The US cybersecurity agency CISA has shared details on the exploitation of a year-old GeoServer vulnerability to compromise a federal civilian executive branch (FCEB) agency.

The exploited bug, tracked as CVE-2024-36401 (CVSS score of 9.8) and leading to remote code execution (RCE), was disclosed on June 30, 2024, two weeks before CISA added it to the KEV catalog.

On July 11, 2024, four days before CISA’s alert, a threat actor exploited the bug to gain access to a GeoServer instance pertaining to the victim agency, then moved laterally to a web server and to an SQL server.

“On each server, they uploaded (or attempted to upload) web shells such as China Chopper, along with scripts designed for remote access, persistence, command execution, and privilege escalation. The cyber threat actors also used living-off-the-land (LOTL) techniques,” CISA explains in a fresh report.

On July 24, ten days after the bug was added to the KEV list, the threat actor exploited the same vulnerability in another GeoServer instance belonging to the same agency.

The attackers dropped web shells and created cron jobs and user accounts to maintain persistence, and then attempted to escalate privileges, including by exploiting the Dirty COW vulnerability in the Linux kernel.

“After compromising web service accounts, they escalated their local privileges to transition away from these service accounts (it is unknown how they escalated privileges),” CISA explains.

The threat actor also used brute force attacks to obtain passwords allowing it to move laterally and elevate privileges, performed reconnaissance using readily available tools, downloaded payloads using PowerShell, and deployed the Stowaway multi-level proxy tool for command-and-control (C&C).

“The cyber threat actors remained undetected in the organization’s environment for three weeks before the organization’s SOC identified the compromise using their EDR tool,” CISA notes.

According to the cybersecurity agency, the victim was within the KEV-required patching window for the GeoServer bug, but lacked procedures for bringing in third parties for assistance, did not detect the activity on July 15, 2024, when it missed an EDR alert on Stowaway, and did not have endpoint protection implemented on the web server.

While CISA has not attributed the attack to a specific threat actor, the China Chopper web shell is typically used in attacks by China-linked threat actors such as APT41 (Brass Typhoon), Gallium (Granite Typhoon), and Hafnium (Silk Typhoon).

Believed to have orchestrated last year’s US Treasury hack, Silk Typhoon is known for targeting critical infrastructure organizations worldwide, and for hacking multiple industries in North America.

“China Chopper has been around for over a decade, and it’s the same web shell used in the 2021 Exchange attacks. The real issue is that attackers chained a well-known exploit, moved laterally, and remained inside the network for nearly three weeks before anyone noticed, even with EDR deployed. That’s the modern danger we’re dealing with. It’s not exotic zero-days, but gaps that go unpatched and undetected until it’s too late,” Tuskira CEO and co-founder Piyush Sharma said.

Related: All Microsoft Entra Tenants Were Exposed to Silent Compromise via Invisible Actor Tokens: Researcher

Related: SonicWall Updates SMA 100 Appliances to Remove Overstep Malware

Related: Sesame Workshop Regains Control of Elmo’s Hacked X Account After Racist Posts

Related: How Do You Know If You’re Ready for a Red Team Partnership?

https://www.securityweek.com/geoserver-flaw-exploited-in-us-federal-agency-hack/

The recent cyberattack aimed at aerospace and defense company Collins Aerospace, which has caused significant disruptions at major airports in Europe, reportedly involved a piece of ransomware known as HardBit.

The HardBit ransomware emerged in October 2022 and it came into the spotlight a few months later when it emerged that the cybercriminals were willing to negotiate ransom amounts based on their victims’ cyberinsurance policy. Not much has been reported on HardBit since.

Cybercriminals are using HardBit ransomware to encrypt files on compromised systems and they claim to steal data from victims but, unlike many other ransomware operations, they do not appear to have a website where they name victims and leak stolen data.

The EU cybersecurity agency ENISA revealed on Monday that the airport disruptions were the result of a ransomware attack, but did not share additional details. 

Cybersecurity expert Kevin Beaumont reported on Tuesday that the attack involved a variant of HardBit, which he described as “incredibly basic”. Beaumont learned from sources that Collins Aerospace has been having difficulties removing the malware, with devices becoming reinfected following cleanup attempts.

The BBC reported earlier this week that over one thousand computers may have been impacted and that Collins had found the hackers still inside its network after it rebuilt and relaunched systems. 

