☕ Good Morning Security Gang
Patch Tuesday arrives later today, but before we even get there, I’ve got nine stories that deserve your attention. Six of them trace back to essentially the same problem: the box sitting at the edge of the network that everyone assumes is doing its job. VPN gateways, RMM platforms, cellular routers and other infrastructure designed to keep attackers out are increasingly becoming the exact on-ramp attackers are using to get in.
We’ve got ransomware operators actively exploiting SonicWall appliances, a major joint government advisory detailing how a ransomware group is abusing Fortinet vulnerabilities and defeating MFA, Microsoft tracking a China-linked actor deploying a new ransomware strain through an incomplete patch, and a destructive attack against Poland’s power infrastructure that should get the attention of every OT and critical infrastructure security leader. Then we move into Cisco vulnerabilities, a global logistics breach with downstream exposure, serious flaws affecting Belgium’s digital identity ecosystem, an incident at LexisNexis, and OpenAI pushing a dedicated cybersecurity model toward the SOC.
Grab your double espresso. Coffee Cup Cheers, Security Gang.
🧭 Today’s Cybersecurity Picture
If there’s one message I want practitioners to take from today’s episode, it’s this: your edge devices are becoming the new front door.
We’ve spent years hardening endpoints, improving EDR, deploying MFA and moving toward Zero Trust, but attackers are increasingly looking for infrastructure that sits before many of those controls. A compromised VPN appliance, RMM console or cellular gateway can give an attacker legitimate-looking access and a pathway deeper into the environment.
The other major theme today is verification. Installing a patch does not automatically mean a vulnerability has been eliminated. Having MFA does not automatically mean MFA cannot be bypassed. Calling a network private does not mean an attacker cannot reach it. Security teams increasingly need to validate whether controls actually work after implementation rather than simply checking the deployment box.
📰 Today’s Top Stories
“The edge device you forgot about is the one an attacker is counting on.”
🚨 Ransomware Operators Are Actively Exploiting SonicWall SMA 1000 Appliances
We start with SonicWall because this is a patch-now situation for organizations still running vulnerable SMA 1000 appliances. These systems are more commonly found among MSPs and small and midsized organizations than massive enterprises, but that distinction shouldn’t make enterprise CISOs comfortable. Your MSPs and suppliers may be running them, which immediately turns this into a third-party and supply-chain risk.
The vulnerabilities had already been associated with zero-day exploitation before disclosure, with the original threat actor reportedly deploying custom malware including Knuckleball and RootRun. What changed now is that CISA has updated its Known Exploited Vulnerabilities catalog to reflect their use by ransomware operators as well. Shadowserver is tracking more than 380 SMA 1000 appliances still exposed to the internet, although the source material does not establish how many of those systems remain unpatched.
For defenders, patching is only the beginning. I would be reviewing appliance logs going back to the pre-disclosure exploitation window in late June, rotating credentials associated with the appliance and looking for evidence of persistence. And if you’re an MSP operating this infrastructure for customers, this isn’t a “monitor the situation” event. This is a call-your-customers event.
SonicWall has also experienced several security incidents involving its remote access portfolio. We’re not necessarily at the point where the pattern itself becomes the headline but we’re getting closer.
🏥 Fortinet Vulnerabilities Used to Defeat MFA and Extort Organizations
Next comes a joint advisory involving the FBI, CISA, Department of Defense Cyber Crime Center, NSA, Secret Service and South Korea’s National Police Agency. When that many agencies jointly publish guidance around one ransomware operation, practitioners should pay attention.
The group described in the episode is Guinera, also operating under the Golden Community name and using ransomware derived from leaked Conti source code. The operation has targeted healthcare, financial services and government organizations by exploiting two known authentication-bypass vulnerabilities affecting FortiOS and FortiProxy. In one documented intrusion, attackers compromised an SSL VPN administrative account protected only by default credentials and lacking an account lockout policy. They then modified authentication files on a corporate VDI portal so that a specific one-time-password value would authenticate successfully every time. In practical terms, the attackers didn’t break MFA cryptographically—they changed the system implementing MFA so it would accept their authentication.
After initial access, the attackers moved laterally over SMB, harvested credentials from domain controllers, hijacked VPN session cookies and exfiltrated potentially enormous volumes of data before deploying ransomware. Ransom demands routinely exceed $10 million, according to the episode, accompanied by aggressive five-to-seven-day deadlines.
There is one potentially valuable recovery angle: researchers found that the Linux ransomware variant derives encryption material partly from file timestamps, meaning defenders may sometimes be able to reconstruct encryption keys and recover data without paying. That is information incident response teams should understand before somebody reaches for the cryptocurrency wallet.
💀 Microsoft Tracks New Ransomware and Another Patch-Bypass Problem
Microsoft is tracking a China-linked, financially motivated threat actor known as Storm-1175, which has shifted from its previous use of Medusa ransomware toward a newly observed ransomware strain Microsoft calls StormCrypt. The C++ ransomware appends an .encrypted extension to affected files and places a ReadMeFirst.txt ransom note throughout compromised directories.
