May 2025 - RedSeal

Cyber News Roundup for May 23, 2025

/by

Resecurity and Starlink Announce Strategic Cybersecurity Partnership

Resecurity, a global cybersecurity leader, has partnered with Starlink to expand advanced threat intelligence and cybersecurity solutions across the Middle East and Africa. The collaboration aims to enhance regional cybersecurity capabilities by providing cutting-edge technologies and expertise. This strategic alliance reflects a growing emphasis on international cooperation to address evolving cyber threats.

(Yahoo Finance)

Ransomware attack on food distributor spells more pain for UK supermarkets

UK food distributor Peter Green Chilled says it was hit by a ransomware attack on May 14th, disrupting operations and deliveries to major supermarkets. New orders were paused, potentially causing significant losses for small suppliers. Experts warn of increasing cyber threats targeting the UK retail supply chain’s operational systems.

(The Record)

South Asian Ministries Hit by SideWinder APT Using Old Office Flaws and Custom Malware

The SideWinder APT group has launched a targeted cyber-espionage campaign against government institutions in Sri Lanka, Bangladesh, and Pakistan. Using spear-phishing emails and geofenced malware payloads, attackers exploited outdated Microsoft Office vulnerabilities to deliver the StealerBot malware. This .NET-based tool captures sensitive data like keystrokes, passwords, and screenshots, with a high degree of precision and selectivity in targeting, reflecting SideWinder’s ongoing and methodical activity in the region.

(The Hacker News)

SK Telecom says malware breach lasted 3 years, impacted 27 million numbers

South Korea’s SK Telecom reported a nearly three-year-long undetected malware breach, beginning June 2022, which compromised sensitive SIM data of nearly 27 million customers, including authentication keys and contact information, elevating SIM-swapping risks. The company is replacing SIMs, blocking unauthorized device changes, and accepting responsibility for resulting damages. Investigations identified 25 malware types on 23 servers, but the full scope of data loss is uncertain due to limited early logging.

(Bleeping Computer)

Researchers from CISA and NIST promote a new metric to better predict actively exploited software flaws

Researchers from CISA and NIST have introduced a new metric called Likely Exploited Vulnerabilities (LEV) to better predict which software flaws are being actively exploited. Developed by Peter Mell (NIST) and Jonathan Spring (CISA), LEV uses equations that combine data from the Exploit Prediction Scoring System (EPSS), Known Exploited Vulnerabilities (KEV) lists, and key dates tied to each vulnerability. The goal is to improve patch prioritization by estimating the probability that a flaw has been exploited. Unlike KEV or EPSS alone—which can be incomplete or inaccurate—LEV helps fill gaps by identifying high-risk vulnerabilities that might be overlooked. It can also gauge how comprehensive KEV lists really are. NIST is now seeking industry partners to test and refine LEV with real-world data.

(SecurityWeek)

KrebsOnSecurity Hit With Near-Record 6.3 Tbps DDoS

KrebsOnSecurity reports it was hit by a 6.3 Tbps DDoS attack on May 12th, likely a test of the Aisuru Internet of Things botnet. The attack lasted less than a minute but was clocked as the largest ever mitigated by Google’s Project Shield. Aisuru has been linked to a known figure named “Forky,” compromising hijacked IoT devices using zero-day exploits. Forky denies involvement in the attack, now claiming to focus on his hosting business, Botshield.

(Krebs on Security)

Mobile carrier Cellcom confirms cyberattack behind extended outages

Cellcom, a Wisconsin-based mobile carrier, confirmed a cyberattack was behind the widespread outages that began on May 14, 2025, disrupting voice and SMS services across Wisconsin and Upper Michigan. The company initially described it as a technical issue but later acknowledged the cyber incident, stating sensitive customer data wasn’t impacted. Cellcom is working with the FBI and cybersecurity experts to restore service, which it aims to complete by the end of the week.

(Bleeping Computer

Chinese Hackers Deploy ‘MarsSnake’ Backdoor in Saudi Arabia

The threat actor “UnsolicitedBooker,” linked to China, used a novel backdoor named MarsSnake in a multi-year espionage campaign targeting a Saudi organization. The malware remained undetected for years. Threat hunters have exposed the tactics of this China-aligned threat actor, which targeted an unnamed international organization in Saudi Arabia. The MarsSnake backdoor allows for persistent access and data exfiltration. The campaign highlights the sophistication and stealth of state-sponsored cyber espionage operations. Security experts recommend organizations enhance their threat detection capabilities to identify such advanced persistent threats.

(The Hacker News)

Delta Air Lines Lawsuit Against CrowdStrike Proceeds

A Georgia judge ruled that Delta Air Lines can proceed with its lawsuit against CrowdStrike over a July 2024 outage that led to 7,000 flight cancellations. Delta alleges gross negligence due to a defective software update. The outage was allegedly caused by a defective update to CrowdStrike’s Falcon software, which crashed over 8 million Microsoft Windows-based computers globally. Delta estimates the outage resulted in $550 million in losses, with only $50 million recouped through fuel savings. The judge also allowed Delta to pursue claims of computer trespass and a narrowed fraud claim relating to unauthorized software access. CrowdStrike expressed confidence that the case lacks merit or would result in minimal damages under Georgia law. Delta filed the lawsuit three months after the incident.

(Reuters)

Researchers track increased malicious targeting of iOS devices

A new report from Zimperium warns that iOS devices, often seen as secure, are increasingly targeted through sideloaded and unvetted apps. Attackers exploit flaws in iOS using tools like TrollStore, SeaShell, and vulnerabilities such as MacDirtyCow and KFD to bypass Apple’s protections. These apps may appear benign but can exfiltrate data or compromise devices without detection. Zimperium found over 40,000 apps using private entitlements and 800+ using private APIs, posing serious risks. Organizations—especially in regulated sectors—must adopt stricter app vetting, monitor permissions, and detect sideloaded apps. Zimperium urges proactive defenses to counter these threats. The takeaway: just because an app runs on iOS doesn’t mean it’s safe—its behavior and origin matter more than its appearance.
(Hackread)

A popular printer brand serves up malware

If you’ve bought a UV inkjet printer from the brand Procolored recently, you might want to scan your system for malware. YouTuber Cameron Coward, known for his DIY tech reviews, first raised the alarm while reviewing a $6,000 printer. His antivirus flagged threats on the included USB—specifically a worm and Floxif, a file infector. When Procolored dismissed this as a false positive, Coward turned to Reddit, catching the attention of cybersecurity firm G Data. Their investigation found malware, including a backdoor and a crypto-stealing Trojan called SnipVex, in official Procolored software downloads. G Data traced around $100,000 in stolen Bitcoin linked to SnipVex. Procolored later admitted malware might have been introduced via USB and has since cleaned up its downloads. Experts now urge users to scan their systems and consider full reinstallation if infected.

