Today, organizations are inundated with a continuous stream of vulnerabilities and effectively prioritizing them  is crucial to safeguarding critical assets and maintaining operational resilience. Organizations can focus their remediation efforts on the most significant threats by adopting a strategic approach to vulnerability prioritization, optimizing resource utilization, and enhancing their security posture.

Understanding vulnerability prioritization

Vulnerability prioritization involves assessing identified security weaknesses and ranking them based on factors such as potential impact, exploitability, and relevance to the organization’s environment. This process enables security teams to address the most pressing vulnerabilities first, thereby reducing the risk of exploitation and potential breaches. Traditional methods, like the Common Vulnerability Scoring System (CVSS), often rely solely on severity scores. While CVSS provides a standardized measure of severity, it doesn’t always account for the contextual nuances of each organization. Integrating additional factors, such as asset criticality and current threat intelligence, offers a more comprehensive risk assessment.

Modern approaches to vulnerability prioritization

Advancements in vulnerability management have led to the development of methodologies that incorporate predictive insights and stakeholder-specific considerations:

• Exploit Prediction Scoring System (EPSS): This system evaluates the likelihood of a vulnerability being exploited in the wild, allowing organizations to focus on vulnerabilities with a higher probability of exploitation.
• Stakeholder-Specific Vulnerability Categorization (SSVC): Developed by the Cybersecurity and Infrastructure Security Agency (CISA), SSVC assists organizations in prioritizing vulnerabilities based on exploitation status, potential safety impacts, and the prevalence of the affected product within their systems.

Best practices for effective vulnerability prioritization

To enhance vulnerability prioritization efforts, organizations should consider the following strategies:

1. Asset inventory and classification: Maintain a comprehensive inventory of all assets and classify them based on their criticality to business operations. Understanding which assets are most vital helps in assessing the potential impact of vulnerabilities.
2. Incorporate threat intelligence: Use up-to-date threat intelligence to understand the current threat landscape. This information aids in evaluating vulnerabilities’ exploitability and aligning remediation efforts with real-world threats.
3. Continuous monitoring and assessment: Implement continuous monitoring to detect new vulnerabilities promptly and reassess the prioritization as the threat environment evolves.
4. Cross-departmental collaboration: Engage stakeholders from various departments to understand the business context and potential impact of vulnerabilities, ensuring that prioritization aligns with organizational objectives.

Leveraging RedSeal for enhanced vulnerability prioritization

RedSeal’s platform offers comprehensive network visualization and risk-scoring capabilities that can significantly enhance an organization’s vulnerability prioritization process. By providing detailed insights into network architecture and highlighting critical assets, RedSeal enables security teams to:

• Visualize network exposure: Understand how vulnerabilities could be exploited within the network context, identifying potential attack paths to high-value assets.
• Assess impact and reachability: Determine the potential impact of vulnerabilities by analyzing their reachability to critical systems, allowing for informed prioritization decisions.
• Integrate with existing tools: Seamlessly incorporate data from various security tools to provide a unified view of vulnerabilities, enhancing the accuracy of risk assessments.

By integrating RedSeal’s capabilities into their vulnerability management strategy, organizations can move beyond traditional severity-based approaches, focusing remediation efforts where they are needed most and strengthening their overall security posture.

Effective vulnerability prioritization is a cornerstone of proactive cybersecurity management. By adopting modern methodologies, leveraging advanced tools like RedSeal, and adhering to best practices, organizations can systematically address the most critical vulnerabilities, optimize resource allocation, and enhance their resilience against cyber threats.

Skybox users have long relied on advanced vulnerability management (VM) and attack path management (APM) to safeguard their networks. With the transition to Tufin, many organizations are discovering that certain capabilities they once depended on are being treated differently. RedSeal, however, takes these critical features to the next level, offering a more integrated and dynamic approach to both VM and APM.