Ransomware expert Dominic Alvieri told SecurityWeek that his sources also confirmed the involvement of HardBit in the attack. However, the researcher pointed out that the HardBit ransomware is offered under an affiliate program and anyone could have used it to target Collins Aerospace. 

Alvieri also pointed out that some HardBit affiliates have been known to use the Mimic ransomware as well, which can complicate attribution. However, the expert does not believe that to be true in this case.

Alvieri also told SecurityWeek that the notorious ransomware group BianLian targeted Collins Aerospace back in 2023, claiming to have stolen employee personal information, operational information, and corporate files. BianLian has not been active since March 2025, but there is a possibility that it left a backdoor on Collins systems during the 2023 intrusion.

There was some indication earlier this week that the notorious ShinyHunters hackers may have been involved. Scattered Spider, which is linked to ShinyHunters, is known to have targeted the aviation industry.

The BBC learned from the UK’s National Crime Agency (NCA) on Wednesday that a 40-year-old man was arrested in West Sussex as part of an investigation into the Collins Aerospace cyberattack.

The suspect was arrested on Tuesday evening, but was later released on bail. NCA representatives said the investigation is still in early stages. 

UK authorities recently arrested two Scattered Spider suspects. One of them has been charged in the United States over critical infrastructure hacking.

The cyberattack on Collins Aerospace, which provides check-in and boarding systems, has impacted major airports in the UK, Germany, and Belgium, including London Heathrow, Brussels Airport, and Berlin Brandenburg.

Delays and flight cancellations have been reported by the impacted airports, with disruptions extending into Wednesday. FlightRadar24 at the time of writing is still showing a significant percentage of delayed departures at the affected airports. 

Related: Air France, KLM Say Hackers Accessed Customer Data

Related: Cyberattack On Russian Airline Aeroflot Causes the Cancellation of More Than 100 Flights

https://www.securityweek.com/european-airport-cyberattack-linked-to-obscure-ransomware-suspect-arrested/

In the light of recent supply chain attacks targeting the NPM ecosystem, GitHub will implement tighter authentication and publishing rules meant to improve the NPM registry’s security.

Several major incidents occurred over the past three months, with the most recent involving the Shai-Hulud self-replicating worm that impacted dozens of maintainer accounts last week. The attackers compromised 195 packages and pushed over 500 malicious package versions to the registry.

A week before, 18 NPM packages maintained by Josh Junon were injected with malware after the maintainer fell victim to a phishing campaign impersonating NPM support. The packages have over 2.5 billion weekly downloads.

In July, multiple packages with combined weekly downloads of over 30 million were poisoned after attackers using typosquatting to impersonate the Node.js package registry targeted their maintainers.

According to GitHub, the Shai-Hulud attack triggered swift action from the platform and the community to remove the malicious packages and block the upload of new malware that could have led to a significantly higher number of infections.

“By combining self-replication with the capability to steal multiple types of secrets (and not just npm tokens), this worm could have enabled an endless stream of attacks had it not been for timely action from GitHub and open source maintainers,” GitHub notes.

To prevent the risks associated with token abuse and self-replicating malware, the Microsoft-owned code hosting platform will only allow local publishing with two-factor authentication (2FA), and will implement granular tokens that will expire after seven days, along with trusted publishing.

A recommended security capability, trusted publishing removes the need for the management of long-lived tokens, relying instead on short-lived and tightly scoped API tokens and ensuring that a package comes from a specific source system.

“When NPM released support for trusted publishing, it was our intention to let adoption of this new feature grow organically. However, attackers have shown us that they are not waiting. We strongly encourage projects to adopt trusted publishing as soon as possible, for all supported package managers,” GitHub notes.

Additionally, the platform will deprecate legacy classic tokens and time-based one-time password (TOTP) 2FA. It will also set a shorter expiration for granular tokens with publishing permissions, change publishing access to disallow tokens by default, prevent 2FA bypass for local package publishing, and expand eligible providers for trusted publishing.

“We recognize that some of the security changes we are making may require updates to your workflows. We are going to roll these changes out gradually to ensure we minimize disruption while strengthening the security posture of NPM,” GitHub says.

