Story perspectives

Urgent Cybersecurity Directives Issued Amid Cisco VPN Attacks

9/26/2025

Summary

CISA Directives Issued

Directives from Canadian Security Intelligence Service (CSE), United States Cybersecurity and Infrastructure Security Agency (CISA), and United Kingdom's National Cyber Security Centre (NCSC) target a Cisco VPN campaign.
Attacks began in May 2025 and are linked to ArcaneDoor campaign.
Hackers exploited new vulnerabilities to implant malware and exfiltrate data.
United States directive requires federal agencies to patch by midnight Friday.

Summary

CISA Urges Cybersecurity Enhancements

Following a federal agency breach, Cybersecurity and Infrastructure Security Agency (CISA) urges patching known exploited vulnerabilities and strengthening incident response.
The GeoServer vulnerability CVE-2024-36401 allowed attackers to stay undetected for three weeks.
Federal agencies should prioritize KEV Catalog entries and establish a dedicated emergency-patch team.
Regular tabletop exercises and continuous monitoring are recommended to test and enhance incident response.

1 of 2

CISA Directives Issued

Directives from Canadian Security Intelligence Service (CSE), United States Cybersecurity and Infrastructure Security Agency (CISA), and United Kingdom's National Cyber Security Centre (NCSC) target a Cisco VPN campaign.
Attacks began in May 2025 and are linked to ArcaneDoor campaign.
Hackers exploited new vulnerabilities to implant malware and exfiltrate data.
United States directive requires federal agencies to patch by midnight Friday.

1 / 2