In today’s cybersecurity news…
New wave of VPN login attempts on Palo Alto portals
This new campaign started on December 2nd and originated from more than 7,000 IP addresses “from infrastructure operated by the German IT company 3xK GmbH, which operates as a hosting provider. The target is Palo Alto GlobalProtect portals, and the activity has taken the form of brute force and login attempts, pivoting to scanning SonicWall API endpoints, according to threat intelligence company GreyNoise. Notably, the GlobalProtect VPN and remote access component of Palo Alto Networks’ firewall platform is used by large enterprises, government agencies, and service providers.
NATO holds its largest-ever cyberdefense exercise
According to The Record, “NATO this week challenged around 1,300 participants in a cyberdefense exercise to guard against major attacks on critical infrastructure including power plants, fuel depots, commercial satellites and military networks.” This was part of its annual Cyber Coalition exercise and involved 29 allies and seven partner nations, seeking to coordinate their responses to seven major storylines. This was NATO’s largest-ever cyberdefense exercise, with most of the participants logging in from their own desks, rather than traveling to a central location. It was directed by U.S. Navy Commander Brian Caplan.
Chinese hackers exploiting React2Shell bug
According to a report from Amazon Integrated Security, state-backed hackers in China are exploiting a vulnerability referred to colloquially as React2Shell (CVE-2025-55182), a popular open-source tool built into thousands of widely used digital products. The vulnerability carries a “critical” severity score of 10 out of 10 and has been added to CISA’s KEV catalog. Amazon says exploitation attempts came from IP addresses and infrastructure linked to known China state-nexus threat actors but noted that attribution is challenging due to “anonymization infrastructure among Chinese threat groups,” adding, “the speed at which the Chinese groups were able to operationalize public PoC exploits underscores a critical reality,” of how quickly sophisticated threat actors can weaponize them.
UK Barts Health NHS discloses Oracle-related data breach
Barts Health NHS Trust in London has disclosed that Clop ransomware actors stole invoice data from a database by exploiting a zero-day flaw in Oracle E-Business Suite (CVE-2025-61882). The breach exposed names and addresses of people who paid for treatments, as well as some former staff and supplier information. Data relating to accounting services for a neighboring trust was also taken and later leaked on Clop’s dark-web portal. Although the theft occurred in August, Barts only became aware in November. The trust says clinical systems were unaffected and has notified UK authorities. Affected patients are advised to review invoices and watch for suspicious communications.
Huge thanks to our sponsor, Adaptive Security
Virtual kidnapping scams gaining popularity
A new and rather heinous twist on cyber extortion is the virtual kidnapping scam in which criminals alter social media photos of people as proof of life as they contact family members of the individual with a ransom demand. According to an alert from the FBI, this campaign can also include scraping images from legitimate missing persons alerts, as well choosing regular people as part of what the FBI calls “emergency scams.” Naturally, some of the threat actors use AI to alter the photos into short videos, threatening violence if payment is not forthcoming, and using timed messages that disappear quickly to avoid victims scrutinizing them too closely.
Pharma firm Inotiv discloses data breach following August attack
Following up on a story we covered in August, the U.S. pharmaceutical firm Inotiv is now notifying its current and former employees, their family members, as well as certain other people who have interacted with Inotiv or with companies it has acquired that the ransomware attack that occurred in August has resulted in the theft of data. The company has not yet shared publicly which types of data were stolen during the incident, nor has it attributed the attack to a specific cybercrime operation.
Porsche outage in Russia locks cars down
According to owners and dealers in the country, hundreds of Porsche vehicles “became undrivable after their factory-installed satellite security system malfunctioned.” The outage included sudden engine shutdowns and fuel-delivery blocks after their cars lost satellite alarm-module connectivity, “leaving all models at risk of self-locking.” The problem appears to be caused by the Vehicle Tracking System, which is an onboard module, and can affect every model of the brand. Some users have been able to implement a workaround by disabling or rebooting the VTS system, while others succeeded after disconnecting the battery for a few hours.
Organizations warned to choose their next CISO wisely
According to an article posted in Dark Reading by David Schwed, COO of SovereignAI, we are enjoying a global CISO hiring spree. This is due to an increase in the number of AI labs, cryptocurrency exchanges, and financial institutions who all need one. The article warns that companies and organizations must choose between two very different archetypes of CISO. This means that choosing an “engineering-focused” CISO over a “holistic” CISO can be risky. In short, he says, an engineering-focused CISO treats security as solely a technical problem which can build clean architecture and preventative controls, but this approach often just moves the risk, with attackers exploiting weaknesses elsewhere, such as human-workflow gaps. A holistic CISO, by contrast, understands security as a broader system involving people, process, and technology, and designs for resilience, not just prevention. A link to the article in all its detail is available in the show notes to this episode.