GitHub encourages maintainers to switch to trusted publishing as soon as possible, to ensure 2FA is required for publishing, and to use WebAuthn instead of TOTP when configuring 2FA.

Related: Shai-Hulud Supply Chain Attack: Worm Used to Steal Secrets, 180+ NPM Packages Hit

Related: Malicious NPM Packages Disguised as Express Utilities Allow Attackers to Wipe Systems

Related: Ongoing Campaign Uses 60 NPM Packages to Steal Data

Related: Popular Scraping Tool’s NPM Package Compromised in Supply Chain Attack

https://www.securityweek.com/github-boosting-security-in-response-to-npm-supply-chain-attacks/

Web performance and security company Cloudflare reported on Tuesday that its systems blocked another record-breaking distributed denial-of-service (DDoS) attack.

The latest record-breaking attack peaked at 22.2 terabits per second (Tbps) and 10.6 billion packets per second (Bpps), and lasted only 40 seconds. 

The company said this hyper-volumetric DDoS attack, which was double in size compared to the previous record, was autonomously blocked by its systems.

Cloudflare told SecurityWeek that the attack was aimed at a single IP address of an unnamed European network infrastructure company.

Cloudflare has yet to determine who was behind the attack, but believes it may have been powered by the Aisuru botnet, which was also linked earlier this year to a massive 6.3 Tbps attack on the website of cybersecurity blogger Brian Krebs.

Aisuru has been around for more than a year. The botnet is powered by hacked IoT devices such as routers and DVRs that have been compromised through the exploitation of known and zero-day vulnerabilities. 

According to Cloudflare, the 22 Tbps attack was traced to over 404,000 unique source IPs across over 14 ASNs worldwide. “Based on internal analysis using a proprietary system, the source IPs were not spoofed,” the company explained. 

The security firm described it as a UDP carpet bomb attack targeting an average of 31,000 destination ports per second, with a peak of 47k ports, all of a single IP address.

Cloudflare revealed in July that the number of DDoS attacks it blocked in the first half of 2025 had already exceeded all the attacks mitigated in 2024.

Related: ShadowV2 DDoS Service Lets Customers Self-Manage Attacks

Related: ‘MadeYouReset’ HTTP2 Vulnerability Enables Massive DDoS Attacks

Related: Record-Breaking 7.3 Tbps DDoS Attack Targets Hosting Provider

https://www.securityweek.com/record-breaking-ddos-attack-peaks-at-22-tbps-and-10-bpps/

Dietro i numeri apparentemente trionfali emersi dal nuovo report di Google DORA 2025 “State of AI-assisted Software Development 2025“, si nasconde una verità più complessa e sfumata. Il 2025 segna un punto di svolta nell’adozione dell’intelligenza artificiale nello sviluppo software. Non più una curiosità per early adopter, ma una realtà consolidata che coinvolge il 90% dei professionisti del settore.

Il paradosso dell’AI: accelerazione individuale, complessità sistemica

L’adozione massiva dell’AI ha prodotto benefici tangibili a livello individuale. Oltre l’80% degli sviluppatori riporta un aumento della produttività personale, mentre il 59% osserva miglioramenti nella qualità del codice. Numeri che confermano l’intuizione comune: l’AI aiuta davvero a scrivere codice più velocemente e, spesso, meglio.

Tuttavia, quando si allarga lo sguardo al sistema organizzativo, emerge un quadro più articolato. Rispetto al DORA Report 2024, l’AI ha iniziato a mostrare benefici positivi sul throughput di delivery del software, invertendo il trend negativo dell’anno precedente. Tuttavia, il problema dell’instabilità nelle consegne persiste, suggerendo che mentre i team si stanno adattando per la velocità, i sistemi sottostanti non si sono ancora evoluti per gestire in sicurezza lo sviluppo accelerato dall’AI.

Questa dinamica rivela una verità fondamentale che il report DORA identifica chiaramente: l’AI funziona come un amplificatore che “magnifica i punti di forza delle organizzazioni ad alte prestazioni e le disfunzioni di quelle in difficoltà.”

