Week of May 5, 2025: Masimo slows production after an intrusion, and LockBit's own panel is hacked

What mattered to security leaders in the week of May 5, 2025? Medical device maker Masimo disclosed in an 8-K that an intrusion on its on-premise network had slowed manufacturing and order fulfilment, and the LockBit ransomware operation had its own affiliate panel hacked, exposing negotiation messages, bitcoin addresses and affiliate accounts. CISA warned that unsophisticated actors were probing oil and gas control systems, while exploited flaws in SonicWall SMA100 gateways and the Langflow AI agent builder added to patch queues.

Masimo reports an intrusion that slowed manufacturing

In an 8-K dated May 6 and filed under Item 8.01, Masimo said it identified unauthorized activity on its on-premise network on April 27, 2025, isolated affected systems, brought in outside experts and notified law enforcement. Some manufacturing facilities were operating below normal levels and its ability to process, fulfil and ship orders on time was temporarily affected. The company said the incident appeared unrelated to its cloud-based systems and that its full scope was not yet known. (Masimo Corporation (SEC EDGAR))

LockBit's affiliate panel is hacked and its database dumped

Help Net Security reported on May 9 that LockBit's dark web affiliate panel had been defaced with a link to a MySQL database dump, apparently generated on April 29, 2025. The dump held nearly 60,000 unique bitcoin addresses, custom ransomware builds with their public keys, nearly 4,500 negotiation messages with victims and a list of 76 affiliates. LockBit's administrator confirmed the breach but said decryptors, stolen victim data and source code were not exposed. For incident responders, the negotiation logs offer rare insight into how affiliates pressure victims. (Help Net Security)

SonicWall SMA100 flaws chain to root, and one may be exploited

SonicWall fixed several vulnerabilities in its SMA100 secure access gateways reported by Rapid7's Ryan Emmons, who showed on Wednesday, May 7, how three of them chain to root-level remote code execution. CVE-2025-32819, an authenticated arbitrary file delete that appears to bypass a fix for a flaw exploited in 2021, can wipe the appliance database and reset the default admin password. Rapid7 said the bug may have been used in the wild. Because a low-privilege account is enough to start, stolen VPN credentials raise the stakes. (Help Net Security)

Langflow's unauthenticated code execution bug is exploited

CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities catalog, confirming attacks on Langflow, an open-source app for building AI agents without code. All versions before 1.3.0 expose an unauthenticated API endpoint that runs submitted code without sanitizing or sandboxing it, letting attackers execute arbitrary code with a crafted HTTP request. Horizon3.ai reported it in February and a fix shipped in late March, with public exploits following in April. AI tooling stood up by business teams often escapes normal asset inventories. (Help Net Security)

CISA warns of unsophisticated actors probing oil and gas OT

On May 6 CISA, with the FBI as co-sealer, said it was increasingly aware of unsophisticated actors targeting ICS and SCADA systems in the oil and natural gas subsector of the energy and transportation sectors. Basic techniques combined with poor cyber hygiene and exposed assets can lead to defacement, configuration changes, operational disruption and, in severe cases, physical damage. CISA pointed operators to a fact sheet of primary mitigations for operational technology. (CISA)

Samsung MagicINFO signage servers attacked to spread Mirai

Attackers began exploiting CVE-2024-7399, a path traversal flaw in the server component of Samsung MagicINFO 9 Server version 21.1050 and earlier, according to the SANS Internet Storm Center and Arctic Wolf. They used it to upload and run a script that downloads a Mirai bot. MagicINFO manages content and firmware on commercial displays in transport hubs, retail stores, hospitals and banks, equipment that often sits outside central IT ownership. (Help Net Security)

Edge Delta names Joan Pepin CISO

Telemetry pipeline company Edge Delta announced on May 8 that Joan Pepin had joined as chief information security officer. Pepin previously held executive security roles at Auth0, Sumo Logic and Nike, and will oversee the company's global security and compliance programs, including secure data processing and platform resilience. (Edge Delta (PR Newswire))