(Neowin)

NATO hosts the world’s largest cyber defense exercise

Earlier this week, the NATO Cooperative Cyber Defence Centre of Excellence hosted Locked Shields 2025, the world’s largest cyber defense exercise, in Tallinn, Estonia. Around 4,000 experts from 41 countries participated remotely, simulating the defense of over 8,000 systems against thousands of cyberattacks. The event, which began in 2010 with just four nations, now features advanced challenges, including AI-driven narratives and quantum computing scenarios. Teams also tackled legal, strategic, and disinformation challenges. While Germany-Singapore, Poland-France, and Italy-Slovenia-U.S. teams scored highest, organizers stressed scores don’t reflect overall national readiness. The exercise, planned by 450 experts and 25 industry partners, highlights growing global focus on cyber resilience. Looking ahead, 2026 will expand cloud infrastructure and introduce Critical Special Systems to further bolster national defense capabilities.
(SecurityWeek)

Hackers use a new fileless technique to deploy Remcos RAT

Hackers are using a new fileless technique to deploy Remcos RAT malware through a PowerShell-based loader, bypassing Windows Defender. The attack begins with a malicious ZIP file containing a spoofed LNK shortcut. When opened, it triggers an obfuscated script that alters registry settings for persistence and injects multiple payloads, including Remcos V6.0.0 Pro. This updated version adds idle-time tracking and infected host management. Researchers stress monitoring for LNK files, PowerShell misuse, and registry changes to detect and prevent such threats.
(SC Media) 

Ransomware groups target the undefended space between IT and OT

In an interview with The Register, Timothy Conway, the technical director at the SANS Institute’s industrial control systems (ICS) programs, says the gangs focus on activities in organizations and systems that exist in between classic IT systems that run core business applications, and operational tech (OT) that drives heavy industrial infrastructure. As an example, Conway suggests what might happen if jet fuel was diverted to a home heating oil pipeline. He added, “all businesses have these middle systems, and encrypting them isn’t as difficult as developing ransomware to target OT.” The victims, he says, are more likely to pay the extortion demands. SANS stands for SysAdmin, Audit, Network, and Security. It is a training, research and certification organization.

(The Register)

OT IT best practices

OT Networks Under Siege: The Hidden Risks—and How to Address Them with or without RedSeal

/by

Cyber threats targeting Operational Technology (OT) networks are no longer a distant concern—they are an active, persistent, and growing problem. A recent joint advisory issued by the Department of Energy, CISA, and the FBI confirms what many cybersecurity professionals already know: foreign state-sponsored threat actors are now aggressively probing and compromising ICS and SCADA systems in the U.S. energy sector.

These attacks often capitalize on surprisingly basic gaps in security—default credentials, misconfigured access controls, exposed remote access interfaces, or neglected segmentation between IT and OT environments. While they may seem simple, the implications are anything but. A compromised controller or a pivoted attack path could disrupt fuel delivery, tamper with safety systems, or shut down critical infrastructure.

What We See at RedSeal

At RedSeal, we encounter this reality every day. Our platform is deployed across a wide range of industries—including energy, manufacturing, and utilities—where we routinely identify OT exposures that customers were previously unaware of. In some cases, these exposures were created intentionally to allow vendor support or remote troubleshooting. In others, they were simply misconfigurations, legacy access rules, or firewall exceptions that no one remembered to remove.

Regardless of how these exposures occur, the result is the same: a critical path from the outside world into some of the most sensitive and fragile components of an organization’s infrastructure.

The RedSeal Approach

RedSeal helps customers take control of their OT cybersecurity posture by providing complete visibility and continuous validation of their network environment. Through RedSeal’s Continuous Threat Exposure Management (CTEM) approach, organizations can:

  1. Scope – Identify and classify OT assets that matter most from a business risk perspective.
  2. Discover – Continuously map the network, including hidden connections and unintended access between IT and OT systems.
  3. Prioritize – Understand which exposures present the highest risk based on reachability, business value, and known vulnerabilities.
  4. Validate – Simulate potential attack paths and validate segmentation policies to ensure defensive strategies are working as intended.
  5. Mobilize – Provide clear, actionable remediation guidance to IT and OT teams to close the gaps.

With this process, RedSeal empowers organizations to proactively manage risk and reduce the likelihood of an incident long before an attacker gets a foothold.

What If You Don’t Have RedSeal?

If your organization doesn’t have RedSeal, that doesn’t mean you’re helpless—but it does mean your path will be more manual and potentially less complete. Here’s what you should prioritize:

  1. Conduct a Manual Network Audit
    Review all network routes and firewall rules, particularly those that bridge IT and OT zones. Look for legacy rules, VPN tunnels, or direct internet access to OT segments.
  2. Identify and Remove Default Credentials
    Many OT devices ship with default usernames and passwords. Inventory all ICS/SCADA systems and ensure these have been changed—and are regularly audited.
  3. Enforce Network Segmentation
    Even without automated tools, you can design and enforce segmentation rules to isolate OT from IT and internet-facing systems. Use internal firewalls and access control lists.
  4. Implement Strict Remote Access Policies
    Disable unnecessary remote access. For required connections, use jump servers, multi-factor authentication, session recording, and strict time-bound access.
  5. Test for Reachability
    Use simple tools like traceroute, port scanning, and network simulation software to assess how systems can be reached from different zones. Keep a living map of known and expected paths.
  6. Work with OT and IT Teams Together
    Misalignments between IT and OT teams often create blind spots. Establish joint governance and regular reviews of access policies and network design.

Final Thoughts

The convergence of IT and OT has brought enormous efficiencies—but it has also introduced risk at a scale and complexity few organizations are prepared to manage manually. Whether it’s a state-sponsored APT or a misconfigured firewall, attackers only need one exposure to cause catastrophic disruption.

Whether you’re using RedSeal or not, the key is to treat your OT environment with the same—or greater—rigor as your IT environment. Visibility, validation, and vigilance must become routine practices, not reactionary responses.

Want to See RedSeal in Action?

If you’re looking for a way to automate this process, simulate attack paths, and continuously monitor segmentation and policy compliance across hybrid environments, we’d be happy to show you how RedSeal works. Our platform has helped government agencies and Fortune 500 companies protect their most sensitive systems—and we can help you too.

Cyber News Roundup for May 16, 2025

/by

This week has been a whirlwind in cyber news, showcasing both the persistent threats and the innovative defenses emerging in our digital landscape. Our wrap-up dives into the concerning breach at cryptocurrency giant Coinbase, where social engineering tactics led to the compromise of sensitive user data and a hefty ransom demand. We’ll also cover the FBI’s warning about the escalating use of AI-powered voice deepfakes targeting US officials, highlighting the growing sophistication of social engineering attacks.

Beyond these critical incidents, we’ll explore the latest activities of nation-state actors, including the Fancy Bear campaign targeting Ukrainian entities and a Russian APT exploiting webmail servers. We’ll also touch upon significant vulnerability disclosures, including those affecting Chrome, Node.js, and even Intel CPUs, alongside the discovery of novel malware like HTTPBot and TransferLoader. Stay tuned as we unpack these stories and more, providing insights into the evolving threat landscape and offering key takeaways for bolstering your own cybersecurity posture.