Il DORA AI Capabilities Model: i 7 pilastri per sbloccare il potenziale dell’AI

La ricerca DORA 2025 introduce per la prima volta un modello di capacità specifico per l’AI, identificando sette elementi fondamentali che amplificano i benefici dell’adozione AI:

1. Una posizione chiara e comunicata sull’AI.

Le interviste qualitative DORA hanno rivelato che gli sviluppatori esprimono costantemente mancanza di chiarezza sulla posizione aziendale riguardo l’uso dell’AI. Questo crea due situazioni subottimali: sviluppatori che agiscono troppo conservativamente per paura di oltrepassare i parametri accettabili, e altri che agiscono troppo permissivamente, superando effettivamente tali parametri.

2. Ecosistemi di dati sani.

Il report conferma l’adagio che “i modelli AI sono validi solo quanto i dati su cui si basano“. Le organizzazioni con ecosistemi di dati interni di alta qualità, facilmente accessibili e unificati, vedono amplificata l’influenza positiva dell’AI sulla performance organizzativa.

3. Dati interni accessibili all’AI.

I benefici dell’AI per produttività e qualità del codice sono amplificati quando i modelli AI hanno accesso a dati interni. Connettere gli strumenti AI ai repository, alla documentazione e ai sistemi aziendali trasforma l’assistenza generica in supporto contestualizzato specifico per l’azienda.

4. Pratiche solide di controllo versione.

La ricerca mostra che l’adozione AI beneficia dalla frequenza dei commit e dall’uso delle funzionalità di rollback. Con l’AI che può aumentare il volume e la velocità delle modifiche, il sistema di controllo versione diventa una “rete di sicurezza psicologica” ancora più critica.

5. Lavorare in piccoli batch.

I risultati sono misti ma illuminanti: mentre lavorare in piccoli batch riduce leggermente l’efficacia individuale percepita dall’AI, amplifica significativamente l’influenza positiva dell’AI sulla performance del prodotto e riduce l’attrito. Il report sottolinea che “l’efficacia individuale non dovrebbe essere perseguita come obiettivo fine a se stesso” ma come mezzo per realizzare performance superiori.

6. Focus user-centrico.

Qui emerge uno dei risultati più critic: senza un focus centrato sull’utente, l’adozione AI può avere un impatto negativo sulla performance del team. Con un focus user-centrico forte, invece, l’influenza positiva dell’AI sulla performance del team è amplificata. Il report avverte esplicitamente che “in assenza di un focus user-centrico, l’adozione AI è improbabile che aiuti i team. Potrebbe persino danneggiarli.”

7. Piattaforme interne di qualità.

Con il 90% delle organizzazioni che ha adottato platform engineering, la qualità della piattaforma interna amplifica gli effetti dell’AI sulla performance organizzativa. Una piattaforma di alta qualità serve come base per trasformare i guadagni di produttività individuale in vantaggi organizzativi.

Oltre le metriche: 7 profili di team performance secondo DORA

La ricerca identifica sette distinti archetipi di team attraverso un’analisi di cluster che considera fattori umani e sistemici:

• Harmonious high-achievers (20%): Eccellenza sostenibile con basso burnout;
• Pragmatic performers (20%): Delivery costante con engagement medio;
• Constrained by process (17%): Bloccati da processi inefficienti nonostante sistemi stabili;
• Stable and methodical (15%): Qualità alta ma throughput deliberato;
• Legacy bottleneck (11%): Sistemi instabili che dettano il lavoro reattivo;
• Foundational challenges (10%): Difficoltà significative in tutti gli indicatori;
• High impact, low cadence (7%): Lavoro ad alto impatto ma con alta instabilità.

Questa tassonomia dimostra empiricamente che il trade-off “velocità vs stabilità” è un mito: i migliori performer (cluster 6 e 7, che rappresentano il 40% del campione) eccellono contemporaneamente in entrambe le dimensioni.

Il Value Stream Management come moltiplicatore di forza

Il report identifica il Value Stream Management come pratica che crea miglioramento focalizzato. I team che adottano principi VSM dedicano significativamente più tempo a lavoro prezioso e mostrano performance superiori di team e prodotto.

Crucialmente, la ricerca conferma che il VSM modera la relazione tra adozione AI e performance organizzativa: mentre l’adozione AI da sola mostra un impatto modesto, l’effetto è drammaticamente amplificato nelle organizzazioni con forti pratiche VSM.

L’AI come specchio organizzativo

L’analisi DORA presenta l’AI non solo come strumento, ma come “specchio e moltiplicatore” che riflette le vere capacità organizzative. Come osserva il report: “In organizzazioni ben allineate, l’AI amplifica il flusso. In quelle frammentate, espone i punti dolenti.”

