InfoSecBulletin Cybersecurity for mankind
CISA, NSA, FBI, and other US and international partners released a joint fact sheet called “People’s Republic of China State-Sponsored Cyber Activity: Actions for Critical Infrastructure Leaders.” This publication includes contributions from various partners.
U.S. Department of Energy (DOE)
CVSS 10.0 Flaw
Critical flaw in Siemens OZW Web Servers Enable Unauthenticated RCE
Microsoft Patch Tuesday May 2025: 72 flaws, 5 Actively Exploited Zero-Day
OTP glitch disrupted NID services across the country
Google to pay Texas $1.4 billion for location tracking practices
YouTube geo-blocks at least 4 Bangladeshi TV channels in India
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA
U.S. Environmental Protection Agency (EPA)
U.S. Transportation Security Administration (TSA)
U.S. Department of Treasury
Australian Signals Directorate’s (ASD’s) Australian Cyber Security Centre (ACSC)
Canadian Centre for Cyber Security (CCCS) a part of the Communications Security Establishment (CSE)
United Kingdom’s National Cyber Security Centre (NCSC-UK)
New Zealand’s National Cyber Security Centre (NCSC-NZ)
The US authoring agencies believe that “Volt Typhoon”, a group sponsored by the People’s Republic of China, is trying to position themselves on IT networks using living off the land (LOTL) techniques. They aim to carry out cyber attacks against critical infrastructure in the US in case of a major crisis or conflict with the US. The fact sheet alerts leaders of critical infrastructure about this urgent risk and provides guidance on how to protect their organization from this threat.
CISA and its partners recommend that leaders of critical infrastructure organizations read the joint fact sheet to defend against the Volt Typhoon threat. For more information, see the guidance on identifying and mitigating Living off the Land Techniques. Visit Secure by Design for information on secure by design principles and practices.