Google issues an emergency patch for a high-severity Chrome browser flaw

Google has issued an emergency patch for a high-severity Chrome browser flaw (CVE-2025-4664) that could allow full account takeovers. Discovered by Solidlab researcher Vsevolod Kokorin, the bug stems from weak policy enforcement in Chrome’s Loader component, letting attackers leak sensitive cross-origin data via malicious HTML. This can expose OAuth tokens through manipulated referrer policies—especially dangerous in authentication flows. Google confirmed a public exploit exists, implying possible active use. The fix is rolling out in Chrome version 136.0.7103.113/114 across platforms. Users should update manually or let Chrome auto-update on restart. This follows a March patch for another critical Chrome zero-day (CVE-2025-2783) used in espionage attacks targeting Russian entities, which exploited Chrome sandbox bypasses to deliver malware.
(Bleeping Computer)

Researchers bypass BitLocker encryption in minutes

A newly revealed flaw in Microsoft BitLocker (CVE-2023-21563) allows attackers to bypass encryption in under five minutes using a software-only method called “Bitpixie.” The exploit targets systems without pre-boot authentication and has a public proof-of-concept available. Unlike hardware-based hacks, Bitpixie extracts BitLocker’s Volume Master Key (VMK) entirely through software by exploiting a flaw in the Windows bootloader during PXE soft reboots. Two attack versions—Linux and Windows PE—allow access using signed components, with no need for physical tampering or a full disk image. The attack is stealthy and effective on unattended or stolen devices. Experts strongly advise enabling pre-boot authentication (PIN, USB key, etc.) to block access to the VMK and prevent such breaches.

(Cyber Security News)Google warns that Scattered Spider is now targeting U.S. retail companies

Google warns that hackers tied to the Scattered Spider group, known for crippling UK retailers like M&S, are now targeting U.S. retail companies. These attackers are skilled at bypassing strong cybersecurity defenses and tend to focus on one industry at a time. Scattered Spider has also been linked to past breaches of MGM Resorts and Caesars Entertainment. U.S. retail security groups are actively monitoring the threat, with Google helping coordinate briefings to prepare major companies like Costco, McDonald’s, and Lowe’s.

(Reuters)

The largest steelmaker in the U.S. shut down operations following a cybersecurity incident

Nucor, the largest U.S. steelmaker, temporarily shut down some operations following a cybersecurity incident involving unauthorized access to its IT systems. The company activated its incident response plan, took affected systems offline, and is working to restore operations. While Nucor didn’t specify which facilities were impacted, it emphasized the shutdown was precautionary. With 300 sites and 25,000 employees, Nucor is a major global player.
(The Record)

New picks for US Cyber Command coming soon

Multiple military, civilian, and congressional sources told The Record that the Trump administration will name a candidate for the vacant role of National Security Agency deputy director before Memorial Day. US Cyber Command and NSA head General Timothy Haugh and deputy NSA chief Wendy Noble were dismissed last month.  This comes as the administration investigates whether to end the so-called “dual-hat” leadership of the NSA and US Cyber Command. Restructuring the leadership requires sign-off from both the Secretary of Defense and the Joint Chiefs chairman that the move won’t hinder Cyber Command.

(The Record)

Exposing North Korean IT workers at scale

Wired shared a report from DTEX Systems that includes a list of over 1,000 email addresses identified as linked to North Korean IT worker activity. Their report profiles two members of a group of North Korean developers now based out of Russia, using the personas “Naoki Murano” and “Jenson Collins.” This group of developers generally worked for cryptocurrency companies, including Coinbase, creating fake job applications and searching for accomplices. These fake IT workers are generally required to hit specific income quotas, with evidence of military personnel directly monitoring communications so they don’t become defectors.

(Wired)

Investigators discover undocumented communications devices inside Chinese-made power inverters

U.S. energy officials are investigating Chinese-made inverters and batteries after discovering undocumented communication devices inside them, Reuters reports. These components—used widely in solar panels, batteries, and EV chargers—could bypass firewalls and pose risks to the power grid. Experts warn they could enable remote disruptions or even destruction of infrastructure. While such devices are built for remote maintenance, some found had hidden capabilities not listed in manuals. The U.S. Department of Energy is working to tighten transparency and supply chain security. As tensions with China grow, utilities and lawmakers are pushing to limit reliance on Chinese technology in critical infrastructure. Some nations, like Lithuania and Estonia, are already taking steps to ban or restrict Chinese inverters to protect energy systems from foreign control.

(Reuters)

Steel producer disrupted by cyberattack

Nucor Corporation, the largest steel producer in the US, disclosed in an 8-K filing with the US Securities and Exchange Commission that it suffered a cyberattack “involving unauthorized third-party access to certain information technology systems.” No other information on date, threat actor, or the type of attack was disclosed. The attack halted production at several locations, although the company began slowly restarting operations. No threat group has taken credit for the attack so far.

(Bleeping Computer)

CISA pares back website security alerts  

CISA announced a major change in how it shares cybersecurity updates: only urgent alerts about emerging threats or major cyber activity will now appear on its website. Routine guidance, vulnerability notices, and product warnings will be distributed via email, RSS, and X (formerly Twitter). This shift, possibly tied to budget cuts and staff reductions under a Trump-aligned cost-cutting initiative, has raised concerns among experts. Critics, including former CISA director Jen Easterly, warn that reducing visibility for routine security updates undermines national cybersecurity. The policy reflects a broader trend of federal agencies moving communications to X, despite its limitations. Agencies like the NTSB and Social Security Administration have also begun phasing out traditional press releases and email updates. Observers worry this change favors Elon Musk’s platform and limits accessibility to critical public information. CISA urges users to subscribe to its email notifications to stay informed.

(The Register)

Europe’s cybersecurity agency launches the European Vulnerability Database

Europe’s cybersecurity agency, ENISA, has officially launched the European Vulnerability Database (EUVD), a centralized platform for tracking cybersecurity flaws. Developed under the NIS2 directive, the EUVD mirrors the U.S. National Vulnerability Database and aims to enhance risk management and transparency across the EU. It gathers data from sources like CSIRTs, vendors, and databases such as MITRE’s CVE and CISA’s KEV Catalog. Users can access three dashboards highlighting critical, exploited, and EU-coordinated vulnerabilities. Each entry includes details like affected products, severity, and mitigation steps. Concerns over the future of the U.S.-based CVE program have increased interest in the EUVD as a stable, independent resource. ENISA says the tool is vital for public users, companies, and authorities to better manage threats and respond effectively to known vulnerabilities.

(Infosecurity Magazine)

A major security flaw has been found in ASUS mainboards’ automatic update system

A major security flaw has been found in ASUS mainboards’ automatic update system, affecting Armoury Crate and DriverHub tools on AMD and Intel platforms. Two vulnerabilities (CVE-2025-3463 and CVE-2025-3462) allow remote attackers to alter system behavior or access features via crafted HTTP requests. The root issue lies in software auto-installed from the UEFI BIOS using Windows Platform Binary Table. ASUS has released updates to fix these issues. Users should update immediately and scan BIOS files for threats using VirusTotal.

(Beyond Machines)

Global Crossing Airlines Group confirms cyberattack

According to a filing with the US Securities and Exchange Commission, the airline, also known as GlobalX, suffered a cyberattack on May 5, 2025. The attackers accessed “systems supporting portions of its business applications.” Over the weekend, the attackers contacted 404 Media, allegedly offering information about Global Crossing’s ICE deportation flights, including flight records and passenger lists. The airline said the attack did not disrupt operations and would not create a material effect on its finances.

