Week of June 2, 2025: New AWS, DTCC CISOs; CISA Updates Play Ransomware Advisory

Security leaders tracked new chief information security officers named at Amazon Web Services and DTCC, alongside a joint CISA, FBI, and Australian Cyber Security Centre update on Play ransomware tactics and indicators. The same week, CISA added nine actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog and published ten industrial control systems advisories covering Hitachi Energy, Schneider Electric, Mitsubishi Electric, and CyberData products.

AWS and DTCC Name New Chief Information Security Officers

Amazon Web Services and the Depository Trust & Clearing Corporation both announced new security chiefs during the week of June 2, 2025. AWS named Amy Herzog as CISO, moving her from leading security for Amazon's Ads & Devices and Specialized Business organizations into the top role following the departure of Chris Betz. DTCC appointed Laura Deaner as CISO, bringing prior CISO experience at Northwestern Mutual, S&P Global, and PR Newswire, plus earlier leadership roles at Morgan Stanley and JPMorgan Chase. (SecurityWeek)

CISA, FBI, and Australian Partners Update Play Ransomware Guidance

CISA, the FBI, and the Australian Signals Directorate's Australian Cyber Security Centre issued updated guidance on June 4, 2025 covering the Play ransomware group, also tracked as Playcrypt. The advisory added new indicators of compromise and detailed new tactics used by the group, which has targeted businesses and critical infrastructure across North America, South America, and Europe since June 2022. The FBI said it had identified approximately 900 entities allegedly exploited by the group as of May 2025, and the agencies recommended multifactor authentication, offline backups, and prompt patching. (CISA)

CISA Adds Actively Exploited Chrome V8 Flaw to KEV Catalog

On June 5, 2025, CISA added CVE-2025-5419, an out-of-bounds read and write vulnerability in Google Chromium's V8 engine, to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation. The addition triggers remediation deadlines for federal civilian agencies under Binding Operational Directive 22-01, and CISA urged all organizations, not only federal agencies, to prioritize patching browser-engine flaws of this type given how frequently they serve as attack vectors against enterprise systems. (CISA)

Qualcomm Chipset Flaws Added to CISA's Exploited Vulnerabilities List

CISA added three Qualcomm chipset vulnerabilities, CVE-2025-21479, CVE-2025-21480, and CVE-2025-27038, to its Known Exploited Vulnerabilities Catalog on June 3, 2025, citing evidence of active exploitation. The first two were incorrect-authorization flaws and the third a use-after-free vulnerability affecting multiple chipsets. CISA again pointed federal civilian agencies to Binding Operational Directive 22-01 remediation deadlines while encouraging all organizations to treat the mobile-chipset issues as a priority within their vulnerability management programs. (CISA)

CISA Flags Five Actively Exploited Bugs in Routers, CMS, and Remote-Access Tool

On June 2, 2025, CISA added five vulnerabilities to its Known Exploited Vulnerabilities Catalog: an improper authentication flaw and a command injection flaw in ASUS routers, two Craft CMS vulnerabilities covering code injection and an assumed-immutable web parameter, and an improper authentication vulnerability in ConnectWise ScreenConnect. All five carried evidence of active exploitation, and CISA directed federal civilian agencies to meet Binding Operational Directive 22-01 deadlines while urging broader organizational adoption of the KEV catalog. (CISA)

CISA Publishes Seven ICS Advisories Covering Hitachi Energy and Mitsubishi Electric

CISA released seven Industrial Control Systems advisories on June 5, 2025, addressing products from Hitachi Energy, Mitsubishi Electric, and CyberData. The advisories covered the CyberData 011209 SIP Emergency Intercom, Hitachi Energy's Relion 670, 650 series and SAM600-IO product line, Mitsubishi Electric FA Engineering Software, and Hitachi Energy's IEC 61850 MMS-Server, among other updates. CISA encouraged asset owners and administrators to review each advisory for technical details and mitigations relevant to their ICS environments. (CISA)

CISA Issues Three ICS Advisories for Schneider Electric and Mitsubishi Electric

CISA released three Industrial Control Systems advisories on June 3, 2025, covering Schneider Electric's Wiser Home Automation line, Schneider Electric's EcoStruxure Power Build Rapsody software, and the Mitsubishi Electric MELSEC iQ-F Series. CISA encouraged users and administrators operating these products to review the advisories for technical details and apply recommended mitigations to reduce exposure across industrial environments relying on this equipment. (CISA)