← Back to stratcyberadvisors.com

Act first

Newly confirmed as actively exploited

These were added to CISA's Known Exploited Vulnerabilities catalog this week. Attackers are already using them, so they belong at the top of any patch queue.

Threat landscape

Incidents and threat activity

• China-linked actor exploits BeyondTrust remote support tool

  Researchers say a China-nexus espionage actor is using a zero-day in BeyondTrust's support tool to harvest credentials and steal sensitive information. It is the latest in a run of exploited edge-device bugs that also hit Ivanti, Cisco and Palo Alto Networks this week.

  Sources: Cybersecurity Dive, Dark Reading, MS-ISAC (CIS)

• Ransomware groups widen use of Palo Alto GlobalProtect flaw

  Multiple threat actors have exploited a high-severity flaw in the company's GlobalProtect portal, and ransomware groups are expanding their targeting. Organizations that expose this portal to the internet should confirm they are patched.

  Source: Cybersecurity Dive

• ConnectWise suspends Cloud Backup amid Microsoft 365 access concerns

  Managed service providers said an attacker used compromised credentials to get into customer Microsoft 365 tenants, and ConnectWise disabled the backup service. ConnectWise says customer impact is not confirmed. Organizations that use an MSP should ask whether they are affected.

  Sources: Cybersecurity Dive, Dark Reading

• California warns students after testing contractor breach

  The California Department of Education says its assessment contractor, ETS, suffered a months-long data breach and has issued repeated warnings to students. The case shows how a third party's security failure becomes the customer's notification problem.

  Source: The Record

Government and regulation

Policy moves

• 23andMe's successor pays $6 million to settle with California

  The California Attorney General announced the settlement over allegations that the company did not properly protect customer data before its 2023 breach. State regulators are willing to pursue data protection failures after a breach.

  Source: The Record

• DHS moves to ban DeepSeek from federal civilian agencies

  The order cites national security concerns, including data going to servers in China, potential malware and risk to federal IT systems. Companies with government customers or similar concerns may want to review their own use of the tool.

  Source: FedScoop

• US builds out an industry-partnered offensive cyber program

  The administration is laying groundwork to enlist companies against foreign cybercriminals. Payment arrangements and protections for participating firms remain unresolved.

  Source: Nextgov

• Officials flag gaps in election communications ahead of midterms

  Sources describe weakening cooperation between the federal government and state and industry partners. AI is also making deceptive foreign influence messaging cheaper to produce and spread.

  Source: Nextgov

Compliance

Government regulation watch

New rules, guidance and deadlines for FISMA, FedRAMP, CMMC, the HIPAA Security Rule and other federal cybersecurity programs.

No major items this week.

Board and market

Governance and market signals

• Directors want more cyber expertise even as technology outpaces readiness

  A new survey found nearly half of corporate directors think board members need cybersecurity expertise. Boards report confidence on cyber and AI oversight, but the survey says technology changes are outrunning readiness.

  Source: Cybersecurity Dive

• AI security hiring centers on red-teaming, SOC orchestration and governance

  A new report says these are the focus of current hiring. Roles for countering AI deepfakes and overseeing post-quantum encryption rollouts are expected to follow.

  Source: Cybersecurity Dive

• AOMEI has not yet notified customers of update server tampering

  The company confirmed that hackers repeatedly altered configuration files on its update servers between April and July. Software was redirected to download malware for minutes at a time. Organizations that use the software should check for any exposure.

  Source: The Record

• EU Cyber Resilience Act leaves fix duration to manufacturers

  The law took effect last month and requires vulnerability fixes and free updates only during a product's support period, which manufacturers define. Buyers should look at stated support periods when procuring connected products.

  Source: The Record

For leadership

Questions to ask your team this week