From the cybersecurity policy and law enforcement front,

• Federal News Network tells us,
  • “The Office of the National Cyber Director is looking to engage industry as it starts to develop a new national cybersecurity strategy.
  • “National Cyber Director Sean Cairncross, speaking at a conferenced hosted by Palo Alto Networks in Tyson’s Corner, Va., Thursday, said U.S. cyber efforts of the past have failed to “send a message” to China and other cyber adversaries.
  • “A failure to send a message creates an opening for a miscalculation, that opens the door for a larger problem,” Cairncross said. “And so, what we are looking to do is to change that posture, so that that message is clear.” * * *
  • “I’m not trying to bring CEOs in and beat them over the head and say, do this, or we’ll regulate, or this is a mandate coming down from on high,” he said. “What I’m looking to do is to say where, where are the regulatory friction points in this domain that you deal with, what’s redundant, what’s become too much of a compliance checklist.”
  • “Cairncross said the private sector should have to meet minimum standards for cybersecurity. But he says the White House wants to work with businesses to understand how cybersecurity could be better prioritized against existing regulations.”
  • “Working to harmonize that regulatory structure, it’s incumbent on us to do that and work with you all to do that, hopefully as rapidly as we can,” he said. “But I see this as a true partnership between government and industry, and I think if we can get that in a place where everyone is sort of speaking the same language, it will be incredibly useful for hardening our resiliency.”
  • “The Trump administration’s cyber strategy will also likely feature a focus on normalizing offensive cyber operations.”

• NextGov/FCW informs us,
  • “Criminal hackers, who for years lacked the sophistication and resources of nation-state cyber adversaries, are now on near-equal footing with state-level powers like China and Russia, thanks to advances in artificial intelligence, the head of the FBI’s Cyber Division said Thursday.
  • “[AI] allows mid-tier actors to really asymmetrically scale in ways that they can’t have impact otherwise, meaning a lot of these cybercriminal groups now have nation-state-type capabilities that they would not otherwise have because they’re using generative AI,” Brett Leatherman said Thursday at the Palo Alto Networks public sector conference in Virginia.” * * *
  • “The FBI has not been as quick to adopt AI in its day-to-day operations because it handles sensitive data that requires stringent protections and oversight to maintain security and legal standards, he said.” * * *
  • “The FBI constantly views data logs and other intelligence collected from legal authorities that can help them track hackers and build computer forensic conclusions. Having AI available to quickly parse those logs would be a benefit, he said, although industry partners are already using their own AI instruments to scan data and report those findings to the FBI.” 
    
• Fedscoop adds,
  • The Department of Energy is set to deploy a new artificial intelligence supercomputer at Oak Ridge National Laboratory early next year, bringing the machine online at “record speeds” thanks to a new public-private partnership the agency unveiled Monday.
  • The deal with Advanced Micro Devices will provide Oak Ridge with the company’s Lux AI cluster, giving the lab expanded “near-term AI capacity” that will accelerate its work on fusion, fission, materials discovery, advanced manufacturing and grid modernization, per a press release announcing the partnership. 
  • “Winning the AI race requires new and creative partnerships that will bring together the brightest minds and industries American technology and science has to offer,” Energy Secretary Chris Wright said in a statement. “That’s why the Trump administration is announcing the first example of a new commonsense approach to computing partnerships with Lux.”
  • Energy also announced plans for the 2028 launch of Discovery, a system built by HPE and powered by AMD processors and accelerators. Discovery, according to the DOE, will “far” outperform Oak Ridge’s Frontier machine — currently the world’s second-largest supercomputer. * * *
  • “The Tennessee lab has been ground zero for many of the country’s advances in AI — and the Trump administration has signaled that there’s more to come. In an RFP released earlier this month, the DOE solicited proposals for the buildout and maintenance of AI data centers and energy generation infrastructure at Oak Ridge.”

• Dark Reading reports,
  • “As China, Iran, Russia, and the European Union signed onto a new global cybercrime treaty, the United States and a minority of other nations continue to voice concerns over the global agreement’s impact on human rights — and the expansion of covered crimes to including any “serious” offense enabled by information communications technology (ICT).
  • “On Monday, more than 70 nations signed on to the treaty — formally, the United Nations Convention Against Cybercrime — pledging to aid in the investigation and prosecution of any “criminal offences … committed through the use of information and communications technology systems,” according to a copy of the document. Signers of the agreement promise to cooperate on “serious” crimes, which includes any violation of law that has a maximum prison time of at least four years.” * * *
  • [M]any nations signing the treaty may not have such laudable goals. In 2019, Russia began the process to establish the treaty, when its delegates sponsored a resolution to create a framework for combatting cybercrime. The other signatories included a list of authoritarian countries: Belarus, Cambodia, China, Iran, Myanmar, Nicaragua, Syria, and Venezuela, with the highest-ranking country among the sponsors earning a 2.94 on The Economist’s 10-point Democracy Index for 2024. For comparison, the Index’s most democratic nation, Norway, scored a 9.81. The Nordic country did not sign the UN cybercrime treaty, either.
  • “Looking at the group of founders should make any policy watcher skeptical, especially with much of the cybercriminal activity coming from China and Russia, says Zach Edwards, a senior threat analyst with Silent Push, a cyberthreat intelligence firm. He pointed to massive economic costs caused by cybercriminals groups in China and Russia.”

• Per Cyberscoop,
  • “A 43-year-old Ukrainian national allegedly involved in the Conti ransomware group pleaded not guilty in federal court Thursday to cybercrime charges that could land him in prison for up to 25 years, according to court documents.
  • “Oleksii Oleksiyovych Lytvynenko, also known as Alexsey Alexseevich Litvinenko, was arrested in Ireland in July 2023, extradited to the United States earlier this month and remains in federal custody in Tennessee where at least three of his alleged victims are based.” * * *
  • “Lytvynenko and his co-conspirators used Conti ransomware to attack more than 1,000 victims globally, ensnaring victims in 47 states, Washington, Puerto Rico and about 31 countries, according to the Justice Department. The FBI estimates Conti extorted more than $150 million in ransom payments from victims.”

