Keep your guard up, Digital Defenders. |
This week brings espionage hiding in household hardware, identity-bending bugs, fragile perimeter defenses, rapidly evolving ransomware, and policy shifts with national stakes. |
|
|
Here’s what you need to know: |
|
|
50K ASUS Routers Hijacked For Global Spy Network |
A large-scale espionage campaign has quietly seized control of more than 50,000 ASUS home and small-office routers, turning everyday devices into operational relay nodes for state-aligned threat actors.
Researchers say attackers are exploiting multiple known flaws to gain privileged access and maintain long-term persistence across targets in multiple countries, echoing past China-nexus ORB activity. |
This is an ongoing campaign in the wild.
Replace end-of-life ASUS WRT routers, lock down remote management, patch supported devices, inspect logs for WrtHug indicators, enforce secure remote-access controls, segment sensitive systems, and monitor for abnormal router activity. |
Grafana SCIM Bug Enables Admin Impersonation |
A critical logic vulnerability in Grafana Enterprise’s SCIM provisioning lets attackers impersonate existing users — including admins — in certain configurations.
The flaw (CVE-2025-41115) arose from Grafana mapping a SCIM-provided externalId directly to an internal user UID, allowing a malicious or compromised SCIM client to provision itself as the built-in Admin.
Only Enterprise versions 12.0.0–12.2.1 with both SCIM flags enabled were affected, and Grafana says there’s no evidence of exploitation.
Update Grafana and disable SCIM until patched, lock down and monitor SCIM access, audit logs for suspicious provisioning, enforce least privilege, and review accounts for unauthorized changes. |
Unauthenticated SSLVPN Flaw Can Crash SonicWall Firewalls |
A critical buffer overflow in SonicWall’s SonicOS SSLVPN lets remote, unauthenticated attackers crash affected firewalls, creating an immediate denial-of-service (DoS) risk.
The CVE-2025-40601 flaw affects many Gen7 and Gen8 hardware and virtual models, and because it only requires network access to the SSLVPN port, attackers can easily automate repeated outages once public exploit code appears.
Although no in-the-wild attacks have been reported, the simplicity of exploitation elevates the threat level for internet-exposed deployments. Limit or shield SSLVPN exposure, enforce strong authentication, monitor for anomalous traffic or crashes, tighten firewall rules, and ensure segmented, resilient failover paths. |
|
|
How are outdated devices handled in your org? |
|
|
Yesterday's Pulse Check Results |
If an attacker pivoted through an IoT device today, what happens next? |
|
|
Security Tools You Can Use |
|
|
Fast-Evolving ‘Gentlemen’ Ransomware Expands Across Enterprise Platforms |
A new ransomware group, The Gentlemen, has quickly become one of 2025’s most aggressive crews, rapidly scaling attacks across Windows, Linux, and ESXi environments.
Researchers report that the group combines advanced RaaS tooling with automated persistence, cross-platform spread, and dual extortion — already yielding dozens of victims and several evolving variants. |
These are ongoing attacks in the wild.
Monitor for early attack activity, enforce MFA and allow-listing, keep systems patched, segment critical assets, maintain offline backups, and use behavioral ransomware defenses with automated response. |
FCC Repeals Telecom Cyber Rules Amid Rising Espionage Threats |
The FCC has voted to roll back recently adopted cybersecurity rules for U.S. telecom providers, removing what many critics called the agency’s strongest response to China-linked intrusions into American communications networks.
The rollback comes after Salt Typhoon breached 200+ carriers, raising alarms over espionage targeting core routing, wiretap systems, and sensitive communications data. While industry groups welcomed less regulation, experts warn it leaves critical national networks reliant on uneven, voluntary security.
Require providers to show proof of segmentation, monitoring, and zero-trust implementation rather than assuming consistent cybersecurity maturity. |
|
|
On AWS Security LIVE!, experts and AWS Partners get real about today’s toughest cloud security battles—what’s working, what’s not, and what’s next. |
|
|
Secure Your Network Hardware |
Attacks on routers, switches, and other network gear are surging as attackers exploit outdated firmware, weak configs, and exposed remote access. Because these devices sit at the heart of enterprise connectivity, a single compromise can give attackers persistent access or stealthy visibility into sensitive traffic. |
Source: Compare Fibre/Unsplash |
How to lock-down your network hardware against attacks: |
- Keep network hardware hardened by updating firmware regularly, disabling unused services, and enforcing strong device authentication.
- Maintain consistent security by centralizing configuration management and segmenting the network to limit blast radius.
-
Detect issues early by continuously monitoring hardware logs for unusual traffic, login attempts, or configuration changes.
|
Securing hardware may not be glamorous, but consistent patching, strong access controls, and continuous monitoring make it a core pillar of cyber resilience by preventing attackers from turning network devices into pivot points for lateral movement. | |
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
