Week of May 12, 2025: Coinbase Extortion Disclosure, Nucor Production Halt

Security leaders watched two material cyber disclosures land in SEC filings in the same week, as Coinbase Global reported an insider-enabled extortion attempt and Nucor Corporation confirmed an intrusion that halted production at multiple sites. CISA added eight vulnerabilities to its Known Exploited Vulnerabilities Catalog across three separate updates, published twenty-two industrial control systems advisories, briefly altered and then paused a change to how it shares public alerts, and Keeper Security named a new chief information security officer.

Coinbase Discloses Extortion Attempt Tied to Overseas Contractor Access

Coinbase Global filed an 8-K on May 14, 2025 describing an extortion attempt after a threat actor emailed the company on May 11, 2025 claiming to hold internal documentation and customer account data. Coinbase said the data had been obtained by paying overseas contractors to pull records from internal systems they could access for work, activity its own security monitoring had already flagged in prior months. The company declined to pay the ransom, warned affected customers, and estimated remediation and reimbursement costs of $180 million to $400 million, with no passwords, private keys, or customer funds compromised. (U.S. Securities and Exchange Commission (EDGAR))

Nucor Takes Production Offline After Cybersecurity Incident

Nucor Corporation filed an 8-K reporting a May 13, 2025 incident involving unauthorized third-party access to certain information technology systems. The steelmaker activated its incident response plan, took potentially affected systems offline, and notified federal law enforcement while investigating with outside cybersecurity experts. Nucor disclosed that the Company temporarily and proactively halted certain production operations at various locations and was in the process of restarting the affected operations as of the filing, with the timing and materiality of the incident still under review. (U.S. Securities and Exchange Commission (EDGAR))

CISA Adds Exploited Fortinet Buffer Overflow Flaw to KEV Catalog

On May 14, 2025, CISA added CVE-2025-32756, a stack-based buffer overflow vulnerability affecting multiple Fortinet products, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The listing triggered Binding Operational Directive 22-01 remediation deadlines for federal civilian executive branch agencies. CISA said such vulnerabilities are frequent attack vectors for malicious cyber actors and urged all organizations, not just federal agencies, to prioritize patching the flaw as part of routine vulnerability management practices. (CISA)

CISA Flags Five Actively Exploited Windows Vulnerabilities

CISA added five Microsoft Windows vulnerabilities to its Known Exploited Vulnerabilities Catalog on May 13, 2025, including use-after-free flaws in the DWM Core Library, the Common Log File System driver, and the Ancillary Function Driver for WinSock, plus a Scripting Engine type confusion bug and a CLFS heap-based buffer overflow. CISA said the vulnerabilities carried significant risk to the federal enterprise and required remediation by federal civilian agencies under Binding Operational Directive 22-01, while urging broader adoption of timely patching. (CISA)

SAP NetWeaver and DrayTek Router Flaws Added to CISA's Exploited List

CISA added three more vulnerabilities to its Known Exploited Vulnerabilities Catalog on May 15, 2025: a deserialization vulnerability in SAP NetWeaver, a command-injection flaw in DrayTek Vigor routers, and an insufficient-policy-enforcement vulnerability in Google Chromium's Loader. The agency said the additions reflected evidence of active exploitation and again urged organizations to prioritize remediation of catalog vulnerabilities as part of ongoing vulnerability management, reiterating that Binding Operational Directive 22-01 sets remediation deadlines for federal civilian agencies. (CISA)

CISA Publishes 22 Industrial Control Systems Advisories

CISA released twenty-two Industrial Control Systems advisories on May 15, 2025, covering products from Siemens, Schneider Electric, and Mitsubishi Electric. The Siemens advisories spanned RUGGEDCOM, SIPROTEC and SICAM, Desigo, SIMATIC PCS neo, Polarion, and several other platforms, while separate advisories addressed Schneider Electric's EcoStruxure Power Build Rapsody and updates to earlier Mitsubishi Electric FA engineering software advisories. CISA encouraged asset owners and administrators to review the advisories for technical details and mitigations relevant to their environments. (CISA)

CISA Pauses Plan to Limit Public Cybersecurity Alerts

CISA said on May 13, 2025 that it was pausing a change announced for May 12 that would have shifted routine cybersecurity alert and advisory announcements off its public Alerts & Advisories webpage toward social media and email-only distribution. The agency said the shift was meant to spotlight urgent threat information but had caused confusion among cyber defenders. CISA said it would reassess its approach to sharing updates with stakeholders while continuing to communicate releases through existing channels. (CISA)

Keeper Security Names Shane Barney as CISO

Password management and privileged access management vendor Keeper Security appointed Shane Barney as chief information security officer in the week of May 12, 2025. Barney joined from U.S. Citizenship and Immigration Services, where he previously served as CISO and held other cybersecurity leadership roles. The appointment was included in SecurityWeek's industry moves roundup, which also noted a separate CEO appointment at managed service provider Ekco the same week. (SecurityWeek)