(The Record, 404 Media)

Researchers uncover two major cybersecurity threats targeting IT admins and cloud systems

Varonis has uncovered two major cybersecurity threats targeting IT admins and cloud systems. First, attackers are using SEO poisoning to trick admins into downloading malware disguised as legitimate tools. These fake downloads can install backdoors like SMOKEDHAM or monitoring software, enabling credential theft and data exfiltration. In one case, nearly a terabyte of data was stolen, followed by a ransomware attack. Separately, Varonis found a critical root access flaw in Azure’s AZNFS-mount utility, used in HPC and AI workloads. The bug, present in versions up to 2.0.10, lets unprivileged users escalate to root by exploiting environment variables. Though Microsoft rated it low severity, the risk of full cloud compromise is significant. Varonis urges immediate patching to version 2.0.11 and recommends a Defense in Depth strategy to reduce exposure.

(Hackread)

A new tool disables Microsoft Defender by tricking Windows into thinking a legitimate antivirus is installed

A new tool called Defendnot disables Microsoft Defender by exploiting the Windows Security Center (WSC) API, tricking Windows into thinking a legitimate antivirus is installed. Created by GitHub developer “es3n1n,” Defendnot registers a fake antivirus product using reverse-engineered interactions with the undocumented WSC API, bypassing Microsoft’s integrity checks by injecting its code into trusted processes like Task Manager. Once registered, Windows automatically disables Defender to avoid conflicts. While the tool requires admin privileges and persistent installation to survive reboots, it poses a risk if abused by malware developers. Security experts warn that although Defendnot showcases impressive technical skill, it highlights a significant security gap in how Windows handles AV product registration. The tool builds on the developer’s earlier project, no-defender, and underscores the need for better safeguards in WSC’s architecture.

(Cyber Security News)

The FBI warns that threat actors are exploiting outdated, unsupported routers

The FBI has warned that threat actors are exploiting outdated, unsupported routers—likely from brands like Cisco’s Linksys and Ericsson’s Cradlepoint—using unpatched vulnerabilities and remote management software. Hackers bypassed authentication to gain shell access, installed malware, and turned the devices into part of a botnet. These compromised routers were then used as proxies via the Anyproxy and 5Socks networks, helping criminals hide their activities. Malware communications included a two-way handshake with a command-and-control server. While no specific group was named, the FBI noted that Chinese cyber actors have exploited similar vulnerabilities in the past. Users are urged to replace old routers or disable remote access. This alert follows the release of OpenEoX, a proposed standard to better manage end-of-life disclosures for tech products.

(infosecurity magazine)

An Indiana health system reports a data breach affecting nearly 263,000 individuals

Union Health System in Indiana has reported a data breach affecting nearly 263,000 individuals, linked to a January cyberattack on legacy Cerner servers during a migration to Oracle’s cloud. The compromised data includes sensitive patient information such as Social Security numbers, medical records, and insurance details. The breach, confirmed by Oracle Health/Cerner in March, did not impact Union Health’s live systems. Lawsuits allege negligence by both Union Health and Oracle, and claim a threat actor named “Andrew” is extorting affected hospitals. Oracle denies a breach of its Cloud Infrastructure but acknowledged unauthorized access to outdated servers. While Oracle will cover credit monitoring costs, it won’t notify individuals directly. Union Health is offering free credit protection and is facing mounting legal pressure over its handling of the incident.

(Bank of Infosecurity)

A sophisticated email attack campaign uses malicious PDF invoices to deliver a cross-platform RAT

Fortinet researchers have uncovered a sophisticated email attack campaign using malicious PDF invoices to deliver a cross-platform Remote Access Trojan (RAT) called RATty. While primarily targeting Windows, the malware also affects Linux and macOS systems running Java. The attack starts with deceptive emails that pass SPF validation using the serviciodecorreo.es service, luring victims into clicking buttons in the PDF that launch a multi-stage infection. The process uses Dropbox and MediaFire to host files, Ngrok tunneling, and geofencing to evade detection. Victims in Italy receive a Java-based JAR file, while others see harmless documents, fooling email scanners. Once active, RATty enables attackers to execute commands, log keystrokes, and access webcams and files. This campaign highlights how attackers combine social engineering and advanced evasion to bypass security and maintain persistent access.

(Cybersecurity News)

 

Cyber News Roundup for May 9, 2025

/by

In this week’s cyber news, we dive into a mix of dramatic events and critical cybersecurity updates that reveal the growing complexities of modern threats. From a dramatic lawsuit involving a Deutsche Bank IT breach to nations seeking independence from U.S. cloud providers, it’s clear that the global digital landscape is shifting. We also explore the latest in DDoS-for-hire takedowns, critical infrastructure attacks, and new vulnerabilities that demand immediate attention. As always, RedSeal remains committed to helping organizations proactively manage their attack surface, stay ahead of evolving threats, and maintain resilience in an increasingly unpredictable cyber world.

Server room shenanigans, with romance, retaliation, and root access   

A former IT manager is suing Deutsche Bank and its contractor Computacenter, alleging they let a security breach slide right under their noses… and into their server rooms. According to James Papa, a fellow IT worker brought his girlfriend—an unauthorized Chinese national with tech skills—into Deutsche Bank’s most sensitive tech areas multiple times. “Jenny,” as she’s called, allegedly accessed secure systems with a contractor laptop, all while Papa was offsite. When he reported it, rather than earning a promotion, Papa got the boot. No action was taken against the lovebirds, who later vacationed in China. Now Papa is suing for $20 million, claiming whistleblower retaliation and a good old-fashioned cover-up. As for Deutsche Bank and Computacenter? Mum’s the word. Because nothing says ‘robust cybersecurity’ like bring-your-girlfriend-to-work day in the server room. (GB Hackers)

 

Nations look for alternatives to U.S. cloud providers   

All of this instability and uncertainty in the U.S. has triggered global demand for alternatives to U.S. cloud dominance. Europe is seeking digital sovereignty through a strategy that moves beyond simply replicating Amazon, Google, or Microsoft. The goal is to build a viable European cloud ecosystem that’s not only technically credible, but politically and economically independent. This means reducing dependency on proprietary U.S. services, investing in open-source software tailored for cloud infrastructure, and supporting European service providers. Governments play a critical role by funding development, shaping procurement policies, and enforcing privacy laws like GDPR to prioritize local solutions. While Europe already has strong hosting and networking players, transitioning them into full-service cloud providers requires new business models and technical capabilities. The plan resembles building digital “railroads”—laying the foundation for others to innovate upon. This initiative, echoed by concerns in Canada, Australia, and New Zealand, represents a broader global desire to break free from U.S. tech hegemony and establish trusted, local control over critical infrastructure. (Bert Hubert⁠)

 

Europol Shuts Down Six DDoS-for-Hire Services Used in Global Attacks   

Europol shut down six DDoS-for-hire services—cfxapi, cfxsecurity, neostress, jetstress, quickdown, and zapcut—linked to global attacks on schools, businesses, and government sites. Polish authorities arrested four suspects, and the U.S. seized nine related domains. These platforms let users launch attacks for as little as €10 via sleek interfaces. QuickDown, one of the services, combined botnets and dedicated servers to scale operations. (The Hacker News)

 

