The Wisconsin Fusion Center has shared an intelligence report regarding an increase in ransomware attacks within the state. They have identified a new threat actor known as “Fog” who is behind some of these attacks.
Notables from the report:
The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:
ICS Vulnerability Advisories:
CISA Releases Seven Industrial Control Systems Advisories
Products are used across multiple sectors, please check these latest advisories for specific equipment used across your ICS environments and address accordingly.
The following posts are useful for general awareness of current cyber threats, vulnerabilities, guidance, and other cyber-related news or updates. These resources have been curated by the WaterISAC analyst team as items of broad relevance and benefit that do not need supplemental analysis at this time.
Critical Infrastructure
Given widespread use, WaterISAC is passing through the following alert which incorporates patches that address previously reported on zero day vulnerabilities regarding ArcaneDoor. Cisco released a bundled publication for security advisories that address vulnerabilities in Cisco Adaptive Security Appliance (ASA), Firepower Management Center (FMC), and Firepower Threat Defense (FTD) software.
One of the many challenges that cybersecurity teams of all sizes face, is knowing where to focus their limited efforts and resources. This is why one of the first things any cybersecurity team should be preoccupied with is obtaining a clear picture of the business-critical assets of their organization, and to maintain a proper inventory of the technology used – essentially mapping out the organization to identify the most needed areas to secure. In a recent article, The Hacker News shares a four-step approach to mapping and securing the most critical assets of an organization.
Not only are threat actors always modifying tactics making it imperative for security teams to maintain situational awareness and adapt training methods, but as of late, cybercriminals have been observed delivering more convincing scams by leveraging generative AI. As this does not come as a huge surprise per se, it is a threat worthy of our attention as scammers have been seen fooling even the savviest internet users and not just the elderly.
WaterISAC is sharing this recent threat actor behavior for member awareness. Threat actors have been identified targeting VPN solutions from various cybersecurity vendors for initial access into enterprise networks. Cybersecurity firm Check Point has monitored such login attempts where attackers leveraged old VPN local accounts with password-only authentication and don’t appear to involve exploitation of a software vulnerability.
The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:
ICS Vulnerability Advisories:
May 28 – CISA Releases One Industrial Control Systems Advisory
May 23 – CISA Releases One Industrial Control Systems Advisory
The following posts are useful for general awareness of current cyber threats, vulnerabilities, guidance, and other cyber-related news or updates. These resources have been curated by the WaterISAC analyst team as items of broad relevance and benefit that do not need supplemental analysis at this time.
Critical Infrastructure
CISA shared the following in an alert sent out today:
Rockwell Automation has released guidance encouraging users to remove connectivity on all Industrial Control Systems (ICS) devices connected to the public-facing internet to reduce exposure to unauthorized or malicious cyber activity.
From Rockwell Automation:
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
