Tuesday Morning Threat Report: May 6, 2025
Where the news is always bad, but the analysis is always good.
Good morning everybody! Happy Tuesday!
Hundreds of Fortune 500 companies unwittingly hired North Koreans and Microsoft makes passwordless the default. Let’s dive in!
Top Stories:
This week’s biggest headlines. Analysis section below.
North Korean IT Workers Contracting For Fortune 500: At the RSA Security Conference, Mandiant Consulting disclosed that hundreds of Fortune 500 companies have unknowingly hired North Korean IT workers. When these workers are identified and employers attempt to terminate them, the companies are subjected to extortion.
India Blocks Encrypted Emailing Service Proton Mail: Proton Mail, a privacy-focused email service that encrypts messages so only the sender and recipient can read them, has been banned from operating in India. The decision came after Proton Mail refused to share customer information in response to a court order.
Microsoft Makes Passwordless The Default: By default, all new Microsoft accounts will now use passwordless authentication. This method, which includes options like biometrics and passkeys, is considered more secure and user-friendly than traditional passwords.
Organizations In Netherlands Targeted By Russian DDoS Group: Multiple Dutch organizations, across both the public and private sectors, have faced disruptions caused by Distributed Denial-of-Service (DDoS) attacks carried out by the Russian hacking group “NoName057.”
Russian Organizations Targeted By Hacking Group: “Hive0117,” a financially motivated hacking group, is targeting numerous Russian companies with phishing emails that contain malware.
Phishing Attack Targets WooCommerce Customers: A major phishing campaign is targeting WooCommerce customers. The phishing emails prompt recipients to download a “critical patch,” which is actually malware designed to steal billing information.
FBI Issues Statement on “Swatting”: Swatting is a form of harassment in which a fake emergency call is made to law enforcement, leading to a police response at the victim’s home. The FBI has announced that it will prosecute individuals responsible for making swatting calls.
European Electric Blackout: This article explores key lessons business executives can learn from the recent electrical blackout in Spain and Portugal. Power outages can lead to IT system failures, so it’s essential for businesses to have plans in place to ensure resilience and continuity.
My Takeaways
Analysis based on this week’s news and my experience in the industry. More headlines below in the Lower Echelon.
Get Mark Maguire’s stories in your inbox
Join Medium for free to get updates from this writer.
The Basics of BCP: Business Continuity Planning (BCP) is the process of creating strategies and procedures to ensure that essential business functions can continue or quickly resume during and after a disruption. BCP covers a wide range of threats, including cyber events like ransomware attacks or data breaches, as well as external factors such as natural disasters, power outages, or supply chain disruptions.
A critical first step for BCP is for an enterprise to list all services that the company uses, and then define both the Maximum Tolerable Downtime (MTD) and the Recovery Time Objective (RTO). The MTD is the longest period an organization can tolerate the unavailability of a critical business function or system before it results in unacceptable consequences, such as significant financial losses, reputational damage, or regulatory penalties. Determining MTD is a key part of risk management and helps prioritize recovery efforts. For example, an e-commerce platform might determine that its payment processing system has an MTD of just a few minutes, while internal reporting tools might have a longer acceptable downtime. The RTO is how quickly the organization plans on bringing back a service in the event of an outage. It is essential that the RTO be less than the MTD. For example, if an ecommerce platform has an MTD of 5 minutes for recovering their payment processing capability, their RTO could be set to one minute.
As the blackout in Europe’s electric grid shows, it is very important for organizations to perform BCP planning prior to an emergency. BCP is important for mitigating all types of threats — not just cyber. It still has not been announced if the blackout in Europe was due to a physical phenomena or from a cyberattack, but I would argue from a business perspective it does not much matter. Regardless of the reason, if the power goes out for your server room in Spain, you need to ensure that as those servers go offline they do so securely, that an outage in Spain does not cause your website to crash globally, and that no data is lost from this event. As the old adage goes, “failing to prepare is preparing to fail.”
The Lower Echelon:
Interesting cybersecurity news that didn’t quite make the cut to be a top story.
FBI Reveals 42,000 Website Domains Used For Phishing: LabHost was a hacking service that enabled scammers to send convincing phishing emails, until it was shut down by the FBI in 2024. The FBI has now released a list of 42,000 website domains that LabHost used to carry out these attacks.
Iris Scanning To Prove You Are Not AI: Tools for Humanity is a project co-founded by OpenAI CEO Sam Altman. One of its recently launched products uses iris-scanning technology to verify that a user is human, not an AI bot.
Apple Warns Of Spyware Threats: Apple has alerted customers in more than 100 countries that their devices were targeted with advanced spyware. Among those affected is an Italian journalist who had publicly criticized his government.
Ascension Health Hacked (Again): Ascension Health is notifying customers that their data was stolen in a breach for the second time this year. The breach occurred due to a vulnerability in third-party software that was compromised.
Europol Targets Organized Crime: Europol has launched a new task force, called GRIMM, to combat organized crime recruitment. A significant portion of this recruitment takes place online, with young people being targeted because they face lighter criminal penalties if apprehended.
Co-operative Group Faces Cyberattack: Co-op, a major U.K.-based retailer, is the second store in the country to be targeted by a cyberattack in recent weeks, following last week’s disclosure of a breach at M&S. Co-op stated that no customer data was compromised in the incident.
Harrods Experiences Cyberattack: Harrods, the luxury retailer, became the third major U.K. store to face a large-scale cyberattack in recent weeks. The U.K. government has stepped in to assist, and so far, the attack appears to have been unsuccessful.
CISA Confirms SonicWall Vulnerability Exploited In Wild: The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers exploited vulnerabilities in SonicWall’s enterprise security products.
On the right side of this page, you can follow and subscribe to receive this newsletter to your inbox weekly (no Medium account needed, just sign in with Google)!
Thanks for reading! See everyone next week!
About the author: Mark is a cybersecurity architect and consultant for leading cybersecurity consultancy Aujas.
