The most damaging incidents this week came from the mundane: default settings, firmware flaws, and social engineering. A widespread campaign highlighted how a Chinese state-linked hacking group is abusing compromised routers to act as covert proxies, intercepting traffic and harvesting credentials before meticulously scrubbing log files to erase their tracks. In another notable development, researchers demonstrated that AI agents can be manipulated into going off-task, ignoring their core directives when prompted with specific inputs. This raises serious concerns about the reliability of autonomous systems in enterprise environments where they are increasingly granted access to sensitive data. A critical backdoor was also discovered in a widely used router model, which shipped with a pre-configured listening service, allowing attackers immediate remote access without authentication. Similarly, a new phishing tactic involved sending fake checks to victims, tricking them into installing malware themselves under the guise of a "verification" step. Multiple older vulnerabilities were chained together to form new attack vectors, bypassing existing security patches. The week also saw an uptick in malicious fake applications on third-party stores, a resurgence of "helpful" tech support call scams, and the availability of cheap, off-the-shelf banking trojan kits on the dark web. Key takeaways from the week include: Chinese Spy Proxy: Routers compromised by a Chinese hacking group are being used as stealth proxies to capture traffic and steal passwords while actively removing logs. AI Agents: Proof-of-concept attacks show AI agents can be prompted to abandon their assigned tasks, potentially leading to unintended actions. Router Backdoors: A specific router model was found to have a backdoor account and listening service enabled by default, granting instant access to the network. Fake Check Scams: Cybercriminals are mailing physical checks to targets, which when deposited, trigger a call to fake support that guides the victim into installing remote access malware. Source: The Hacker News Given the prevalence of router-based attacks, is your organization auditing its edge devices for unauthorized listening services or default credentials?

Threat actors linked to the Aurora (aka Aur0ra) ransomware operation have been caught leveraging Cursor, an AI-powered coding assistant developed by SpaceX, to facilitate intrusions into corporate networks. This finding comes from two separate analyses conducted by CloudSEK and Gambit Security, which based their reports on exposed infrastructure tied to the Russian-speaking cybercrime group. The investigation revealed that the operators are not only using conventional initial access methods but are also incorporating AI-assisted tooling to streamline their attack lifecycle. Cursor, which is designed to help developers write and debug code, is being repurposed by the threat actors to automate malicious script generation, refine payloads, and potentially speed up the exploitation of misconfigurations. The attackers reportedly used Cursor to assist with writing custom code for privilege escalation and lateral movement. The AI tool was also used to modify or obfuscate existing malware templates, making detection more difficult for signature-based security controls. Both research teams independently noted that the group's reliance on AI tools appears to be a growing trend among financially motivated cybercriminals. At the time of reporting, the Aurora group has successfully compromised at least 10 distinct targets, although the specific industries and geographic locations of the victims were not fully disclosed. The use of AI in this context highlights a shifting threat landscape where even non-state actors can access advanced development aids to lower the technical barrier for sophisticated attacks. Organizations are advised to review their endpoint detection rules for unusual execution of AI-assisted code generation tools and to monitor for any unauthorized installations of development utilities on production systems. Source: The Hacker News Has your security team started monitoring for AI-driven tool usage in your environment, or are you relying solely on traditional behavioral detection against these evolving threats?

Claude Code operates with broad permissions—reading files, executing shell commands, invoking MCP tools, and acting through the credentials present on a developer’s machine. Anthropic’s new Compliance API endpoints provide security teams with their clearest visibility yet into that activity, but they also highlight a deeper issue: activity logs alone cannot verify whether an agent’s access is actually legitimate. As AI workloads shift from isolated browser sessions to local development environments, the attack surface expands significantly. The Compliance API introduces capabilities for auditing agent actions, capturing session telemetry, and exporting usage data for SIEM ingestion. This marks a critical step toward observability, yet it also raises governance questions around identity and authorization. Key details from the announcement: The API provides programmatic access to Claude Code session logs, including commands executed, files accessed, and tool invocations. Endpoints support filtering by time range, user, and session ID to assist with incident investigations. Data is designed to integrate with existing security information and event management (SIEM) workflows. The focus remains on post-hoc visibility rather than real-time prevention or permission enforcement. The practical implication for organizations is that monitoring alone is insufficient. Security teams need to pair these logs with robust identity governance—ensuring that the credentials Claude Code uses are scoped, reviewed, and rotated like any other privileged access. Without that, the audit trail shows what happened, but not whether it should have happened at all. Source: The Hacker News Is your team planning to deploy the Compliance API for agent auditing, and how are you aligning it with your existing identity and access management policies?

