From the Desk of Melissa Irace, CISO
This week’s threats reinforce an important reality: attackers are targeting the systems organizations depend on to manage security, control networks, deploy software, and authenticate users. These trusted platforms provide broad operational access, making them attractive targets for ransomware, credential theft, and business disruption. Organizations should prioritize protecting administrative systems, monitoring privileged activity, and rapidly addressing actively exploited vulnerabilities.
Weekly executive summary
This week’s cyber activity highlights a growing trend: attackers are focusing on the technologies that manage and control enterprise environments rather than individual employee devices.
Active exploitation involving Check Point Management Servers, F5 BIG-IP, Arista VeloCloud, JetBrains TeamCity, and AI-enabled Microsoft phishing campaigns demonstrates that security management, remote access, software development, and identity platforms remain the highest-value targets.
Organizations should ensure these critical systems are patched, continuously monitored, and protected with strong administrative controls.
Melissa’s perspective
“The biggest cyber risk today isn’t simply an unpatched workstation. It’s the compromise of the systems that manage your business. Firewall management, remote access, identity platforms, and software development environments have become primary targets because they provide attackers with broad operational control. Organizations should focus on protecting privileged systems, reducing unnecessary administrative access, and validating that critical security infrastructure is working as intended before an incident occurs.”
This week’s top threats
01 · Critical
Check Point management servers under active attack
Attackers are actively targeting Check Point management infrastructure responsible for administering firewall policies and security controls. A successful compromise could allow attackers to manipulate security policies and gain deeper access into business networks.
How Intuitus helps
- External Attack Surface Assessments
- Penetration Testing as a Service (PTaaS)
- Network Security Assessments
- Security Architecture Reviews
- Vulnerability Assessments
02 · High
F5 BIG-IP remote access under active exploitation
Critical vulnerabilities affecting F5 BIG-IP remote-access platforms are being actively exploited. Because these systems often protect access to business applications and cloud services, compromise can expose sensitive internal resources.
How Intuitus helps
- Penetration Testing as a Service (PTaaS)
- Identity Security Assessments
- Network Security Assessments
- Vulnerability Assessments
- MDR
03 · High
Arista VeloCloud SD-WAN infrastructure at risk
Attackers are targeting centralized SD-WAN management platforms that connect multiple offices and remote locations. Compromise of these systems may affect network availability, connectivity, and administrative control across the organization.
How Intuitus helps
- Network Security Assessments
- External Attack Surface Assessments
- Penetration Testing as a Service (PTaaS)
- Vulnerability Assessments
- Security Architecture Reviews
04 · High
Software development platforms targeted by ransomware
Ransomware groups continue targeting software development and build environments to gain access to credentials, software deployments, and production systems, increasing software supply-chain risk.
How Intuitus helps
- DevSecOps Reviews
- Application Security Assessments
- Ransomware Readiness Assessments
- DFIR Services
- Secure Architecture Reviews
05 · Medium
AI-enhanced phishing targets Microsoft users
New phishing campaigns are using artificial intelligence to improve social engineering and compromise Microsoft 365 accounts. Identity theft remains one of the fastest paths to business disruption.
How Intuitus helps
- Identity Security Assessments
- Microsoft 365 Security Reviews
- Security Awareness Training
- Managed Detection & Response (MDR)
- Incident Response Planning
Our approach
We don’t simply report cyber threats. We help organizations understand their business impact, validate security controls, and build practical roadmaps that strengthen resilience before an incident occurs.
Five actions to take this week
- Prioritize management systems. Patch firewall, remote-access, and management platforms experiencing active exploitation.
- Review privileged access. Audit administrator accounts, enforce Multi-Factor Authentication (MFA), and limit unnecessary privileged access.
- Secure network management. Restrict administrative interfaces and monitor changes to network and security configurations.
- Protect development environments. Review CI/CD systems, software repositories, and build environments for exposed credentials or unauthorized changes.
- Strengthen identity defenses. Educate users about modern phishing techniques and continuously monitor for suspicious authentication activity.