Questa dinamica trasforma l’adozione AI da questione tecnologica a sfida di trasformazione sistemica. Il report sottolinea che “le organizzazioni sono sistemi, non somme di individui” e che migliorare una parte non garantisce risultati migliori complessivi se il resto del sistema non si adatta.

La realtà della fiducia nell’AI

Il report presenta dati sfumati sulla fiducia: il 70% dei rispondenti esprime qualche grado di fiducia nell’output AI, ma solo il 24% ha “molta” o “moltissima” fiducia. Significativamente, il 30% ha “poca” (23%) o “nessuna” (7%) fiducia.

La ricerca interpreta questo come “paesaggio sfumato della fiducia degli utenti” e suggerisce che “alti livelli di adozione AI e benefici percepiti possono coesistere con un approccio misurato e sfumato alla fiducia.” Durante le interviste, gli sviluppatori hanno paragonato questo al sano scetticismo applicato ad altre risorse come Stack Overflow.

Implicazioni per la trasformazione organizzativa

Il report DORA identifica due percorsi complementari per la trasformazione AI:

Augmentation: Preparare i sistemi esistenti per sostenere i guadagni AI attraverso pipeline CI/CD evolute, protocolli di sicurezza aggiornati, e infrastruttura dati migliorata.

Evolution: Progettare nuovi workflow nativi per l’AI, inclusi pipeline di delivery AI-native, sistemi di dati AI-native, e modelli di collaborazione emergenti come workflow agentici.

Verso una maturità sistemica dell’AI

Il DORA Report 2025 documenta un’industria che sta superando la fase di hype iniziale per entrare in quella della maturità operativa. La lezione principale è chiara: “I maggiori ritorni sull’investimento AI non provengono dagli strumenti stessi, ma da un focus strategico sul sistema organizzativo sottostante.”

Il report conclude che nel 2025, la domanda centrale per i leader tecnologici non è più se adottare l’AI, ma come realizzarne il valore attraverso la qualità della piattaforma interna, la chiarezza dei workflow, e l’allineamento dei team. Senza questa fondazione sistemica, l’AI crea sacche localizzate di produttività che spesso si perdono nel caos a valle.

La ricerca DORA dimostra che l’AI è potente, ma sono le capacità organizzative fondamentali a determinare se quella potenza si trasforma in vantaggio competitivo sostenibile o in accelerazione caotica senza direzione.

Fonti:

Regolamento DORA, LOTL e Threat Shifting – Implicazioni per la Cyber Security

https://www.ictsecuritymagazine.com/notizie/dora-2025-ai-software/

SonicWall has released a fresh software update for its SMA 100 appliances to help users remove the Overstep malware deployed in a recent campaign.

As part of the attacks, flagged in July by Google’s Threat Intelligence Group, a threat actor tracked as UNC6148 infected fully patched SMA appliances with a persistent backdoor and user-mode rootkit that supports credential, session token, and one-time password seed theft.

The threat actor likely used local administrator credentials that were stolen in previous attacks, before devices were patched, through the exploitation of known vulnerabilities, such as CVE-2025-32819, CVE-2024-38475, CVE-2021-20035, CVE-2021-20038, and CVE-2021-20039.

In July, Google released indicators-of-compromise (IoCs) and detection rules to help SonicWall customers identify and block potential UNC6148 attacks.

This week, SonicWall announced the release of SMA 100 software version 10.2.2.2-92sv, which includes “additional file checking, providing the capability to remove known rootkit malware present on the SMA devices”.

All SMA 210, 410, and 500v appliances running 10.2.1.15-81sv and earlier software versions are impacted, SonicWall notes.

The company urges all organizations using SMA 100 series appliances to review and implement security steps outlined in its July advisory.

Earlier this month, SonicWall announced it will no longer offer support for SMA100 devices starting October 1, 2025, urging customers to transition to “more secure, modern remote access solutions” and offering free replacement options for eligible SMA100 appliances.

“Due to significant vulnerabilities presented by legacy VPN appliances, SonicWall will be deactivating all SMA100 appliances on October 31, 2025. Following this date, all SMA100 appliances will lose connectivity and no longer function. To ensure uninterrupted security and connectivity, partners and customers will need to migrate to an alternative SonicWall solution before October 31, 2025,” the company notes.

