From the cybersecurity policy and law enforcement front,
- Cyberscoop reports,
- “The tax and spending bill Congress sent to President Donald Trump and that he signed into law over the holiday weekend [the One Big Beautiful Act] contains hundreds of millions of dollars for cybersecurity, with a heavy emphasis on military-related spending.
- “The biggest single pot of money under the “One Big Beautiful Bill” would be for Cyber Command, a $250 million allocation for “artificial intelligence lines of effort.” Another $20 million would go to cybersecurity programs at the Defense Advanced Research Projects Agency.
- “The U.S. Indo-Pacific Command — which counts among its geographical areas of responsibility territorial waters for cyber adversaries in Russia, China and North Korea — would get $1 million for cyber offensive operations. Cyber offense was something the second Trump administration emphasized when coming into office.”
- Cybersecurity Dive adds,
- Congress must reauthorize a cybersecurity threat information sharing law before it expires in October, a group of leading technology companies told lawmakers on Monday.
- The 2015 Cybersecurity Information Sharing Act “has enabled rapid dissemination of actionable threat intelligence to protect networks before an incident occurs, more coordinated responses to cyber incidents; and improved situational awareness across multiple sectors,” the Hacking Policy Council said in a letter to House and Senate homeland-security committee leaders.
- “The council’s members include tech giants Google, Microsoft and Intel; security firm Trend Micro; and bug bounty platforms Bugcrowd, HackerOne and Intigriti. The group advocates for policies that improve vulnerability management, security research and penetration testing.
- “The CISA law, which offers legal protections for companies that share threat information, is set to expire on Sept. 30. There is bipartisan support on Capitol Hill for renewing the law, but lingering questions could complicate its prospects, including whether any lawmakers will press for changes to the program and whether the reauthorization will be attached to a larger must-pass bill or proceed on its own.”
- The Government Accountability Office released a positive report about the 2015 Cybersecurity Information Sharing Act earlier this week.
- Per Cybersecurity Dive,
- “The Securities and Exchange Commission has reached a settlement with SolarWinds and the company’s chief information security officer, Timothy Brown, to resolve charges stemming from the Russian-backed cyberattack on the company’s systems.
- “The parties “have reached a settlement in principle that would completely resolve this litigation,” the SEC said in a filing last week with the federal judge in New York who is overseeing the commission’s lawsuit against the company.
- ‘The judge quickly approved the SEC’s request to stay deadlines in the case, including oral arguments previously scheduled for July 22. “The Court congratulates counsel and the parties on this productive development,” the judge said. He gave SolarWinds, Brown and the SEC until Sept. 12 to either file settlement paperwork or provide a status update on the settlement process.” * * *
- “Adam Hickey, a partner at Mayer Brown and a former federal prosecutor handling cyber and national security cases, said an examination of the eventual settlement terms would reveal “whether and to what extent the SEC is abandoning certain theories or allegations.”
- “So far, the SEC has not moved to rescind the rule requiring cybersecurity disclosures in annual and periodic reports,” he said. “The settlement may or may not point in that direction.”
- Per an HHS news release,
- “Today [July 7, 2025], the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with Deer Oaks – The Behavioral Health Solution (Deer Oaks), a behavioral health provider, resolving potential violations under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules. Deer Oaks provides psychological and psychiatric services to residents of long-term care and assisted living facilities.” * * *
- The settlement principally related to an August 2023 ransomware attack that affected 171,000 patients.
- “Under the terms of the resolution agreement, Deer Oaks agreed to implement a corrective action plan that OCR will monitor for two years and paid $225,000 to OCR.” * * *
- The resolution agreement and corrective action plan may be found at: https://www.hhs.gov/sites/default/files/ocr-hipaa-racap-deer-oaks.pdf [PDF, 183 KB]
- Cybersecurity Dive informs us,
- “Italian authorities and FBI agents have arrested a Chinese man who allegedly helped Beijing’s Hafnium group conduct a series of high-profile cyberattacks in 2020 and 2021.
