Week in review: Botnet meets M365 accounts, POC for weaknesses of the Ivanti Endpoint Manager published

Here is an overview of some of the most interesting news, articles, interviews and videos from last week:

Massive Botnet meets Microsoft 365 accounts
A recently discovered bot network of over 130,000 endangered devices starts coordinated passwords against Microsoft 365 (M365).

POC Exploit for Ivanti Endpoint Manager Conditions (CVE 2024-13159)
An exploit of the Proof-of-Concept (POC) for four weaknesses of the critical Ivanti endpoint manager was published by Horizon3.ai researchers.

Avoid selling sellers when using Managed Cloud Security Services
In this Help Security interview, Marina Segal, CEO von Tamnoon, discusses the most important obstacles when implementing the managed cloud security in hybrids and multi-cloud environments.

2024 Phishing trends tell us what we would expect in 2025
According to the RiskoSadium Kroll, which was most often used by cybercriminals in 2024 in 2024, Phishing was the method that was most frequently used by cybercriminals that expected this trend in 2025.

Man against machine: beat the perfect balance of threat intelligence
Aaron Roberts, director of perspective intelligence, discusses the NET Security interview in this aid how automation changes threat information.

Siemens Team Center View could enable the account of account (CVE 2025-23363)
A high-quality vulnerability (CVE-2025-23363) In the Siemens Team Center Product Lifecycle Management (PLM) software, it can enable an attacker to steal applicable session data from the users and to receive an unauthorized access to the use in need of protection.

Is Agentic Ai too smart for your own good?
The Agentic AI, which consists of systems that take action autonomously based on high -ranking goals, is closed for corporate security, threat information and automation.

Is your e -mail or password among the over 240 million of information valleys at risk?
For the second time since the beginning of 2025, a variety of registration information that was extracted from info -led protocols was added to the database that runs the Habweenpwned site (HIBP) and the Breach notification service.

The compliance illusion: why your company may be at risk despite passing the audits
For many CISOS, compliance can feel like a necessary evil and a wrong feeling of security.

OSPS Baseline: Practical Safety -Best Practices for Open -Source -Software Projects
The Open Source Security Foundation (OpenSSF), a cross-sector initiative by the Linux Foundation, has announced the first publication of the open source project security (OSPS basis), a graded framework for security practices that develop with the maturity of open source projects.

Hundreds of github repos served malware for years
Kaspersky researchers have discovered an extensive and long-lasting malware delivery campaign, which the tendency of the users used to download code from Github and used without checking whether it is malicious.

Misconfig Mapper: Open Source Tool to uncover safety defect configurations
Misconfig Mapper is an open source cli tool that is installed in Golang, which discovers and counts instances of services in your company.

Background examination, drug test providers Disa suffers from data violation
Disa Global Solutions, a company based in Texas that offers over 55,000 organizations a cyber incident that led to a data injury that led to a potential compromise of personal and financial information of over 3.3 million people.

Dalfox: Open source XSS scanner
Dalfox is an open source tool for automating the detection of XSS weak spots.

China based Silver Fox Parods Healthcare App to provide malware
Silver Fox, a threat player based in China, who may be supported by the Chinese government or not, the Backdoor has delivered the Valleyrat to unsuspecting users by disguising the malware as a legitimate health app (the Philips dicom Viewer), a Windows text editor (EMEDIVT) as well as system drivers and supply companies.

Understanding of the AI ​​law and its compliance challenges
In this Help -Netto -Security Interview, David Dumont, partner at Hunton Andrews Kurth, discusses the effects of the EU -AAI Act and how companies can use existing GDPR frameworks and at the same time can take into account new obligations such as conformity ratings and transparency requirements.

Account transfer recognition: there is no single knowledge
Account takeover (ATO) is one of the most common types of attacks. According to Proofpoint, 99% of the customer tenants were affected in 2024 with at least one account takeover attempt, and 62% of the customers experienced at least one that was successful.

Debunking 5 myths about network automation
The success of the network automation is based on a single source of truth for network and safety forwarding data, including manufacturers, type, model number, firmware and software version.

The art to compensate for data security with business objectives
In this aid network -security video, Nathan Parks, Senior Research Specialist at Gartner, discuss their latest research and shows that only 14% of the security manager effectively compensates for data security with the business objectives.

Cyber ​​security needs a guide. So let's stop debating and decide
In view of the increasingly aggressive and organized threat players, the time for the debate is over. Cyber ​​security needs a clearly defined guide who has power. Everything else is doomed to fail.

The CISO dilemma of protecting the company while the innovation is promoting
The responsibilities of modern CISO have exceeded traditional technical supervision, which includes strategic leadership, risk management and regulations for official compliance.

How Enterprise leaders can secure and govern the agent -ki
In this Help Security Videos, Nataraj Nagaratnam, IBM Fellow and CTO for cloud security discuss the steps of companies to create a secure basis for AGETIC AI proposals.

Open source strike back: NextCloud Hub 10 emphasizes the monopoly of Big Tech on AI and privacy
With the start of HUB 10, Nextcloud shows that Open Source is a practical alternative for safe collaboration with corporate degrees.

Why the AI ​​use requires a new level of governance
In this Help -Net -Net -Security Video, Lee Waskevich, VP of Security at Eplus, such as the KI provision requires improved governance and stricter controls, especially when managing data.

Cybersecurity -jobs now available: February 25, 2025
We have searched the market to offer you a selection of roles that include various skills in the field of cyber security, whereby the possibilities are available in both Europe and all over the world. Take a look at this weekly selection of cyber security jobs.

Infosec products of the month: February 2025
Here you will find a look at the most interesting products from the last month with publications of: 1password, armor, bigid, dynatrace, fortinet, Legit Security, Netwrix, Nymi, Palo Alto Networks, Pangea, Privacera, Qualies, SafebReach, Satori, Seal Security and Veam software.