Security Affairs newsletter Round 543 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs’ international edition for Round 543, written by Pierluigi Paganini, rounds up a slate of recent cyber stories with a focus on ransomware, vulnerabilities and targeted campaigns. Notable items include Ohio’s Union County suffering a ransomware attack that impacted 45,000 people, and ForceLeak flaws in Salesforce Agentforce that expose CRM data via prompt injection.

Microsoft has uncovered a new variant of the XCSSET macOS malware in targeted attacks, while attackers reportedly exploited the Fortra GoAnywhere flaw before a public alert. The UK’s NCSC warned that Cisco firewall zero-days were used to deploy RayInitiator and LINE VIPER malware, and Google flagged Brickstorm backdoor activity targeting the U.S. legal and tech sectors. Other highlights cover U.S.

CISA adding Cisco Secure Firewall ASA and Secure FTD flaws to its Known Exploited Vulnerabilities catalog, the seizure of $439 million in a global cybercrime operation by Operation HAECHI VI, and a Volvo North America data breach linked to an IT provider’s ransomware.

The newsletter also notes Cisco fixed an actively exploited zero-day in IOS/IOS XE, Libraesva Email Gateway vulnerability exploitation by nation-state actors, SolarWinds releasing a hotfix for CVE-2025-26399, and ongoing discourse around ransomware disruptions to European airports and related security measures.