- “Xu Zewei, 33, faces charges of hacking into the computers of U.S. researchers studying the COVID-19 virus and exploiting vulnerabilities in Microsoft Exchange servers that kicked off a global attack spree. The Justice Department announced his indictment and arrest on Tuesday, [July 8,] along with charges against another Chinese man, 44-year-old Zhang Yu, who remains at large.
- “Both men carried out the attacks on behalf of China’s Ministry of State Security, prosecutors alleged.”
- Per Cyberscoop,
- “At the request of the United States, French police arrested a professional Russian basketball player who had a brief tenure at Penn State over accusations that he was part of a ransomware ring, according to overseas reports.
- “News of the arrest of Daniil Kasatkin came in a court in Paris on Wednesday [July 9]. His lawyer denied to foreign press that he was part of any ransomware ring. * * *
- “Kasatkin is allegedly part of a hacking outfit that the news outlets did not name, but that American investigators believe has attacked 900 institutions, including two U.S. federal entities, between 2020 and 2022. Authorities said he negotiated ransomware payments on behalf of the ring.”
- and
- “Three teenagers and a 20-year-old woman were arrested Thursday by the U.K.’s National Crime Agency for their alleged role in cyberattacks on major retailers Marks & Spencer (M&S), Co-op, and Harrods.
- “The arrests, comprising British and Latvian nationals, followed sustained investigations into attacks that crippled the retailers’ operations. The NCA’s National Cyber Crime Unit detained all four at their homes and seized their electronic devices.” * * *
- “The particular incidents that led to these arrests occurred in April, with attackers crippling the online services of Marks & Spencer, a popular retailer in the U.K. The company’s online sales channels were halted, contactless payments and click-and-collect options were disrupted, and in-store product availability suffered. The attack also resulted in the theft of customer information, including names, email addresses, and postal data. Recovery efforts began in June, with the retailer eventually restoring sections of its online business across the U.K.”
From the cybersecurity breaches and vulnerabilities front,
- Radiology Business reports,
- “A PET imaging provider was recently impacted by a phishing attack, forcing the company to notify patients about the breach.
- “Nashville, Tennessee-based Integrated Oncology Network alerted Health and Human Services in late June about the hacking incident, which occurred in December. Affected locations include PET Imaging of Tulsa, Oklahoma, and similarly branded centers in cities such as Houston, Dallas and Sugar Land, Texas.
- “Information accessed by third parties may have included dates of birth, diagnoses, financial account info and (“for a small number of individuals”) Social Security numbers.” * * *
- “The network notified physicians about the phishing attack on June 13 and started alerting customers on June 27. This after a May investigation determined there was unauthorized access to patient information in a “small number” of email and SharePoint accounts. ION is urging patients to review their statements from providers and insurance plans to see if they find any inconsistencies. It’s also providing additional cybersecurity training to staffers, according to the notice.
- “Schubert Jonckheer & Kolbe sent a news alert on July 9, with the law firm launching an investigation into the cyber incident. It estimated that nearly 114,000 individuals may have been affected, with the firm now considering filing a suit against Integrated Oncology Network.”
- Cybersecurity Dive adds,
- “Mobile phishing scams are becoming an increasingly serious threat, but companies aren’t taking that threat seriously enough, the mobile security firm Lookout said in a report released Thursday.
- “Nearly six in 10 companies “have experienced incidents due to executive impersonation scams via text or voice” and 77% have experienced at least one such attack in the past six months, Lookout said in the report. Yet despite the pervasiveness of these attacks, “only half of respondents are very concerned” about the threat, the report found.
- “The findings — based on a survey of more than 700 security leaders — reflect “a dangerous situation that leaves businesses overconfident and more vulnerable to modern threats than they realize,” Lookout said.