RedSeal’s superior vulnerability management
Effective vulnerability management requires more than just identifying potential weaknesses—it’s about understanding which ones can truly be exploited and where they fit within your network. While other platforms may provide basic vulnerability scanning, RedSeal’s topology-aware platform takes vulnerability management a step further. We seamlessly integrate data from leading scanners like Tenable, Qualys, and Rapid7 (a full list of integrations can be found here), mapping it directly to the network’s topology. By linking vulnerabilities to actual attack paths, RedSeal provides context-driven risk scoring, ensuring that security teams are prioritizing the vulnerabilities that pose the greatest threat based on real-world access.

RedSeal’s superior attack path management
Attack path management is a critical component of network defense, and RedSeal excels in this area by continuously calculating all potential attack paths, factoring in real-time changes to the network. Unlike static models, RedSeal’s dynamic approach ensures that new configurations, devices, and network adjustments are always accounted for. By providing an always-updated view of attack paths, RedSeal empowers teams to proactively mitigate the most likely risks before they can be exploited, rather than relying on assumptions or outdated data.

RedSeal’s advantage
RedSeal offers a proactive, predictive approach to both vulnerability management and attack path management. By integrating with existing vulnerability scanners and using network context to guide decision-making, RedSeal gives teams the tools to make smarter, faster decisions, addressing vulnerabilities in their true context—where they matter most. Our integrated view ensures that organizations are not just identifying vulnerabilities but prioritizing those that are truly exploitable, ultimately reducing risk and bolstering network defenses.

When it comes to vulnerability management and attack path management, RedSeal doesn’t just offer a solution—we provide a smarter, more powerful way to protect your network. Our platform’s ability to link vulnerabilities with attack paths and continuously update with real-time network changes gives organizations a clear, actionable roadmap to risk reduction. If you’re looking for a more dynamic and reliable way to manage your security posture, schedule a demo today and see for yourself how RedSeal is the solution you need to stay ahead of the curve.

This week’s Cyber News Roundup brings you the latest cybersecurity headlines, where new risks and vulnerabilities continue to emerge. From Forescout’s report on the riskiest connected devices to advanced phishing campaigns, these incidents highlight the need for stronger, more proactive security strategies. RedSeal helps organizations mitigate these evolving threats by offering robust network visibility and risk exposure management to stay ahead of cybercriminals. Read on to catch up on the critical threats making waves this week.

A new report reveals routers’ riskiness  

Forescout’s 2025 Riskiest Connected Devices report reveals routers are now the riskiest devices in enterprise networks, responsible for over half of the most critical vulnerabilities. Device risk overall has jumped 15% from last year. While computers hold the most bugs, routers, firewalls, and ADCs top the list for severity, often exploited as zero-days. The top 20 riskiest device types now include 12 newcomers like PoS systems and healthcare workstations. IoMT devices also carry major threats. Retail leads in risk exposure, followed by finance, government, healthcare, and manufacturing. Over 50% of non-legacy Windows devices across sectors still run Windows 10, nearing end-of-support. There’s also a shift away from encrypted SSH to unencrypted Telnet. Forescout warns modern threats span IT, IoT, OT, and IoMT, demanding broader, cross-domain security strategies. (SecurityWeek)

Windows Defender Antivirus Bypassed Using Direct Syscalls & XOR Encryption  

Researchers have uncovered a method to bypass Windows Defender antivirus by using direct system calls (syscalls) combined with XOR encryption, as detailed in a recent cybersecurity study. By employing shellcode encryption and injecting malicious code into both local and remote processes, they avoided detection from Defender’s static and dynamic analysis. Direct syscalls allowed them to bypass user-mode API monitoring, while XOR encryption obscured the shellcode, making it harder to detect. The approach, tested in a controlled lab, highlights the need for stronger defenses against such advanced evasion tactics, as traditional antivirus solutions struggle to counter these sophisticated methods. (Cyber Security News)

Nissan Leaf cars can be hacked for remote spying and physical takeover  

Researchers at PCAutomotive, a pentesting and threat intelligence company specializing in the automotive and financial sectors, services industries revealed the hacking potential last week at Black Hat Asia 2025. Focusing on the second generation Nissan Leaf made in 2020, they were able to “use the infotainment system’s Bluetooth capabilities to infiltrate the car’s internal network. They were then able to escalate privileges and establish a command and control channel over cellular communications to maintain stealthy and persistent access to the EV directly over the internet, up to and including being able to control the steering when while a car was in motion. (Security Week)

