The cloud isn’t the only thing leaking this week, Digital Defenders. |
Misconfigured databases, poisoned npm packages, and botnets on the rise… attackers aren’t slowing down. Before we dive in: Help define the future of industrial AI—share your insights in our 7-minute survey for a chance to win a $100 gift card. |
|
|
Here’s what you need to know: |
|
|
178K Invoicely Records Exposed in Database Leak |
A misconfigured database exposed 178,519 Invoicely records—including invoices, checks, and tax documents—to public access.
Researcher Jeremiah Fowler discovered the unencrypted, unprotected Invoicely database, exposing financial and personal data—fueling risks of identity theft, invoice fraud, and phishing. |
Fowler stated he did not receive a response to his report, but the database was restricted from public access within hours.
Enforce cloud governance, encrypt data, apply zero-trust with least privilege, integrate security into DevOps, monitor vendors, and promote a security-first culture. |
Critical Elastic ECE Vulnerability Enables Remote Code Execution |
A critical Elastic Cloud Enterprise (ECE) vulnerability allows attackers to run arbitrary commands and steal enterprise data.
CVE-2025-37729 stems from improper Jinjava variable handling, enabling payload injection and code execution via logs. Affecting ECE 2.5.0–3.8.1 and 4.0.0–4.0.1, it poses a threat to production environments—especially if admin credentials are compromised in hybrid or multi-cloud setups. Elastic has released a patch for the vulnerability.
Apply the latest patch, restrict admin console access with MFA and least privilege, and monitor logs for injection attempts using Elastic’s published detection query. |
North Korean Hackers Deploy 338 Malicious npm Packages |
North Korean Hackers Deploy 338 Malicious npm Packages
Researchers uncovered 338 malicious npm packages tied to North Korean state hackers, signaling a major escalation in the Contagious Interview campaign.
Downloaded over 50,000 times, the packages target crypto and blockchain developers using social engineering and tainted dependencies. Masquerading as recruiters, attackers trick victims into cloning repos that install malware stealing credentials, tokens, and wallets—while in-memory loaders evade detection.
Socket researchers report this is an ongoing campaign. Treat every npm install as potential code execution, automate dependency scanning, validate package integrity before import, and verify recruiter identities before downloading or running any “test assignments.” |
|
|
Dev Supply Chain Reality Check: How secure is your npm workflow? |
|
|
Yesterday's Pulse Check Results |
If your cloud creds were targeted tomorrow, how secure are you? |
|
|
Security Tools You Can Use |
|
|
Data of 1.2M Patients Exposed in SimonMed Breach |
A ransomware attack on SimonMed Imaging compromised the personal and medical data of roughly 1.2 million patients across 11 states.
The Medusa ransomware group stole 212 GB of medical, insurance, and ID data over two weeks in January 2025. SimonMed began notifying victims in October 2025. |
Conduct regular third-party risk assessments and implement continuous vendor monitoring. |
RondoDox Botnet Exploits 50+ Known Vulnerabilities |
Trend Micro researchers have uncovered RondoDox, a rapidly growing botnet that exploits over 50 vulnerabilities across 30 vendors to compromise routers, DVRs, and other connected devices.
RondoDox weaponizes Pwn2Own vulnerabilities, transforming disclosed flaws into global exploits within weeks. Using automated scans and an “exploit shotgun” method, it targets unpatched CVEs in devices like TP-Link and Four-Faith, deploying Mirai-linked payloads for DoS attacks and data theft at scale.
Trend Micro reports this is an ongoing campaign. Implement continuous vulnerability management with automated patch verification—unpatched “n-day” flaws, not zero-days, now fuel many large-scale IoT botnet operations. |
|
|
Elevate Your AWS Identity Security Posture with Cisco Duo
Join Cisco Duo and AWS experts for a comprehensive webinar designed for security professionals and organizations from SMB to Enterprise. Learn how to build a robust, Zero Trust identity security framework for your AWS environment and beyond. |
|
|
Stop Cloud Misconfigurations Before They Stop You |
Cloud misconfigurations remain a top cause of data breaches, exposing sensitive assets through open buckets, excessive permissions, or weak policies. As organizations race to scale in the cloud, even a single unchecked setting can grant attackers a free pass to your most valuable data. |
Source: Growtika/Unsplash |
How to secure your cloud from costly misconfigurations: |
-
Continuously monitor and automate security: Use CSPM, cloud-native, and IaC tools to detect misconfigurations, enforce secure configurations, and maintain consistent defenses.
- Enforce least privilege: Limit user and service access strictly to the resources necessary for their roles.
- Protect and audit data: Apply encryption by default, regularly review storage permissions, and ensure compliance to prevent data exposure.
|
Cloud misconfigurations are quiet until they cost you. Automate checks, enforce least privilege, and maintain visibility to prevent expensive mistakes.
|
|
|
| Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
