Week of May 26, 2025: Laundry Bear Espionage Exposed, DragonForce Hits MSP Clients

Security leaders closed out May 2025 watching Dutch and Microsoft researchers unmask the Laundry Bear espionage group, Sophos confirm a DragonForce ransomware intrusion delivered through a compromised MSP's RMM tool, and CISA publish fresh ICS advisories and SIEM/SOAR procurement guidance. The week also brought a new CISO appointment at Sagent, a NIST proposal for scoring likely-exploited vulnerabilities, and renewed federal warnings about patient data routed through Chinese-operated servers.

Sagent Names Kyle Draisey as CISO

Mortgage servicing technology provider Sagent appointed Kyle Draisey as its new Chief Information Security Officer and Head of Cybersecurity, announced in SecurityWeek's industry-moves roundup covering May 26, 2025. Draisey previously served nearly 15 years as an Army Intelligence Officer before holding the role of Senior Technical Director for Cyber and Intelligence at BAE Systems. The same roundup listed other executive changes, including Home Depot naming Angie Brown as EVP and CIO and Zscaler appointing Kevin Rubin as CFO, reflecting continued movement in security and technology leadership ranks. (SecurityWeek)

CISA Issues Five ICS Advisories

On May 29, 2025, CISA published five Industrial Control Systems advisories covering products from Siemens, Consilium Safety, Instantel, and Santesoft. The bulletins addressed vulnerabilities in Siemens SiPass and SiPass Integrated access-control systems, the Consilium Safety CS5000 Fire Panel, the Instantel Micromate monitoring device, and the Santesoft Sante DICOM Viewer Pro medical imaging software. CISA urged operators of industrial and critical-infrastructure environments to review the technical details and apply recommended mitigations promptly, continuing a steady cadence of vendor-specific ICS disclosures spanning both industrial and medical device vendors. (CISA)

CISA and Allies Issue SIEM/SOAR Procurement Guidance

On May 27, 2025, CISA, working with Australia's Cyber Security Centre and other international and U.S. partners, released new guidance intended to help organizations evaluate and procure Security Information and Event Management and Security Orchestration, Automation, and Response platforms. The three-part package offers separate guidance for executives and practitioners, plus a resource for prioritizing which security logs to ingest into a SIEM. CISA said the documents are meant to help organizations improve network visibility and strengthen detection and incident-response capabilities as they select or expand SIEM and SOAR deployments. (CISA)

Dutch Agencies and Microsoft Expose Laundry Bear Espionage Group

On May 27, 2025, the Netherlands' AIVD and MIVD, working with Microsoft, publicly detailed a Russia-affiliated threat group they named Laundry Bear, tracked by Microsoft as Void Blizzard. The group was linked to a September 2024 breach of the Dutch National Police and to intrusions against defense ministries, armed forces branches, defense contractors, and technology and aerospace firms across NATO and EU countries. Investigators said the actor relied on password-spray and stolen-cookie techniques to access Microsoft email and cloud accounts rather than deeper network intrusion, making detection difficult for administrators. (Help Net Security)

DragonForce Ransomware Delivered to MSP Clients via SimpleHelp

Sophos disclosed on May 28, 2025, that a threat actor using the DragonForce ransomware had compromised an unnamed managed service provider and used its SimpleHelp remote monitoring and management platform to push malicious installers to the MSP's client organizations. Sophos MDR said it held medium confidence the attacker exploited a chain of SimpleHelp vulnerabilities disclosed in January 2025, and that the intruder also collected device names, configurations, and network details from multiple customer environments before Sophos cut off access to one affected client before ransomware deployment occurred. (Help Net Security)

Agencies Flag Chinese-Hosted Servers as Risk to US Health Data

On May 29, 2025, Smart Meter highlighted that federal agencies had identified the routing of sensitive U.S. patient data through Chinese-operated servers as a growing national-security concern, noting that some connected medical devices send readings overseas before reaching U.S. healthcare systems. The warning referenced an April 8 Department of Justice rule restricting data transfers to countries including China, which introduced joint liability for remote patient-monitoring vendors and providers and set a 90-day enforcement discretion period running until July 8, 2025, with potential penalties reaching $1 million and 20 years imprisonment for willful violations. (Help Net Security)

NIST Proposes 'Likely Exploited Vulnerabilities' Scoring Method

On May 26, 2025, NIST introduced a new metric called Likely Exploited Vulnerabilities, designed to estimate the probability that a given flaw has already been exploited by using historical Exploit Prediction Scoring System data. NIST said the statistical estimate is meant to supplement, not replace, EPSS and CISA's Known Exploited Vulnerabilities list, and could help organizations check KEV completeness, surface high-risk vulnerabilities missing from that list, and prioritize patching. The agency said the scores remain unvalidated and asked industry partners holding real-world exploitation data to help test the method's accuracy. (Help Net Security)