Infosec experts warn of China Typhoon retaliation against tariffs  

Referring to the White House imposition of tariffs on China, cybersecurity advisor Tom Kellermann warns that China may “retaliate with systemic cyber attacks as tensions simmer over.” Speaking to The Register, he points out how the various “Typhoon” campaigns “have given them a robust foothold within critical infrastructure that will be used to launch destructive attacks. Trade wars were a historical instrument of soft power. Cyber is and will be the modern instrument of choice.” In a separate interview with The Register, Annie Fixler, director of the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies, said, “to the extent that China is holding back on conducting certain types of cyberattacks, it may feel less restrained now.” (The Register)

U.S. Comptroller suffers ‘major incident’  

On Tuesday, the U.S. Treasury Department’s Office of the Comptroller of the Currency (OCC) characterized their recent email system breach as a “major incident.” In late February, Microsoft alerted officials to the incident which abused an OCC email administrator account. The initial investigation found no evidence of impact on the financial sector and concluded that only a “limited number” of email accounts were affected. However, new reports from Bloomberg and Microsoft indicate that 103 email accounts with emails totaling 150,000 were compromised and contained highly sensitive financial information. The attack commenced in May of last year, nine months prior to its discovery. It remains unclear who is behind the attack. (SecurityWeek)

Phishing kits now vet victims in real-time  

Threat actors have been spotted employing a new evasion tactic called ‘Precision-Validated Phishing.’ This new technique uses real-time email validation through either validation service API calls or JavaScript code to ensure phishing content is shown only to pre-verified, high-value targets. If an invalid target is identified, they are either presented with an error message or directed to benign sites. Email security firm Cofense said this new tactic is blocking visibility for researchers who typically enter fake or controlled email addresses to map the credential theft campaign. Ultimately, this reduces detection rates and prolongs the lifespan of phishing operations. (Bleeping Computer)

Hackers target bugs in EC2 sites to steal AWS credentials  

F5 Labs has observed hackers exploiting Server-Side Request Forgery (SSRF) vulnerabilities in websites hosted on AWS Elastic Cloud Compute (EC2) instances. The attackers are using credentials from extracted EC2 Metadata to escalate their privileges and access S3 buckets and other AWS services. The attacks are targeting instances running on AWS’s older metadata service, IMDSv1, that allows anyone with access to retrieve the metadata. The system has been superseded by IMDSv2, which requires session token authentication to protect websites. F5 researchers said that the malicious activity culminated between March 13 and 25, 2025 and behavioral patterns strongly suggest that it was carried out by a single threat actor. (Bleeping Computer)

Google’s latest Android update addresses two zero-days  

Google’s April 2025 Android Security Bulletin addresses multiple critical vulnerabilities, including two zero-days—CVE-2024-53150 and CVE-2024-53197—actively exploited in targeted attacks. Both impact the Linux kernel’s ALSA USB-audio driver and pose serious risks to Android devices running versions 12 through 15. CVE-2024-53150 allows information disclosure via an out-of-bounds read, while CVE-2024-53197 enables privilege escalation through memory corruption triggered by malicious USB devices. These flaws may bypass standard device locks and resemble methods used by surveillance firms. Google and Samsung have released urgent patches, with fixes included in the 2025-04-05 security level. The continued targeting of Android underscores the ecosystem’s security challenges, with Google reporting a significant rise in zero-day attacks. Users are urged to update devices immediately to avoid exploitation. (Cyber Security News)

AI outphishes human red teams  

Move over chess grandmasters—AI has now leveled up to out-hustle human red teams in the world of phishing. According to cybersecurity firm Hoxhunt, their AI phishing agent, code-named JKR (yes, like “Joker”), beat human-crafted phishing attempts by 24% in March. That’s a glow-up from last year, when JKR lagged 31% behind. Think of it as a Skynet-meets-email moment. JKR adapts like a social engineering ninja, customizing bait with user-specific context like job roles and locations. It’s not just phishing—it’s precision phishing, in bulk. Hoxhunt says this could make mass phishing campaigns as effective as today’s spear-phishing attempts. Great.