Two security flaws in PaperCut NG and PaperCut MF — patched last week after being exploited in the wild — are now being leveraged in active data theft campaigns. The vulnerabilities, which were previously used as zero-days, allow attackers to gain unauthorized access to affected print management servers. The attacks reportedly follow a pattern where threat actors exploit the flaws to bypass authentication and execute arbitrary code. Once access is obtained, the attackers move laterally within the network to locate and exfiltrate sensitive documents, often targeting print queues and stored files. The print management software is widely deployed in enterprise environments, making these attacks particularly concerning for organizations that have not yet applied the updates. Affected software: PaperCut NG and PaperCut MF Patches: Released last week by the vendor Attack vector: Exploitation of the zero-day flaws leads to remote code execution and unauthorized data access Observed activity: Post-exploitation actions include data theft, with no ransomware or destructive behavior confirmed so far Administrators are strongly advised to verify that the latest patched versions are installed across all servers. In addition, monitoring print server logs for unusual login attempts or unexpected file access patterns is recommended. Network segmentation and restricting access to management interfaces can also reduce exposure. Source: Unknown Has your organization already applied the latest PaperCut patches, or are you still assessing exposure to these zero-day exploits?

Five Venezuelan nationals have pleaded guilty to their involvement in a series of ATM jackpotting attacks across the United States, admitting to attempting to drain cash from automated teller machines using malware. The group reportedly targeted standalone ATMs, often located in pharmacies and retail stores, by physically accessing the machines and deploying malicious payloads to force them to dispense cash. The attacks, which took place over several months, involved the actors installing malware on the target ATMs and using special tools to trigger what is known as a "jackpotting" sequence — a technique that effectively turns the machine into a cash dispenser without requiring a card. Court documents indicate the group operated in coordination, with some members acting as installers and others serving as drivers or lookouts during the heists. The defendants now face sentencing after entering their guilty pleas, with each potentially facing years in federal prison. The case highlights the ongoing threat posed by organized groups using hardware and software tools to compromise physical banking infrastructure, a trend that has prompted increased security measures by ATM manufacturers and financial institutions. Key details from the case include: The defendants are all Venezuelan nationals, though no further personal identifiers were provided in the plea agreements. The jackpotting method used in these attacks is consistent with known malware families designed specifically for ATM compromise, though no specific CVE or advisory identifier was cited in the reporting. The group is believed to have targeted ATMs across multiple U.S. states, with losses mitigated by rapid response from law enforcement and ATM operators. Sentencing hearings have not yet been scheduled, but the guilty pleas are expected to expedite the legal proceedings. Source: BleepingComputer Is your organization taking any extra precautions to secure standalone ATMs against physical tampering and malware-based jackpotting attacks?