But the ransomware itself isn’t what concerns me most.
The more important issue is how attackers are getting in.
“Patch verification isn’t optional anymore. It’s the job, and you’ve got to do it, and you’ve got to do it right.” James Azar
Microsoft believes exploitation involves a vulnerability that represents a patch bypass for an earlier security flaw. The group has previously targeted enterprise-facing technologies including N-able N-central, TeamCity and Fortra GoAnywhere, and once initial access is achieved, the timeline from compromise to data theft and encryption can be measured in days rather than weeks. Attackers also use legitimate remote-management utilities including AnyDesk and SimpleHelp, alongside reconnaissance and credential-dumping tools, allowing malicious activity to blend into software defenders routinely see inside enterprise environments.
And this is where security teams need to change their thinking.
A vendor publishing a patch does not necessarily mean the vulnerability lifecycle is finished.
Patch verification is becoming part of vulnerability management.
⚡ Why an Incomplete Security Patch Should Concern Every CISO
I spent some time on today’s show talking about the bigger issue behind the N-central situation because we’re seeing the same pattern increasingly often. Organizations aren’t necessarily being compromised because they ignored patches. Sometimes they applied the vendor’s security update—and the fix itself didn’t fully eliminate the attack path.
That creates a fundamentally different operational challenge.
For an RMM platform such as N-central, the blast radius extends well beyond one organization. Compromise the management platform used by an MSP and suddenly every downstream customer potentially becomes reachable through infrastructure designed specifically to administer their systems.
The vulnerability-to-exploitation timeline has compressed dramatically. What historically unfolded over months increasingly happens in days or even hours. Security teams therefore need telemetry that confirms exploitation has stopped, not simply configuration management data showing that a patch package successfully installed.
⚡ Sandworm Attack on Poland Shows How IT-to-OT Pivoting Really Happens
The most strategically important story today comes from Poland, where CERT Polska published additional details about a destructive attack against a combined heat-and-power facility supporting approximately 50,000 residents. The activity ran alongside previously disclosed Sandworm operations targeting energy infrastructure, and according to the episode, investigators assessed the objective as destructive rather than espionage-driven.
The attack chain is what makes this case essential reading for OT practitioners.
Attackers started with an internet-connected Fortinet VPN/firewall device associated with a wind farm. From there, they pivoted into a cellular router, accessed its administrative interface and abused exposed SSH connectivity to tunnel into a private APN used by the distribution operator to communicate with substation equipment. CERT Polska described this as the first documented case of a private APN being used in this way as an attack vector and warned that similar architectures exist elsewhere.
Once inside, attackers found another gateway with SSH enabled, pivoted deeper into the plant’s OT environment and spent approximately a week conducting reconnaissance. They eventually placed Siemens PLCs into STOP mode, password-protected them and shut down a steam turbine and water-treatment system. Operators recovered by factory-resetting affected PLCs and restoring logic from backups. Heat and electricity ultimately remained available, but the attackers also damaged a gateway device on their way out by corrupting its partition table, potentially destroying useful forensic evidence.
This attack succeeded because several independent assumptions failed simultaneously: the VPN would hold, the cellular router was trusted, the APN was private, SSH exposure would go unnoticed and OT segmentation would prevent meaningful consequences.
That is precisely how sophisticated attack chains work.
🏭 The Operational Consequence of Stopping a Steam Turbine
This story deserves additional context because I spent three years working in the power sector.
Taking a steam turbine offline is not comparable to rebooting a server. Depending on the equipment and circumstances, recovery can require lengthy cooling, inspection, maintenance and restart procedures. An unplanned shutdown can therefore create significant operational and financial consequences.
That is why the Poland incident matters beyond one cyberattack. The attackers got remarkably close to creating a much larger operational problem affecting a system supporting tens of thousands of residents.
Cybersecurity in critical infrastructure isn’t ultimately about protecting Windows boxes.
It’s about keeping physical processes operating safely.
⚡ Quick Hits
🛡️ Cisco Secure Endpoint Inherits Seven ClamAV Vulnerabilities
Cisco is warning that Secure Endpoint Connector deployments across Windows, macOS and Linux are affected by seven vulnerabilities inherited through ClamAV, with proof-of-concept code already available for two of them. No active exploitation was identified in the episode, and no workarounds are available. Updates are rolling out through August, with Windows systems carrying particular risk because ClamAV executes with elevated privileges.
The operational answer is simple: don’t allow these updates to disappear into routine patch queues. Prioritize them as they become available.
🚛 CEVA Logistics Breach Creates Downstream Global Exposure
Shipping and logistics giant CEVA Logistics confirmed a cyberattack beginning July 29 that affected eight European warehouses and exposed customer information downstream to several organizations, including banking, retail and technology customers. Valve is among the organizations notifying Steam hardware buyers that shipping information was exposed.
Confirmed stolen information includes names, addresses, phone numbers and email addresses. The episode notes that CEVA has not yet disclosed the initial access vector or complete scope of the compromise.