The Anti-Phishing Working Group also reported a global spike in phishing sites and smishing scams, including hilariously off-target toll collection texts. So, while humans still bring creativity, AI brings scale, 24/7 hustle, and zero need for coffee. Experts say defending against AI-driven threats will still require one vital element: human judgment. We’d have more good judgment if it weren’t constantly busy cleaning up after bad judgment.

(GovInfo Security)

Windows Remote Desktop Service Vulnerability Let Attackers Execute Malicious Code Remotely  

Critical vulnerabilities in Windows Remote Desktop Services (RDS), specifically CVE-2025-24035 and CVE-2025-24045, both rated with a CVSSv3 score of 8.1. These Remote Code Execution (RCE) flaws could allow unauthorized attackers to execute malicious code over a network, potentially compromising entire systems. CVE-2025-24035 stems from improper memory handling, while CVE-2025-24045 requires an attacker to win a race condition, though Microsoft deems exploitation “more likely” for both. Successful attacks could severely impact confidentiality, integrity, and availability. The article notes additional vulnerabilities addressed by Microsoft, including six actively exploited flaws, urging organizations to apply patches and follow security best practices like enabling Network Level Authentication and restricting RDP access to mitigate risks.

(Cyber Security News)

WhatsApp vulnerability could facilitate remote code execution  

Meta has patched a serious vulnerability in the WhatsApp desktop app for Windows that could let attackers trick users into executing malicious code via spoofed file types. The flaw involved MIME type manipulation, making harmful files appear safe (like images or documents). While there’s no evidence it has been exploited in the wild, users are urged to update to version 2.2450.6 to stay protected. (SecurityWeek)

CISA Warns of CrushFTP Vulnerability Exploitation in the Wild  

A critical authentication bypass vulnerability in CrushFTP, identified as CVE-2025-31161, has been actively exploited by remote attackers following a disrupted disclosure process, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, affecting unpatched versions of CrushFTP v10 and v11, allows unauthenticated access with a CVSSv3.1 severity score of 9.8, posing a significant risk of full system compromise. Initially disclosed responsibly by Outpost24 with a 90-day non-disclosure period, the process was undermined when VulnCheck published a separate CVE (CVE-2025-2825) without coordination, accelerating exploitation after a proof-of-concept exploit emerged. As of March 30, 2025, 815 systems remained unpatched, down from 1,800 two days prior, highlighting the urgency for organizations to apply updates as federal agencies face a mitigation deadline of April 28, 2025. This incident follows a pattern of file transfer software vulnerabilities, with CrushFTP previously targeted by a zero-day exploit in April 2024. (Infosecurtiy Magazine)

PoisonSeed campaign weaponizes CRM system  

Researchers at Silent Push found a new campaign that uses customer relationship management and bulk email systems to send out phishing emails with crypto seed phrases to potential victims. These emails claim to be from Coinbase, urging users with self-custodial wallets to transfer assets. The seed phrases are included in transfer instructions for setting up new wallets, which grants threat actors access to them. It’s estimated that Coinbase users have lost roughly $46 million in crypto assets since mid-March. The campaign has used a variety of providers to spam people, including Hubspot, Mailchimp, Mailgun, SendGrid, and Zoho. (Security Week)

State-backed actors could have exploited ESET flaw  

The cybersecurity firm ESET confirmed a flaw reported by Kaspersky researchers that could be used by threat actors to plant a malicious DLL and execute it with ESET’s antivirus scanner to bypass system defenses. ESET patched the issue and maintains it didn’t find any evidence of it being exploited in the wild. However, Kaspersky researchers claim the suspected state-backed threat group ToddyCat used the flaw in a campaign, using a modified version of EDRSandBlast to load the malicious DLL under the name TCDSB to execute payloads. ESET said it hasn’t seen the suspected DLLs to review them, but regardless, the approach would have required admin privileges to perform the attack. (The Record)

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts or schedule a demo today.