The most common way into a company last year wasn't a sophisticated zero-day exploit—it was simply asking the user to run a command. A web page instructs a visitor to prove they are not a robot. While the instructions are being read, a malicious command is silently copied to the clipboard. The page then walks the victim through opening a terminal (Windows Run dialog, macOS Terminal, or Linux terminal) and pasting the contents. This technique, known as ClickFix, was the most prevalent initial access method observed by Microsoft's threat intelligence team last year. ClickFix is a prime example of the shift in attacker behavior. Threat actors aren't necessarily pursuing more complex or "better" attacks; they are optimizing for repeatable, reliable social engineering. The attack chain relies on psychological coercion and user trust, bypassing traditional email security gateways entirely. Key characteristics of this trend include: Social engineering is the primary vector, targeting the human element rather than technical vulnerabilities. The attack is platform-agnostic, working across Windows, macOS, and Linux as long as the user follows the prompts. Malicious payloads often include info-stealers or remote access trojans (RATs) delivered via the pasted command. Microsoft’s data indicates this method has outpaced traditional phishing links and malicious attachments in observed volume. Because the command is pasted directly by the user, it often bypasses endpoint detection rules that monitor for file downloads or browser-based exploits. Security teams are encouraged to focus on user education regarding console commands and to monitor for unusual powershell, cmd, or bash execution patterns. Source: The Hacker News Has your organization updated its user training to specifically address "paste-and-run" social engineering tactics like ClickFix, or are you relying on endpoint detection to catch the payload after it lands?

Healthtech firm Novocure has confirmed that a cyberattack in mid-August exposed the personal data of more than 1,400 U.S. cancer patients, along with an undisclosed number of its employees. The company, which specializes in tumor-treating电场 therapy devices, said the breach involved unauthorized access to internal systems. The exposed information varies by individual but may include names, contact details, dates of birth, and clinical or treatment-related data. For employees, the compromised records could involve payroll or benefits information. Novocure stated that the attackers accessed the systems during a limited window, and the company has since taken steps to contain the incident. Affected patient population: more than 1,400 U.S. patients Breach timeframe: mid-August Data types potentially exposed: names, contact information, clinical data (patients); financial/HR data (employees) Novocure has begun notifying affected individuals and regulators, though it has not yet disclosed the exact attack vector or whether ransomware was involved. The company is offering credit monitoring and identity protection services to those impacted. No evidence of data misuse has been reported so far, but Novocure advises affected patients to remain vigilant against phishing or fraud attempts. Source: Unknown Is your organization prepared to handle a breach that exposes both patient and employee data, and what specific steps are you taking to secure clinical information in particular?

Attackers compromised the update chain for Virtualizor, a web-based VPS control panel, by hijacking BGP routes tied to the software’s update infrastructure. This allowed them to intercept legitimate update requests and redirect them to attacker-controlled servers, which served malicious payloads in place of genuine patches. The incident underscores a broader risk: even signed updates can be weaponized if the distribution path is subverted. While the exact scope of affected users remains unclear, administrators running Virtualizor should treat any recent update as potentially compromised until verified against official checksums or re-downloaded from a trusted, out-of-band source. Key points for administrators: The attack relied on BGP hijacking to reroute traffic destined for the vendor’s update servers. No specific CVE or patch identifier was disclosed in the public report, so verification should focus on file integrity and server-side logs. If you have applied a Virtualizor update recently, review your system for unexpected processes, new cron jobs, or modified startup scripts. Check your BGP observability tools or ISP for any route anomalies during the suspected window. Consider manual re-installation from the official website after confirming DNS and network paths are clean. This incident highlights how infrastructure-level attacks can bypass endpoint defenses. Even robust code-signing does not help if the transport layer is silently rerouted. Source: Unknown Has your organization implemented any specific monitoring for BGP anomalies or update-channel integrity after incidents like this?

Threat actors are actively exploiting two critical vulnerabilities in Langflow and Ruby on Rails, according to new findings from VulnCheck. The attacks are being used for credential probing and command-and-control (C2) operations, signaling a shift from simple exploitation to active, multi-stage campaigns. CVE-2026-0768 (CVSS score: 9.8): A flaw in Langflow caused by improper validation of user-supplied input, allowing attackers to execute arbitrary Python code in the context of the root user. CVE-2026-66066: A critical vulnerability in Ruby on Rails that is also being leveraged in the wild, though specific technical details regarding the exploitation vector were not disclosed in the report. The exploitation of these flaws highlights the urgency for administrators to patch affected systems immediately. For Langflow, the arbitrary code execution risk is particularly severe given the root-level privileges. For Ruby on Rails, the C2 activity suggests the flaw is being used to establish persistent access, likely targeting web-facing applications. If you are running vulnerable versions, consider the following immediate actions: Apply vendor-provided patches or updates as soon as they are available. Monitor logs for unusual outbound network connections tied to C2 behavior. Restrict access to management interfaces for Langflow and related services. Audit user accounts for signs of credential harvesting. Source: The Hacker News Given the root-level execution risk in Langflow, has your team already prioritized patching these instances, or are you relying on network segmentation to mitigate exposure?