From the cybersecurity vulnerabilities and breaches front,

• Cybersecurity Dive reports,
  • “The Cybersecurity and Infrastructure Security Agency issued updated guidance on a critical vulnerability in Windows Server Update Service and urged security teams to immediately apply patches to their systems and check for potential compromise.
  • “The vulnerability, tracked as CVE-2025-59287, involves deserialization of untrusted data in WSUS, a tool widely used by IT administrators to deploy Microsoft product updates. 
  • Security researchers have been tracking a series of exploitation attemptsin recent weeks. An initial patch issued in mid-October fell flat, and Microsoft issued an emergency out-of-band security update late last week. 
  • “CISA on Wednesday [October 29] issued additional guidance on how to check for potential compromise and warned security teams to take the threat very seriously.
• and
  • “At least 50 organizations have been impacted by attacks targeting a critical vulnerability in Windows Server Update Service, with most of them located in the U.S., according to researchers at cybersecurity firm Sophos. 
  • “The vulnerability, tracked as CVE-2025-59287, involves deserialization of untrusted data. A security update issued by Microsoft in mid-October failed to provide adequate protection, and Microsoft issued an emergency out-of-band patch late last week to address the problem. 
  • “Sophos’s own telemetry picked up six incidents linked to the exploitation activity, and additional intelligence gathered by researchers shows at least 50 victims, the company told Cybersecurity Dive.” 

• CISA added four known exploited vulnerabilities to its catalog this week.
  • October 28, 2025
    • CVE-2025-6204 Dassault Systèmes DELMIA Apriso Code Injection Vulnerability
    • CVE-2025-6205 Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability
      • Security Week discusses these KVEs here.
  • October 30, 2025
    • CVE-2025-24893 XWiki Platform Eval Injection Vulnerability
    • CVE-2025-41244 Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
      • NIST discusses the XWiki KVE here.
      • Bleeping Computer discusses the Broadcom KVE here.

• Cyberscoop relates,
  • “F5 CEO François Locoh-Donou said on a company earnings call that there were two categories of impact on customers following a nation-state attacker’s long-term, persistent access to its systems: widespread emergency updates to BIG-IP software and hardware, and customers whose configuration data was stolen during the attack.
  • “We were very impressed frankly, with the speed with which our customers have mobilized resources to be able to make these upgrades and put them in production fairly rapidly,” Locoh-Donou said Monday. F5 helped thousands of customers install critical updates upon disclosure, he added.
  • “The vendor’s latest assessment of the prolonged attack, which it became aware of Aug. 9 and disclosed Oct. 15, indicates F5 remains optimistic it has contained and limited exposure from the breach, which prompted a rare emergency directive from federal cyber authorities when it was disclosed in a regulatory filing.”

• Per Dark Reading,
  • “A researcher has demonstrated that Windows’ native artificial intelligence (AI) stack can serve as a vector for malware delivery.
  • “In a year where clever and complex prompt injection techniques have been growing on trees, security researcher hxr1 identified a much more traditional way of weaponizing rampant AI. In a proof-of-concept (PoC) shared exclusively with Dark Reading, he described a living-off-the-land attack (LotL) using trusted files from the Open Neural Network Exchange (ONNX) to bypass security engines.”
• and
  • “A variety of old, abandoned projects, long considered dead, continue to rise up and undermine the cybersecurity posture of the companies who created them.
  • “From code to infrastructure to APIs, these so-called “zombie” assets continue to cause security headaches for companies, and sometimes, lead to breaches. Oracle’s “obsolete” servers, abandoned Amazon S3 buckets used by attackers to distribute malware, and the unmonitored API connecting Optus’ customer-identity database to the Internet are all variations of the zombies plaguing enterprises.
  • “The lack of attention to forgotten — dare we say, “undead” — services causes cybersecurity headaches in two ways, says Andrew Scott, director of product at cybersecurity firm Palo Alto Networks.
  • “If you’ve got a device that has been forgotten, you’re probably not looking after it, so if it were compromised, it may be hard for you to know,” he says. “And two: The longer that those things stay out there, stay unmanaged or not getting the TLC and patch cycles … the more likely that they are vulnerable to risks over time.”

From the ransomware front,

• Health Exec reports,
  • “On Oct. 27, Russia-based cybercrime group Qilin posted to the dark web claiming it had successfully hacked pharmacy benefit manager (PBM) MedImpact, with the group releasing screenshots of documents that appear to be billing invoices.
  • “In reviewing the post, Cybernews said the snippets are “mostly financial operation details which don’t seem to contain extremely sensitive personal data.” The company later confirmed that what Qilin said was true, releasing a short statement about its ongoing investigation into the incident, which it said is being conducted with the “assistance of one of the nation’s leading cybersecurity firms and is notifying all applicable authorities.” 
  • “The PBM also confirmed that the attack involved the deployment of ransomware, and that at least part of its infrastructure is still down. It said it deployed containment measures upon noticing the breach, often involving taking all systems offline until the situation is assessed.
  • “MedImpact is currently working to restore impacted systems in a new environment that is segregated from the prior infrastructure and protected by multiple layers of defense. Due to these measures, as of today, pharmacy claims for all clients are now adjudicating,” the company wrote. 
  • “The company apologizes for any disruption this issue may cause its clients and partners,” it added.” 

• Per Bleeping Computer,
  • “CISA confirmed on Thursday [October 30] that a high-severity privilege escalation flaw in the Linux kernel is now being exploited in ransomware attacks.
  • “While the vulnerability (tracked as CVE-2024-1086) was disclosed on January 31, 2024, as a use-after-free weakness in the netfilter: nf_tables kernel component and was fixed via a commit submitted in January 2024, it was first introduced by a decade-old commit in February 2014.
  • “Successful exploitation enables attackers with local access to escalate privileges on the target system, potentially resulting in root-level access to compromised devices.
  • As Immersive Labs explains, potential impact includes system takeover once root access is gained (allowing attackers to disable defenses, modify files, or install malware), lateral movement through the network, and data theft.

• The Hacker News explains how Russian Ransomware Gangs Weaponize Open-Source AdaptixC2 for Advanced Attacks.

• The HIPAA Journal reports,
  • “The ransomware remediation firm Coveware has reported a growing divide in the ransomware landscape, with larger enterprises facing increasingly targeted, high-cost attacks, whereas attacks on mid-market companies continue to be conducted in volume. Ransomware groups conducting high-volume attacks appear to have found the sweet spot, as while the ransom payments they receive are much lower, the attacks are easier to conduct, and a higher percentage of victims pay up. Attacks on larger companies require more effort, although attacks are far more lucrative when a ransom is paid. Coveware reports that larger organizations are increasingly resisting paying ransoms, having realized that there are few payment benefits, but has warned that these targeted attacks are likely to increase due to falling ransom payments.
  • “Across the board, there has been a sharp fall in both the average and median ransom payments from a 6-year high in Q2, 2025, to the lowest level since Q1, 2023. In Q3, 2025, the average ransom payment fell by 66% to $376,941, with the median ransom payment down 65% to $140,000. In Q1, 2019, 85% of victims of ransomware attacks chose to pay the ransom, compared to a historic low of 23% in Q3, 2025.”

