Do Son Sandworm (APT44) has shifted tactics, favoring misconfigured edge devices over complex exploits to breach energy and telecom sectors via credential replay.
misconfiguration
A Critical (CVSS 9.8) flaw (CVE-2025-59396) in WatchGuard Firebox allows unauthenticated remote root access via SSH on port 4118 using default credentials (admin:readwrite). Patch immediately.
CISA added a Critical (CVSS 10.0) RCE flaw (CVE-2025-54253) in Adobe Experience Manager Forms to its KEV Catalog due to active exploitation. Patch is mandatory by Nov 5.
A new report reveals a dangerous misconfiguration: exposed appsettings.json files can contain Azure AD credentials, giving attackers full access to a company's cloud kingdom.
A severe misconfiguration in Tencent Cloud exposed sensitive internal credentials and source code to the public internet for months, risking a major breach.
A misconfigured Elasticsearch server exposed hundreds of millions of detailed records on Swedish citizens and businesses, linked to fintech company Risika. The database is now secured.
Datadog reveals a method to impersonate any hybrid Entra ID user, including Global Admins, by exploiting Office 365 Exchange Online service principal. Microsoft calls it "expected behavior."
Cloudflare's 1.1.1.1 public DNS resolver experienced a global outage on July 14, 2025, confirmed as an internal configuration error, not a cyberattack or BGP hijack.
Wiz uncovers JINX-0132, a cryptojacking campaign exploiting misconfigured Nomad, Consul, Docker, and Gitea in DevOps environments to mine Monero.
Over 50,000 Microsoft Azure AD user records from the aviation industry were exposed due to a misconfigured, unauthenticated API, revealing sensitive data and posing major risks.