NIST loses key cyber experts in standards and research   

The National Institute of Standards and Technology (NIST) is experiencing significant staffing losses, with over 20% of its Computer Security Division’s federal employees departing due to early retirement offers and buyouts. Notably, Matthew Scholl, the division chief, and other key leaders have left, raising concerns about the continuity of NIST’s critical cybersecurity initiatives. These departures threaten to disrupt NIST’s efforts in standardizing post-quantum cryptographic algorithms, essential for safeguarding data against future quantum computing threats. Experts warn that the loss of institutional knowledge could impede NIST’s ability to provide timely and effective cybersecurity guidance to industry and government partners. The agency’s capacity to address emerging challenges in quantum computing and artificial intelligence may be compromised, necessitating new leadership to sustain its pivotal role in national cybersecurity.
(Cybersecurity Dive)

 

Masimo says cyberattack has impacted its ability to fulfill orders   

Masimo, maker of patient monitoring devices, is investigating an April cyberattack that disrupted its manufacturing systems and ability to fulfill orders. The company says its on-premises systems were affected, but there’s no evidence the attack reached its cloud infrastructure. Masimo says it’s working with law enforcement and third-party experts and does not expect the incident to impact its 2025 earnings guidance. (Cybersecurity Dive)

 

CISA warns of hackers targeting critical oil infrastructure   

CISA, alongside the FBI, EPA, and Department of Energy, has issued a joint advisory warning that unsophisticated cyber actors are actively targeting industrial control systems (ICS) and SCADA systems in the U.S. oil and gas sector. These attackers—likely hacktivists—exploit poor cyber hygiene using basic tools like default credentials, brute force attacks, and misconfigured remote access. Despite their simplicity, such intrusions can lead to serious consequences including system shutdowns or physical damage. CISA urges asset owners to immediately remove OT systems from the public internet, enforce strong passwords and phishing-resistant MFA, secure remote access, segment networks, and prepare for manual operations. The alert also stresses reviewing third-party access and system configurations. This follows recent warnings about critical vulnerabilities in ICS devices from major manufacturers. (Bleeping Computer)

 

Texas school district breach impacts over 47,000 people   

Alvin Independent School District (AISD) confirmed they suffered a breach in June of 2024 that compromised sensitive information belonging to 47,606 individuals. The district began notifying affected people over the weekend that the incident exposed names, Social Security numbers, state-issued IDs, credit card and financial account details, as well as medical and health insurance info.The Fog ransomware gang published the district’s name on its data leak site but it remains unclear whether the district paid a ransom. Since then, Fog has claimed responsibility for 20 confirmed ransomware attacks, 12 of them on educational institutions, and an additional 157 unconfirmed incidents. However, the group appears to have suddenly gone dark last month. (Infosecurity Magazine)

 

‘Easily Exploitable’ Langflow flaw requires immediate patching   

CISA has added a critical authentication flaw found in the open source Langflow platform (CVE-2025-3248) to its Known Exploited Vulnerabilities (KEV) catalog. Langflow is a Python-based Web application that allows users to build AI-driven agents and workflows. The issue allows remote code injection and affects Langflow versions prior to 1.3.0. Horizon3.ai, who discovered the flaw and said it is “easily exploitable” and that the available patch fails to fully address the issue. The researchers encouraged users to update to the latest Langflow version to fully mitigate the risk of exploitation.  (Bleeping Computer and Dark Reading)

 

Hackers exploit IoT devices to deploy Mirai Botnet   

Threat actors have been observed actively exploiting security flaws in two different Internet of Things (IoT) devices to corral them into the Mirai botnet for conducting distributed denial-of-service (DDoS) attacks. The first device is an end-of-life GeoVision surveillance device which can be exploited via two critical severity operating system command injection flaws (CVE-2024-6047 and CVE-2024-11120). These issues could be used by threat actors to execute arbitrary system commands. That disclosure comes as researchers warned of active exploitation of a path traversal flaw in Samsung MagicINFO 9 digital signage server (CVE-2024-7399) that could enable an attacker to write arbitrary files as system authority. While Samsung addressed the issue back in August 2024, it has since been weaponized by attackers following the release of a proof-of-concept (PoC) exploit on April 30, 2025. (The Hacker News)

 

Magento backdoor hid for six years before activation   

It took six years for a backdoor hidden in widely used Magento online store extensions to finally reveal itself. On April 20, the malware finally began affecting hundreds of digital storefronts. Security firm Sansec uncovered 21 modules published between 2019 and 2022, which share identical malicious logic hidden in PHP files. Once activated, the backdoor runs a remote payload, enabling attackers to deploy Magecart-style skimming scripts in customer browsers. Sansec estimates that between 500 to 1,000 stores are running the backdoored software, “including a $40 billion multinational.” The researchers said, “It is rare that a backdoor remains undetected for six years, but is even stranger that actual abuse has only started now.” (Data Breach Today)

 

Threat brokers advertise a new SS7 zero-day exploit on cybercrime forums   

A newly advertised SS7 zero-day exploit on cybercrime forums is raising alarms about global mobile network security. Priced at $5,000, the kit allows attackers to intercept SMS messages, track phones in real time, and potentially eavesdrop on calls or bypass two-factor authentication. The exploit targets vulnerabilities in the Mobile Application Part (MAP) of the SS7 protocol, spoofing legitimate network nodes to manipulate routing and location data. Despite SS7’s outdated design, it still underpins many 2G and 3G telecom systems worldwide—used by around 30% of mobile connections. While newer networks offer stronger security, legacy systems remain vulnerable. Experts urge telecom providers to adopt SS7 firewalls and stricter controls, and recommend users move away from SMS-based authentication. This incident highlights the ongoing risks from legacy telecom infrastructure, even decades after SS7’s known flaws were first exposed. (Cyber Security News)

 

FortiGuard uncovers a cyber-espionage campaign targeting critical national infrastructure in the Middle East   

FortiGuard’s Incident Response Team has uncovered a prolonged cyber-espionage campaign targeting critical national infrastructure in the Middle East, attributed to an Iranian state-sponsored group. The intrusion spanned from May 2023 to early 2025, with activity possibly dating back to 2021. Attackers used stolen VPN credentials to access the network, deploying custom malware like HanifNet, HXLibrary, and NeoExpressRAT, and evaded segmentation using proxy tools. They also attempted to regain access post-containment via web app vulnerabilities and phishing attacks. The campaign showed a high level of sophistication, with an emphasis on persistence and stealth. No operational disruptions were confirmed, but the attackers demonstrated strong interest in OT systems. The report urges better credential hygiene, stronger segmentation, and proactive monitoring to defend against such advanced threats. (Fortinet)

 

EU fines TikTok for violating GDPR with China data transfer   

The European Union has fined TikTok €530 million ($600 million) for violating the General Data Protection Regulation (GDPR) by inadequately safeguarding European users’ data accessed by staff in China. Ireland’s Data Protection Commission found that TikTok failed to ensure EU-equivalent protections and lacked transparency about data transfers. The investigation also revealed that TikTok provided inaccurate information, initially denying storage of EU user data on Chinese servers, only to later admit some data had been stored there. TikTok plans to appeal, asserting that the issues predate its “Project Clover,” which aims to localize data within Europe through new data centers. (AP News)

 

Canadian power company hit by cyberattack   

Halifax-based electric utility Nova Scotia Power and its parent company Emera have shut down parts of their IT networks while responding to a cyberattack, SecurityWeek reports. The attack disrupted the utility’s customer care phone line and online portal, but did not affect physical operations.