From the cybersecurity business and defenses front,

• The Wall Street Journal reports,
  • “Artificial intelligence and weakening federal demand had dual impacts on this week’s earnings reports from large cybersecurity companies, which generally posted stronger results than the same time last year.
  • “Security and network specialist F5 posted a fourth-quarter profit of $190.5 million on Monday, up from $165.3 million last year. Its full-year profit was $692.4 million, compared with $566.8 million last year.
  • “However, the company warned of potential sales disruptions stemming from a breach by nation-state hackers. The breach, which was disclosed by F5 in October, was serious: Attackers gained access to the production environment for the company’s most popular products and its database of known software flaws. F5’s products are widely deployed among Fortune 500 companies and the federal government, making the disclosure worthy of briefings by the U.S. Cybersecurity and Infrastructure Security Agency.” * * *
  • “Other cybersecurity companies posted encouraging results. Network security vendor Check Point Software Technologies posted a third-quarter profit of $358.7 million, up from $206.9 million last year. The Israeli company closed its acquisition of AI specialist Lakera last week and said it expects AI to inform its acquisition strategy going forward.” * * *
  • “Infrastructure security specialist Tenable Holdings swung to a $2.3 million profit in its third quarter from a $9.3 million loss the previous year. Co-Chief Executive Stephen Vintz said the company is seeing a shift in customer spending away from traditional defensive strategies toward more proactive technologies that identify weaknesses before they are exploited, largely due to the use of AI.
  • “AI is dramatically reshaping the threat landscape as attacks have become faster, more automated and more sophisticated,” he said on a call with analysts Thursday.
  • “Data protection provider Commvault Systems reported $14.7 million profit for its second quarter on Tuesday, though this slipped from $15.6 million in the same quarter last year. Rival data security company Varonis reported a loss of $29.9 million, wider than the $18.3 million loss the previous year.”
    
• Cyberscoop points out,
  • “A new security-focused AI model released Thursday by OpenAI aims to automate bug hunting, patching and remediation.
  • “The model, powered by ChatGPT-5 and given the name Aardvark, has been used internally at OpenAI and among external partners. Currently offered in an invite-only Beta, it’s designed to continuously scan source code repositories to find known vulnerabilities and bugs, assess and prioritize their potential severity, then patch and remediate them.
  • “In a blog post published on the company’s website, OpenAI claims that Aardvark “does not rely on traditional program analysis techniques like fuzzing or software composition analysis.”
  • “Instead, it uses LLM-powered reasoning and tool-use to understand code behavior and identify vulnerabilities,” the blog stated. “Aardvark looks for bugs as a human security researcher might: by reading code, analyzing it, writing and running tests, using tools, and more.”

• Here is a link to Dark Reading’s CISO Corner.

From the cybersecurity policy front and law enforcement front,

• Federal News Network reports,
  • “For years, the influential Cyberspace Solarium Commission has advanced recommendations on cyber policy that have slowly but steadily been adopted by Congress and federal agencies.
  • “But now, commission leaders are confronting a new reality: progress is “stalling, and in several areas, slipping,” largely due to the Trump administration’s federal workforce cuts.
  • “In its latest annual report, the Cyberspace Solarium Commission 2.0 — the “2.0” because the commission no longer resides within Congress but at the Foundation for the Defense of Democracies — found that there had been a “reversal” on its recommendations for the first time in the commission’s five-year history.”

• Dark Reading adds,
  • “Cyberattacks against US agencies were rising steadily even before Oct. 1, in anticipation of the shutdown. Researchers at the Media Trust then observed a spike of activity on its very first day.
  • “At this point, they’re projecting that the feds will experience north of 555 million cyberattacks by the end of the month [of October] — an 85% increase over the already more active than usual month of September.”
  • “To make matters worse, Media Trust CEO Chris Olson points out that those 555 million attacks aren’t the cheap phishing chum one might expect to dominate such a dataset.
  • “These are targeted digital attacks through websites, apps, and targeted advertising. What we are detecting are actual interactions with employees,” he says.”
    
• Dark Reading also informs us,
  • “A massive seizure by the US government of cryptocurrency from a sprawling Southeast Asia cybercrime syndicate has raised hopes that coordinated actions against cybercriminal groups can help undermine their profits.
  • “On Oct. 14, the US Department of Justice — along with the Drug Enforcement Agency, the Department of State, and other agencies — announced the seizure of 127,271 bitcoin kept in “unhosted wallets” and the indictment of Chen Zhi, the founder and chairman of the Prince Holding Group, on charges of conspiracy to commit wire fraud and money laundering. The seized bitcoin, stored in 25 wallets, are worth more than $14 billion, and were valued at nearly $15 billion on the day of the announcement.” * * *
  • “Repeating the win will be difficult, however.
  • “While the US Department of Justice and government officials announced the seizure and indictment on Oct. 14, the actual investigation and enforcement actions occurred last year and the investigation took much longer. The seizure of the funds likely took place in June and July of 2024, when the wallets holding the bitcoin “suddenly lit up … suggesting coordinate[d] enforcement activity,” says TRM Labs’ Redboard.
  • “These operations are exceptionally hard to pull off,” he says. “They require cooperation across agencies and borders, and — critically — access to private keys. Investigators can map transactions forever, but they can’t move assets without those keys. The fact that the US was able to gain control here means that digital and physical evidence aligned, resulting in a great outcome.” * * *
  • “The successful seizure may also reverse a trend that blockchain experts have noted: Cybercriminals’ increasing dependency on bitcoin. While other cryptocurrencies exist — and stable coin has become popular among some investors — bitcoin’s self-custody attribute has been seen as a significant benefit, says Eric Jardine, cybercrimes research manager at Chainalysis, a crypto intelligence firm.” * * *
  • “Whether the seizure by the US government results in a movement away from bitcoin remains to be seen.”

From the cybersecurity vulnerabilities and breaches front,

• Cybersecurity Dive reports,
  • “Security researchers are warning that cyber threat actors are abusing a critical vulnerability in Microsoft Windows Server Update Service. 
  • “The vulnerability, tracked as CVE-2025-59287, involves deserialization of untrusted data and could allow intruders to execute code without authorization.
  • “Researchers at Huntress said they have seen attackers exploiting the vulnerability in four different customers’ networks. 
  • “Senior security researcher John Hammond described the attack as a simple “point-and-shoot” technique, noting that the recent release of a proof of concept made the attack trivially accessible for any hacker to launch.” * * *
  • “In an advisory released late Friday [October 24], CISA urged users to identify servers that are vulnerable to exploitation and immediately apply the upgrades. These servers have WSUS Server Role enabled, and ports open to 8530/8531, according to CISA.”
    
