Buckle up, Digital Defenders. |
Hijacked VPNs, shattered VMs, global botnets… this week’s threats blur the line between legacy risk and modern chaos. |
|
|
Here’s what you need to know: |
|
|
Oracle EBS Flaw Opens Door to Enterprise Data Theft |
Source: BoliviaInteligente/Unsplash |
Oracle has released a patch for the issue.
Apply the latest patch, harden legacy systems, restrict admin access, enable detailed logging, enforce MFA and least privilege, and regularly test backups and IR response plans to strengthen ERP security. |
Hackers Hit SonicWall After Firewall Backup Leak |
Huntress researchers have detected a sharp rise in attacks on SonicWall SSLVPN devices.
Attackers used valid credentials across more than 100 accounts in 16 environments, indicating that the data may have been stolen or compromised by insiders. This is an ongoing attack in the wild, but Huntress released a list of IOCs.
Disable unnecessary remote access, reset and rotate all credentials and keys, enable detailed logging for review, re-enable services cautiously, and enforce MFA on all admin and remote accounts to prevent re-entry and strengthen firewall security. |
RMPocalypse Shatters AMD Protections, Exposes Cloud VMs |
Researchers developed a proof-of-concept (PoC) attack on SEV-SNP’s Reverse Map Table that lets malicious hypervisors bypass memory protections to access or alter confidential VM data.
Affecting Zen 3–5 and EPYC servers, the flaw endangers cloud tenants running sensitive workloads by enabling forged attestation, debug escalation, and code injection—undermining SEV-SNP’s core integrity protections. There are no reports of this being exploited in the wild. Pause affected confidential VMs, verify updated PSP/firmware attestations from providers, and deploy runtime attestation with out-of-band integrity monitoring. |
|
|
If your cloud creds were targeted tomorrow, how secure are you? |
|
|
Yesterday's Pulse Check Results |
Website Defense Check: How ready is your site? |
|
|
Security Tools You Can Use |
|
|
Hackers Unleash 100K IP Assault on RDP Systems |
Security researchers at GreyNoise have discovered a massive botnet comprising over 100,000 IP addresses from more than 100 countries targeting RDP services across the US.
Shared TCP fingerprints indicate a single, coordinated botnet leveraging RD Web Access timing and RDP login enumeration to harvest valid credentials, posing a serious threat to enterprises and evading brute-force detection. |
This is an active attack in the wild. Apply GreyNoise’s “Oct-2025 RDP Botnet Campaign” blocklist, monitor for abnormal RDP login attempts, and enforce MFA to prevent unauthorized access. |
Edge IE Mode Under Fire After Device Hijacks |
Attackers are exploiting Edge’s IE mode to execute malicious code and gain full system control.
They exploited a spoofed site and a Chakra zero-day to trigger IE mode, then chained an exploit to escape the sandbox and moved laterally across networks. Microsoft has removed IE mode’s one-click options for non-enterprise users.
Disable IE mode when possible, audit remaining domains, and enforce MFA on Edge admin policies to block re-enablement. |
|
|
AI-driven attacks are increasing, highlighting the need for stronger identity security. Learn how Duo’s security-first IAM protects against evolving threats. |
|
|
How Secure Is Your Remote Access Right Now? |
The botnet discovered by GreyNoise researchers is a stark reminder that remote access remains a top target. Securing VPNs, RDP, and admin portals is essential to protecting your organization. |
Source: Privecstasy/Unsplash |
How to fortify your remote access defenses: |
-
Authentication and access controls: Enforce multi-factor authentication (MFA), rotate credentials regularly, and restrict remote access (RDP, VPN) to trusted networks or secure tunnels.
-
Zero-trust: Continuously verify users and devices, apply least-privilege access, and isolate critical assets to prevent lateral movement.
-
Monitoring: Enable detailed logging and alerts for unusual login attempts, geolocation anomalies, or abnormal access patterns to identify threats early.
|
Securing remote access isn’t just about convenience—it’s about control. These steps help close common entry points, limit attacker movement, and ensure that only authorized users access the correct systems. |
|
|
| Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