Aesto Health, operating as Aesto LLC, has disclosed a data breach impacting more than 9.5 million individuals. The incident was discovered recently, and the company has since initiated a response to contain the exposure and notify affected parties. While the exact attack vector has not been fully detailed in public statements, the scale of the compromise suggests a significant intrusion into their systems. The affected data potentially includes sensitive personal and health-related information, which raises serious concerns for the millions of patients involved. Aesto Health is reportedly working with cybersecurity experts and law enforcement to investigate the breach. They are also in the process of notifying regulatory bodies and offering credit monitoring or identity protection services to those impacted, as is standard in such incidents. For affected individuals, the following steps are commonly recommended: Monitor bank and insurance statements for any unauthorized activity. Place a fraud alert or credit freeze with major credit bureaus. Be cautious of phishing emails that may reference the breach to extract further information. The full scope of the data accessed is still under review, but the 9.5 million figure places this among the larger healthcare breaches this year. Patients are advised to assume their information was compromised and act accordingly. Source: BleepingComputer Given the scale of this incident, is your organization reviewing its third-party health data handling agreements in light of this Aesto Health breach?

Phishing actors are abusing the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install ScreenConnect remote support software. The attack chain leverages the trusted nature of Faronics Deploy, which is designed for IT administrators to manage endpoints, making the malicious activity harder to detect by security tools and users alike. The campaign begins with a phishing email that tricks the recipient into running a malicious script or executable. Once executed, the malware connects to the Faronics Deploy service using stolen or misappropriated credentials, effectively turning the victim's machine into a managed endpoint under the attacker's control. From there, the attackers silently deploy ScreenConnect, a legitimate remote access tool, to establish persistent interactive access to the compromised system. Key technical details of the attack include: The abuse of Faronics Deploy's legitimate administrative functions to bypass application allowlisting and endpoint detection and response (EDR) products. ScreenConnect is installed without user interaction, using the platform's deployment mechanisms rather than typical droppers or loaders. The attackers use the remote access session to perform follow-up actions such as credential harvesting, data exfiltration, or deploying additional payloads. Faronics Deploy is not compromised; rather, the attackers are abusing valid accounts, likely obtained through phishing or infostealer malware. Indicators that an environment may have been targeted include: Unexpected Faronics Deploy agent enrollment for machines that are not part of an organization's legitimate deployment setup. Unusual ScreenConnect client installations appearing on endpoints without corresponding IT helpdesk activity. Outbound network connections to Faronics and ScreenConnect infrastructure originating from non-admin workstations. To mitigate this threat, administrators should: Audit all Faronics Deploy accounts for unrecognized users or roles and enforce multi-factor authentication. Restrict ScreenConnect installation and execution to authorized administrative accounts only, using application controls where possible. Monitor for new endpoint management enrollments and remote support sessions in logs, correlating them with helpdesk tickets. Review email gateway rules for phishing lures that reference IT support or remote access tools. This campaign highlights a growing trend: attackers increasingly abuse legitimate remote management and support tools to blend in with normal administrative activity, making detection reliant on behavioral analysis rather than signature-based defenses. Source: BleepingComputer Is your organization auditing for unauthorized enrollments in remote management platforms like Faronics Deploy, or are you relying on EDR rules to catch this behavior post-installation?

