NetSec News Articles of Interest From the Week of August 4, 2025

Read more cybersecurity news in this edition of NetSec News.

• 

  Jessica Owens

  MSSP Training & Development Coordinator, T2 SOC Analyst

Akira ransomware exploits SonicWall VPNs in likely zero-day attack on fully-patched devices

SonicWall SSL VPN devices have become the target of Akira ransomware attacks as part of a newfound surge in activity observed in late July 2025. (The Hacker News)

“With SonicWall SSL VPNs being a popular product among environments, the impact of this zero-day vulnerability introduces risk for compromise, especially in the higher levels of a network. Instances of Akira, one of the most common ransomwares as of Q2 2025, have also been found in multiple exploitation incidents related to this threat. This leads organizations to requiring good asset management, good user management practices, as well as good user security hygiene. In addition to this, it requires organizations to take extra measures in securing their network and having clear direction in what authorized telemetry looks like in their environment, especially VPN usage and the authorization of different VPNs.” –Michael Reed, Tier 2 SOC Analyst at C3 Integrated Solutions

Spikes in malicious activity precede new security flaws in 80% of cases

Researchers have found that in roughly 80% of cases, spikes in malicious activity like network reconnaissance, targeted scanning, and brute-forcing attempts targeting edge networking devices are a precursor to the disclosure of new security vulnerabilities (CVEs) within six weeks. (BleepingComputer)

Minnesota activates National Guard in response to cyberattack

Minnesota Governor Tim Walz on Tuesday called in the National Guard’s cyber experts to help the City of Saint Paul respond to a cyberattack. (SecurityWeek)

CISA open-sources Thorium platform for malware, forensic analysis

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced the public availability of Thorium, an open-source platform for malware and forensic analysts across the government, public, and private sectors. (BleepingComputer)

New ‘Plague’ PAM backdoor exposes critical Linux systems to silent credential theft

Cybersecurity researchers have flagged a previously undocumented Linux backdoor dubbed Plague that has managed to evade detection for a year. “The implant is built as a malicious PAM (Pluggable Authentication Module), enabling attackers to silently bypass system authentication and gain persistent SSH access,” Nextron Systems researcher Pierre-Henri Pezier said. (The Hacker News)

The polyworking Gen Z: new victims of cybercrime

The stereotype of Gen Z as lazy, uncommitted employees averse to hard work, and prone to job-hopping is quite common. But the statistics tell a different story. Nearly half of Zoomers juggle multiple gigs: a full-time job, freelancing, and various side hustles. And cybercriminals have identified these polyworking young professionals as convenient targets. (Kaspersky Blog)