Week of December 8, 2025: CISA Warns of Pro-Russia Hacktivists, Unveils CPG 2.0

Security leaders watched CISA, the FBI, NSA and international partners warn that pro-Russia hacktivist groups were exploiting exposed VNC connections to reach operational technology at water, energy and food-sector facilities, while CISA separately released version 2.0 of its Cross-Sector Cybersecurity Performance Goals. The same week brought five new entries to CISA's Known Exploited Vulnerabilities Catalog, a refreshed CWE Top 25, a dozen ICS advisories, and security-leadership appointments at CISA, Microsoft, Opal Security and Fastly.

CISA, FBI and Global Partners Warn of Pro-Russia Hacktivist Attacks on OT

On December 9, 2025, CISA, the FBI, NSA, the Department of Energy, the Environmental Protection Agency, the Department of Defense Cyber Crime Center and international partners including Europol and the UK's National Cyber Security Centre published a joint cybersecurity advisory on pro-Russia hacktivist activity. The advisory described groups such as Cyber Army of Russia Reborn, Z-Pentest, NoName057(16) and Sector16 exploiting minimally secured internet-facing virtual network computing connections to reach operational technology in water, energy and food and agriculture facilities, in some cases causing physical damage. The agencies urged organizations to reduce internet exposure of OT assets and strengthen authentication. (CISA)

CISA Adds WinRAR and Windows Flaws to Exploited Vulnerabilities List

On December 9, 2025, CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2025-6218, a path traversal flaw in RARLAB WinRAR, and CVE-2025-62221, a use-after-free vulnerability in Microsoft Windows. Under Binding Operational Directive 22-01, federal civilian agencies must remediate catalog entries by their due dates, though CISA urged all organizations to prioritize remediation of these vulnerabilities as part of routine vulnerability management practice. (CISA)

Actively Exploited Chromium Flaw Joins CISA's KEV Catalog

On December 12, 2025, CISA added CVE-2025-14174, an out-of-bounds memory access vulnerability in Google Chromium, to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation. The addition triggers remediation deadlines for federal civilian executive branch agencies under Binding Operational Directive 22-01, and CISA again encouraged all organizations to treat the vulnerability as a priority in their patching programs given its history as a frequent attack vector for malicious cyber actors. (CISA)

CISA Releases Cybersecurity Performance Goals 2.0 With New Governance Focus

On December 11, 2025, CISA released version 2.0 of its Cross-Sector Cybersecurity Performance Goals, updating the voluntary benchmarks to align with the latest NIST Cybersecurity Framework revisions and three years of operational lessons. The update added a new governance component covering accountability, risk-management strategy and executive oversight, and consolidated separate information-technology and operational-technology goals into unified objectives. Acting CISA Director Madhu Gottumukkala said the update reflected extensive engagement with public- and private-sector stakeholders over the prior year. (CISA)

CISA and MITRE Publish 2025 CWE Top 25 Software Weaknesses

CISA, working with the MITRE-operated Homeland Security Systems Engineering and Development Institute, released the 2025 Common Weakness Enumeration Top 25 Most Dangerous Software Weaknesses on December 11, 2025. The annual list identifies the weaknesses most frequently exploited to compromise systems, steal data or disrupt services, and CISA tied it to its Secure by Design and Secure by Demand initiatives. The agency recommended developers, security teams and procurement staff use the list to prioritize remediation, application security testing and vendor evaluation criteria. (CISA)

CISA Issues 12 Industrial Control Systems Advisories

On December 11, 2025, CISA released 12 Industrial Control Systems advisories covering products from Johnson Controls, AzeoTech, Siemens, OpenPLC and medical-imaging software from Grassroots DICOM and Varex Imaging. The advisories, numbered ICSA-25-345-01 through ICSA-25-345-10 and ICSMA-25-345-01 and -02, detailed current security issues, vulnerabilities and exploits affecting the listed ICS products. CISA encouraged asset owners and administrators to review each advisory for technical details and mitigations relevant to their specific industrial environments. (CISA)

CISA, Microsoft, Opal Security and Fastly Announce Security-Leadership Moves

SecurityWeek's Industry Moves roundup for the week of December 8, 2025 recorded several security-leadership changes. CISA named Andrew McCarthy as Chief of Staff to lead daily operations and policy priorities. Microsoft Global CISO Igor Tsyganskiy announced on December 9 that Geoff Belknap and Michael Srihari were promoted to Operating CISOs and Sherrod DeGrippo to Deputy CISO. Opal Security named former Cyberhaven chief executive Howard Ting as its new CEO, and Fastly named Kelly Shortridge as Chief Product Officer. (SecurityWeek)