Attackers increasingly route malicious traffic through residential proxies, VPNs, and other anonymizing infrastructure, which makes high-risk sessions look nearly identical to legitimate user activity. Traditional edge security controls, no matter how well-tuned, often fail to flag these sessions because they lack sufficient context about the network and the requesting client. Spur highlights that the core issue is a blind spot in how enforcements are made. To close this gap, session enrichment adds critical data points—such as whether an IP address belongs to a known proxy, a hosting provider, or a residential network—so security teams can assess risk with greater precision. With this additional context, organizations can move beyond basic allow/deny decisions and enforce policies based on the actual trustworthiness of a session. Key takeaways from the analysis: Session enrichment reveals the true nature of the IP address behind each request (e.g., residential vs. hosting vs. proxy). It helps detect when attackers use legitimate-looking but suspicious infrastructure, including VPNs and anonymized residential networks. Enriched data enables more granular enforcement, such as forcing additional authentication or blocking high-risk sessions entirely. This approach complements existing edge security tools rather than replacing them, reducing false positives while improving threat detection. The bottom line: edge security alone is no longer enough. Adding session context is becoming essential for identifying high-risk traffic that otherwise blends in with normal user behavior. Source: Unknown Has your organization integrated session enrichment into its security stack yet, or are you still relying on edge controls alone to spot these disguised high-risk sessions?

Nearly 22,000 internet-exposed Microsoft Exchange servers are still running unpatched builds, leaving them open to a high-severity authentication bypass that can let an attacker take over every mailbox on the system. The flaw allows remote exploitation without valid credentials, effectively granting full control over user accounts and mail data. The vulnerable versions remain exposed despite patches being available for some time. Administrators are urged to check their Exchange Server builds against the latest cumulative updates, as the attack vector does not require any user interaction. Successful exploitation can lead to data theft, mailbox hijacking, and further lateral movement inside a corporate network. Affected component: Exchange Server authentication mechanism Impact: Full mailbox takeover, unauthorized access to emails and attachments Attack vector: Remote, unauthenticated Mitigation steps include: Apply the latest Exchange Server cumulative updates immediately Verify no unknown or rogue accounts have been added since exposure Review IIS logs for suspicious authentication entries or anomaly patterns Restrict remote access to Exchange endpoints where possible If patching is not immediately feasible, administrators should consider placing Exchange servers behind a VPN or additional access controls to reduce exposure. Source: Unknown Is your organization among the exposed instances, and are you prioritizing the patch rollout or adding temporary access restrictions first?

Threat actors are actively exploiting a critical authentication bypass vulnerability in JFrog Artifactory, just days after it was publicly disclosed. Security researchers at [watchTowr] have observed the flaw being leveraged in the wild to compromise instances. The vulnerability, tracked as CVE-2026-82329 with a CVSS score of 9.8, stems from an authentication weakness in the software's default configuration. Successful exploitation allows an unauthenticated attacker to bypass security checks entirely, granting them administrative access to the Artifactory instance. Once an attacker gains admin privileges, they can perform a range of high-impact actions, including: Generating persistent admin tokens for long-term, stealthy access. Modifying repository configurations or injecting malicious code into artifacts. Potentially exfiltrating sensitive binaries and metadata stored within the registry. Given the high CVSS score and the speed at which exploitation was observed, immediate action is critical for any organization running Artifactory. Prioritize patching your JFrog Artifactory instances to the latest available version immediately. Audit existing admin accounts and generated tokens for any signs of unauthorized creation or modification. Review access logs for suspicious activity, particularly from unknown IP addresses, occurring around or after the disclosure date. If you are unable to patch immediately, consider restricting network access to the Artifactory admin interface as a temporary mitigation. Source: The Hacker News Is your team patching this directly, or are you relying on cloud-managed updates for your Artifactory instances?