- “Hackers are increasingly relying on mobile voice and text phishing messages to trick workers into handing over their passwords, granting attackers access to computer networks through legitimate accounts that raise fewer red flags on security monitoring platforms.”
- and
- “Hackers linked to the Iranian government have escalated attacks against certain U.S. critical infrastructure since the beginning of the Israel-Iran conflict, according to new research.
- “The Iran-linked threat groups, tracked as MuddyWater, APT33, OilRig, CyberAv3ngers, FoxKitten and Homeland Justice, tried to breach at least 10 U.S. companies, mostly in the transportation and manufacturing sectors, researchers at Nozomi Networks said on Wednesday.
- “MuddyWater targeted five firms, APT33 targeted three and the others targeted two, according to the research.”
- The Cybersecurity and Infrastructure Security Agency added five known exploited vulnerabilities to its catalog this week.
- July 7, 2025
- CVE-2014-3931 Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability
- CVE-2016-10033 PHPMailer Command Injection Vulnerability
- CVE-2019-5418 Rails Ruby on Rails Path Traversal Vulnerability
- CVE-2019-9621 Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
- SC Media discusses these KVEs here.
- “What made these four bugs of special note were that two date back to 2019, one to 2016, and the fourth was first identified in 2014, underscoring that security teams have to keep tabs on all bugs and continually monitor and stay up-to-date with patching. Two of the four were rated critical.
- July 10, 2025
- CVE-2025-5777 Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability.
- Cybersecurity Dive and Bleeping Computer discuss this KVE.
- “[CISA] has confirmed active exploitation of the CitrixBleed 2 vulnerability (CVE-2025-5777) in Citrix NetScaler ADC and Gateway and is giving federal agencies one day to apply fixes.
- “Such a short deadline for installing the patches is unprecedented since CISA released the Known Exploited Vulnerabilities (KEV) catalog, showing the severity of the attacks exploiting the security issue.
- “The agency added the flaw to its Known Exploited Vulnerabilities (KEV) catalog yesterday, ordering federal agencies to implement mitigations by the end of today, June 11.”
- Per SC Media,
- “A newly disclosed infostealer dubbed “NordDragonScan” executes stealthily on Windows machines using living-off-the-land (LOTL) techniques, Fortinet reports.
- “The attack kicks off when users visit a site called secfileshare[.]com, which downloads a RAR archive designed to look like a Ukrainian government document, Fortinet’s FortiGuard Labs Threat Research unit described in a blog post Monday.
- “A LNK shortcut within the archive invokes the Windows utility mshta.exe to retrieve and execute an HTML Application (HTA) script from the secfileshare[.]com domain, called 1.hta.
- “This HTA copies the legitimate PowerShell.exe binary to the Documents folder and renames to install.exe to hide its activity. It then downloads a benign decoy document, tricking the victim into believing this is the file they installed while the malicious payload runs in the background.”
From the ransomware front,
- Dark Reading warns,
- “Changes are afoot at Pay2Key, a ransomware-as-a-service (RaaS) gang with ties to a notorious Iranian nation-state threat group, and it could spell trouble for the US.
- “Pay2Key was first observed in 2020, and while it has been one of the lesser-known RaaS gangs, it achieved some notoriety for hack-and-leak attacks on Israeli organizations. Over the years, cybersecurity vendors and US authorities alike have tied the gang to Fox Kitten, an Iranian state-sponsored threat group also known as UNC757.
- “Now, researchers at Morphisec say Pay2Key has re-emerged with a new approach: targeting Western organizations and offering higher payouts for attacks that meet the gang’s geopolitical goals in the wake of Israel-Iran-US conflict. According to a new report from Morphisec Labs researchers, the gang has raised its affiliate profit-sharing from 70% to 80% for attacks against “the enemies of Iran.”
- CSO offers us an “anatomy of a Scattered Spider attack: A growing ransomware threat that evolves.”
