Week of February 24, 2025: CISA Advisories, DISA Breach Disclosure, and M365 Botnet

Security leaders faced a cluster of CISA advisories during the week of February 24, 2025, including two rounds of Known Exploited Vulnerabilities Catalog additions and four Industrial Control Systems bulletins, alongside disclosure of a data breach affecting over 3.3 million people tied to background-check provider DISA Global Solutions. Researchers also reported a 130,000-device botnet targeting Microsoft 365 accounts and a new Dragos report showing an 87% surge in ransomware attacks against industrial organizations.

CISA Adds ColdFusion and Oracle PLM Flaws to Exploited Vulnerabilities Catalog

On February 24, 2025, CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2017-3066, an Adobe ColdFusion deserialization flaw, and CVE-2024-20953, a deserialization vulnerability in Oracle Agile Product Lifecycle Management software. The addition triggers remediation deadlines for Federal Civilian Executive Branch agencies under Binding Operational Directive 22-01, and CISA urged all organizations to prioritize patching these flaws given their history as attack vectors for malicious cyber actors. (CISA)

CISA Flags Microsoft Partner Center and Zimbra Flaws as Actively Exploited

A day later, on February 25, 2025, CISA added two more vulnerabilities to the same catalog: CVE-2024-49035, an improper access control issue in Microsoft Partner Center, and CVE-2023-34192, a cross-site scripting flaw in Synacor's Zimbra Collaboration Suite. Both were confirmed to carry evidence of active exploitation. CISA pointed administrators toward related Palo Alto security bulletins and again reminded Federal Civilian Executive Branch agencies that remediation by the stated due date is mandatory under Binding Operational Directive 22-01. (CISA)

CISA Publishes ICS Advisories for Rockwell and Contec Health Devices

On February 25, 2025, CISA released two Industrial Control Systems advisories covering security issues in Rockwell Automation's PowerFlex 755 drives and an updated advisory for the Contec Health CMS8000 patient monitor. The bulletins detailed technical specifics and mitigations for operators running the affected equipment. CISA encouraged administrators across critical infrastructure sectors to review the advisories directly, underscoring the continued exposure of industrial and medical device environments to vulnerabilities that could affect manufacturing and patient-care operations. (CISA)

CISA Issues ICS Advisories for Schneider Electric and Dario Health Systems

Two days later, on February 27, 2025, CISA published a further pair of Industrial Control Systems advisories, one addressing Schneider Electric communication modules used with Modicon M580 and Quantum controllers and another covering the Dario Health USB-C blood glucose monitoring system's Android application. The advisories gave technical detail and mitigation steps for affected organizations. CISA again encouraged users and administrators managing industrial and connected medical equipment to review the bulletins and apply recommended fixes promptly. (CISA)

Botnet of 130,000 Devices Targets Microsoft 365 Accounts

Researchers at SecurityScorecard disclosed a botnet of over 130,000 compromised devices conducting coordinated password-spraying attacks against Microsoft 365 accounts, using command-and-control infrastructure hosted by SharkTech. The campaign relied on Non-Interactive Sign-Ins, a service-to-service authentication channel that does not always generate security alerts, allowing attackers to operate without triggering multi-factor authentication or Conditional Access Policies. Researchers noted possible links to infrastructure associated with China-affiliated hosting providers. Security teams were advised to review non-interactive sign-in logs and rotate credentials for flagged accounts. (Help Net Security)

Open Redirect Flaw Found in Siemens Teamcenter Single Sign-On

Siemens disclosed CVE-2025-23363, a high-severity open redirect vulnerability in the single sign-on login service of its Teamcenter product lifecycle management software, affecting all current versions. The flaw could let an attacker craft a link that redirects a legitimate user to an attacker-controlled site to steal valid session data, though successful exploitation requires the user to click the malicious link. An initial fix proved insufficient and was withdrawn, leaving Siemens working on a new patch while advising customers to avoid untrusted links. (Help Net Security)

Dragos Report Finds Industrial Ransomware Attacks Surged 87%

Dragos published its 2025 OT/ICS Cybersecurity Report, finding that ransomware attacks against industrial organizations rose 87% over the prior year alongside new malware families built specifically for operational technology environments. The report described state-sponsored groups embedding in critical infrastructure while hacktivists and cybercriminals exploited known vulnerabilities and exposed remote access configurations. It also detailed malware such as FrostyGoop, which Dragos linked to heating outages affecting over 600 apartment buildings in Ukraine, and noted continuing gaps in OT visibility. (Help Net Security)