• Cyberscoop adds,
  • “Last week, Cybersecurity and Infrastructure Security Agency officials spoke candidly about the challenges they faced tracking the use of F5 products across the civilian federal government. While CISA knows there are thousands of instances of F5 currently in use, it admitted it wasn’t certain where each instance was deployed. 
  • “The uncertainty came as the agency issued an emergency directive related to F5, instructing other government agencies to find and patch any F5 instances. The urgency stemmed from the fact that F5 itself had revealed a nation-state had gained a long-term foothold in its systems.
  • “One of the main goals of the directive: “help us identify the different F5 technology in the federal network,” as one official told reporters.
  • “CISA didn’t already have a complete picture of that despite the billions of dollars spent on a program, Continuous Diagnostics and Mitigation (CDM), designed for, among other things, “increasing visibility into the federal cybersecurity posture,” which CISA’s website for the program states is one of its main four goals.
  • “CISA’s lack of awareness about the extent of the F5 vulnerability’s presence in the federal government highlights a weakness in a program that is, by and large, a well-regarded one. But the fact that CDM did not automatically identify F5 prevalence is a circumstance of fast-changing technology and a shortcoming in the part of CDM that’s focused on keeping track of digital assets, according to current and former CISA officials and cyber industry professionals.”
    
• CISA added the following known exploited vulnerabilities to its catalog this week,
  • October 20, 2025
    • CVE-2022-48503 Apple Multiple Products Unspecified Vulnerability 
    • CVE-2025-2746 Kentico Xperience Staging Sync Server Digest Password Authentication Bypass Vulnerability
    • CVE-2025-2747 Kentico Xperience Staging Sync Server None Password Type Authentication Bypass Vulnerability
    • CVE-2025-33073 Microsoft Windows SMB Client Improper Access Control Vulnerability 
    • CVE-2025-61884 Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
      • Security Affairs discusses the five KVEs here.
      • CRN and Security Week focus on the Oracle KVE.
  • October 22, 2025
    • CVE-2025-61932. Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability
      • The Hacker News discusses the Motex KVE here.
  • October 24, 2025
    • CVE-2025-54236 Adobe Commerce and Magento Improper Input Validation Vulnerability
    • CVE-2025-59287 Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability 
      • HelpNetSecurity and Dark Reading discusses the Adobe KVE.
      • The Windows KVE is discussed above.

• Cybersecurity Dive relates,
  • “Critical flaws in TP-Link Omada and Festa VPN routers could allow attackers to take control of a device, according to a report released Thursday from Forescout Research – Vedere Labs. 
  • “One vulnerability, tracked as CVE-2025-7850, could enable OS command injection through improper sanitation of user input, according to the researchers. The flaw, which has a severity score of 9.3, in some cases can be exploited without requiring credentials to the device.
  • “A second vulnerability, tracked as CVE-2025-7851, allows root access via residual debug code, and has a severity score of 8.7. The flaw exposes hidden functionality that allows for root login via SSH, Forescout researchers told Cybersecurity Dive.
  • “TP-Link devices have been the target of exploitation activity in the past, including large botnets such as Quad7, says Daniel dos Santos, head of research at Forescout Research.” * * *
  • The researchers said they are not aware of any exploitation involving the newly found vulnerabilities but given that one is rated as critical and the other as high-severity, users should immediately apply new firmware updates issued by TP-Link.”
• and
  • “Half of all organizations have been “negatively impacted” by security vulnerabilities in their AI systems, according to recent data from EY.
  • “Only 14% of CEOs believe their AI systems adequately protect sensitive data.
  • “AI’s new risks are compounding the difficulty of securing networks with a patchwork of cybersecurity defenses as organizations use an average of 47 security tools, EY found.”
    
• Fierce Network adds,
  • “Beware. It’s that time of year when many employees are being told it’s open enrollment and they’re given a deadline to renew their health benefits. But if an unverified and unexpected message comes through SMS on your smartphone, it might be a smishing attack.
  • “Don’t click on the link, however tempting it may be.
  • “That’s one bit of advice from Chris Novak, VP of Global Cybersecurity Solutions at Verizon Business. He talked with Fierce about the latest Verizon Mobile Security Index that shows just how vulnerable mobile devices are to attacks. And guess what? AI isn’t helping matters. In fact, it’s putting devices more at risk.”

• Cyberscoop notes,
  • “Researchers have uncovered a long-running phishing campaign that uses text messages to trick victims, and it’s both bigger and more complex than previously thought. The operation, dubbed Smishing Triad, is managed in Chinese and involves thousands of malicious actors, including dozens of active, high-level participants, Palo Alto Networks’ research unit told CyberScoop.
  • “Unit 42 has traced about 195,000 domains to the highly decentralized phishing operation since January 2024. Researchers say more than two-thirds of the malicious domains are registered through Hong Kong-based registrar Dominet (HK) Limited using China-based domain name system infrastructure.
  • “Most of the attack domains (58%) are hosted on U.S.-based IP addresses, while 21% are hosted in China and 19% reside in Singapore. The global phishing operation is designed to collect sensitive information, including national identification numbers, home addresses, financial details and credentials, according to Unit 42.
  • “The malicious domains, which include hyphenated strings followed by a top-level domain, trick victims into thinking they are visiting a legitimate site. These domains impersonate services across many critical sectors including toll road services, multinational financial service and investment firms, e-commerce markets and cryptocurrency exchanges, health care organizations, law enforcement agencies and social media platforms.”

• HelpNetSecurity explains how “attackers turn trusted OAuth apps into cloud backdoors.”

• Cybersecurity Dive points out that “social engineering gains ground as preferred method of initial access [for cyberattacks]. Senior executives and high-net-worth individuals are increasingly at risk as hackers use deepfakes, voice cloning and other tactics for targeted attacks.”

From the ransomware front,

• The HIPAA Journal reports,
  • “Ransomware groups are conducting fewer attacks than a year ago and are increasingly adopting a more targeted approach using stealthy tactics to achieve more impactful results, according to the 2025 Global Threat Landscape Report from the network detection and response (NDR) company ExtraHop.
  • “Indiscriminate attacks are being dropped in favor of targeted, sophisticated attacks that allow ransomware actors to spend longer inside victims’ networks as they move undetected to achieve an extensive compromise before deploying their file-encrypting payloads. Attacks are designed to cause maximum damage and extensive downtime, which both increases the likelihood of a ransom being paid and allows them to obtain higher ransom payments.
  • “ExtraHop reports that in the space of a year, the average ransom demand has increased by more than one million dollars, from $2.5 million a year ago to $3.6 million, although ransom demands are higher for healthcare organizations and government entities. 70% of victims end up paying the ransom.
  • “Last year, ExtraHop tracked an average of 8 incidents per organization compared to 5-6 incidents this year. Ransomware actors typically have access to victims’ networks for almost two weeks before they launch their attack, during which time sensitive data is exfiltrated. It typically takes victims more than two weeks to respond to a security alert and contain an attack, with the attacks causing an average downtime of around 37 hours.”