From the cybersecurity threat research front,
- Cyberscoop reports,
- “Cybersecurity researchers have identified four significant security vulnerabilities in a widely used automotive Bluetooth system that could potentially allow remote attackers to execute code on millions of vehicles worldwide.
- “The vulnerabilities, collectively named PerfektBlue by PCA Cyber Security, affect OpenSynergy’s BlueSDK Bluetooth stack, which is used to implement Bluetooth functionality in embedded systems, with a strong emphasis on automotive applications. The vulnerabilities impact technology used in Mercedes-Benz, Volkswagen, and Skoda automobiles. A fourth manufacturer, which researchers have not publicly identified, is also confirmed to use the affected technology.
- “The discovery highlights the expanding attack surface in modern connected vehicles, where Bluetooth-enabled infotainment systems have become standard equipment. The researchers found that the four vulnerabilities can be linked together in an exploit chain, potentially allowing attackers to gain unauthorized access to vehicle systems through Bluetooth connections.”
- Dark Reading adds,
- “Systemic vulnerabilities in embedded Subscriber Identity Module (eSIM) cards have exposed billions of devices to spying, SIM swaps, and other threats.
- “For some time now, traditional SIM cards have been slowly ceding to eSIMs. eSIMs allow multiple phone carrier subscriptions to exist on a single device. Unlike traditional SIM cards, you can’t physically remove and replace them, and they tout superior security.
- “New research suggests, though, that they actually introduce significant security risks. Using a Kigen embedded Universal Integrated Circuit Card (eUICC) card, Adam Gowdiak, founder and CEO of Security Explorations, found that attackers could theoretically breach eSIMs to spy on their users, manipulate their services, and steal valuable information from mobile network operators(MNOs).”
- Bleeping Computer notes,
- “A novel tapjacking technique can exploit user interface animations to bypass Android’s permission system and allow access to sensitive data or trick users into performing destructive actions, such as wiping the device.
- “Unlike traditional, overlay-based tapjacking, TapTrap attacks work even with zero-permission apps to launch a harmless transparent activity on top of a malicious one, a behavior that remains unmitigated in Android 15 and 16.
- “TapTrap was developed by a team of security researchers at TU Wien and the University of Bayreuth (Philipp Beer, Marco Squarcina, Sebastian Roth, Martina Lindorfer), and will be presented next month at the USENIX Security Symposium.”
- and
- “NVIDIA is warning users to activate System Level Error-Correcting Code mitigation to protect against Rowhammer attacks on graphical processors with GDDR6 memory.
- “The company is reinforcing the recommendation as new research published by the University of Toronto demonstrates the practicallity of Rowhammer attacks against an NVIDIA A6000 GPU (graphical processing unit).
- “We ran GPUHammer on an NVIDIA RTX A6000 (48 GB GDDR6) across four DRAM banks and observed 8 distinct single-bit flips, and bit-flips across all tested banks,” describe the researchers.’
From the cybersecurity defenses front,
- Dark Reading reports,
- The cyber-insurance market continues to generate profits for underwriters, but competition in the market and softening demand has led to a decline in the total revenue from premiums for the third straight year in a row — a situation that could work in businesses’ favor.
- Overall, cyber-insurance experts expect premiums to continue to decline in 2025 and likely level off next year, as market economics balance supply and demand. Renewal rates for cyber-insurance policies have declined each quarter for the last three quarters, which is expected to continue, according to credit and economic firm Fitch Ratings.
- “As businesses shop around for better rates on cyber coverage — or take a pause to reassess — insurers continue to lower rates by mid- to low-single-digit percentages, says Gerry Glombicki, senior director at Fitch Ratings.
- “Historically, cyber insurance has been pretty profitable — even with 2017” and the damage from WannaCry and NotPetya, he says. “Now, the number of policies they’re selling is down year-over-year, and their pricing is down … because the returns that the insurers have [historically] gotten have been good, so they have to give up some of that.”
- Here is a link to Dark Reading’s CISO Corner.