The companies stated, “There remains no disruption to any of our Canadian physical operations, including at Nova Scotia Power’s generation, transmission, and distribution facilities, the Maritime Link or the Brunswick Pipeline, and the incident has not impacted the utility’s ability to safely and reliably serve customers in Nova Scotia. There has been no impact to Emera’s US or Caribbean utilities. CBC News reports that the utility is only responding to emergencies and outages, leaving some new customers unable to get their power turned on. (SecurityWeek)

 

Ascension Health discloses another breach   

US health system Ascension is informing some patients that their medical data was breached after hackers compromised a third-party vendor in December 2024, the Register reports. The breached data involved personal information, including Social Security numbers, as well as medical information. The medical data included “[i]nformation related to inpatient visits, such as the place of service; physician name, admission and discharge dates; diagnosis and billing codes; medical record number; and insurance company name. Ascension sustained a separate breach in May 2024 after it was hit by the Black Basta ransomware gang. (The Register)

 

Ransomware attacks on food and agriculture industry have increased this year   

Speaking at RSA, Jonathan Braley, director of the Food and Agriculture-Information Sharing and Analysis Center, (Food and Ag-ISAC), said that paired with the increase in ransomware attacks is the fact that many go unreported, preventing visibility into the full scope of the problem. The increase in attacks seems to stem from activities by the Clop ransomware gang, specifically its exploitation of MOVEit, GoAnywhere and Accellion, as well as activity from the groups RansomHub and Akira. The industry saw 84 attacks from January to March, more than double the number seen in Q1 2024. A report from Food and Ag-ISAC says that industries in food, agriculture, and manufacturing typically face ransomware attacks because they tend to have more legacy equipment and industrial control systems, making them easier targets. (The Record)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts or schedule a demo today.

RedSeal Wins 2025 SC Awards: Best Continuous Threat Exposure Management (CTEM) Solution

/by

Menlo Park, CA – May 5, 2025– RedSeal, a leader in proactive threat exposure management, today announced it has been named the winner of the prestigious 2025 SC Awards for Best Continuous Threat Exposure Management (CTEM) Solution. This top honor recognizes RedSeal’s proprietary technology and its commitment to helping organizations effectively reduce their attack surface and manage security risk.

The SC Awards, now in their 28th year, honor outstanding achievements by cybersecurity professionals, leaders, and organizations dedicated to safeguarding digital assets. Winners are selected by a panel of distinguished judges comprised of cybersecurity professionals, industry leaders, and members of the CyberRisk Alliance CISO community.

“Winning the SC Award for Best CTEM Solution is a tremendous validation of our vision and the hard work of our entire team,” said Greg Enriquez, CEO at RedSeal. “We are incredibly proud to be recognized for our innovation and leadership in this critical area of cybersecurity. This award reaffirms our commitment to providing our customers with the most comprehensive model of their hybrid environments to proactively manage their threat exposure in today’s complex and dynamic threat landscape.”

The SC Awards celebrate the best in cybersecurity, and RedSeal has demonstrated exceptional leadership in the CTEM category. RedSeal’s winning CTEM platform provides organizations with:

  • Comprehensive Network Visibility: A holistic view across complex, interconnected IT, OT, IoT, and cloud environments.
  • Proactive Threat Intelligence: Actionable insights to identify and address real-time threats.
  • Intelligent Validation and Prioritization: Patented technology to accurately determine exploitability and focus on critical risks.
  • Continuous and Automated Exposure Discovery: Ongoing identification of vulnerabilities, misconfigurations, and segmentation violations.
  • Risk-Driven Remediation Orchestration: Prioritization based on business impact and exploitability, enabling efficient and effective remediation.

“This award will further fuel our mission to enable organizations to know their hybrid network environments better than adversaries do ,” added Greg. “We remain dedicated to empowering organizations to take control of their security posture and mitigate risk proactively.”

RedSeal is at the forefront of addressing the critical need for continuous, context-aware security in today’s high-risk, highly regulated industries. Learn more about how RedSeal supports comprehensive CTEM strategies and contact RedSeal today for a demo.

About RedSeal

RedSeal, a pioneer in cybersecurity and exposure management, delivers proactive, actionable insights to close defensive gaps across hybrid environments. RedSeal continually discovers all resources, connections, and exposures, creating a single, comprehensive model—a network digital twin. This enables unparalleled analysis and simplified protection of the entire cyber terrain. Trusted by hundreds of Fortune 1000 companies and more than 75 government agencies, including five branches of the U.S. military, RedSeal improves operational efficiency, boosts staff productivity, and reduces business risk. Visit www.redseal.net to learn more.

 

About CyberRisk Alliance (CRA)

CyberRisk Alliance provides business intelligence that helps the cybersecurity ecosystem connect, share knowledge, accelerate careers, and make smarter and faster decisions. Through our trusted information brands, network of experts, and more than 250 innovative annual events we provide cybersecurity professionals with actionable insights and act as a powerful extension of cybersecurity marketing teams. Our brands include SC Media, the Official Cybersecurity Summits, Security Weekly, InfoSec World, Identiverse, CyberRisk Collaborative, ChannelE2E, MSSP Alert, LaunchTech Communications, TECHEXPO Top Secret and CyberRisk TV. Learn more at www.cyberriskalliance.com.

Cyber News Roundup for May 2, 2025

/by

Welcome to this week’s Cyber News Roundup! AI is quickly advancing in the realm of software exploits, with former NSA cyber chief Rob Joyce warning that it could soon be a key tool for attackers. Meanwhile, the FBI flags China as a top threat to U.S. infrastructure, and new reports reveal North Korean infiltration of global companies. RedSeal keeps organizations ahead of these evolving threats through comprehensive network visibility and proactive exposure management, ensuring you’re prepared to defend against emerging risks.

Let’s dive into this week’s highlights!

 

Former NSA cyber chief Rob Joyce warns that AI is rapidly approaching the ability to develop high-level software exploits   

At RSAC, former NSA cyber chief Rob Joyce warned that AI is rapidly approaching the ability to develop high-level software exploits. Joyce, now an advisor to Sandfly Security, predicted AI could become a reliable exploit developer as soon as this year or next. He pointed to AI’s strong performance in coding contests and the recent Hack The Box challenge, where an AI team nearly matched top human competitors. While he’s not worried about AI creating “script kiddie” attackers, he cautions that AI will enable skilled hackers to work faster and at scale.

