Week of July 28, 2025: Palo Alto Networks bids $25 billion for CyberArk, and St. Paul calls in the Guard

What mattered to security leaders in the week of July 28, 2025? Palo Alto Networks agreed to acquire CyberArk in a deal valuing the identity security company at about $25 billion, and Minnesota's governor activated the National Guard after a cyberattack forced St. Paul to shut down city networks. Allied agencies also refreshed their joint advisory on Scattered Spider, and a claimed hacktivist operation grounded dozens of Aeroflot flights.

Palo Alto Networks agrees to buy CyberArk for about $25 billion

Palo Alto Networks and CyberArk signed a definitive agreement under which CyberArk holders get $45.00 in cash plus 2.2005 Palo Alto Networks shares per CyberArk share, according to Help Net Security's July 31 report. That puts CyberArk's equity value near $25 billion, a 26% premium to its unaffected 10-day average price as of July 25. The buyer framed the deal as its formal move into identity security, with privileged access controls extended to machine identities and AI agents. Buyers with both vendors in their stack now face a consolidation question at renewal time. (Help Net Security)

Minnesota activates the National Guard after St. Paul cyberattack

Governor Tim Walz signed an executive order bringing Minnesota National Guard cyber forces into the response to an attack on St. Paul, the state capital, which began on Friday, July 25 and persisted through the weekend. The city shut off government networks as a defensive step, cut Wi-Fi in city buildings and took online payment systems down, while 911 stayed operational. Mayor Melvin Carter said on Tuesday, July 29 that employee data was the city's main concern. A city of more than 300,000 people losing core services shows why municipal incident plans need state support lined up in advance. (The Record)

Allied agencies update their joint Scattered Spider advisory

On July 29 CISA, the FBI and partner agencies in Canada, Australia and the UK issued an updated advisory on Scattered Spider, drawing on FBI investigations through June 2025. It says the group has lately deployed DragonForce ransomware in data extortion attacks and still leans on phishing, push bombing and SIM swaps to steal credentials and get around multi-factor authentication. The advisory is aimed at commercial facilities sectors and subsectors. Help desk identity verification and MFA fatigue controls are the practical takeaways. (CISA)

Aeroflot cancels more than 60 flights after a claimed wiper attack

Russia's flag carrier Aeroflot cancelled more than 60 flights on July 28 after a cyberattack. The hacktivist groups Silent Crow and Cyberpartisans BY took responsibility, claiming a year of access and the wiping of 7,000 physical and virtual servers; Aeroflot had not confirmed any data destruction when BleepingComputer reported it on July 29, and Russian officials had not attributed the attack. The claims included access to 122 hypervisors and four Proxmox clusters, which points again at virtualization management as a single point of failure. (BleepingComputer)

Cisco ISE injection flaws and an old PaperCut bug go on the KEV list

CISA added three actively exploited vulnerabilities to its catalog on July 28: two injection flaws in Cisco Identity Services Engine, CVE-2025-20281 and CVE-2025-20337, and CVE-2023-2533, a cross-site request forgery bug in PaperCut NG/MF. ISE sits at the center of network access control in many enterprises, so its exposure to exploitation deserves a same-week patch window. (CISA)

CISA and the Coast Guard publish findings from a critical infrastructure threat hunt

A joint advisory from CISA and the US Coast Guard on July 31 described a proactive threat hunt at a US critical infrastructure organization. The teams found no sign of malicious activity but did find weaknesses, and their recommended fixes include not keeping credentials in plaintext, not sharing local administrator credentials across machines and turning on comprehensive logging. It reads as a checklist operators can run against their own environments. (CISA)

DHS opens more than $100 million in state, local and tribal cyber grants

On August 1 CISA and FEMA announced funding for fiscal year 2025: $91.7 million through the State and Local Cybersecurity Grant Program and $12.1 million through the Tribal Cybersecurity Grant Program. The money can pay for planning, exercises and hiring cyber expertise. For public sector security leaders, cases like St. Paul show where such grants can matter. (CISA)