The internet didn’t sleep this week, Digital Defenders. |
Silent healthcare breaches, trusted-brand phishing, leaky containers, and adaptive APTs all make the headlines.
Help improve Cyber Security Insider — share your feedback in a quick 60-second survey. |
|
| Here’s what you need to know: |
|
|
VITAS Breach Exposes 319K Patient Records |
A healthcare breach went unnoticed for over a month at VITAS Healthcare, allowing attackers to steal sensitive data from 319,177 patients across 15 states. The breach, which began with a compromised vendor account, enabled lateral movement until detection and exposed extensive patient data, including social security numbers and PHI.
|
The investigation into the incident is ongoing.
Segment networks and systems and implement continuous vendor-access monitoring with automated anomaly detection, especially for accounts with elevated or persistent privileges. |
Massive 40K Finance Phishing Wave Strikes Businesses |
A new phishing campaign sent over 40,000 emails impersonating SharePoint, DocuSign, and other e-signing platforms to lure users into opening fake financial documents.
Check Point researchers found that attackers used trusted services like Mimecast and convincing branding to bypass users and filters. This is an ongoing campaign in the wild. Use trusted platforms for document access, strengthen identity and email protections, and conduct security awareness training. |
Windows Hit by PowerShell Code-Execution Flaw |
A PowerShell vulnerability allows attackers to run malicious code through improper input sanitization. Microsoft warned the flaw could allow local code execution if users run crafted commands, and because it affects nearly all supported Windows versions, public disclosure increases the likelihood attackers may pair it with social engineering for exploitation. Microsoft has released a patch for the vulnerability.
Apply the patch, enforce least-privilege and controlled script execution, and monitor PowerShell activity closely to reduce exploitation risk. |
|
|
SharePoint/DocuSign lookalike email arrives — what’s your move? |
|
|
Yesterday's Pulse Check Results |
How confident are you in your defenses against account takeovers? |
|
|
Security Tools You Can Use |
-
If you’ve looked at DZone recently, we’d appreciate your input in our Community Survey.
- Keep your data safe with tools designed to detect and block threats in real time.
-
Uncover blind spots quickly with platforms that surface risks before they become incidents.
|
|
|
10,000 Docker Images Leak Secrets, Flare Warns |
Flare researchers found more than 10,000 Docker Hub images leaking sensitive credentials, including live API keys, cloud tokens, and CI/CD secrets.
Many exposed credentials provided administrative access to production systems, affecting over 100 organizations across major sectors, with 42% of images leaking five or more secrets — enough to compromise full pipelines or cloud environments. |
Source: Rubaitul Azad/Unsplash |
The increase in leaked AI model API keys highlights how quickly new tools are being adopted and why security practices need to keep pace.
Remove secrets from containers, use short-lived identity-based access, and automate scanning and rotation to keep credentials protected throughout the SDLC. |
APT28 Deploys New Wi-Fi Hacks and AI Malware |
A new assessment shows APT28 is expanding its tactics by combining traditional spearphishing and infrastructure abuse with Wi-Fi proximity attacks and experimental LLM-powered malware.
Picus Security researchers note that APT28 continually adapts its methods to each target, leveraging everything from webmail exploits and dual-homed Wi-Fi access to steganography and cloud-based C2 channels.
Strengthen identity, endpoint, network, and cloud controls while continuously validating detections to better defend against adaptable APT techniques. |
|
|
Legacy ITSM is holding teams back. On December 16 at 1:00 PM ET, join TechnologyAdvice × Freshworks for Straight from the Source: ITSM Customers Who Switched.
Hear real stories from IT teams who’ve modernized with AI-powered Freshservice to simplify operations and accelerate outcomes. Don’t wait, secure your seat today. |
|
|
Is Your Organization Prepared for Modern APT Tactics? |
Advanced persistent threat (APT) groups continue to adapt their methods, blending traditional intrusion techniques with cloud misuse, Wi-Fi–based access, and malware designed to blend into normal enterprise activity. Their adaptability makes them harder to detect and disrupt, especially in complex environments. |
How to strengthen your defenses against APTs: |
-
Enforce phishing-resistant MFA, tighten authentication for critical services, and patch webmail or edge-facing systems promptly to reduce common APT entry points.
- Segment networks and Wi-Fi while hardening native tools like PowerShell to limit lateral movement and disrupt living-off-the-land techniques.
- Continuously monitor for abnormal cloud activity and run attack simulations to identify visibility gaps and detect misuse early.
|
By combining strong identity controls, segmentation, monitoring, and regular validation of security controls, organizations can build a more resilient environment. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
