Network Box Security Response

Name: Network Box Security Response
Address: 16/F Metro Loft, 38 Kwai Hei Street, Kwai Chung, Kowloon, HK
Telephone: +85227362083

Home
Hong Kong
Kowloon
Network Box Security Response

Network Box Headquarters

Internet threats to Network security are a global phenomenon which is why Network Box has established operation centres around the world. With headquarters in Hong Kong and regional operations centres in Europe, Australasia, America and Asia we ‘follow the sun’ twenty four hours a day, seven days a week to ensure our products are kept up to date against the very latest internet security threats.

16/10/2026

Fortinet's newly disclosed CVE-2025-61624 is a reminder that the most dangerous cyberattacks are often the hardest to see. After gaining privileged access, attackers used the vulnerability to deploy PEERSTITCH, a sophisticated malware implant that embeds itself within trusted FortiOS processes and selectively bypasses VPN security checks. Unlike traditional malware, it leaves the firewall appearing fully operational while quietly undermining the controls designed to protect the network. The result is a troubling scenario where organisations may believe they are secure, even as attackers evade detection and maintain persistent access. This incident reinforces a critical reality: when trust in security infrastructure is compromised, the firewall can become part of the attack surface rather than the defence.

LINK:

PEERSTITCH alters trusted FortiOS processes to bypass checks on selected VPN sessions. Its deployment exposes the real risks of compromised firewall management.

13/10/2026

That cybercriminals exfiltrate data from companies is currently an everyday phenomenon. The criminal online gang The Gentlemen now shows entries for Confluent, Deloitte, KFC, and MoneyGram on its darknet leak site. The perpetrators do not provide information on the type and scope of the data. The countdown for the Deloitte entry has already counted down 40 hours longer than for the other entries. The entry from the cyberattack on FTAPI, which became known at the end of September, looked similar. Meanwhile, the countdown has given way to a button that displays the data.

LINK:

A cyber gang claims to have copied data from Confluent, Deloitte, KFC and MoneyGram. It has published data from Air Canada and FTAPI.

10/10/2026

Two of the most widely deployed names in enterprise networking spent the first two weeks of October 2026 issuing emergency patches for the same class of bug. Cisco pushed a fix for a critical authentication-bypass flaw in Catalyst SD-WAN Manager that the company confirmed was already under active attack. Days later, SonicWall shipped hotfixes for a maximum-severity server-side request forgery flaw in its SMA 1000 remote-access appliances — the second CVSS 10.0 bug to hit that same product line in barely five weeks. Both landed on the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, forcing federal agencies and, by extension, the enterprises that depend on the same gear, into a compressed scramble to patch before attackers get there first.

LINK:

Cisco CVE-2026-76504 and SonicWall CVE-2026-102255 hit CISA KEV within weeks, both scoring near-max CVSS as a second SMA 1000 flaw emerges.

26/09/2026

AI agents attempted to get information from "governments, universities, public agencies, and other institutions", including the SEC, Census Bureau and Education Department, the company said. The disclosures come just days after Australian Prime Minister Anthony Albanese announced that OpenAI agents had breached non-public files on the website of its government-run health care scheme, Medicare. Since August, public fears have grown around the potentially serious, even life-threatening, impacts of AI tools falling outside of human control.

LINK:

OpenAI said its bots accessed public data from the US Census and the Securities and Exchange Commission, which regulates US stock markets.

30/08/2026

Healthcare data breach exposes 3.75M patient records.
Hackers stole medical records, Social Security numbers, government IDs and financial data from millions of CareCloud patients You can be careful with your passwords and still get caught in a breach at a company you may have never heard of. That is one of the frustrating parts of the CareCloud data breach. More than 3.75 million people had personal information and medical records stolen after hackers gained access to a CareCloud cloud environment earlier this year.

LINK:

The CareCloud data breach exposed Social Security numbers, banking information and medical records belonging to more than 3.75 million people.