• CSO adds,
  • “Two in five companies that pay cybercriminals for ransomware decryption fail to recover data as a result, according to a survey of 1,000s SMEs by insurance provider Hiscox.
  • “The survey also revealed that ransomware remains a major threat, with 27% of businesses surveyed reporting an attack in the past year. Of those affected, 80% — which includes both insured and uninsured businesses — paid a ransom in an attempt to recover or protect critical data.
  • “But only 60% successfully recovered all or part of their data as a result, Hiscox’s Cyber Readiness Report found.”
• and
  • “As ransomware attacks accelerate in speed and sophistication, 38% of security leaders rank AI-enabled ransomware as their top concern — the most frequently cited worry about AI-related security issues according to CSO’s new 2025 Security Priorities study.
  • “That concern appears to already be well founded, as a second study released today, CrowdStrike’s 2025 State of Ransomware Survey, provides a snapshot of how the ransomware threat is evolving, revealing cybersecurity pros’ fears surrounding the use of AI in ransomware attack chains, as well as the need to for CISOs to build better — and more intelligent — defenses to match AI-powered attackers.
  • “From malware development to social engineering, adversaries are weaponizing AI to accelerate every stage of attacks, collapsing the defender’s window of response,” Elia Zaitsev, CTO at CrowdStrike, said in announcing the survey’s findings. “The 2025 State of Ransomware Survey reinforces that legacy defenses can’t match the speed or sophistication of AI-driven attacks. Time is the currency of modern cyber defense — and in today’s AI-driven threat landscape, every second counts.”

• Cybersecurity Dive seconds the CSO report,
  • “The vast majority of ransomware-as-a-service groups are using AI-powered tools, which are “almost certainly increasing the speed of ransomware attacks,” the security firm ReliaQuest said in a report published on Tuesday.
  • “One sign that automation is making a difference: Attackers’ breakout time — the measure of how long it took them to go from initial access to compromising other devices — dropped from 48 minutes in 2024 to 18 minutes in the middle of 2025, the company said.
  • “RaaS groups are offering AI-powered tools such as antivirus detection and “features to automatically kill software that prevents ransomware execution,” according to the report.”

• Per Industrial Cyber,
  • “Trend Micro researchers identified the Agenda ransomware group, also known as Qilin, deploying a Linux-based ransomware binary on Windows hosts by exploiting legitimate remote management and file transfer tools. This cross-platform approach bypasses Windows-focused detections and conventional endpoint security solutions. The technique allows low-noise operations, including theft of backup credentials to disable recovery options and neutralization of endpoint defenses using BYOVD (Bring Your Own Vulnerable Driver) attacks.
  • “Since January 2025, Agenda ransomware has affected 591 victims across 58 countries, primarily in developed markets and high-value industries. Most victims were in the U.S., Canada, and the U.K., with manufacturing, technology, financial services, and healthcare among the hardest hit. Any environment using remote access platforms, centralized backup solutions, or hybrid Windows/Linux infrastructures is at risk. Enterprises are advised to restrict remote access tools to authorized hosts and continuously monitor for unusual activity.”

• Per SC Media,
  • “HackRead reports that U.S. multinational media and telecommunications conglomerate Comcast Corporation had 186.36 GB of compressed data, amounting to 834 GB of stolen information, exposed by the Medusa ransomware gang following its refusal to pay the $1.2 million ransom demand.
  • “Medusa has posted the data for download in 47 files, with most of the files sized at 4 GB. Earlier analysis of the data sample posted by Medusa in late September showed Excel files indicating claim data specifications, as well as multiple auto premium impact analysis-related Python and SQL scripts, according to Cybernews researchers.
  • “Comcast has yet to acknowledge Medusa’s posting. Such a development comes just weeks after Medusa was noted by Microsoft to have launched attacks leveraging the maximum severity GoAnywhere MFT flaw, tracked as CVE-2025-10035, to facilitate unauthenticated remote code execution.”

From the cybersecurity industry and defenses front,

• Cyberscoop reports,
  • “Veeam announced Tuesday [October 21] it agreed to acquire Securiti AI for $1.725 billion, marking the data protection company’s largest acquisition and its entry into the artificial intelligence security market as enterprises struggle to deploy AI systems safely.
  • The deal, expected to close in early December, comes as organizations face mounting challenges in managing data across fragmented systems while attempting to launch AI initiatives.
  • “Securiti AI, based in San Jose, Calif., specializes in data security management and provides tools that help organizations understand what data they have, who can access it, and how it’s being used across hybrid cloud environments. The company uses a knowledge graph to map relationships between data assets, users, AI models and compliance requirements.
  • “Veeam, headquartered in Kirkland, Wash., makes software for backing up and recovering data after ransomware attacks and other breaches. The combination aims to address what both companies describe as a critical gap: enterprises cannot safely deploy AI without knowing whether the data feeding those systems is secure, properly governed and accessible only to authorized users.”

• CIO explains why containment is the key to ransomware defense.
  • “Security leaders tasked with thwarting ransomware attacks must leverage containment techniques to prevent breaches from causing widespread chaos.
  • “Containment strategies reduce the blast radius of a cyberthreat by limiting or preventing the lateral movements of an intruder who succeeds in breaking into your network, a topic covered in a recent post.
  • “It’s a strategy that, when properly implemented, can all but eliminate the possibility of a catastrophic ransomware attack, says John Kindervag, chief evangelist at Illumio and the creator of Zero Trust.”

• Cyberscoop lets us know,
  • “In recent years, the cybersecurity industry has made significant strides in securing endpoints with advanced Endpoint Detection and Response (EDR) solutions, and we have been successful in making life more difficult for our adversaries. 
  • “While this progress is a victory, it has also produced a predictable and dangerous consequence where threat actors are shifting their focus to the network perimeter, a domain often plagued by technical debt and forgotten hardware.
  • “The recent cyber espionage campaign by the China-linked group Salt Typhoon demonstrates this shift. It is the latest in a series of attacks that highlight a dangerous and common thread connecting them to other major adversaries, including Russia’s Static Tundra and various ransomware groups. 
  • “These groups are all exploiting the ghosts in our networks. Old, unpatched, and forgotten routers, VPNs, and firewalls that make up our network perimeter are making very attractive targets. * * *
  • “Not only does this represent an unprecedented level of tactical threat advancement, but it showcases a deep understanding from our adversaries of how U.S. and allied networks are being defended today. These attackers have shown us that they are now capable of operating invisibly within the systems built to protect against them, compromising our national resilience.
  • “This also highlights a critical lesson: a patch is not a time machine. It cannot undo a previous compromise. End-of-Life (EoL) devices forgotten in time are not forgotten by exploit writers after the patches stop. These “forgotten” devices may be out of sight for network administrators, but they are front and center for our adversaries. We must treat them as the critical risks they are.
  • “The path to a stronger national security posture lies in mastering the fundamentals that are too often neglected and establishing a proactive security program to anticipate and counter threats.”