Brazilian financial services, retail, and e-commerce organizations have been under attack since 2024 by a financially motivated threat actor known as Breeze Comet (formerly UNC5669). Researchers from Google Threat Intelligence Group (GTIG) and Mandiant characterize the group as specialized in tampering with payment systems and banking software within Brazil to enable unauthorized transfers. The campaign focuses on manipulating transaction flows at the point of sale or within backend banking integrations. While the exact initial access vector is not detailed in public reporting, the attackers demonstrate deep familiarity with Brazilian payment infrastructure and compliance frameworks. Key operational details disclosed so far include: Activity concentrated exclusively on Brazilian entities across financial services, retail, and e-commerce verticals. The ability to execute hundreds of fraudulent transactions per campaign, indicating automated or semi-automated exploitation of payment logic. Targeting of banking software and payment gateways rather than traditional endpoint malware. A clear financial motive, with no evidence of espionage or data theft beyond what is necessary for payment fraud. Breeze Comet’s tradecraft suggests a deliberate focus on the unique characteristics of Brazilian banking, including Pix instant payments and local card processing rules. The group appears to have evaded widespread detection by operating within legitimate transaction volumes, making anomaly-based monitoring particularly challenging. Affected organizations are advised to review payment gateway logs for irregular sequence patterns and to validate any changes to bank routing configurations. Source: The Hacker News Given the heavy reliance on Pix and local payment rails, how is your organization detecting anomalies in high-frequency transaction streams without drowning in false positives?

International law enforcement agencies and private sector partners have dismantled infrastructure tied to the Sality botnet, a long-running peer-to-peer (P2P) malware operation. The coordinated action targeted the command-and-control nodes and distribution channels that have kept the botnet active for over two decades. First observed in 2003, Sality is known for its modular design, enabling it to deliver additional payloads such as ransomware, credential stealers, and cryptocurrency miners. Its P2P architecture has made it notoriously resilient, as no single centralized server is required for communication between infected machines. The takedown involved seizing domains and sinkholing traffic, effectively cutting off the botnet’s ability to receive updated instructions from its operators. Key technical aspects of the operation include: Seizure of domains used for payload distribution and malware updates. Sinkholing of P2P communication channels to isolate infected devices. Coordination between multiple national cybercrime units and cybersecurity firms. The exact scope of infected devices remains unclear, but prior research estimated that Sality has infected hundreds of thousands of machines globally, with a heavy concentration in Latin America and Eastern Europe. The malware is often propagated via infected removable drives and malicious email attachments, exploiting weak or reused credentials to spread across networks. While the infrastructure disruption is significant, experts note that the Sality codebase is publicly available and highly adaptable. Victims whose systems are still infected will not be automatically cleaned by this action; they must manually remove the malware and patch the vulnerabilities that allowed the initial compromise. Organizations are advised to review network logs for connections to known Sality P2P endpoints and to disable autorun functionality on removable media. Source: BleepingComputer Given that Sality infections often persist on legacy systems, is your organization actively auditing endpoints for P2P communication patterns, or relying on endpoint protection alone?

Microsoft is currently investigating a defect in Defender for Office 365 that is causing the security platform to incorrectly flag and block legitimate Google search links as malicious. The issue appears to affect users who click on organic search results, with Defender intercepting the navigation and presenting a warning page instead of allowing the request through. The problem does not seem to originate from the destination websites themselves, but rather from the way Google formats its redirect URLs. When a user clicks a search result, Google briefly routes the request through a tracking or forwarding prefix before sending the user to the final page. Defender for Office 365 is reportedly misreading this standard URL structure as a potential phishing or malware vector, leading to false positives. Microsoft has acknowledged the reports and stated that its team is actively investigating the root cause. While no workaround has been officially provided yet, administrators experiencing this issue have noted that temporarily disabling URL detonation or link safety checks in the security policy may restore normal functionality—though this is not recommended as a long-term solution due to the increased risk. Affected users are encouraged to monitor the Microsoft 365 admin center for service health notifications. The company has not yet specified a timeline for a permanent fix. Affected service: Defender for Office 365 (link and URL protection features) Trigger: Clicking legitimate Google search result links Current status: Under active investigation by Microsoft Temporary mitigation (not advised long-term): Disabling link safety checks in security policies Source: Unknown Has your organization encountered this false-positive issue with Defender for Office 365, and are you applying any interim filtering rules while waiting for the official patch?

