Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On May 28, 2025, ConnectWise published an advisory disclosing suspicious activity within its environment, attributed to a sophisticated nation-state threat actor known for intelligence collection. The activity reportedly affected a very small number of ScreenConnect customers, all of whom ConnectWise has directly contacted. Details remain limited as the investigation is ongoing.

The IT environment is evolving. Organizations have embraced hybrid work models, expanded their operations and personnel footprints, and digitalized their processes and capabilities. And those in charge of these now sprawling environments must deal with the increasingly complicated task of keeping endpoints, users, and more both operational and secure.

On May 21, 2025, ProjectDiscovery published technical details for multiple vulnerabilities they discovered in Versa Concerto, including authentication bypasses, remote code execution (RCE), and container escapes. Versa Concerto is a centralized management platform used to manage Versa’s SD-WAN and SASE services. It is a Spring Boot-based application deployed via Docker containers and routed through Traefik.

The ways in which people work are changing, and so are the approaches needed to secure modern work. As organizations race to gain the benefits of cloud computing, relax rules around bring-your-own devices, and leverage hybrid-work models that require edge devices such as VPN gateways, the result is an expanding, disparate IT environment. And even worse, users are a part of the attack surface — one threat actors are all too ready and willing to exploit.

Arctic Wolf has recently observed the distribution of a trojanized RVTools installer via a malicious typosquatted domain. The domain matches the legitimate domain, however, the Top Level Domain (TLD) is changed from.com to.org. RVTools is a widely used VMware utility for inventory and configuration reporting, developed by Robware. Once the malicious installer was downloaded, the installer attempts to make outbound connections to known command and control infrastructure.

The cloud provides many great business advantages – efficiency, speed-to-market, and many others – and has been rapidly adopted by organizations all over the world. While the rise in cloud operations allows organizations to operate in a way that’s more cost-effective and flexible, opening data, assets, and networks to the internet creates additional risk — particularly around misconfigurations and non-compliance.