• Dark Reading points out,
  • “Most successful cyberattacks target end users through social engineering. They also exploit systems left vulnerable due to user errors. This is why securing the human element is crucial to managing cyber-risks in the modern era. 
  • “As recent headlines of data breaches, business disruptions, and threats demonstrate, the situation is dire. Despite the investment in security awareness training programs, many organizations are not receiving what they need. The average security awareness training program remains lackluster, at best, offering semi-annual cookie-cutter modules that drop a few factoids about security trends, hit users with a spot-the-phish game, or even surprise them with a simulation. As long as the click-through rates on phishing emails remain relatively low, the programs are considered successful. 
  • “The poor security outcomes should speak for themselves: This kind of training isn’t helping move the needle on risk.   
  • “Leading organizations are moving beyond the habits of ho-hum programs to deliver training that not only changes users’ insecure behaviors but also empowers them to take actions that boost the organization’s overall defense. One of the most fundamental shifts that effective security training programs are making is that they’re starting to dump the “awareness” label altogether.”

• Here is a link to Dark Reading’s CISO Corner.

From the cybersecurity policy and law enforcement front,

• The White House issued a proclamation yesterday about October being Cybersecurity Awareness Month so let’s go.

• Per Cyberscoop,
  • “European law enforcement dismantled and seized an expansive cybercrime operation used to facilitate phishing attacks via mobile networks for fraud, including account intrusions, credential and financial data theft, Europol said Friday [October 17].
  • “Investigators from Austria, Estonia and Latvia linked the cybercrime networks to more than 3,200 fraud cases, which also involved investment scams and fake emergencies for financial gain. Financial losses amounted to about $5.3 million in Austria and $490,000 in Latvia, authorities said.
  • “The operation dubbed “SIMCARTEL” netted seven arrests and the seizure of 1,200 SIM box devices, which contained 40,000 active SIM cards that were used to conduct various cybercrimes over telecom networks. Officials described the infrastructure as highly sophisticated, adding that the online service it supported provided telephone numbers for criminal activities to people in more than 80 countries.”
• and
  • “A Massachusetts man who previously pleaded guilty to a cyberattack on PowerSchool, exposing data on tens of millions of students and teachers, was sentenced to four years in prison Tuesday — half the amount federal prosecutors sought in sentencing recommendations submitted to the court.
  • “Matthew Lane, 20, stole data from PowerSchool belonging to nearly 70 million students and teachers, extorted the California-based company for a ransom, which it paid, causing the education software vendor more than $14 million in financial losses, according to prosecutors.
  • “U.S. District Judge Margaret Guzman sentenced Lane to four years in prison, followed by three years of supervised release. Lane was also ordered to pay almost $14.1 million in restitution and a $25,000 fine for crimes involving the attack on PowerSchool and an undisclosed U.S. telecommunications company.”

From the cybersecurity vulnerabilities and breaches front,

• Cyberscoop reports,
  • “Federal cyber authorities issued an emergency directive Wednesday [October 15] requiring federal agencies to identify and apply security updates to F5 devices after the cybersecurity vendor said a nation-state attacker had long-term, persistent access to its systems.
  • The order, which mandates federal civilian executive branch agencies take action by Oct. 22, marked the second emergency directive issued by the Cybersecurity and Infrastructure Security Agency in three weeks. CISA issued both of the emergency directives months after impacted vendors were first made aware of attacks on their internal systems or products.
  • F5 said it first learned of unauthorized access to its systems Aug. 9, resulting in data theft including segments of BIG-IP source code and details on vulnerabilities the company was addressing internally at the time. CISA declined to say when F5 first alerted the agency to the intrusion.
  • CISA officials said they’re not currently aware of any federal agencies that have been compromised, but similar to the emergency directive issued following an attack spree involving zero-day vulnerabilities affecting Cisco firewalls, they expect the response and mitigation efforts to provide a better understanding of the scope of any potential compromise in federal networks.
• and
  • “F5, a company that specializes in application security and delivery technology, disclosed Wednesday that it had been the target of what it’s calling a “highly sophisticated” cyberattack, which it attributes to a nation-state actor. The announcement follows authorization from the U.S. Department of Justice, which allowed F5 to delay public disclosure of the breach under Item 1.05(c) of Form 8-K due to ongoing law enforcement considerations.
  • “According to an 8-K form filed with the Securities and Exchange Commission, the company first became aware of unauthorized access Aug. 9 and initiated standard incident response measures, including enlisting external cybersecurity consultants. In September, the Department of Justice permitted F5 to withhold public disclosure of the breach, which the government allows if a breach is determined to be a “a substantial risk to national security or public safety.”  
  • “Investigators discovered that the threat actor maintained prolonged access to parts of F5’s infrastructure. Systems affected included the BIG-IP product development environment and the company’s engineering knowledge management platform. The unauthorized access resulted in the exfiltration of files, some of which contained segments of BIG-IP source code and details regarding vulnerabilities that the company was actively addressing at the time. It also said the files taken were “configuration or implementation information for a small percentage of customers.”

• Cybersecurity Dive adds,
  • “More than 600,000 F5 network security devices running the company’s flagship BIG-IP software are sitting unpatched on the internet one day after the company revealed that nation-state hackers had accessed its networks and source code.
  • “The figure, which Palo Alto Networks provided on Thursday [October 16], highlights how many organizations could be vulnerable to cyberattacks exploiting vulnerabilities that the unidentified hackers discovered while roaming through F5’s production environment and developer resources.” * * *
  • “F5, which said on Thursday that it believed it had kicked the hackers out of its networks, is working with government and private-sector cyber experts to further investigate the compromise. CISA ordered federal agencies to promptly patch their affected F5 products and disconnect the devices’ management interfaces from the internet.
  • “The potential impact of this compromise is unique due to the theft of confidential information regarding previously undisclosed vulnerabilities that F5 was actively in the process of patching,” Palo Alto Networks researchers wrote in their blog post. “This data potentially grants threat actors the capacity to exploit vulnerabilities for which no public patch currently exists, which could accelerate the creation of exploits.”
  • “F5 said there was no evidence that the hackers had compromised its source code or software production processes, despite having access to those systems and data.”