SonicWall may continue to provide support to SMA100 appliances that have support expiration dates extending beyond October 31, 2027.

Related: SonicWall Prompts Password Resets After Hackers Obtain Firewall Configurations

Related: Libraesva Email Security Gateway Vulnerability Exploited by Nation-State Hackers

Related: Remote CarPlay Hack Puts Drivers at Risk of Distraction and Surveillance

Related: Hundreds of Pagers Exploded in Lebanon and Syria in a Deadly Attack. Here’s What We Know.

https://www.securityweek.com/sonicwall-updates-sma-100-appliances-to-remove-overstep-malware/

Libraesva has addressed a vulnerability in its integrated email security platform that has been exploited in the wild.

Tracked as CVE-2025-59689 (CVSS score of 6.1), the flaw is described as a command injection issue that could lead to the execution of arbitrary commands as a non-privileged user.

According to Libraesva’s advisory, the bug could be exploited via malicious emails containing crafted compressed attachments.

“This occurs due to an improper sanitization during the removal of active code from files contained in some compressed archive formats,” the company explains.

The CVE is triggered with specific archive formats containing payloads that exploit an improper input sanitization bug to execute arbitrary shell commands.

The security defect affects Libraesva ESG versions 4.5 through 5.5, but fixes were released only for ESG 5.x versions, as the 4.x versions have been discontinued.

Libraesva pushed the patches to both cloud and on-premise ESG deployments and says all appliances are now running a fixed software iteration.

Customers running on-premise ESG 4.x versions are advised to manually update to a patched 5.x version as soon as possible, given that the vulnerability has been exploited.

“One confirmed incident of abuse has been identified. The threat actor is believed to be a foreign hostile state entity,” Libraesva says.

“The single‑appliance focus underscores the precision of the threat actor (believed to be a foreign hostile state) and highlights the importance of rapid, comprehensive patch deployment,” the company notes.

In addition to resolving the flaw, Libraesva’s patches scan for indicators-of-compromise (IoCs) and contain a self-assessment module that checks the patch integrity and hunts for residual threats.

An integrated solution, Libraesva ESG protects email services from phishing, BEC, and advanced threats, and is suited for all types of organizations, including small and medium-sized businesses and large enterprises.

Related: SolarWinds Makes Third Attempt at Patching Exploited Vulnerability

Related: Patch Bypassed for Supermicro Vulnerability Allowing BMC Hack

Related: Top 25 MCP Vulnerabilities Reveal How AI Agents Can Be Exploited

Related: Researchers Earn $150,000 for L1TF Exploit Leaking Data From Public Cloud

https://www.securityweek.com/libraesva-email-security-gateway-vulnerability-exploited-by-nation-state-hackers/

Il settore sanitario italiano si trova sotto assedio informatico, come documentato dall’Agenzia per la Cybersicurezza Nazionale (ACN). Secondo la relazione ufficiale ACN 2024, negli ultimi anni si sono verificati in media 2,6 eventi cyber malevoli al mese ai danni di strutture sanitarie, dei quali la metà circa ha dato luogo a “incidenti”.

Nel 2024, secondo i dati ufficiali ACN, si è registrato un significativo aumento delle minacce: 1.979 eventi cyber gestiti dal CSIRT Italia, con 573 incidenti significativi confermati, segnando un aumento del 40% rispetto al 2023. Gli incidenti confermati sono aumentati dell’89,1% rispetto al 2023.

Per quanto riguarda specificatamente il settore sanitario, nel 2024, circa 50 strutture sanitarie italiane sono state colpite da cyberattacchi, causando gravi ripercussioni sui servizi essenziali.

Il costo devastante delle violazioni: Il settore sanitario al primo posto

Per il quattordicesimo anno consecutivo, il settore sanitario detiene il primato poco invidiabile dei costi più elevati per violazione dei dati, con una media di 9,77 milioni di dollari per breach nel 2024, secondo il report IBM 2024 Cost of a Data Breach. Nel 2025, nonostante una diminuzione a 7,42 milioni di dollari, la sanità rimane il settore più costoso, superando di gran lunga il costo medio globale delle violazioni.

