Author: Staff Writer

Summary Points Smaller firms and midsize organizations are less likely to indemnify CISOs against personal liability, increasing their legal and financial risks, unlike Fortune 1000 companies where 88% are protected. The primary protection for CISOs is through indemnification provisions and D&O insurance, but lack of formal agreements can leave CISOs vulnerable to covering legal costs personally. Increasing inclusion of CISOs in D&O insurance policies—over 50% receive this benefit—helps safeguard them, but this coverage isn’t foolproof without proper indemnification agreements. Given rising accountability pressures from regulators and high-profile cases like SolarWinds, organizations must revamp governance structures and ensure adequate legal protections…

Essential Insights A zero-day vulnerability (CVE-2025-40602) in SonicWall SMA 1000’s appliance management console allows local privilege escalation and has been exploited in a chained attack with the patched CVE-2025-23006, enabling unauthenticated remote code execution with root privileges. SonicWall confirmed that its firewall products are unaffected, but past vulnerabilities in SonicWall devices, including SMA, have been frequently exploited, with notable incidents reported over recent years. Patches have been released for affected versions of SonicWall SMA 1000, and restricting access to trusted sources is recommended as a workaround until systems are fully updated. No public proof-of-concept currently exists, but once available, attackers…

Summary Points NAKIVO Backup & Replication v11.1 enhances virtual environment protection, introducing real-time replication, automated backup verification, and direct recovery from tape, significantly improving disaster recovery capabilities. The update extends support for Proxmox VE with a comprehensive disaster recovery toolkit, including Flash VM Boot technology, automatic transaction log truncation, and seamless VM template backup and restoration. MSPs benefit from a reimagined Direct Connect architecture that eliminates inbound port requirements, encrypts communications, and now supports Hyper-V, Proxmox VE, and physical infrastructure, enabling secure, scalable multi-client management. The new version offers multilingual interface support, granular backup options for physical machines, and a…

Quick Takeaways Suspected Cyberattack: France’s counterespionage agency is investigating a possible cyberattack on an international ferry, with a Latvian crew member arrested for alleged ties to a foreign power. Russian Interference: French officials, including Interior Minister Laurent Nunez, suggest that Russia may be behind the interference, reflecting ongoing concerns about “hybrid warfare” tactics in Europe. Software Infection: Intelligence from Italy indicated that RAT software, used by cybercriminals, may have infiltrated the ferry’s computer systems, prompting a security investigation. Arrests Made: Two crew members were arrested, with the Latvian facing serious charges related to hacking and conspiracy; the ferry has since…

Summary Points The Chinese-linked group “Ink Dragon” targets IIS servers for espionage, leveraging widespread misconfigurations to build an elusive global network. They compromise servers, harvest credentials, and install custom modules to turn servers into covert relays, masking attack origins and complicating detection. The group’s infrastructure is used to both exfiltrate intelligence and relay attack traffic, relying on hijacked government servers instead of traditional command-and-control servers. Coincidentally, another Chinese group, RudePanda, also exploits IIS weaknesses simultaneously, highlighting the critical need for IIS security and proper configurations. What’s the Problem? The Chinese-linked threat group known as “Ink Dragon” is actively targeting vulnerable…

Fast Facts React2Shell (CVE-2025-55182) is a critical, widely exploited vulnerability disclosed on Dec. 3, impacting over 60 organizations, with public exploits reaching an all-time high, facilitating remote code execution and network infiltration. Attackers, including cybercriminals, ransomware groups, and nation-state actors, are actively exploiting this flaw across diverse sectors globally, leading to malware deployment, data theft, lateral movement, and persistent access. Ongoing efforts to patch the vulnerability are complicated by related defects (CVE-2025-55183 and CVE-2025-67779), and incomplete patches leave systems vulnerable to bypass techniques and existing compromises. The exploitation timeline is accelerating from weeks to hours, emphasizing urgent need for organizations…

Quick Takeaways Federal prosecutors have dismantled E-Note, a cryptocurrency platform used to launder over $70 million from ransomware and cybercrimes since 2017, linking it to criminal networks globally. Mykhalio Petrovich Chudnovets, a Russian national, controlled and operated E-Note, providing money laundering services since 2010, evolving from personal schemes to a scalable online business. Law enforcement seized servers, apps, and data, potentially enabling them to trace illicit fund flows and identify criminal networks, with Chudnovets possibly still in Russia. The operation involved international cooperation and resulted in an indictment for conspiracy to launder, which can carry up to 20 years in…

Summary Points Proactive Cloud Protection: Lumen Technologies introduces Lumen Defender Managed Rules for AWS Network Firewall, delivering advanced threat intelligence directly to AWS customers, enabling early threat detection and blocking. Enhanced Visibility: By integrating Black Lotus Labs’ intelligence, organizations gain insight into malicious infrastructure beyond their own networks, allowing them to identify and disrupt threats from bots, malware, and nation-state actors proactively. Accessible on AWS Marketplace: Customers can easily subscribe to Lumen Defender Managed Rules on AWS Marketplace, benefiting from rapid integration of curated threat data to enhance cloud security without added complexity. Expert-Led Threat Intelligence: Leveraging over 200 billion…

Quick Takeaways CISA has released Version 2.0 of its Cross-Sector Cybersecurity Performance Goals (CPGs) to enhance cybersecurity resilience in critical infrastructure sectors like water treatment and healthcare. The updated framework introduces a new “Govern” category to emphasize leadership’s role in cybersecurity, consolidates IT/OT goals, and addresses emerging risks such as supply chain and zero trust. Revisions were made based on feedback from stakeholders and aim to provide clearer guidance on goal implementation, costs, impacts, and difficulty levels. The CPGs are designed to create measurable security objectives, foster collaboration between IT and operational technology, and guide strategic cybersecurity investments across sectors.…

Top Highlights Modern vehicle head units, utilizing Unisoc’s System-on-Chip technology, are vulnerable to remote hacking due to weaknesses in their cellular modems, particularly in handling data packet fragmentation. A critical flaw in the 3G RLC protocol implementation allows attackers to execute arbitrary code via a stack-based buffer overflow, bypassing standard cellular security measures. Exploiting this vulnerability enables hackers to gain control over the vehicle’s dashboard, potentially running malicious applications or hijacking vehicle functions. The flaw underscores the risks of “black box” components in automotive supply chains and highlights the need for more robust security measures in connected vehicle systems. Underlying…