In this week’s roundup, we cover a series of significant cybersecurity incidents and developments from around the globe. Europol’s takedown of a major child exploitation platform, Kidflix, underscores the real-world consequences of cybercrime, while concerns over AI misuse and data leaks continue to grow. Meanwhile, a joint advisory warns of the escalating threat posed by fast flux tactics, and new vulnerabilities highlight ongoing risks for cloud services and enterprise systems.

As organizations continue to face evolving threats, RedSeal’s proactive exposure management helps identify and mitigate risks across complex networks, ensuring a more secure defense against emerging cyber threats. From high-profile cyberattacks to critical system breaches, this roundup highlights the increasing need for vigilance and robust cybersecurity measures across industries.

Europol shuts down a major international CSAM platform  

Europol announced the takedown of Kidflix, a major dark web child sexual abuse material (CSAM) platform, calling it the largest child exploitation operation in its history. The multi-year effort led to 79 arrests so far, with 1,393 suspects identified and 39 children rescued. Over 39 countries participated in the investigation. Offenders used cryptocurrency to access the site, which hosted up to 91,000 videos—many previously unknown to law enforcement. German and Dutch authorities seized servers containing 72,000 videos. Users could earn access tokens by tagging content. Europol emphasized the real-world harm behind the platform’s operations, rejecting attempts to frame the case as a purely cyber issue. The platform had 1.8 million users, with around 3.5 new videos uploaded every hour. The investigation remains ongoing.

Elsewhere, a major data leak at GenNomis, an AI image-generation platform by South Korea’s AI-NOMIS, exposed 47.8GB of sensitive data, including 93,000+ images—some appearing to depict underage individuals in explicit content. Discovered by researcher Jeremiah Fowler, the unsecured database also contained deepfakes of celebrities as children and user command logs. The platform, now offline, allowed face-swapping and nude image generation. The incident raises alarm over AI misuse in creating non-consensual, explicit content, especially involving minors, prompting urgent calls for stricter safeguards and developer accountability. (The Record)

A joint advisory labels Fast Flux a national security threat  

Fast flux is a technique used by cybercriminals and nation-state actors to evade detection by rapidly rotating DNS records and IP addresses linked to malicious domains. This tactic supports resilient command-and-control (C2) infrastructure and enables persistent malicious activity, such as ransomware, phishing, and botnets. Variants include single flux (rotating IPs) and double flux (changing DNS servers too), often supported by bulletproof hosting services.

A joint advisory from the NSA, CISA, FBI, and international partners warns of fast flux as a national security threat and urges ISPs and cybersecurity providers—especially Protective DNS (PDNS) services—to develop detection and mitigation capabilities. Recommended strategies include DNS analysis, anomaly detection, IP blocking, sinkholing, and threat intelligence sharing. Distinguishing malicious fast flux from legitimate services like CDNs remains a challenge. Organizations are encouraged to verify PDNS protections, train staff on phishing, and participate in collaborative defense efforts to reduce exposure to fast flux-enabled cyber threats.

Meanwhile, House cybersecurity leaders criticized Trump-era cuts to CISA, urging expanded responsibilities instead. Rep. Andrew Garbarino wants CISA central to U.S. cyber efforts, including reauthorizing the 2015 cyber info-sharing law and extending a key grant program. He criticized cuts that harmed operations and signaled support for nominee Sean Plankey. Rep. Eric Swalwell slammed chaotic firings as inefficient and backs legislation to formalize the Joint Cyber Defense Collaborative. Both aim to shield CISA from political attacks and ensure strong congressional support moving forward. (CISA)

Google patches Quick Share vulnerability  

The app, formerly known as Nearby Share, is “a peer-to-peer file-sharing utility similar to Apple AirDrop that allows users to transfer files, photos, videos, and other documents between Android devices, Chromebooks, and Windows desktops and laptops in close physical proximity.” Researchers at SafeBreach Labs disclosed details of this new vulnerability that “could be exploited to achieve a denial-of-service (DoS) or send arbitrary files to a target’s device without their approval,” in other words a zero-click. The vulnerability was one of 10 that the researchers discovered last August. (The Hacker News)