I costi delle violazioni sanitarie sono aumentati del 10% anno su anno, mentre le organizzazioni finanziarie, al secondo posto, riportano un costo medio di 6,08 milioni di dollari.

Ransomware ospedali: l’attacco all’ASST Rhodense

Uno dei casi più documentati del 2024 è l’attacco subito dall’ASST Rhodense. Tra il 5 e il 6 giugno 2024, l’ASST Rhodense è stata colpita da un attacco ransomware rivendicato dal gruppo cybercriminale Cicada3301, che ha portato all’esfiltrazione di 1 TB di dati sensibili.

I dati rubati includevano informazioni di identificazione personale (PII), dati personali, documenti medici, prescrizioni e altri documenti sensibili, successivamente pubblicati integralmente sul sito di leak del gruppo. L’attacco ha interessato le strutture sanitarie di Garbagnate Milanese, Bollate, Rho e Passirana.

Secondo l’intervista esclusiva condotta dal gruppo cybersecurity Red Hot Cyber con gli attaccanti, l’accesso alla rete è avvenuto tramite “un appaltatore che serve l’ospedale” e il gruppo è rimasto all’interno delle infrastrutture IT per “circa un anno”.

Il panorama internazionale: il caso Change Healthcare

L’attacco più devastante documentato a livello internazionale è quello subito da Change Healthcare negli Stati Uniti. Il 21 febbraio 2024, Change Healthcare ha scoperto di essere vittima di un attacco ransomware perpetrato dal gruppo ALPHV/BlackCat.

L’accesso è avvenuto il 12 febbraio tramite credenziali compromesse utilizzate per accedere a un portale Citrix di Change Healthcare, che non utilizzava l’autenticazione a più fattori. UnitedHealth Group ha pagato un riscatto di 22 milioni di dollari tramite Bitcoin, ma il gruppo ransomware ha eseguito un “exit scam”, trattenendo il denaro senza fornire le chiavi di decrittazione.

L’attacco ha compromesso i dati personali, sanitari e finanziari di circa 192,7 milioni di individui, rendendolo la più grande violazione di dati sanitari nella storia degli Stati Uniti.

Il valore dei dati sanitari nel mercato nero

Secondo Nunzia Ciardi, Vicedirettore generale dell’ACN, “una cartella clinica può valere tra i 300 e i 1.000 dollari, mentre una carta di credito arriva a 30 dollari”, evidenziando perché i cybercriminali considerano il settore sanitario un bersaglio particolarmente appetibile.

Le vulnerabilità del sistema sanitario italiano

Un’analisi condotta dall’ACN su oltre 50.000 indirizzi IP associati al settore sanitario ha rivelato che circa 2.178 di essi espongono quotidianamente servizi su Internet, presentando numerose criticità. Le vulnerabilità sono state classificate in tre categorie:

• Configurazioni errate (60% delle criticità)
• Software obsoleti o vulnerabili (25% delle criticità)
• Servizi e dispositivi esposti incautamente (15% delle criticità)

Le analisi sugli incidenti svolte dall’ACN mostrano che “i tentativi di attacco spesso hanno successo poiché alcune pratiche di sicurezza, anche elementari, vengono ignorate o mal implementate”.

La crescita del fenomeno

Secondo i dati ufficiali ACN, nel 2022 sono stati rilevati 45 eventi cyber nel settore sanitario, con un aumento del 50% nel 2023 rispetto all’anno precedente. Per il 2024 il numero complessivo degli eventi cyber è quasi raddoppiato rispetto al 2023.

Va chiarito che i dati sull’Italia come “terzo posto in Europa” sono riferiti a classifiche generali di cybersecurity e non specificamente al settore sanitario. Secondo i dati di ACN, nel 2023 la sanità italiana è stata il terzo settore più bersagliato dagli attacchi ransomware, subito dopo il manifatturiero e il commercio al dettaglio.

Le contromisure e le raccomandazioni

Quest’anno in Italia, secondo il Vicedirettore dell’ACN, sono state colpite da cyberattacchi circa cinquanta strutture sanitarie, con ripercussioni che spesso si estendono a più ospedali e servizi. “Quando un ospedale viene attaccato, le attività essenziali, come i pronto soccorso e la radioterapia, vengono interrotte, costringendo i malati oncologici a spostarsi su altri distretti sanitari”, ha dichiarato Nunzia Ciardi.