• CISA added six known exploited vulnerabilities to its catalog this week.
  • October 14, 2025
    • CVE-2016-7836 SKYSEA Client View Improper Authentication Vulnerability
    • CVE-2025-6264 Rapid7 Velociraptor Incorrect Default Permissions Vulnerability
    • CVE-2025-24990 Microsoft Windows Untrusted Pointer Dereference Vulnerability
    • CVE-2025-47827 IGEL OS Use of a Key Past its Expiration Date Vulnerability
    • CVE-2025-59230 Microsoft Windows Improper Access Control Vulnerability
      • Security Affairs Discusses these KVEs here.
  • October 15, 2025
    • CVE-2025-54253 Adobe Experience Manager Forms Code Execution Vulnerability
      • Security Week discusses this KVE here.

• Per Cyberscoop,
  • “North Korean operatives that dupe job seekers into installing malicious code on their devices have been spotted using new malware strains and techniques, resulting in the theft of credentials or cryptocurrency and ransomware deployment, according to researchers from Cisco Talos and Google Threat Intelligence Group.
  • “Cisco Talos said it observed an attack linked to Famous Chollima that involved the use of BeaverTail and OtterCookie — separate but complementary malware strains frequently used by the North Korea-aligned threat group. Researchers said their analysis determined the extent to which BeaverTail and OtterCookie have merged and displayed new functionality in recent campaigns. 
  • “GTIG said it observed UNC5342 using EtherHiding, malicious code in the form of JavaScript payloads that turn a public blockchain into a decentralized command and control server. Researchers said UNC5342 incorporated EtherHiding into a North Korea-aligned social engineering campaign previously dubbed Contagious Interview by Palo Alto Networks. 
  • “Cisco and Google both said North Korean threat groups’ use of more specialized and evasive malware underscores the efforts the nation-state attackers are taking to achieve multiple goals while avoiding more common forms of detection.”

• Per Dark Reading,
  • “Major password managers are being impersonated in a spate of recent phishing attacks, including LastPass, Bitwarden, and 1Password, and enterprise users should be on notice. In a three-week span, all of them have been dealing with impersonation attacks by threat actors trying to con users into handing over their master password — and with it, troves of sensitive credentials.
  • “Password management vendors have long been among hackers’ favorite brands to impersonate, for good reason. Users need to have complete trust in their password managers — after all, nobody would store all of their credentials for all of their accounts in an app they didn’t have total confidence in. Phishers try to exploit that trust.
  • “Because password managers are protected by a single master password, a password reset scam — “Your password has been compromised, click here to reset it” — might engender more fear and urgency in this context than in others with lower stakes (that is, unless the user understands the basic mechanics of how their manager works — namely, that their master password would never be stored online to begin with). And of course, if attackers can get their hands on just that one master password, they can access all of a user’s online accounts, plus all of the huge corporate systems they might afford access to.
  • “Either by coincidence or reflecting a growing trend, password manager phishing attacks have been popping up even more than usual this October, cyber researchers are warning.”
    
• Per Bleeping Computer,
  • “Threat actors exploited a recently patched remote code execution vulnerability (CVE-2025-20352) in Cisco networking devices to deploy a rootkit and target unprotected Linux systems.
  • “The security issue leveraged in the attacks affects the Simple Network Management Protocol (SNMP) in Cisco IOS and IOS XE and leads to RCE if the attacker has root privileges.
  • “According to cybersecurity company Trend Micro, the attacks exploited the flaw in Cisco 9400, 9300, and legacy 3750G series devices and deployed rootkits on “older Linux systems that do not have endpoint detection response solutions.”
• and
  • “Earlier this week, Microsoft patched a vulnerability that was flagged with the “highest ever” severity rating received by an ASP.NET Core security flaw.
  • “This HTTP request smuggling bug (CVE-2025-55315) was found in the Kestrel ASP.NET Core web server, and it enables authenticated attackers to smuggle another HTTP request to hijack other users’ credentials or bypass front-end security controls.
  • “An attacker who successfully exploited this vulnerability could view sensitive information such as other user’s credentials (Confidentiality) and make changes to file contents on the target server (Integrity), and they might be able to force a crash within the server (Availability),” Microsoft said in a Tuesday advisory.”

• Per InfoSecurity Magazine,
  • “The phishing platform “Whisper 2FA” has rapidly become one of the most active tools used in large-scale credential theft campaigns, according to new research from Barracuda.
  • “Since July 2025, the platform has been responsible for nearly one million phishing attacks targeting accounts across multiple industries, placing it just behind Tycoon and EvilProxy in the global phishing-as-a-service (PhaaS) landscape.
  • “What makes Whisper 2FA stand out is its use of AJAX, a web technology that allows real-time communication between browser and server without page reloads. This enables the phishing kit to repeatedly capture credentials and multi-factor authentication (MFA) codes until it obtains a valid token. 
  • “Unlike typical phishing kits that stop after stealing a password, Whisper 2FA continuously loops through attempts, effectively bypassing MFA protections.
  • “Attackers have been using a range of lures to deliver Whisper 2FA, mimicking brands such as DocuSign, Adobe and Microsoft 365. These phishing emails often use urgent pretexts, such as invoices or voicemail notifications, to prompt users to log in and unknowingly submit their details to attackers.”

From the ransomware front,

• Microsoft tells us,
  • “In 80% of the cyber incidents Microsoft’s security teams investigated last year, attackers sought to steal data—a trend driven more by financial gain than intelligence gathering. According to the latest Microsoft Digital Defense Report, written with our Chief Information Security Officer Igor Tsyganskiy, over half of cyberattacks with known motives were driven by extortion or ransomware. That’s at least 52% of incidents fueled by financial gain, while attacks focused solely on espionage made up just 4%. Nation-state threats remain a serious and persistent threat, but most of the immediate attacks organizations face today come from opportunistic criminals looking to make a profit.
  • “Every day, Microsoft processes more than 100 trillion signals, blocks approximately 4.5 million new malware attempts, analyzes 38 million identity risk detections, and screens 5 billion emails for malware and phishing. Advances in automation and readily available off-the-shelf tools have enabled cybercriminals—even those with limited technical expertise—to expand their operations significantly. The use of AI has further added to this trend with cybercriminals accelerating malware development and creating more realistic synthetic content, enhancing the efficiency of activities such as phishing and ransomware attacks. As a result, opportunistic malicious actors now target everyone—big or small—making cybercrime a universal, ever-present threat that spills into our daily lives.
  • “In this environment, organizational leaders must treat cybersecurity as a core strategic priority—not just an IT issue—and build resilience into their technology and operations from the ground up. In our sixth annual Microsoft Digital Defense Report, which covers trends from July 2024 through June 2025, we highlight that legacy security measures are no longer enough; we need modern defenses leveraging AI and strong collaboration across industries and governments to keep pace with the threat. For individuals, simple steps like using strong security tools—especially phishing-resistant multifactor authentication (MFA)—makes a big difference, as MFA can block over 99% of identity-based attacks.”