AI also enhances phishing attacks by generating convincing, personalized emails—even with fake email threads and PDFs. On defense, AI offers speed advantages: reversing complex code in seconds instead of hours. Joyce also shared a clever ransomware attack that pivoted to a Linux video camera to encrypt data—highlighting how attackers exploit weak spots in unexpected places. (The Register)

 

An FBI official warns that China is the top threat to U.S. critical infrastructure   

Elsewhere at the RSA Conference, FBI Deputy Assistant Director Cynthia Kaiser called China the top threat to U.S. critical infrastructure. She said Chinese state-backed hackers are increasingly using AI to boost their cyber capabilities. This includes crafting fake business profiles, launching more convincing spear-phishing campaigns, and improving early-stage network scans. While AI isn’t yet creating shapeshifting malware, it’s enhancing targeting efforts. Kaiser stressed the importance of multi-factor authentication as a defense against these evolving, AI-powered threats. (SC World)

 

Mandiant and Google raise alarms over widespread infiltration of global companies by North Korean IT workers   

Mandiant and Google are raising alarms over widespread infiltration of global companies by North Korean IT workers, a threat more pervasive than previously believed. At RSA 2025, Mandiant CTO Charles Carmakal revealed that most Fortune 500 firms have unknowingly received job applications—and often hired—North Korean nationals. These operatives earn high salaries, often holding multiple jobs, funneling millions back to Pyongyang. While initially seen as a revenue strategy, the risk has escalated, with some ex-employees resorting to extortion after termination. Mandiant and Google warn these insiders could leak data or disrupt critical systems, especially under pressure. Evidence links some operatives to IP addresses used by North Korea’s intelligence bureau, suggesting potential handovers of access to state-sponsored threat actors. Though companies are catching and removing infiltrators more quickly, the embedded nature of these actors poses a significant long-term cybersecurity risk to corporate and national infrastructure. (CyberScoop)

 

France accuses Russia’s Fancy Bear of targeting at least a dozen French government and institutional entities   

France has publicly accused Russian state-backed hacking group APT28—also known as Fancy Bear and linked to the GRU—of targeting or compromising at least a dozen French government and institutional entities. Active since 2004, APT28 has increasingly focused on espionage, using phishing, vulnerability exploitation, and brute-force attacks, often with low-cost, disposable infrastructure. The French cybersecurity agency ANSSI and Cyber Crisis Coordination Centre identified attacks on local governments, ministries, research institutions, and think tanks, including efforts targeting the 2024 Olympics. APT28 has used tools like the HeadLace backdoor and OceanMap stealer, hiding infrastructure behind compromised routers and free services. France condemned these cyberattacks as a violation of UN norms and vowed to respond, highlighting past incidents including interference in the 2017 French elections and attacks on TV5Monde. The government pledged continued vigilance and coordinated defense with international partners. (SecurityWeek)

A China-linked APT group known as “TheWizards” is abusing an IPv6 networking feature   

A China-linked APT group known as “TheWizards” is abusing an IPv6 networking feature to conduct adversary-in-the-middle (AitM) attacks and hijack software updates on Windows systems, according to ESET. Active since at least 2022, the group targets entities in Asia and the Middle East, including individuals and gambling firms. Their tool, “Spellbinder,” exploits IPv6’s Stateless Address Autoconfiguration (SLAAC) by sending spoofed Router Advertisement messages, tricking nearby systems into routing traffic through attacker-controlled gateways. Spellbinder is deployed via a fake AVG archive and uses DLL sideloading to load malicious code into memory. It captures traffic to Chinese software update domains, redirects requests, and installs the “WizardNet” backdoor for persistent access. ESET warns that organizations should monitor IPv6 traffic or disable IPv6 if not required. This tactic mirrors similar supply chain hijacking seen in January by another APT group, “Blackwood.” (Bleeping Computer)

 

SonicWall warns of VPN exploitation in the wild   

Cybersecurity company SonicWall is warning users of its Secure Mobile Access appliances that these are now being actively exploited in attacks. This is in reference to two vulnerabilities, with separate CVE numbers (CVE-2023-44221 and CVE-2024-38475) whose advisories have been updated to reflect the exploitation situation. The vulnerabilities impact a range of SMA brands, listed in the show notes to this episode, which have been patched in a recent firmware version update. “The two vulnerabilities impact SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v devices and are patched in firmware version 10.2.1.14-75sv and later.” (BleepingComputer)

 

Alleged ‘Scattered Spider’ member extradited to U.S.   

A 23-year-old Scottish man, thought to be part of the prolific ransomware gang, was extradited last week from Spain to the U.S., where he faces charges of wire fraud, conspiracy and identity theft. U.S. prosecutors allege Tyler Robert Buchanan and co-conspirators hacked into dozens of companies in the U.S. and abroad, and that he personally controlled more than $26 million stolen from victims. Buchanan was arrested in connection with a series of SMS-based phishing attacks back in 2022 that led to intrusions at Twilio, LastPass, DoorDash, Mailchimp, and other tech firms. While Scattered Spider has been tied to the 2023 ransomware attacks against MGM and Caesars casinos in Las Vegas, it remains unclear whether Buchanan was implicated in those incidents. (Krebs on Security)

 

RansomHub operation goes dark   

A report issued this week by Group-IB offers an in-depth look at RansomHub’s affiliate recruitment methods, negotiation tactics, and aggressive extortion strategies. The researchers say the ransomware-as-a-service (RaaS) operation has been inactive since April 1 but speculated that the operation may have migrated to the Russian-language speaking Qilin operation. Earlier this month GuidePoint Security noted that a “series of internal disagreements” between RansomHub administrators and some affiliates had caused disruptions within the RaaS operation. The disagreements apparently stirred unease among other RansomHub affiliates, who began diverting their communications with victims to rival platforms. (Dark Reading)

 

Millions of Apple Airplay-Enabled Devices Can Be Hacked via Wi-Fi   

Researchers at cybersecurity firm Oligo have disclosed AirBorne, a set of vulnerabilities in Apple’s AirPlay SDK that expose millions of third-party devices—such as smart TVs, speakers, and CarPlay systems—to remote code execution over shared Wi-Fi. Apple has patched its own hardware, but Oligo warns many third-party vendors may not, which poses risks for lateral movement, network persistence, and potential surveillance.  (Wired)

 

Google tracked 75 zero days exploited in the wild in 2024   

According to Google’s Threat Intelligence Group, 75 zero-day vulnerabilities were exploited in the wild in 2024—down from 98 in 2023, but above 2022’s total—pointing to an upward trend in zero-day activity over the past four years. Most exploits still target end-user platforms but there’s an increase in attacks on enterprise technologies, especially security and networking appliances, which made up over 60% of enterprise-targeted zero-days. The group attributes more than half of all known exploits to cyber espionage actors. (cloud.google.com)

 

Nova Scotia energy provider takes some servers offline following cyber incident   

Nova Scotia Power disclosed it experienced a cyberattack on April 25, affecting parts of its Canadian IT infrastructure, including its customer care center and online portal. No disruption occurred to power generation or grid operations, but the company isolated impacted servers to contain the incident. The nature of the attack has not been confirmed, but Emera, Nova Scotia Power’s parent company, says it’s working with law enforcement and cybersecurity experts to investigate and recover. Physical operations and international subsidiaries remain unaffected. (The Record)

 

House passes bill to study routers’ national security risks   

The U.S. House of Representatives passed the ROUTERS Act, which mandates the Department of Commerce to study national security risks posed by routers and modems controlled by foreign adversaries, especially China. Lawmakers have emphasized securing U.S. communications networks as a critical role in national infrastructure. This builds on previous efforts to remove untrusted equipment, following cybersecurity threats such as the Salt Typhoon hacker group’s exploitation of telecom networks. (CyberScoop)

 