27/08/2026

Three major UK airports have been hit by a "cyber security incident" in which criminal hackers accessed the data of almost nine million people and demanded a ransom. Manchester Airports Group (MAG), which owns Manchester, East Midlands and London Stansted airports, said customers' contact details, vehicle registrations and postcodes were obtained by hackers at the weekend. MAG told the BBC the hackers demanded a ransom fee for the return of the data, which the group said it refused to pay. The sum of the ransom fee was not disclosed.

LINK:

About 8.7 million customers had their data accessed and a ransom was demanded.

26/07/2026

Kaspersky has disclosed details of two ransomware incidents in Latin America in which attackers combined the use of Microsoft’s BitLocker encryption tool with an unusual tactic: hijacking corporate printers to distribute ransom notes throughout affected organizations.

In the Colombian case, attackers reportedly gained access through an internet-exposed remote access service connected to a server managing an 8 TB storage device containing business-critical data. After taking control of the environment and modifying user credentials, they used BitLocker to encrypt a storage volume that primarily contained financial information, rendering the data inaccessible. The attackers then used the organization’s network printers to print ransom notes demanding payment.

A separate investigation in Mexico found that a group identifying itself as the “XEntry Team” allegedly accessed an organization’s network through a misconfigured Microsoft SQL Server after obtaining login credentials exposed in publicly available source code. Kaspersky said the attackers expanded beyond the database environment, weakened web server protections, and maintained persistent access for several months before the intrusion was discovered.

LINK:

Ransomware Attacks Using Corporate Printers Found in LATAM: Kaspersky has disclosed details of two ransomware incidents in Latin America …

22/07/2026

OpenAI has revealed some of its most advanced AI models went rogue and hacked a start-up after it lost control of them during a security test. The ChatGPT-maker said its agent - an AI system which can operate alone after some human instruction – was being tested in a controlled environment, but found vulnerabilities and managed to escape. They targeted Hugging Face, one of the world's largest hubs for sharing AI models, gaining access to some internal company systems. OpenAI said the incident was "unprecedented", and it was conducting an investigation alongside Hugging Face, whose boss Clement Delangue said in a post on X it was "mind-blowing that all of this happened autonomously".

LINK:

It is one of the first publicly disclosed cyber-attacks carried out by AI without direct human involvement.

21/07/2026

Threat actors deploying Qilin ransomware exploited a Palo Alto Networks GlobalProtect authentication bypass flaw, CVE-2026-0257, as the consistent initial access vector across multiple June 2026 intrusions investigated by Arctic Wolf Labs.

The campaign moved rapidly from perimeter compromise to domain-wide encryption, with post-exploitation tactics varying between affiliates operating under Qilin’s ransomware-as-a-service model.

CVE-2026-0257 is an authentication bypass affecting the GlobalProtect portal and gateway in PAN-OS, exploitable when authentication override cookies are enabled alongside a specific certificate configuration.

LINK: https://cyberpress.org/qilin-ransomware-exploits-palo-alto-globalprotect-flaw/

18/07/2026

Ernst & Young discloses data breach after attackers accessed clients’ tax documents. Ernst & Young (EY), one of the world’s largest professional services firms, has disclosed a data breach after an unauthorized attacker compromised a third-party system used by the firm.

The accounting giant notified affected individuals through a filing with the California Department of Justice, revealing that attackers gained access to a third-party IT service management platform used to support EY employees working on client tax services.

EY said the incident involved documents that may have contained personal information and financial details related to clients’ tax filings, as support tickets submitted through the platform may include attached documents with sensitive information.

LINK:

Ernst & Young disclosed a data breach after attackers accessed a third-party IT service management platform used for tax support.

Address

16/F Metro Loft, 38 Kwai Hei Street, Kwai Chung
Kowloon

Telephone

+85227362083

Website

http://response.network-box.com/

Alerts

Be the first to know and let us send you an email when Network Box Security Response posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The Business

Send a message to Network Box Security Response: