 6:00 AM (EST) on November 6, 2025; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Read the Brief

View the full report here

278 Million Location Points Reveal EU Officials’ Movements

What we know:

• Some European reporters have acquired a free sample from a commercial data broker containing 278 million location points from millions of Belgian mobile devices.
• This exposed data has reportedly made it “easy” to track top EU officials despite General Data Protection Regulation (GDPR) protections.

New Hacker Group UNK_SmudgedSerpent Linked to Iran Targeting U.S. Policy Experts

What we know:

• A new Iran-linked threat activity cluster called UNK_SmudgedSerpent has been uncovered targeting Western academics and foreign policy experts between June and August 2025, coinciding with heightened geopolitical tensions between Iran and Israel.

Cyber Threat Actors Facilitating Physical Cargo Theft by Targeting Logistics Industry

What we know:

• Cybercriminals are collaborating with organized crime networks to steal cargo freight from trucking and logistics companies.
• The activity has been observed to be active since at least June 2025, with food and beverage products being the most targeted commodity.