A massive power outage strikes the Iberian Peninsula   

A massive power outage struck the Iberian Peninsula on April 28, 2025, cutting electricity across Spain, Portugal, and parts of southern France and Andorra. The blackout, which began around 12:30 p.m. local time, caused Spain’s power demand to collapse by half within moments — a total grid failure known as a “cero energético.” Sources suggest a cyberattack is the likely cause, though authorities have not confirmed this. Critical infrastructure was severely impacted, including airports, metros, telecommunications, and traffic systems. Spain’s Prime Minister Pedro Sánchez visited Red Eléctrica’s control center as emergency restoration efforts began, focusing on hydroelectric power while gas and nuclear plants remain offline. Internet traffic dropped by nearly 30–37% across the region. The Spanish Cybersecurity Coordination Office is investigating, but officials warn it’s too early to draw conclusions. This outage highlights growing concerns, as cyberattacks on utilities have more than doubled globally in recent years. Recovery is expected to take time. (Cyber Security News)

 

A British retailer tells warehouse workers to stay home following a cyberattack   

British retailer Marks & Spencer (M&S) has told around 200 agency workers not to report to its main warehouses as it manages a growing cyberattack crisis. Online shopping remains paused, with M&S apologizing for the disruption but assuring customers that stores are still open. The incident, first disclosed last week, has already led to an 8% drop in M&S shares. The company says its internal team and external cyber experts are working urgently to restore online and app services. (The Record)

 

Iran claims it stopped infrastructure cyberattack   

The head of Iran’s Telecommunication Infrastructure Company, Behzad Akbari told the Tasnim News Agency that “one of the most widespread and complex cyber attacks against the country’s infrastructure was identified and preventive measures were taken,” over the weekend. However, he was otherwise light on details. This announcement came a day after a large explosion at Iran’s largest commercial port, although there is no indication these events are related. Iran suffered two notable infrastructure attacks in 2021 and 2022, both claimed by the dissident group Predatory Sparrow, but no group has come forward to take credit so far.  (The Record)

 

How Bad Scans and AI Spread a Scientific Urban Legend   

And finally, ever heard of “vegetative electron microscopy”? No? Good — because it’s total nonsense. But thanks to a string of scanning errors, translation mix-ups, and a little AI mischief, this completely made-up scientific term has wormed its way into real academic papers! It all started when 1950s research got poorly digitized, blending unrelated words into something that sounded impressive but meant absolutely nothing. Then, a tiny mistranslation in Farsi helped the error spread even further. Now, large AI models, including GPT-3 and GPT-4, faithfully regurgitate the fake term as if it’s a cornerstone of modern science. Researchers are calling it a “digital fossil” — a mistake now permanently trapped in the AI training ecosystem. The real kicker? Fixing it is next to impossible. So the next time someone drops “vegetative electron microscopy” in a paper, just know: science — and AI — sometimes make stuff up too. (ScienceAlert)

 

“Policy Puppetry” can break the safety guardrails of all major generative AI models   

A new attack called “Policy Puppetry” can break the safety guardrails of all major generative AI models, according to AI security firm HiddenLayer. The technique tricks large language models into interpreting malicious prompts as policy files, bypassing their built-in safeguards against producing harmful content HiddenLayer successfully tested the attack on top models from OpenAI, Anthropic, Google, Meta, and others. By formatting prompts to look like XML, INI, or JSON files, attackers can override system instructions and generate restricted outputs.

This discovery highlights a major vulnerability: AI models can’t reliably police themselves. With universal jailbreaking now easier, researchers warn that more external security layers are needed to defend against misuse. Policy Puppetry shows that today’s LLM training and alignment methods still have critical gaps. (SecurityWeek)

 

The U.S. opens a criminal antitrust investigation into router maker TP-Link   

The U.S. is conducting a criminal antitrust investigation into TP-Link, a California-based router maker with Chinese ties. Prosecutors are looking at whether TP-Link used predatory pricing to dominate the U.S. market—and whether its growing presence poses national security risks. The probe began under Biden and continues under President Trump. Meanwhile, the Commerce Department is separately investigating TP-Link’s China connections. TP-Link denies wrongdoing but says it will cooperate if contacted. No charges have been filed yet, and the investigations could take years. (Bloomberg)

 

A popular employee monitoring tool exposes over 21 million real-time screenshots   

A major privacy mess has hit WorkComposer, a popular employee monitoring tool. Cybernews researchers discovered that the company had exposed over 21 million real-time screenshots on the open internet through an unsecured Amazon S3 bucket. These screenshots captured everything employees were doing—emails, passwords, sensitive communications, even proprietary company data.

WorkComposer, which tracks remote workers by logging hours and snapping a screenshot every 20 seconds, boasts over 200,000 users. While there’s no evidence yet that hackers accessed the images, the risk for identity theft, scams, and wire fraud is huge This leak highlights a bigger issue: too many companies still don’t grasp the shared responsibility model for cloud security. Experts are again urging businesses to properly lock down their databases—or risk joining the growing list of high-profile breaches. (TechRadar)

 

The Defense Department is launching a new fast-track software approval process   

The Pentagon is giving its software approval process a serious makeover. Acting CIO Katie Arrington announced a new system called SWIFT that will use AI to speed up the months—or even years—it currently takes to certify software for Defense Department networks. Speaking at an industry event, Arrington didn’t hold back. She called the old Risk Management Framework and ATO process “stupid” and “archaic,” and said it’s time for a change.

Under SWIFT, software vendors will upload cybersecurity info and Software Bills of Materials—think ingredient lists for software—into the government’s eMASS system. AI tools will review the data automatically, aiming to issue a “provisional ATO” much faster than a human could. Third-party certification will also be required to make sure everything checks out. Arrington said the official memo launching SWIFT is being signed now, with industry feedback coming next. Her message was clear: “I want the RMF eliminated.” (airandspaceforces)

 

Hackers abuse OAuth 2.0 workflows to hijack Microsoft 365 accounts   

This attack is separate from the DomainKeys Identified Mail (DKIM) OAuth attack that we covered on Tuesday. Since early March, Russian threat actors have been abusing legitimate OAuth 2.0 authentication workflows to hijack Microsoft 365 accounts of employees tied to Ukraine and human rights causes. In this campaign the attackers impersonate European officials or Ukrainian diplomats via WhatsApp and Signal, luring targets with fake invitations to private video meetings. Victims are tricked into providing Microsoft authorization codes or clicking phishing links. One communication originated from a compromised Ukrainian government account. (BleepingComputer)

 

Education clouds hit with AzureChecker that deploys crypto mining containers   

Microsoft has identified a threat actor named Storm-1977 that has been conducting password spraying attacks against cloud tenants in the education sector over the past year. The Microsoft Threat Intelligence team stated, in an analysis, “the attack involves the use of AzureChecker.exe, a Command Line Interface (CLI) tool that is being used by a wide range of threat actors.” The tool connects to an external server to pull in files containing username and password combinations to carry out the password spray attack. In one instance, the threat actor was able to create more than 200 containers within a victim’s resource group in order to conduct illicit cryptocurrency mining. (The Hacker News)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts or schedule a demo today.

 

Get the latest news, invites to events, and threat alerts

CONTACT US
RedSeal Japan
Distinguished Vendor badge 2025

Footer
Connect on LinkedIn