Juniper Networks and Palo Alto Networks devices in mystery scanning event  

The Register is reporting that scanning of login portals for devices made by both companies has increased substantially in recent weeks. “On Wednesday, SANS Institute’s Johannes Ullrich said he noticed a surge in scans for the username “t128,” which, when accompanied by the password “128tRoutes,” is a well-known default account for Juniper’s Session Smart Networking products.” Internet scanning security firm GreyNoise has also spotted mass probing, in this case directed at the login portals of Palo Alto Networks’ PAN-OS GlobalProtect remote access products. They believe “anonymous scanners are searching for exposed or vulnerable product and noted almost 24,000 unique IP addresses attempting to login over the past 30 days.” (The Register)

Russian state railway suffers cyber disruption  

The state-owned railway, RZD, has reported a cyberattack that temporarily disrupted its website and mobile application. This is the second incident this week for Russia’s transit systems, following a Monday attack and disruption on the app and website for Moscow’s subway system. This RZD attack is being confirmed by RZD officials as a DDoS attack, which meant that ticket sales remained operational at physical offices across stations and terminals. No group has yet claimed responsibility for this attack. (The Record)

Google Cloud patches a vulnerability affecting its Cloud Run platform  

Google Cloud has patched a vulnerability called ImageRunner, which affected its Cloud Run platform. Discovered by Tenable, the flaw allowed users with certain permissions to modify Cloud Run services and potentially access private container images. In the worst case, attackers could extract secrets and exfiltrate sensitive data. Google says they alerted customers in November 2024 and fully deployed a fix by January 28, 2025. The update now enforces stricter IAM checks during deployments to prevent unauthorized image access.

Elsewhere, Google has launched a beta feature allowing enterprise users to send end-to-end encrypted (E2EE) emails within their organization, with plans to expand it to all Gmail inboxes by year’s end. Unlike S/MIME, Google’s approach doesn’t require certificate management or key sharing, simplifying secure communication. Organizations retain control of encryption keys, keeping messages secure and compliant with regulations. External recipients can access messages via a restricted Gmail interface or S/MIME if supported. Additional Gmail security features, including data loss prevention and AI threat protection, are also now available. (SecurityWeek)

North Korean IT worker army expands operations in Europe  

Security researchers with the Google Threat Intelligence Group found that North Korean IT workers are infiltrating European companies using fake identities to secure remote jobs, generating revenue for the DPRK regime…operating through platforms like Upwork and Telegram, with payments processed through cryptocurrency to evade detection. Authorities in the U.S. and UK have issued sanctions and warnings, as some workers have also engaged in extortion using insider knowledge. (Bleeping Computer)

Latest Ivanti bug, paired with malware, earns an alert from CISA  

CISA has issued an alert about a powerful malware called Resurge, used by alleged Chinese hackers to exploit a vulnerability in Ivanti security tools. The malware can manipulate system integrity, harvest credentials, and create backdoors, allowing persistent access even after updates. Google-owned Mandiant confirmed that the malware is linked to China-based espionage actors, who have targeted government, defense, and finance sectors since 2020. Ivanti’s Integrity Checker Tool (ICT) was also compromised, making detection harder. CISA urges administrators to reset credentials and factory reset affected Ivanti devices to mitigate risks. (The Record)

GitHub expands security tools after 39 million secrets leaked in 2024  

GitHub has expanded its security tools after detecting over 39 million leaked secrets in repositories in 2024, including API keys and credentials. Despite measures like “Push Protection,” leaks persist due to developer habits and accidental exposure. To combat this, GitHub now offers standalone security products, free organization-wide secret risk assessments, enhanced push protection with bypass controls, AI-powered secret detection via Copilot, and improved detection through cloud provider partnerships. Users are advised to enable push protection, avoid hardcoded secrets, and use secure storage methods. (Bleeping Computer)

A covert Chinese-linked network targets recently laid-off U.S. government workers  

