Little-Known Microsoft "Escorts" Handle Sensitive DOD Data; Salt Typhoon Compromised US Army National Guard Network; Stuxnet Anniversary Congressional Hearing on Cyber Threats to Critical Infrastructure

If the cost of only using US citizen technicians vs. using a non-US technician PLUS an escort is high enough to lead to meaningful cost savings, then there is no way the escort program can be more than eyewash. The contractual wording that enables this kind of compromise obviously needs to be reviewed and actual audits of physical security activities (not just policies) should be required. Example: checking to see if anyone ever challenges someone walking around with no badge, or someone tailgating at entrances, etc. – often also eyewash.

While this story is talking about sensitive US Government data, we all have sensitive/IP we need to protect and should consider this use case in the context of our business. This started off as a well-intentioned plan to protect/monitor access from remote, much as you would apply guardrails for a support person to remotely access your system to help fix it. The problem is, oversight/escorting for an occasional support call doesn't scale well to a team working remotely. In addition, the remote worker capabilities and loyalties need to be considered before enabling this sort of plan. Make sure your contracts include language for staff with an appropriate level of assurance/risk. For example, my team sought out US Person/US-Only support options, which resulted in a better understanding of who was going to be on the far end, surfaced risks which may have been overlooked, and identified showstoppers before problems arose.

Outside of the fact that there is a tech support for Microsoft in China, this would apply globally to anyone using this program. There is a skills gap that needs to be addressed, and that will be a challenging task, to be sure. I would imagine you could “solve” this in some ways by using monitoring on systems, but we all know that things can happen. This is an interesting “insider threat” issue.

Ugh, this looks bad, just bad. I would be shocked if the government wasn’t aware and had ‘signed off’ on this arrangement. This was simply ‘window-dressing’ to keep costs down and profits up.

What is concerning is it appears Salt Typhoon maintained their access to the network for over a year. Don't get tunnel vision trying to block a single adversary like Salt Typhoon; focus on broad measures to raise the bar across the board. Beyond verifying your monitoring and response capabilities are dialed in to detect adversaries on your network, make sure you've fully embraced and implemented MFA, EDR, and robust vulnerability management.

The quote from Kevin Surace in the SCWorld piece captures the big issue here: “Disrupting one group temporarily limits active campaigns, but the underlying vulnerabilities remain, […] Until organizations address the root problem — reliance on credentials and outdated authentication methods — new groups will continue to gain access using the same techniques.”

The hits just keep coming with Salt Typhoon. The draft of the fiscal 2026 NDAA calls for “…DoD to develop a deterrence strategy against cyber activity on critical infrastructure.” What seems to be missing in congressional thinking is the understanding that defense of this country and its critical infrastructure is more than a military function. Somehow, they bought into the trope that we just have to conduct offensive cyber operations to keep the enemy at bay.

Salt Typhoon compromised a lot of networks, some of which we may never know about.

Given the ongoing and increased frequency of attacks targeting critical infrastructure, it's not a bad idea to look back at Stuxnet to see if we've missed any lessons learned, particularly as time diminishes memory and security workarounds evolve. From the basics, PR photos containing recognizable OT components, to unsafe media transfer practices, or even ignoring/disabling alerts, we need to make sure we're (still) diligent. The hearing is bringing their A-Team, and their recommendations will be noteworthy.

This is a hearing on the occasion of Stuxnet 15 years ago, on the evolution of threats to our infrastructure, rather than on Stuxnet itself. It is not likely to leak any information about Stuxnet that might be useful to our adversaries.

From what I’ve read the key to Stuxnet success was the ability to coopt a trusted insider. And we all know the most difficult threat to protect against is… the trusted insider.

Interestingly, the DoH traffic to Cloudflare was not impacted as it uses different addresses and is often setup by domain name rather than IP address. Using secure DNS resolvers is becoming a best practice, and you need to have more than one IP address configured. While you're considering having a backup to the 1.1.1.1 DNS Resolver, or any other external DNS resolver, make sure you test fail-over.

Two points here: (1) free services generally don’t come with SLAs (1.1.1.1 does not) so some of the savings need to be “banked” to have tested backup capabilities in place; and (2) even services with SLAs don’t guarantee 100% up time, or only convenient outages, or any overall limit on length of any individual incident, or frequency of short disruptions – stuff happens!

So it wasn’t BGP this time… just DNS. In all seriousness, this is a tricky one. Do you plan for your DNS Resolver to go completely out? How do you back up? Primarily, if you rely on DNS for Security, having a third or fourth resolver as an always-available backup to a different provider could result in some queries being unfiltered from time to time. How do you balance this one out?

