In today’s cybersecurity news…
Law enforcement seizes botnet infrastructure
Agencies and tech companies from the U.S., Germany, and Canada collaborated on an operation designed to seize infrastructure used by the Aisuru, KimWolf, JackSkid, and Mossad botnets. All of these were to deliver DDoS attacks. The four botnets were built out of about three million compromised devices around the world, many of which are Internet of Things (IoT) devices like cameras, routers and video recorders. Hundreds of thousands of these are located in the U.S. and some were behind firewalls. The botnet operators monetized these by selling access to other criminal organizations. The Justice Department did not say if any arrests were made in conjunction with the infrastructure takedown.
California city and LA transit agency report cybersecurity issues
Foster City, a Silicon Valley-area town had to pause all public services outside of emergency responses on Thursday, following a ransomware attack. City manager Stefan Chatwin declared a state of emergency, and the city warned that theft of public information was possible and that people should change personal passwords that related to city activities and take measures to protect personal data. This attack was followed by a potential attack attempt on the Los Angeles Metro service. A ransomware gang has claimed that it attacked the city of Los Angeles, and although city officials have not responded to media requests for clarification, technical issues with its internal administrative computer systems were reported by the transit service on Friday morning.
Microsoft Azure Monitor alerts used for callback phishing attacks
Azure Monitor is Microsoft’s cloud-based monitoring service that collects and analyzes data from Azure resources, applications, and infrastructure, allowing users to track performance, notify about billing changes, detect issues, and trigger alerts based on various conditions. Numerous customers of the service have recently reported receiving Azure Monitor alerts that include warnings of suspicious charges or invoice activity on their accounts, and which request the customers to call an enclosed phone number. The verbiage of the warning is in line with that released by legitimate software services, right down to an apology for the inconvenience. “Unlike other phishing campaigns, these messages are not spoofed but are sent directly by the Microsoft Azure Monitor platform using the legitimate azure-noreply@microsoft.com email address.”
Huge thanks to our sponsor, ThreatLocker
Feds issue PSA regarding Russian Signal phishing campaign
Following up on a story we covered this past month, the FBI and CISA issued a joint public service announcement on Friday warning that Russian intelligence-affiliated hackers have “gained access to thousands of users’ messaging apps with a global phishing campaign.” The campaign chiefly seeks high-value targets including “current and former U.S. government officials, political figures, military personnel and journalists.” The U.S. agencies reiterated that hackers had not been able to bypass end-to-end encryption, instead manipulating users into giving up access, by posing as Signal help personnel. A link to the PSA, posted on IC3.gov is available in the show notes to this episode.
(Cyberscoop and IC3.gov)
Critical Quest KACE vulnerability potentially exploited
Researchers from Arctic Wolf are warning of suspicious activity affecting unpatched Quest KACE Systems Management Appliance (SMA) instances exposed to the internet. This is an on-premises tool used for centralized endpoint management, including asset inventory, software distribution, patching, and monitoring. The vulnerability being exploited has a CVE number (CVE-2025-32975) and is identified as a critical authentication bypass flaw. Quest patched the flaw in May of last year, but according to Arctic Wolf, there has been one instance of attackers appearing to have exploited it to gain initial access to a system and achieve administrative control.
Oracle patches critical vulnerability in Identity Manager
The vulnerability, which has a CVE number (CVE-2026-21992), also carries a CVSS score of 9.8. It is remotely exploitable without authentication, said Oracle in an advisory and could result in remote code execution. NIST calls the flaw “easily exploitable” by an unauthenticated attacker with network access via HTTP. Oracle has made no mention of this vulnerability being exploited in the wild.
Microsoft rolls back some of its Copilot AI bloat on Windows
Microsoft announced on Friday “a series of changes focused on improving the quality of its Windows 11 operating system, which notably includes dialing back the number of entry points to its AI assistant, Copilot.” The reductions will apply to apps such as Photos, Widgets, Notepad, and its Snipping Tool. As reported in TechCrunch, “this “less-is-more” approach to integrating AI into existing platforms may reflect the growing consumer pushback against AI bloat.” A Pew Research study published this month noted that “half of U.S. adults are now more concerned than excited about AI as of June 2025, up from 37% in 2021.”