A covert Chinese-linked network is allegedly targeting recently laid-off U.S. government workers with fake job ads, aiming to gather sensitive information. Researcher Max Lesser found the campaign uses bogus consulting firms with overlapping websites and fake contact details. One firm, RiverMerge Strategies, posted ads for roles requiring government experience, with connections traced to a Chinese tech company. Some ads ran on LinkedIn and Craigslist but were later deleted. Reuters couldn’t confirm if any hires occurred or direct ties to the Chinese government. U.S. officials warn these tactics mirror past Chinese espionage operations. The FBI confirmed that foreign intelligence often uses fake recruiters to exploit former federal workers’ financial vulnerability. The firms’ activity raises concerns about national security, especially amid recent federal workforce layoffs. (Reuters)

Global phishing threat targets 88 countries  

A phishing-as-a-service platform called Lucid is targeting 169 entities across 88 countries, using iMessage and RCS to bypass spam filters and deliver large-scale phishing campaigns. Run by the Chinese cybercriminal group XinXin, Lucid offers over 1,000 phishing domains, auto-generated phishing sites, and pro-grade spamming tools to its subscribers. Victims clicking the links are redirected to fake landing pages impersonating companies like USPS, Amazon, and major banks, where their personal and financial data is stolen. (Bleeping Computer)

Samsung data breach tied to old stolen credentials  

Credentials compromised in a 2021 Racoon infostealer infection and never changed led to the leak of 270,000 customer records from Samsung Germany’s ticketing system. The threat actor ‘GHNA’ exploited these stolen Spectos GmbH credentials, which remained unchanged for four years, to access Samsung’s system and expose sensitive customer data, including names, addresses, emails, and transaction details. (Security Week)

North Korea’s fake worker schemes getting worse  

North Korean operatives aren’t just freelancing—they’re securing full-time IT and engineering roles, gaining deep access to enterprise networks under legitimate employment. DTEX’s investigation found these insiders operating in Fortune 2000 companies, with privileged access to systems, remote tools, and the ability to pivot into supply chain partners. The workers, often teams posing as one high-performing individual, are funneling salaries back to Pyongyang, but experts warn financial motives could shift to espionage or sabotage. Forcing job candidates to be on camera and show government-issued ID is also not proving to be enough – researchers suggest watching for social red flags, such as candidates looking away for prompts during interviews or avoiding casual conversation about personal interests. (CyberScoop)

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts or schedule a demo today.

On February 24, 2025, Skybox shut its doors as Tufin acquired limited assets from the company, leaving Skybox customers without support or service agreements. Now, those who relied on Skybox are stuck in limbo, unsure of what to do next. The uncertainty is real, but here’s the good news: RedSeal is the best partner to help you transition smoothly without losing critical capabilities—and without the financial penalties or operational disruptions.

The situation for Skybox customers

Tufin’s acquisition only covers select assets from Skybox, leaving existing customer contracts behind. This means that Skybox customers must migrate to Tufin or find a new home for their cybersecurity program. While Tufin offers some incentives to make the switch, it doesn’t cover everything Skybox customers need—such as vulnerability management (VM), attack path management (APM), and critical compliance features. All capabilities relied upon to protect a network.

RedSeal is the clear choice

From comprehensive network visibility to advanced vulnerability management and attack path management, RedSeal ensures continuity and enhances your security posture during the migration. Unlike Tufin, RedSeal offers a migration path that keeps critical features intact while giving you access to even more robust capabilities. When you move to RedSeal, you’re taking your security to the next level.

Limited time migration offer

To make this transition even easier, RedSeal is offering a program for Skybox customers. If you have less than six months remaining on your Skybox subscription, we’ll allow you to migrate to RedSeal at no additional cost for those remaining months. If you’re on a perpetual license, we’ll take over support at the same rate you were paying Skybox and move you to a RedSeal subscription within two years. This is your chance to move without the usual hassle or financial burden.

Conclusion

Don’t let the closure of Skybox leave your network security in the dark. With RedSeal, you get a seamless migration, full continuity of your critical security features, and an upgraded platform that will set your organization up for future growth.

Now is the time to act.

Schedule a demo today and see for yourself how RedSeal is the solution you need to stay ahead of the curve.