This Week in Cybersecurity #16
Your Weekend Briefing: From SharePoint Zero-Days to Ransomware Reality Checks and everything in the middle from the Chief information security officer perspective
Hey there, cyber Gang!
If you've been following the CyberHub podcast this week, you know it's been an absolute rollercoaster in the cybersecurity world. For those just tuning in or catching up over your weekend coffee ☕, buckle up - because this week had everything from nation-state shenanigans to ransomware gangs literally patching vulnerabilities to keep other bad guys out of "their" systems. You can't make this stuff up!
Whether you caught us live at 9 AM Eastern or you're one of our amazing newsletter subscribers getting the weekend wrap-up, this summary is your one-stop shop for all the cyber chaos that went down. We're talking major enterprise breaches, geopolitical cyber warfare that reads like a Tom Clancy novel, and some seriously sophisticated attacks that'll make you rethink everything you thought you knew about defense.
So grab your favorite beverage, settle in, and let's dive into this week's cyber madness. Trust me, by the time we're done here, you'll have everything you need to walk into Monday morning like the informed security professional you are.
Ready? Let's get into it! 🚀
🏢 Major Enterprise Breaches
Workday & Salesforce Campaign: Scattered Spider and ShinyHunters targeted multiple enterprises including Workday, Allianz Life (1.1M records), Adidas, and Cisco through credential-focused attacks exploiting weak MFA setups. Attackers impersonated IT/HR staff for phishing and blackmail campaigns.
Telecom Under Fire: Colt Technology Services faced Warlock ransomware demanding $200K for 1M stolen documents, while Orange Belgium lost 850K customer records including PUK codes—a goldmine for telecom fraud. Australia's TPG Telecom also suffered a breach affecting 280K email addresses.
Critical Infrastructure: Indiana-based drug research firm Inotive remains offline after Qillin ransomware leaked 176GB of oncology research data, highlighting healthcare sector vulnerabilities.
🌐 Nation-State & Geopolitical Attacks
SharePoint Zero-Day Spree: Microsoft SharePoint vulnerability (CVE-2025-53770) compromised the Canadian House of Commons and multiple UK organizations, with attackers accessing employee databases and asset details.
North Korean Embassy Campaign: Kimsuky group used XenoRAT malware to target foreign embassies in Seoul via multilingual spear-phishing, leveraging GitHub as covert C2 infrastructure.
"If you're still teaching people to look for spelling mistakes, we're going to lose this game. It's really, really sophisticated, and you've got to have defense in depth here." James Azar this Week
Russian Infrastructure Targeting: Moscow escalated attacks on European water utilities, opening dam valves in Poland/Norway, while Static Tundra exploited 7-year-old Cisco vulnerabilities for persistent telecom access.
🔐 Critical Vulnerabilities & Patches
Immediate Action Required: Apple released emergency patches for CVE-2025-43300 (actively exploited spyware), while Chrome/Firefox patched AI-discovered bugs. SAP NetWeaver exploit chains are being leveraged by RansomEXX and BianLian ransomware groups.
Legacy System Risks: Apache ActiveMQ attackers are patching vulnerabilities themselves after exploitation to maintain exclusive access—a new tactic showing adversary sophistication.
"Time to patch, time to mitigate. That's your maturity. Those are the two you need to focus on. Everything else, AI, all of that – those are all complementary to the fact that initial access always either starts with a zero-day vulnerability on an unpatched server or unmanaged identities effectively." James Azar this week
💰 Financial Crime & Enforcement
Crypto Targeting: Turkish exchange BTC Turk lost $49M from hot wallets, while DOJ seized $2.8M from Zeppelin ransomware operators and Treasury sanctioned Russian crypto exchange Grinex.
Emerging Threats: Password manager clickjacking affects 11 major platforms including 1Password and Bitwarden, while AI-powered website builders are being abused for mass phishing campaigns.
⚡ Quick Action Items
🛡️ Patch immediately: SharePoint (CVE-2025-53770), Apple devices (CVE-2025-43300), Chrome/Firefox
🔐 Strengthen MFA across all SaaS platforms, especially Salesforce/Workday
🌊 Audit critical infrastructure - water utilities, telecoms, legacy Cisco devices
💻 Review password manager settings and educate on clickjacking risks
📡 Monitor GitHub/Dropbox traffic for covert C2 activity
🏥 Enhance healthcare/pharma ransomware resilience planning
🧠 James Azar's CISO Take
Today's breaches reinforce that our security fundamentals remain broken. Whether it's SharePoint zero-days, Salesforce abuse, or crypto theft, attackers don't need sophisticated techniques—they exploit unpatched systems and weak MFA, then move laterally until they find value. The metric every CISO must live by is "time to patch, time to mitigate." Everything else—AI, advanced threat detection—is complementary to fixing these core gaps. Organizations treating patch cycles and identity governance as afterthoughts will continue falling victim to basic attacks.
The geopolitical dimension is equally critical. From China's Taiwan campaigns to Russian water utility attacks, cyber has become inseparable from global strategy. Techniques tested on battlefields inevitably migrate to civilian cybercriminal playbooks. CISOs must elevate these risks to board level and align cyber strategy with geopolitical realities. If your resilience planning doesn't account for both direct attacks and indirect geopolitical shocks, you're already behind the curve.
Stay Cyber Safe, Security Gang!
Thanks for tuning in. We'll be back Monday at 9 AM Eastern Live!