The perimeter isn’t where you think it is anymore. |
Today’s stories trace attacks that slip in through everyday devices, trusted platforms, and familiar tools — quietly bypassing defenses while posing as business as usual.
Read past newsletters here. |
|
| Here’s what you need to know: |
|
|
Kimwolf Botnet Hits Two Million Devices Worldwide |
The Kimwolf botnet is abusing residential proxies to turn consumer devices into entry points for large-scale local network attacks. Researchers estimate over two million devices are infected, enabling DDoS attacks, fraud, and account takeovers, often without owners’ awareness. |
The botnet is still active in the wild.
Reduce risk by isolating unmanaged devices, segmenting networks, blocking proxy abuse, hardening exposed services, securing DNS and routers, and maintaining continuous monitoring. |
SmarterMail Bug Opens Door to Server Takeover |
A critical SmarterMail flaw allows unauthenticated file uploads, putting thousands of internet-facing mail servers at risk of remote code execution. The vulnerability has a CVSS of 10.0 and nearly 11,000 servers are still exposed.
There are no reports of this being exploited in the wild. Patch immediately, minimize internet exposure, harden execution paths, deploy layered defenses, monitor for signs of compromise, and regularly test incident response plans. |
Google Tasks Used in Stealth Phishing Attacks |
Researchers warn attackers are abusing Google Tasks notifications to deliver phishing emails that evade traditional defenses.
Observed in December 2025, the campaign hit over 3,000 organizations by abusing Google’s own notification infrastructure to deliver legitimate-looking messages that bypass domain and signature-based controls.
Detect and contain trusted-platform phishing by analyzing SaaS workflows, enforcing notification controls, hardening authentication and link-sharing, enabling post-delivery detection, and updating incident response playbooks. |
|
|
Mail Server Reality Check: How exposed are you right now? |
|
|
Yesterday's Pulse Check Results |
How confident are you in your wireless defenses? |
|
|
Security Tools You Can Use |
-
Give your security team tools designed to match the speed and sophistication of today’s attacks.
- Share your insights to help define how AI security evolves in autonomous vehicles.
- Create an AI-powered bot with ChatGPT, Python, and Django — and unlock 42% in savings.
|
|
|
Security Pros Plead Guilty in ALPHV Ransomware Case |
Two U.S.-based cybersecurity professionals pleaded guilty to acting as ALPHV/BlackCat ransomware affiliates, using their security expertise to carry out extortion attacks. At least $1.2 million was extorted from victims through an affiliate revenue-sharing model common to RaaS groups like ALPHV. |
Both suspects are pending sentencing.
Reduce insider risk by enforcing least-privilege and just-in-time access, monitoring privileged activity, requiring multi-party approval for high-risk actions, promoting ethical reporting, and testing insider-threat scenarios with attack simulation tools. |
Telegram Messaging Accounts Compromised in Handala Leak |
Kela researchers say the threat actor’s claims of full phone compromise were overstated, with the attack centered on stolen Telegram account access rather than advanced iPhone hacking.
The incident shows how messaging account takeovers can still expose sensitive communications and deliver intelligence value without advanced exploits.
Reduce messaging account takeover risk by strengthening authentication, limiting SIM-based verification, monitoring session behavior, hardening executive endpoints, enforcing usage policies, and training high-risk users. |
|
|
How prepared are you for insider risk? |
Whether driven by malicious intent, financial pressure, or simple error, insiders with privileged access can cause damage that is difficult to detect and costly to contain. |
How to reduce insider threat risk: |
-
Limit and govern privileged access by enforcing least-privilege and just-in-time controls, supported by regular access reviews and strict session management.
-
Detect and constrain risky actions through continuous monitoring of privileged activity and requiring multi-party approval for high-impact security operations.
- Reduce insider risk through identity and culture by using phishing-resistant authentication, clear reporting channels, and ongoing security training.
|
Reducing insider threat risk requires combining strong access controls, continuous visibility, and a culture of accountability to detect issues early and limit impact. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
