The threat landscape is shifting, Digital Defenders. |
From Cisco flaws and AWS botnets to supply chain malware, rogue AI, and LockBit’s resurgence. Even trusted systems are turning into attack surfaces overnight. |
|
|
Here’s what you need to know: |
|
|
New Cisco Flaw Opens Door to Full Network Compromise |
A critical flaw in Cisco IOS/IOS XE lets attackers intercept TACACS+ traffic or bypass authentication. The flaw stems from the lack of shared secret enforcement, exposing devices to adversary-in-the-middle (AitM) attacks that risk data theft, lateral movement, and full compromise if left unpatched. |
Cisco has released a patch for the vulnerability and has not yet seen it exploited in the wild. Organizations should patch, automate secret checks, audit configurations, log TACACS+/RADIUS events in a SIEM, and enforce fail-secure policies. |
AWS Misconfigs Fuel ShadowV2’s DDoS-for-Hire Botnet |
Darktrace researchers discovered ShadowV2, a botnet that exploits misconfigured AWS Docker containers for DDoS-for-hire attacks.
ShadowV2 leverages containers, modular APIs, and HTTP/2 resets to mimic cloud-native applications, demonstrating how modern DDoS exploits can compromise poorly secured cloud workloads at scale. This botnet is active in the wild.
Lock down your Docker APIs, integrate workload monitoring into your SIEM, and leverage AWS security tools to enforce least privilege and spot anomalies before attackers do. |
Google Exposes BRICKSTORM Malware in Supply Chain Attacks |
Google researchers recently discovered BRICKSTORM, a stealthy malware used by China-linked UNC5221 to infiltrate US tech, SaaS, and legal firms.
Attackers planted backdoors on unprotected edge and VMware systems, stealing code and exposing customers—showing how supply chain intrusions multiply risk and why edge devices are prime targets. This malware is still being used in the wild.
Organizations should lock down management access, enforce MFA, and feed edge logs into SIEMs to spot stealthy activity early. |
|
|
What’s your top security blind spot? |
|
|
Yesterday's Pulse Check Results |
If attackers exfiltrated sensitive files from your enterprise today, how good are your defenses? |
|
|
Security Tools You Can Use |
-
Enterprise protection without the enterprise headache: NordLayer shows you how.
- Fast fixes, smarter tools: see which vulnerability manager actually delivers.
-
Get 30% off enterprise ransomware defense: Bitdefender blocks attacks before they reach your systems.
|
|
|
Salesforce AI Agents Tricked Into Data Theft |
Noma Labs uncovered ForcedLeak, a critical Salesforce Agentforce flaw rated 9.4 CVSS. Attackers abused a CSP flaw and Web-to-Lead entries to trick Salesforce AI agents into leaking CRM data, exposing how AI systems are unable to easily spot malicious context. |
Salesforce has patched the issue, but the lesson is broader: AI agents are only as secure as the data they process. Enable Trusted URLs enforcement, audit lead data for suspicious entries, and tighten validation rules for all untrusted inputs to stay ahead of emerging AI-driven risks. |
LockBit 5.0 Targets Virtual Machines at Scale |
Trend Micro confirmed LockBit’s return with version 5.0, a cross-platform ransomware hitting Windows, Linux, and VMware ESXi.
LockBit 5.0 introduces obfuscation, service-killing, and anti-analysis capabilities, with its ESXi variant posing a threat to mass VM encryption. The issue highlights ransomware’s resilience and growing focus on virtualization, despite its takedown attempt in 2024.
This new version of the ransomware is active in the wild. Security teams should harden hypervisors, rigorously test backups, and proactively hunt for compromise across hybrid environments. |
|
|
Jumpstart your security journey: CISOs get a field-tested 100-day roadmap to validate risk, implement CTEM, and lead with proof. |
|
|
Ransomware Strikes Where You Least Expect |
Ransomware attacks are on the rise, targeting enterprises with cross-platform variants that can cripple operations in minutes. Attackers now target virtualization, backups, and hybrid environments, making resilience essential for survival. |
Here's how to defend your network from ransomware: |
-
Test backups regularly: Ensure backups are isolated, encrypted, and can be restored quickly.
- Harden hypervisors: Apply patches and restrict access to ESXi or other virtualization hosts.
- Use EDR/XDR solutions: Detect ransomware early with continuous endpoint monitoring.
-
Enforce MFA everywhere: Block lateral movement by requiring strong authentication.
- Segment networks: Limit ransomware spread with strict access zones.
- Proactive threat hunting: Search for early indicators of compromise before encryption starts.
|
Ransomware isn’t slowing down… it’s evolving. By layering defenses, testing recovery, and tightening controls, you dramatically reduce both impact and downtime. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