The SonicWall SMA 100 series is EOL: you can't buy new ones, and support is hit or miss depending on the model. Plan A needs to be replace/retire these now. Assume they have been compromised, so you need to rotate credentials no matter what. UNC6148 is exploiting a combination of five fixed flaws, CVE-2021-20038, CVE-2024-38475, CVE-2021-20035, CVE-2021-20039 and CVE-2025-32819. The Google Cloud blog has the IoCs for your threat hunters.

These are relatively old SonicWall Devices; these types of devices are typically run until they are no longer functional, and pulling these devices back out will be difficult, I’m sure, for SonicWall. This isn’t solely a SonicWall issue; it's a general issue with many vendors, where their products run eternally. If you are running a network, check and ensure that all your devices are not only patched but also still under support and not at end of life.

While the number of patches seems large, remember they span 111 products, and last quarter they addressed 378 vulnerabilities. The hard part is once you fix the underlying apps – Fusion, MySQL, Oracle DB, Java – you need to make sure that application layer updates are also applied. In some cases these need to be coordinated with the other updates; it's a good time to take your business unit contacts to lunch. The good news here is that the OCI Code Editor flaw is fixed, doubly so as the Tenable writeup includes how to exploit the flaw.

Major update for Oracle, and the words “unauthenticated RCE” should cause some attention. Given the numerous products Oracle has in its wheelhouse, please verify that you are not running one of them.

There are no current indications of active exploitation, but with this news making the rounds that will change quickly. If you're running Cisco ISE, you should update to 3.4 Patch 2 or if you're staying with 3.3, update to patch 7; there are no workarounds. The updates are hot patches, which should facilitate the process.

This is going to confuse everyone. The ISE Unauthenticated RCE from last month differs from the current ISE RCE. This ISE RCE affects the same API as the RCE reported in the previous month and is the same type of vulnerability. In other words, if you patched last month because it was urgent, it’s time for that same urgency again. What will August have in store for us?

While often the cost (premiums plus deductible) of “adequate” cyber-insurance exceeds the cost of avoiding most incidents, one benefit is it does drive victims to make public declarations of cost as part of going after insurance payouts. The UNFI financial report has some good numbers to point out to your CIO: UNFI will reduce “capital and cloud expenditures” by 32% in 2025, likely as part of reducing the financial impact of the incident.

While $350-$400 million seems like a big number, UNFI net sales are expected to be about $31.7 billion, which is how you get to the impact not extending beyond the current quarter.

This is the kind of information of interest to investors which the SEC regulation is intended to elicit but often fails to do.

Validation for why every organization should have cyber insurance. The downside, though, is that cyber insurance premiums are sure to rise across the board. The insurance industry could also do a better job enforcing a minimum cybersecurity baseline that organizations must meet to obtain the policy. Otherwise, we stay in this ‘rinse and repeat’ cyber incident cycle.

Well at least the members know they are all impacted and can respond accordingly. The better news is the actions the Co-op Group took to block the attack prevented any cleanup, so they were able to capture everything they did as well as prevent deployment of ransomware. While the game is changing to more of an exfiltration/extortion (minus ransomware) it's worth learning all the actions taken by their team to see if you can increase your preparedness.

We may well be approaching the point where the cost of acquiring PII by breaching systems will exceed the cost of simply buying it from the data brokers.

NCSC is working to leverage external expertise, particularly as AI starts impacting vulnerability research. If you want to participate in the external security research, send your skills and focus areas to VRI at ncsc.gov.uk. NCSC has a separate portal, which leverages the HackerOne platform for reporting discovered vulnerabilities: https://www.ncsc.gov.uk/information/vulnerability-reporting

NCSC’s decision is but a reflection that cyber talent is now largely pooled outside of government. Today, graduates are lured away from government service by better pay, benefits, and perhaps more importantly, the opportunity to innovate. Organizations like NCSC, in other countries, have been on this path for years.

Wagenius and his cohort exfiltrated data and were able to extort at least $1 million from their victims. You may not want to search for "can hacking be treason" and "US military personnel defecting to Russia" on a corporate system, let alone brag in public forums about the data you've exfiltrated, let alone immediately purchase a new laptop after your electronics were seized.

The DoD has excellent technical schools for its computer network operators. In fact, it’s one of the quickest ways to obtain valuable skills that are highly marketable in the private sector. Unfortunately, the enlisted ranks are not well compensated, leading to thoughts on how to make a quick buck. This appears to be a case in point.