Warnings and recommendations from national cyber security agencies, newest first. Each brief is at most 120 words, bottom line first, and links to the publication it was written from.
CISA · Advisory ·
#StopRansomware: SafePay Ransomware
CISA warns of SafePay ransomware targeting businesses and infrastructure.
SafePay actors gain access by stealing passwords, exploiting vulnerabilities, and using phishing. They use CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. SafePay actors encrypt files and demand payment.
Recommended by the publisher: CISA recommends patching systems, implementing Zero Trust, and restricting administrative tools.
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
Chinese government-linked actors target organizations worldwide.
Chinese government-linked cyber threat actors exploit vulnerabilities in Microsoft Exchange servers using scanning tools and cross-site scripting attacks. They establish persistence through VPN software and exfiltrate emails and credentials using scripts. Affected products include those with CVE-2014-6278, CVE-2015-3306, and other vulnerabilities.
Recommended by the publisher: CISA recommends disabling unused services and ports, sanitizing web application inputs, and implementing multifactor authentication.
China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
China-based AI companies conduct industrial-scale distillation campaigns against U.S. AI companies.
China-based AI companies, including DeepSeek and Alibaba, extracted billions of tokens from U.S. frontier AI models, violating terms of use. They use multiple pathways and proxies to gain unauthorized access. CISA assesses these activities threaten U.S. technological leadership.
Recommended by the publisher: CISA recommends U.S. AI companies implement detection and mitigation, deploy targeted response changes, and establish cross-organization intelligence sharing.
A Tale of Two SOCs: Insights From Two Red Team Assessments
CISA conducted red team assessments at two organizations.
The red team achieved full domain compromise and accessed sensitive business systems and cloud resources. Organization A failed to detect the activity, but Organization B identified and contained it. CISA assesses that untuned detection tools and organizational silos hindered effective incident response.
Recommended by the publisher: CISA recommends implementing Conditional Access policies and establishing procedures for detecting cloud compromises.
Defending Against an Active Threat to Siemens S7 Series PLCs
CISA warns of active threat to Siemens S7 Series PLCs.
The threat concerns Siemens S7 Series PLCs, including S7-200, S7-300, S7-400, S7-1200, and S7-1500 Series. Threat actors are using AI-generated exploitation scripts to target these devices. Exploitation could lead to disruption of critical industrial processes.
Recommended by the publisher: CISA recommends applying critical security patches and strengthening access controls.