Week of May 19, 2025: CISA Deputy Director Named, Lumma Stealer Takedown

Security leaders tracked a Commvault Metallic SaaS backup compromise, a joint US-UK-German advisory on Russian GRU targeting of logistics and technology firms, and a multinational takedown of the Lumma Stealer infostealer operation during the week of May 19, 2025. The same week brought a new CISA Deputy Director, a fresh LummaC2 malware advisory, an unpatched Windows Server privilege-escalation technique, and a compromised installer on the official RVTools site.

CISA Welcomes Madhu Gottumukkala as Deputy Director

CISA announced Madhu Gottumukkala as its new Deputy Director on May 19, 2025, placing him in a role central to the agency's cyber and infrastructure risk mission. Gottumukkala previously served as Commissioner and Chief Information Officer for South Dakota's Bureau of Information and Technology, where he oversaw statewide technology and cybersecurity initiatives, and earlier held the post of the state's second chief technology officer. He said he was "honored to be appointed by Secretary Noem" to serve in the position. CISA's Bridget Bean said his blend of technical expertise and real-world experience would strengthen the agency's infrastructure resilience mission. (CISA)

CISA Adds Six Vulnerabilities to Known Exploited Catalog

CISA added six vulnerabilities to its Known Exploited Vulnerabilities Catalog on May 19, 2025, citing evidence of active exploitation. The list included two Ivanti Endpoint Manager Mobile flaws, an MDaemon Email Server cross-site scripting bug, a Srimax Output Messenger directory traversal issue, a Zimbra Collaboration Suite cross-site scripting flaw, and a ZKTeco BioTime path traversal vulnerability. Binding Operational Directive 22-01 requires federal civilian agencies to remediate catalog entries by set deadlines, and CISA urged all organizations to prioritize patching these products given their history as frequent attack vectors for malicious cyber actors. (CISA)

CISA Details Threat Activity Against Commvault's Metallic SaaS Backup

CISA and Commvault disclosed that threat actors may have accessed client secrets tied to Commvault's Metallic Microsoft 365 backup software-as-a-service offering hosted in Microsoft Azure, allowing unauthorized access to some customers' M365 environments. CISA assessed the activity as part of a broader campaign targeting SaaS providers' cloud applications with default configurations and elevated permissions. The agency urged affected organizations to monitor Entra audit logs, rotate application secrets established between February and May 2025, and apply conditional access policies restricting authentication to Commvault's allowlisted IP ranges. CISA separately added the related Commvault vulnerability, CVE-2025-3928, to its Known Exploited Vulnerabilities Catalog. (CISA)

CISA and Allies Warn of Russian GRU Targeting Logistics and Tech Firms

CISA, the NSA, the FBI, and international partners including the UK's NCSC and Germany's BSI released a joint advisory describing a Russian GRU cyber espionage campaign against Western logistics and technology firms. The advisory attributed the activity to GRU 85th Main Special Service Center, military unit 26165, and said the campaign targeted organizations involved in coordinating, transporting, and delivering foreign assistance to Ukraine across defense, transportation, maritime, air traffic management, and IT services sectors. Agencies urged executives and defenders at logistics and technology companies to increase monitoring and threat hunting for known indicators tied to unit 26165. (CISA)

FBI and CISA Issue Advisory on LummaC2 Infostealer Targeting Critical Infrastructure

CISA and the FBI issued a joint cybersecurity advisory on May 21, 2025, detailing tactics and indicators of compromise linked to threat actors deploying LummaC2 infostealer malware against U.S. critical infrastructure sectors. The advisory said LummaC2 can infiltrate networks and exfiltrate sensitive information including financial credentials and multifactor authentication details, and noted that threat actors continued using the malware through May 2025. Indicators included in the advisory covered infections dating from November 2023 through May 2025, and the agencies urged organizations to apply the advisory's mitigations to reduce exposure. (CISA)

US, European, and Japanese Authorities Disrupt Lumma Stealer Infrastructure

US, European, and Japanese authorities worked with Microsoft, Cloudflare, and other companies to disrupt the infrastructure behind Lumma Stealer, described as the most significant infostealer-as-a-service operation at the time. Microsoft said it had identified more than 394,000 infected Windows computers worldwide between March 16, 2025, and May 16, 2025, and that more than 1,300 domains tied to the operation were seized or sinkholed. The US Department of Justice seized the Lumma control panel central to its marketplace, while Cloudflare countered the malware's abuse of its infrastructure to hide criminal servers' origin IP addresses. (Help Net Security)

Malicious RVTools Installer Found on Official Download Site

A security researcher reported that the official download site for the VMware utility RVTools, Robware.net, served a compromised installer containing the Bumblebee malware loader, which is often used to gain initial access before delivering ransomware payloads. The site went offline intermittently between May 12 and May 19, 2025, and briefly returned a clean file before going dark again. Dell Technologies, which had acquired RVTools, said its investigation found no indication its official sites or software were compromised, attributing some disruption to denial-of-service attacks, and warned customers away from lookalike domains distributing malware. (Help Net Security)

Unpatched Windows Server Flaw Enables Full Active Directory Domain Compromise

Akamai researchers disclosed an unpatched Windows Server 2025 privilege escalation technique, dubbed BadSuccessor, that abuses the delegated Managed Service Account feature to let an attacker who controls a dMSA object gain control over any Active Directory user, including Domain Admins. The technique required only two attribute changes and worked under default configurations without needing elevated group membership. Researchers said the issue likely affected most organizations relying on Active Directory and had reported it to Microsoft, which was developing a fix; in the meantime they urged restricting dMSA creation permissions and monitoring related attribute changes and authentication events. (Help Net Security)