• HIPAA Journal reports,
  • “Kettering Health has provided an update on its May 20, 2025, ransomware attack. The investigation confirmed that the Interlock ransomware group first gained access to its network on April 9, 2025, and retained access until May 20, 2025, when the attack was detected and the unauthorized access was blocked. During that time, the ransomware group accessed or copied files containing patient information.
  • “Kettering Health has been providing regular updates on its progress recovering from the attack and has now completed its file review. The review confirmed that current and former patients had the following information compromised in the attack: first and last name, contact information, date of birth, Social Security number, patient identification number, medical record number, medical information, treatment information, diagnosis information, health insurance information, driver’s license/state identification number, financial account information, and/or education records.
  • “Kettering Health said it has reviewed its policies, procedures, and processes related to data security and has taken steps to prevent similar incidents in the future. Kettering Health said it is unaware of any misuse of the exposed information and has provided patients with information on how they can protect themselves against identity theft and fraud. Complimentary credit monitoring and identity theft protection services do not appear to have been offered.”

• The Record adds,
  • “Michigan City, Indiana, has confirmed that a damaging cyber incident three weeks ago that impacted government systems was a ransomware attack.  
  • “The Indiana city located on the south shore of Lake Michigan was forced to take many systems offline on September 23 and initially called it a “network disruption.” 
  • “On Saturday [October 11], the city acknowledged it was hit with a ransomware attack “that affected a portion of the City’s data and impacted municipal employees’ online and telephone access.” * * *
  • “On Monday, the Obscura ransomware gang took credit for the attack and said they stole 450 gigabytes of data. The group claimed that the time on their ransom had expired and  that they posted all of the data that was taken during the cyberattack. Obscura emerged last month and has since named more than 15 victims.”  

• Dark Reading points out,
  • “Harvard University confirmed that it fell victim to an attack exploiting the recently disclosed zero-day vulnerability in Oracle’s E-Business Suite (EBS) system.
  • “The critical vulnerability, tracked as CVE-2025-61882, allows an attacker without authentication to remotely access EBS instances. The flaw has been exploited by the notorious Clop ransomware gang in attacks on Oracle customers.   
  • “Harvard is aware of reports that data associated with the University has been obtained as a result of a zero-day vulnerability in the Oracle E-Business Suite system,” the University told Dark Reading. “This issue has impacted many Oracle E-Business Suite customers and is not specific to Harvard. While the investigation is ongoing, we believe that this incident impacts a limited number of parties associated with a small administrative unit.”
• and
  • “Microsoft disrupted a Rhysida ransomware campaign that used fake Teams binaries signed with digital certificates, including many from Microsoft’s own service. 
  • “In a social media post on X, Microsoft Threat Intelligence on Wednesday said it revoked more than 200 code-signing certificates issued by Azure’s Trusted Signing service. These certificates are sometimes abused by threat actors to make malware appear as if it is legitimate, trusted software.
  • “According to the post, a cybercriminal group tracked by Microsoft as Vanilla Tempest crafted the fake Teams files to drop a backdoor known as “Oyster,” which allowed attackers to eventually deliver Rhysida ransomware in victims’ networks.
  • “Vanilla Tempest, also known as Vice Society, has a track record of targeting healthcare organizations and public schools, though it’s unclear what organizations the group was targeting with its latest campaign.”
     
• Wiz notes,
  • “Cloud ransomware targets data and systems in cloud environments by exploiting cloud-native features and APIs rather than just encrypting local files
  • “Attackers have evolved beyond simple encryption to use sophisticated tactics like data exfiltration, deletion, and manipulation of cloud services
  • “Common attack vectors include compromised credentials, misconfigured storage, overly permissive identities, and supply chain compromises
  • “Defending against cloud ransomware requires cloud-native detection and prevention strategies with deep visibility across your entire environment.”

From the cybersecurity defenses front,

• Cybersecurity Dive reports,
  • “Fortune 500 companies have seen the structure of their security operations teams evolve in recent years, with four of every 10 companies assigning a dedicated, deputy chief information security officer or an equivalent leadership role, according to a report released Thursday from IANS Research and Artico Search. 
  • “A deputy CISO steps in when the CISO is unavailable and is seen as the eventual successor to the CISO in the company’s risk management hierarchy, according to researchers. 
  • “In practical terms, the deputy CISO often either holds a dual role as a functional department head who takes on additional executive leadership responsibility or operates as a chief of staff who also takes on CISO-like responsibilities that the CISO needs to delegate,” Nick Kakolowski, senior research director at IANS Research told Cybersecurity Dive via email.”

• Beckers Hospital Review calls attention to six notes about health system efforts to sharpen their cybersecurity and margins narrow.

• Dark Reading relates,
  • “Agentic AI deployments are becoming an imperative for organizations of all sizes looking to boost productivity and streamline processes, especially as major platforms like Microsoft and Salesforce build agents into their offerings. In the rush to deploy and use these helpers, it’s important that businesses understand that there’s a shared security responsibility between vendor and customer that will be critical to the success of any agentic AI project.
  • “The stakes in ignoring security are potentially high: last month for instance, AI security vendor Noma detailed how it discovered “ForcedLeak,” a critical severity vulnerability chain in Salesforce’s agentic AI offering Agentforce, which could have allowed a threat actor to exfiltrate sensitive CRM data from a customer with improper security controls through an indirect prompt injection attack. Although Salesforce addressed the issue through updates and access control recommendations, ForcedLeak is but one example of the potential for agents to leak sensitive data, either through improper access controls, ingested secrets, or a prompt injection attack.
  • “It’s not an easy task to add agentic AI security to the mix; it’s already challenging enough to determine where responsibility and culpability lie with traditional software and cloud deployments. With something like AI, where the technology can be hastily rolled out (by both vendor and customer alike) and is constantly evolving, establishing those barriers can prove even more complex.” 
     
• TechRadar explains “how to plan a smooth Windows 10 to Windows 11 migration – even if you missed the October 14th [support] deadline.”

• Here is a link to Dark Reading’s CISO Corner.