ISMG Editors: UN Cybercrime Treaty Raises Privacy Fears

Anna Delaney • October 31, 2025

In this week's panel, ISMG editors discussed privacy concerns related to the U.N. Cybercrime Treaty, the legal fallout from candid photos of patients at Baptist Jay Hospital posted to SnapChat, and the market implications for Francisco Partners' acquisition of Apple device management firm Jamf.

Agentic AI

Fortinet Accused of Securities Fraud Over Firewall Forecasts

Latest

Nation-State Breach Hits Ribbon Communications

Chris Riotta • October 31, 2025

A nation-state threat actor carried out a supply chain attack targeting Ribbon Communications, a leading U.S. provider of telecom and networking infrastructure, and may have maintained access within its systems for nearly a year. Ribbon said it became aware of the activity in early September.

Denmark Withdraws Chat Control Proposal Amid Controversy

Akshaya Asokan • October 31, 2025

Denmark withdrawing a proposal that would have required online service providers to scan communications and files on user devices for child sexual abuse material after domestic and international opposition. The Scandinavian country presides over the Council of European Union until December.

Cybercrime

Russian Police Bust Suspected Meduza Infostealer Developers

Mathew J. Schwartz • October 31, 2025

Russian police have arrested "three young IT specialists" in Moscow, charging them with developing and selling the notorious Meduza information-stealing malware, and members of their group using the infostealer to breach a Russian government institution in May and exfiltrate data.

Artificial Intelligence & Machine Learning

How to Fix Decades of Technical Debt

Brian Pereira • October 31, 2025

Technical debt is no longer just a developer's dilemma; it's a global business risk. As companies cling to legacy systems and monolithic code, modernization efforts stall. Rising costs, slower delivery and AI limitations highlight the urgent need for scalable, future-ready architectures.

Governance & Risk Management

Building Cyber Resilience Across Canada's Skies

Joshua Cunningham-Marsh • October 31, 2025

With threats targeting aviation infrastructure, NAV Canada CISO Tom Bornais explained how his team focuses on building resilience rather than chasing perfection. He outlined why internal alignment, incident simulation and supply chain security are critical to defending IT and OT systems.

Governance & Risk Management

Keeping Revenue Forecasts From Becoming Legal Liabilities

Suparna Goswami • October 30, 2025

Fortinet's stock unexpectedly plunged more than 20% in August. That same month, Gartner named Fortinet an industry leader in its Magic Quadrant for hybrid mesh firewalls. But the thing that sent Fortinet's stock into a nosedive was revenue forecasts that didn't pan out.

Access Management

ConductorOne Hauls in $79M to Modernize Identity Security

Michael Novinson • October 30, 2025

Amid rising complexity from AI agents and non-human identities, ConductorOne has raised $79 million in Series B funding. CEO Alex Bovee said the company aims to expand its identity platform, simplify access control and help security teams address evolving threats in hybrid environments.

Cyberwarfare / Nation-State Attacks

How to Block North Korean IT Worker Scams in Remote Hiring

Anna Delaney • October 30, 2025

North Korean operatives are using fake identities and remote job listings to bypass sanctions and infiltrate companies. But employers can avoid becoming unwitting accomplices, said legal expert Jonathan Armstrong, who advises firms to adopt stronger vetting practices and structured investigations.

Cyberwarfare / Nation-State Attacks

CISA Issues Guidance to Curb Microsoft Exchange Exploits

Chris Riotta • October 30, 2025

U.S. cyber defense officials and their international partners issued a new blueprint for mitigating Microsoft Exchange vulnerabilities on Thursday as governments worldwide continue to grapple with persistent intrusion campaigns targeting on-premises Microsoft Exchange servers in hybrid environments.

Cybercrime

ClickFix Infrastructure Surprises Inform Better Blocking

Mathew J. Schwartz • October 30, 2025

Tracking how cybercriminals and their service providers use malicious infrastructure can give defenders an edge for blocking their targeting. New research spotted a massive crossover between IP addresses used for both ClickFix and adversary-in-the-middle attacks.

Cybercrime

Breach Roundup: Hackers Probe Canada's Critical Infrastructure

Anviksha More • October 30, 2025

This week, critical infrastructure breaches in Canada, a Swedish grid operator breached, an Australian guilty of selling cyber exploits, Gmail wasn't breached, F5 projected a revenue dip, PhantomRaven targeted developers, a Pakistan-linked actor targeted India and Dentsu confirmed a data breach.

Governance & Risk Management

NIS2 Enhances Vulnerability Management Practices

Akshaya Asokan • October 30, 2025

The NIS2 Directive has driven significant improvements in vulnerability management across Europe. Organizations are accelerating vulnerability discovery by engaging with crowdsourced security communities and ethical hackers, said Ed Parsons, chief operations officer at Intigriti.