A California federal grand jury has indicted a Russian national for orchestrating a large-scale phishing campaign that compromised approximately 80,000 freelancers. The operation deployed TVRAT and DarkVNC malware to hijack accounts and steal funds, with the indictment detailing a multi-year scheme that preyed on remote workers. The attack chain reportedly began with legitimate-looking phishing emails designed to lure victims into downloading a malicious attachment or visiting a fake login page. Once delivered, the dual-malware payload functioned as a remote access toolkit: TVRAT acted as the primary backdoor for command-and-control, while DarkVNC provided live screen capture and keystroke logging capabilities. Together, the tools allowed the attacker to wait for freelancers to log into financial or work-related portals, then perform unauthorized wire transfers directly from the victim’s session. The indictment covers the suspect’s alleged use of money mules and cryptocurrency exchanges to launder the proceeds. It also highlights how the freelancer community, often dependent on platforms without corporate endpoint protection, became a prime target for these thefts. Authorities have urged gig-economy workers to enable hardware-based two-factor authentication and to treat unsolicited job-related messages with suspicion. Source: BleepingComputer For those of you operating as independent contractors or managing remote teams, how are you enforcing phishing resistance outside a traditional corporate perimeter?

Ransomware resilience is no longer just about having backups or a solid endpoint detection tool in place — managed service providers need a layered strategy that they actively test across every client environment. Acronis highlights six core capabilities that should be part of any MSP’s recovery playbook, focusing on reducing exposure, detecting threats early, and preserving clean recovery points. While the full details of the checklist go deeper, the key takeaway is that protection must be verified under real-world conditions. For MSPs, this means routinely simulating attacks to confirm that detection triggers correctly, that backup chains remain intact, and that restoration workflows actually meet recovery time objectives. Simply deploying tools is not enough — you have to prove they work together when it matters most. Reduce attack surface by hardening client endpoints and patching known vulnerabilities. Detect active threats quickly using behavioral analysis and continuous monitoring. Preserve recovery points by using immutable or write-once storage to stop ransomware from encrypting backups. Test restoration processes regularly to ensure critical systems can be brought back online fast. Verify that backup integrity checks are automated and run consistently across all client environments. Align recovery speed with business expectations, factoring in both recovery time objectives and recovery point objectives. The emphasis on testing is what separates a documented plan from a practical one. If you haven’t already, run a tabletop exercise or a live restore drill with your largest client to identify gaps before an actual incident forces the issue. Source: BleepingComputer Is your team actively running restore drills across all client environments, or is testing limited to only a few key accounts?

Dropbox has begun notifying a subset of users that their accounts were accessed without authorization. The breach stems from a vulnerability in Lenovo’s email verification process, which allowed an attacker to register fraudulent Lenovo IDs tied to victims’ email addresses. By exploiting this flaw, the threat actor was able to use those fraudulent Lenovo accounts to gain entry into linked Dropbox accounts. Once inside, they potentially accessed stored files, though Dropbox has not indicated how many users were impacted or what specific data may have been exposed. Dropbox has stated that it has no evidence that its own systems were compromised, and the root cause lies entirely with the Lenovo verification weakness. The company is advising affected users to take precautionary steps, including: Resetting passwords and revoking active sessions Reviewing connected apps and third-party access Enabling two-factor authentication (2FA) if not already active Lenovo has not yet issued a public advisory detailing the flaw or its patch status. Dropbox’s notification does not include a specific CVE identifier for the underlying issue, so the exact technical reference remains undisclosed. This incident highlights how authentication flaws in one service can cascade into breaches in unrelated platforms that rely on email verification as a trust anchor. Source: Unknown Has your organization reviewed whether any linked third-party email verification processes could expose your cloud storage accounts in a similar way?