Insights

SonicWall has issued an urgent security advisory addressing multiple critical vulnerabilities in its Secure Mobile Access (SMA) series. These flaws-now confirmed to be actively exploited-pose a serious risk to organizations relying on SonicWall's SSL VPN appliances to secure remote access. What's at Stake? Three vulnerabilities (CVE-2025-32819, CVE-2025-32820, and CVE-2025-32821) have been disclosed affecting the following SMA appliances: SMA 200 SMA 210 SMA 400 SMA 410 SMA 500v When chained together, these vulnerabilities can allow an attacker with valid SSL VPN user credentials to execute arbitrary code with root privileges. This grants full system control and could be used to pivot into internal networks, exfiltrate data, or deploy ransomware. Breakdown of the Exploits: CVE-2025-32819: Enables attackers to delete the primary SQLite database and reset the admin password, giving them admin access to the web interface. CVE-2025-32820: A path traversal vulnerability that makes the /bin directory writable. CVE-2025-32821: Allows an attacker to…

A newly discovered technique is being leveraged by threat actors to bypass Endpoint Detection and Response (EDR) protections-specifically those provided by SentinelOne-through an abuse of its own update process. Dubbed the "Bring Your Own Installer" (BYOI) technique, this method disables the EDR's defenses long enough to allow for the deployment of ransomware, such as variants of Babuk, without interference. How the BYOI Technique Works Most EDR platforms, including SentinelOne, are designed with anti-tamper features that prevent uninstallation or modification without authorization-typically requiring administrative access or a unique passphrase. However, attackers have found a workaround that exploits the EDR's legitimate update mechanism. During an upgrade or downgrade, SentinelOne temporarily stops its active protections to replace the running components. By forcibly interrupting this process mid-way, threat actors leave the system in a vulnerable state-protection disabled, upgrade incomplete, and no alerts triggered. At this point, ransomware can be deployed with impunity. This method…

In March 2025, Cobb County, Georgia, became the target of a significant ransomware attack orchestrated by the Russian-speaking cybercriminal group known as Qilin. This breach resulted in the compromise of approximately 150 gigabytes of sensitive data, encompassing over 400,000 files. The stolen information reportedly includes autopsy photographs, Social Security numbers, driver's license images, and internal government documents. FOX 5 Atlanta The Attack and Its Implications The cyberattack led to noticeable disruptions in county services, prompting officials to take systems offline temporarily. Qilin, operating under a ransomware-as-a-service model, demanded a ransom to prevent the public release of the stolen data. To demonstrate the severity of the breach, the group released 16 sample images on the dark web, which included sensitive personal information. FOX 5 Atlanta Cobb County officials have confirmed the breach but have opted not to engage with the attackers' demands. In a public statement, the county emphasized its stance…

A critical security vulnerability, identified as CVE-2025-2538, has been discovered in specific deployments of Esri's ArcGIS Enterprise. This flaw resides in the Password Recovery feature of the Portal component and could allow unauthorized attackers to reset the password of the built-in admin account, leading to potential unauthorized access and data compromise.​ Vulnerability Details The vulnerability affects the following versions of Portal for ArcGIS on Windows: 10.9.1​ 11.1​ 11.2 This issue has been assigned a CVSS v3.1 score of 9.8 (Critical), indicating its high severity. The vulnerability stems from the use of hard-coded credentials (CWE-798), which can be exploited over a network without requiring authentication. Recommended Actions Esri has released the "Portal for ArcGIS Security 2025 Update 1 Patch" to address this vulnerability. It is imperative for organizations utilizing the affected versions to apply this patch immediately to mitigate potential risks. Additional Recommendations Review Access Logs: Examine system logs for any…