In today’s cybersecurity news…
Dutch teenagers arrested for attempted espionage for Russia
The two were arrested by Dutch police on Monday. According to the Dutch newspaper De Telegraaf, the teens used a WiFi sniffer device near the offices of the European law enforcement agency Europol as well as those of Eurojust, the Union Agency for Criminal Justice Cooperation offices, and the Canadian embassy in The Hague. There are no signs of a compromise on any of the agencies’ systems. The boys were allegedly recruited over Telegram and were arrested following a tip from the country’s intelligence service, the General Intelligence and Security Service (AIVD). BleepingComputer adds that this case “marks an escalation to lower-level recruitment cases seen elsewhere in Europe, for example in Germany, where young people were paid by Russian agents to perform acts of vandalism and sabotage on critical infrastructure.
DoD announces replacement for risk management framework
The Department of Defense has unveiled a new five-phase framework for assessing cyber risks on its networks. Named the Cybersecurity Risk Management Construct, it has been designed to replace the older Risk Management Framework, which is described as being “overly reliant on static checklists and manual processes that failed to account for operational needs and cyber survivability requirements.” A statement from the department says, “the CSRMC addresses these gaps by shifting from ‘snapshot in time’ assessments to dynamic, automated, and continuous risk management, enabling cyber defense at the speed of relevance required for modern warfare.” A layout of its five-phased lifecycle plus further details is available as a link to the report in the show notes to this episode.
Fake Microsoft Teams installers deliver Oyster malware
Hackers have using SEO poisoning and search engine advertisements, also called malvertising, to “promote fake Microsoft Teams installers that infect Windows devices with the Oyster backdoor, providing initial access to corporate networks.” Oyster malware, also known as Broomstick and CleanUpLoader, is a backdoor that first appeared in mid-2023 and has since been linked to multiple campaigns, providing attackers “with remote access to infected devices, allowing them to execute commands, deploy additional payloads, and transfer files.” Ransomware operations, including like Rhysida, have also utilized the malware to breach corporate networks.
Huge thanks to our sponsor, Nudge Security
What if you could continuously discover when people start using new apps or sharing data, then prompt them with security guidance right when and where they are working?
At Nudge Security, we call that securing the Workforce Edge. Instead of trying to control everything (which, let’s face it, is impossible), we give IT and security teams the visibility they need and automation to guide employees toward secure behaviors.
The result? Your workforce stays productive, your data stays secure, and you can finally get some sleep at night. Learn more at nudgesecurity.com/workforceedge
Union County suffers cyberattack
In this most recently announced local government attack, hackers stole data including Social Security numbers, financial information, driver’s license numbers, fingerprint data, medical information, and passport numbers. The attack occurred on May 18 and impacts around 45,000 people. No ransomware gang has yet taken credit for the attack.
Experts express concern over maximum severity GoAnywhere defect
Following up on a story we covered last week, cybersecurity experts are voicing concern over a maximum-severity flaw in Forta’s GoAnywhere MFT file-transfer service. While Forta claims it found the vulnerability (CVE-2025-10035) during a Sept. 11 security check and has not confirmed active exploitation, researchers at watchTowr say they have credible evidence of attacks dating back to Sept. 10. The conflicting accounts highlight ongoing challenges in vulnerability disclosure, especially when vendors downplay severity or exploitation status. Forta’s advisory, criticized for lacking clarity, was later updated with indicators of compromise and stack traces that suggest impacted customers could confirm if their systems had been breached.
UK Prime Minister to unveil digital ID cards
UK Prime Minister Keir Starmer is set to announce plans requiring all working adults to hold digital ID cards, dubbed “Brit cards,” as part of efforts to curb illegal migration. The proposal, which would need new legislation, has already drawn criticism from civil liberties and privacy groups. Downing Street argues the measure is essential to ensure only those with legal rights can work, suggesting public opinion has shifted since Tony Blair’s abandoned ID card initiative in the 2000s.
Cisco warns of ASA zero-day duo under attack
Cisco is “urging customers to patch two security flaws impacting the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software, which it said have been exploited in the wild.” These zero-day vulnerabilities have CVE numbers and have CVSS scores of 9.9 and 6.5 respectively. Cisco said “it is aware of attempted exploitation of both vulnerabilities, but did not reveal who may be behind it, or how widespread the attacks are.”