This week’s Cyber Security Headlines – Week in Review is hosted by Rich Stroffolino with guests Tom Hollingsworth, networking technology advisor, The Futurum Group, as well as on BlueSky, and Brett Conlon, CISO, American Century Investments
Missed the live show? Check it out on YouTube
Cyber Security Headlines – Week in Review is live every Friday at 12:30pm PT/3:30pm ET. Join us each week by registering for the open discussion at CISOSeries.com
Velociraptor forensics tool becomes LockBit ransomware weapon
Once again, the Velociraptor open-source digital forensics and incident response (DFIR) tool is being used in connection with ransomware attacks, this time likely orchestrated by the group Storm-2603 which is known for deploying the Warlock and LockBit ransomware. Researchers at Sophos suggest that “the attackers weaponized the on-premises SharePoint vulnerabilities known as ToolShell to obtain initial access and deliver an outdated version of Velociraptor (version 0.73.4.0) that’s susceptible to a privilege escalation vulnerability (CVE-2025-6264) to enable arbitrary command execution and endpoint takeover, per Cisco Talos. This appears to be connected to a story we covered on September 1 regarding reported abuse of Velociraptor for tunneling and remote access. This current story appears to be an expanded, and more fully characterized instance of the same abuse trend. Rapid7, which maintains Velociraptor after having acquired it in 2021, stated during the previous tunneling exploit, that “it’s aware of the misuse of the tool, and that it can also be abused when in the wrong hands, just like other security and administrative tools.”
Acting U.S. Cyber Command, NSA chief loses nomination for the job
Army Lt. Gen. William Hartman will not be nominated to be the next leader of U.S. Cyber Command and the National Security Agency, according to four people familiar with the matter. Hartman has been leading both entities in an acting capacity since April. The reasons for the non-nomination include a lack of desire within the current administration to continue the “dual-hat” leadership arrangement at Cyber Command and the NSA. This decision to not nominate Hartman “further scrambles what has already been a prolonged leadership shakeup atop the military’s top digital warfighting outfit and the country’s largest spy agency.”
Sotheby’s suffers cyberattack
The world-famous auction house says the breach occurred on July 24, resulting in the theft of “an unspecified amount of data, including Social Security numbers and financial account information.” Spokespeople said the company is not aware of who was behind the attack but added that the attackers broke in despite the company having “layered defenses, strict access controls, secure connections, and advanced threat protections,” along with regularly patched systems, testing of internal incident response plans, back ups, critical services, vetted vendors, and a security trained workforce.
Huge thanks to our sponsor, Vanta
Is it “Do I have the right controls in place?”
Or “Are my vendors secure?”
….or the really scary one: “how do I get out from under these old tools and manual processes?
Enter Vanta.
Vanta automates manual work, so you can stop sweating over spreadsheets, chasing audit evidence, and filling out endless questionnaires.
Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your security at scale.
Vanta also fits right into your workflows, using AI to streamline evidence collection, flag risks, and keep your program audit-ready—ALL…THE…TIME.
With Vanta, you get everything you need to move faster, scale confidently—and get back to sleep.
Get started at vanta.com/headlines
Microsoft warns of 32% surge in identity hacks, from stolen passwords
In its 85-page Digital Defense Report 2025, Microsoft points to the continued success of password attacks that allow hackers to take over victim accounts. It says that “hackers are increasingly using stolen identities to breach organizations, impersonating employees or contractors before stealing data and launching ransomware, according to new research.” The 32% surge means that 97% of identity attacks are password attacks. Amy Hogan-Burney, a corporate vice president at Microsoft, added that “the vast majority of malicious sign-in attempts an organization might receive are via large-scale password guessing attempts. Attackers get usernames and passwords (‘credentials’) for these bulk attacks by and large from credential leaks.”
Microsoft revokes more than 200 certificates to disrupt ransomware campaign
A campaign is being run by Vanilla Tempest, also known as Vice Spider and Vice Society, with the goal of deploying of Rhysida ransomware. The group has been in operation since 2021 and chiefly performs ransomware attacks on the education and healthcare sectors. Microsoft says it disrupted the group’s campaign in early October by revoking more than 200 certificates that the group used to sign their malware. Victims were attracted to installer websites through SEO poisoning.