From the Desk of Melissa Irace, CISO
This week’s threats reinforce an important reality: attackers continue targeting the infrastructure organizations depend on to securely connect users, manage enterprise networks, protect communications, and operate cloud environments. Active exploitation of Citrix NetScaler, Cisco Catalyst SD-WAN Manager, Fortinet FortiMail, and Zimbra Collaboration Suite demonstrates how quickly trusted platforms can become an attacker’s gateway into an organization. The emergence of an AI-enabled botnet targeting Docker environments highlights the growing use of AI to automate post-compromise activity. Organizations should prioritize protecting internet-facing systems, validating security controls, and conducting compromise assessments after emergency patching.
Weekly executive summary
This week’s cyber activity underscores a critical shift: attackers are going after the platforms that enable and protect business operations, not just individual endpoints.
Remote access gateways, network management systems, email security platforms, and cloud-native technologies are high-value targets because they give attackers broad visibility and control across the organization.
The impact of these attacks extends beyond IT. A successful compromise can disrupt business operations, expose sensitive data, erode customer trust, and create significant recovery costs.
For executive leadership, this week is a reminder to focus on proactive risk reduction, validate security controls, and ensure detection and response capabilities are in place for the systems that keep your organization running.
Melissa’s perspective
“The biggest cybersecurity risk today isn’t just an unpatched workstation. It’s the compromise of the systems that manage your business. Remote access gateways, network management platforms, secure email infrastructure, and cloud services give attackers broad operational control when compromised. Organizations should prioritize validating these critical systems and monitoring privileged access before attackers can leverage it.”
This week’s top threats
01 · Critical
Citrix NetScaler under active exploitation
Attackers are actively exploiting multiple Citrix NetScaler vulnerabilities to deploy web shells, steal credentials, establish persistence, and gain privileged access into enterprise environments.
How Intuitus helps
- External Attack Surface Assessments
- Penetration Testing as a Service (PTaaS)
- Vulnerability Assessments
- Security Architecture Reviews
- DFIR Services
02 · Critical
Cisco Catalyst SD-WAN Manager under attack
A critical authentication bypass vulnerability is being actively exploited, allowing attackers to gain administrative control over centralized network management infrastructure and potentially impact multiple sites.
How Intuitus helps
- Network Security Assessments
- Infrastructure Security Reviews
- Penetration Testing as a Service (PTaaS)
- Vulnerability Assessments
- MDR
03 · High
Fortinet FortiMail zero-day under active exploitation
Attackers are exploiting a critical FortiMail vulnerability to compromise secure email infrastructure, enabling credential theft, persistence, and potential business email compromise.
How Intuitus helps
- Email Security Assessments
- Microsoft 365 Security Reviews
- Identity Security Assessments
- Vulnerability Assessments
- MDR
04 · High
Zimbra Collaboration Suite exploited in the wild
Threat actors are exploiting vulnerabilities in Zimbra Collaboration Suite to deploy web shells, steal credentials, and establish long-term persistence within enterprise environments.
How Intuitus helps
- Email Security Assessments
- Threat Hunting
- DFIR Services
- Identity Security Assessments
- Vulnerability Assessments
05 · Medium
Carbonato AI botnet targets Docker environments
Researchers identified the Carbonato botnet using AI-enabled agents to automate reconnaissance, steal API keys and credentials, and expand attacks across exposed Docker environments and cloud infrastructure.
How Intuitus helps
- Cloud Security Assessments
- Container Security Reviews
- Threat Hunting
- Penetration Testing as a Service (PTaaS)
- Identity Security Assessments
Our approach
We don’t simply report cyber threats. We help organizations understand their business impact, validate security controls, and build practical roadmaps that strengthen resilience before an incident occurs.
Five actions to take this week
- Prioritize internet-facing systems. Immediately patch and validate Citrix, Cisco, Fortinet, and other internet-facing infrastructure.
- Review privileged access. Audit administrative accounts, enforce MFA, and remove unnecessary privileged access.
- Monitor management platforms. Review SD-WAN, remote access, and management systems for unauthorized configuration changes and suspicious activity.
- Secure email and cloud infrastructure. Review secure email gateways, cloud services, API keys, Docker environments, and exposed management interfaces.
- Conduct compromise assessments. Following emergency patching, validate systems through threat hunting, log analysis, and incident response procedures.