Week of August 25, 2025: China-Linked Telecom Advisory and Nevada Cyberattack

Security leaders watched a joint CISA-NSA-FBI advisory expose a sustained China-linked campaign against telecom routers worldwide, while CISA teams were simultaneously on the ground helping Nevada recover from an August 24 cyberattack on state services. The week also brought a 4.4-million-record TransUnion breach disclosure, fresh Known Exploited Vulnerabilities additions for Citrix NetScaler and Sangoma FreePBX, and new CISO appointments at Mimecast and Insight Global.

Agencies Detail Chinese State-Sponsored Router Compromises Targeting Telecoms Worldwide

On August 27, 2025, CISA joined the NSA, FBI, and numerous international partners to publish a joint cybersecurity advisory describing a sustained campaign by China-linked advanced persistent threat actors compromising provider edge and customer edge routers at telecommunications, government, transportation, lodging, and military networks across multiple continents. The advisory, which overlapped with industry reporting on groups known as Salt Typhoon, OPERATOR PANDA, and GhostEmperor, outlined techniques used to maintain long-term access and offered mitigation guidance for network defenders to detect and evict the activity from critical infrastructure. (CISA)

CISA Supports Nevada After August 24 Cyberattack Disrupts State Services

Following an August 24, 2025 cyberattack that disrupted essential state services, CISA deployed Threat Hunting teams to help Nevada officials assess the scope of the intrusion and restore affected networks. The FBI joined the investigation, and CISA coordinated with FEMA on available emergency response grants. Acting CISA Director Madhu Gottumukkala said the agency was leading federal coordination with state and local partners to restore critical services, describing the response as an example of real-time operational collaboration between government and private-sector partners. (CISA)

CISA Adds Actively Exploited Citrix NetScaler Flaw to KEV Catalog

On August 26, 2025, CISA added CVE-2025-7775, a memory overflow vulnerability affecting Citrix NetScaler, to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation. The addition triggered remediation deadlines for federal civilian executive branch agencies under Binding Operational Directive 22-01, and CISA urged all organizations to prioritize patching the flaw given its frequent use as an attack vector against network appliances deployed across enterprise environments. (CISA)

Sangoma FreePBX Authentication Bypass Added to CISA's Exploited Vulnerabilities List

CISA added CVE-2025-57819, an authentication bypass vulnerability in Sangoma FreePBX, to its Known Exploited Vulnerabilities Catalog on August 29, 2025, citing evidence of active exploitation. The listing obligated federal civilian executive branch agencies to remediate the flaw by a set deadline under Binding Operational Directive 22-01, and CISA again encouraged all organizations running FreePBX deployments to treat the vulnerability as a priority within their vulnerability management programs. (CISA)

TransUnion Notifies 4.4 Million After Third-Party Application Breach

Credit bureau TransUnion disclosed on August 29, 2025, that a cyber incident traced to a third-party application supporting its US consumer operations had compromised personal information, including names, Social Security numbers, and dates of birth, for more than 4.4 million individuals. The company said the breach, which occurred July 28, 2025, did not involve its core credit database, and it began offering affected individuals 24 months of credit monitoring while working with law enforcement on the investigation. (SecurityWeek)

Mimecast Names Leslie Nielsen Chief Information Security Officer

Mimecast announced on August 27, 2025, that Leslie Nielsen had joined as Chief Information Security Officer, arriving from marketing automation platform Klaviyo where he served as SVP and CISO through its growth to $1.3B in revenue and through IPO readiness. Nielsen previously held CISO roles at Nuance Communications, SAP Concur, and SuccessFactors. In his new role he will lead Mimecast's global cybersecurity strategy, threat intelligence, and incident response efforts for the company's more than 42,000 customers. (Mimecast)

Insight Global Appoints John Dickson as CISO

Staffing and consulting firm Insight Global announced on August 25, 2025, the appointment of John Dickson as Chief Information Security Officer, tasking him with overseeing global information security strategy for the company and its clients. Dickson brought more than 28 years of cybersecurity and industrial control systems experience, having previously served as Vice President and CISO at Colonial Pipeline and in a similar role at Republic National Distributing Company. (Insight Global)

Wytec International Discloses Repeated Website Defacement as Material Incident

Wytec International filed an SEC Form 8-K disclosing that on August 25, 2025, it became aware of a cybersecurity incident in which an attacker defaced its corporate website, wytecintl.com, and did so again after the company restored the site from backups. Wytec took the website offline, engaged forensic specialists, reported the matter to the FBI, and said it had received no contact from the actor, while also canceling a September 2 seminar as a consequence of the disruption. (SEC EDGAR)