This is another reminder that supply-chain data doesn’t remain neatly inside the organization collecting it. If your company uses CEVA, determine whether customer or employee information flowed through affected facilities before waiting for a formal breach notification to tell you.
🇧🇪 Belgian Digital Identity Extension Exposed Banking Customers
Researchers disclosed severe vulnerabilities affecting Belgium’s Connective eID browser extension, used by nearly two million people and eight of the country’s ten largest banks. The vulnerabilities could allow malicious websites to silently access electronic identity and payment-card information, while fraudulent authentication prompts could trick users into disclosing PINs.
A separate remote-code-execution issue could potentially have enabled self-propagating attacks. Fixes shipped in late July, and according to the episode, no CVEs were assigned and there was no evidence of exploitation before disclosure.
For financial institutions, this highlights an overlooked attack surface: browser extensions and middleware supporting authentication can become part of the institution’s effective security perimeter even when another vendor develops them.
📰 LexisNexis Takes Platforms Offline Following Third-Party Server Activity
LexisNexis took its Diligence, Metabase API and Newsdesk platforms offline after detecting unusual activity involving servers managed by a third-party vendor. The company is rebuilding affected environments while working with forensic investigators.
Importantly, the incident is separate from the Metabase Cloud zero-day discussed previously on the podcast. According to the episode, LexisNexis does not use that service. The nature and scope of the activity remain undisclosed.
For customers, this remains primarily a service-availability and vendor-risk issue until additional forensic information becomes available.
🤖 OpenAI Pushes Cybersecurity AI Deeper Into the SOC
And because apparently we cannot get through a CyberHub episode anymore without talking about AI, OpenAI expanded its Daybreak Cyber Defense program with a proposed cybersecurity-focused GPT-5.6 offering aimed at incident response, malware analysis and vulnerability research.
The episode describes trusted partners including Accenture, IBM, CrowdStrike and Cloudflare and positions the effort alongside Anthropic’s broader cybersecurity work. There isn’t an immediate defensive action practitioners need to take from this story. The important development is how quickly frontier cybersecurity models are moving from research environments and vendor pilots toward actual SOC and security-stack integration.
The question isn’t whether AI enters the SOC.
It’s how much authority we eventually allow it to have once it’s there.
💬 Two Memorable Quotes from James Azar
🧠 James Azar’s CISOs Take
What I take away from today’s stories is that edge infrastructure has become one of the most consequential, and inconsistently managed, parts of the enterprise attack surface. We can deploy EDR everywhere, enforce MFA and spend millions building modern SOC capabilities, but if a forgotten VPN gateway, RMM platform or cellular router provides attackers with a trusted pathway around those controls, we’ve built an expensive security program around an unlocked side door. CISOs need accurate inventories of externally exposed infrastructure, clear ownership of every appliance and aggressive remediation requirements for anything that bridges networks. And in OT environments, that needs to include cellular infrastructure, private APNs, engineering interfaces and every device capable of eventually reaching a PLC.
The second issue is verification. A patch being installed doesn’t prove an exploit path disappeared. MFA being enabled doesn’t prove the authentication workflow cannot be modified. A private network doesn’t prove it is isolated. A legitimate remote-management tool doesn’t prove the person using it is legitimate. The vulnerability-to-exploitation window has collapsed, and defenders no longer have the luxury of treating security controls as static accomplishments. We need to patch fast, segment aggressively and then validate that the control actually produced the outcome we expected. The fundamentals haven’t disappeared, they’ve become more important because attackers have become much faster at exploiting every place where we failed to apply them.
🛠️ Action Items
Patch SonicWall SMA 1000 immediately and investigate appliance activity back through the pre-disclosure exploitation window.
Rotate credentials associated with exposed SonicWall infrastructure rather than assuming patching removes existing attacker access.
Validate FortiOS and FortiProxy remediation and audit VPN/VDI authentication files for unauthorized modification.
Test MFA workflows, including account lockout and session-token controls, instead of simply confirming MFA is enabled.
Verify immutable and offline backups now, before ransomware turns backup validation into an incident-response task.
Patch N-able N-central against the latest remediation and do not assume earlier fixes eliminated the full attack path.
Hunt for unauthorized AnyDesk and SimpleHelp deployments and distinguish approved remote-management activity from attacker use.
Inventory every internet-facing VPN, firewall, RMM and edge appliance and establish clear technical ownership.
Review OT connectivity through cellular routers and private APNs and remove unnecessary administrative access and exposed SSH.
Validate IT/OT segmentation by testing whether a compromised edge appliance can ultimately reach PLC or engineering networks.
Prioritize Cisco Secure Endpoint updates as the ClamAV fixes become available.
Review CEVA Logistics exposure if customer or employee information moves through its European operations.
Update Connective eID components where relevant and review browser-extension dependencies involved in authentication.
Track LexisNexis service restoration and forensic findings if your organization depends on affected services.
Begin governance planning for cybersecurity AI models before frontier models become deeply embedded in SOC workflows.
Stay Cyber Safe.