L’Intelligenza Artificiale emerge come strumento di difesa: le organizzazioni che hanno implementato estensivamente l’intelligenza artificiale e l’automazione nei loro workflow di prevenzione hanno visto una riduzione media di 2,2 milioni di dollari nei costi delle violazioni.

Conclusioni

L’ACN sottolinea come l’aumento del 50% degli attacchi informatici nel settore sanitario evidenzi la gravità della situazione. “La cybersecurity sanitaria non è solo un problema tecnico: è una questione di responsabilità collettiva, che riguarda istituzioni, aziende e cittadini”, ha concluso il Vicedirettore di ACN.

La protezione delle infrastrutture sanitarie richiede un approccio sistemico che comprenda aggiornamenti tecnologici, formazione del personale e implementazione di protocolli di sicurezza robusti, poiché quando si tratta di salvare vite umane, la vulnerabilità informatica non è un’opzione accettabile.

Fonti:

Agenzia per la Cybersicurezza Nazionale. (2024). Relazione annuale al Parlamento 2024. Roma: ACN.

Agenzia per la Cybersicurezza Nazionale. (2025). La minaccia cibernetica al settore sanitario: Report gennaio 2023 – maggio 2025. Roma: ACN, CSIRT Italia.

Ciardi, N. (2024, 17 ottobre). Dichiarazioni ufficiali durante il convegno “La minaccia cibernetica al settore sanitario”. Palazzo Lombardia, Milano. In Cyberattacchi in crescita nel settore sanitario, dati digitali nel mirino degli hacker. Agenzia per la Cybersicurezza Nazionale.

IBM Security. (2024). Cost of a Data Breach Report 2024. Armonk, NY: IBM Corporation.

(2024, 20 settembre). Attacchi hacker alla sanità in continuo aumento, 46 nel 2024. ANSA Tecnologia – Cybersecurity.

Krebs, B. (2024, marzo). BlackCat Ransomware Group Implodes After Apparent $22M Payment by Change Healthcare. Krebs on Security.

Red Hot Cyber. (2024, 20 giugno). Attacco Informatico all’ASST Rhodense: Cicada3301 pubblica 1 TB di Dati Sensibili liberamente scaricabili. Red Hot Cyber Security Intelligence.

Red Hot Cyber. (2024, 24 giugno). Esclusivo! Parla il Gruppo Hacker Dietro l’Attacco alla ASST Rhodense intervistato da RHC. Red Hot Cyber Dark Lab.

HIPAA Journal. (2025, 15 agosto). Change Healthcare Increases Ransomware Victim Count to 192.7 Million Individuals.

ICT Security Magazine. (2025, 21 gennaio). Cybersecurity nel Settore Sanitario: Minacce, Vulnerabilità e Strategie di Difesa per il 2025.

Lerman, R. (2025, 27 gennaio). How the ransomware attack at Change Healthcare went down: A timeline. TechCrunch.

https://www.ictsecuritymagazine.com/notizie/ransomware-ospedali/

Troy Cruzen is a vCISO at Fortified Health Security, headquartered in Brentwood, Tennessee. Image courtesy of Cruzen

https://www.securitymagazine.com/blogs/14-security-blog/post/101927-disabling-hospital-hvac-is-now-a-bargaining-chip-in-ransomware

When an incident occurs, every second counts. Whether it’s a security breach, theft, or an unauthorized access attempt, physical security teams must act quickly to determine what happened, who was involved, and what actions to take next. 

Digging through hours of footage, manually piecing together evidence, and cross-referencing logs can be slow and cumbersome. But with a modern video management system (VMS), security teams can streamline investigations, improve response times, and uncover critical insights faster — “supercharging” their investigations. 

A modern VMS is no longer simply used for recording and storing video; it enhances every stage of an investigation. By integrating automation and advanced data visualization tools, a VMS transforms how security professionals collect, analyze, and act on evidence.  

Improving the investigator’s experience 

Investigators don’t have time for trial and error. A robust VMS provides automation and intelligence to help security teams move seamlessly from incident response to in-depth investigation. Advanced system automation ensures that security operators get the tools they need right away to begin their analysis. 

For example, automated incident response features allow security teams to pre-program event-to-action sequences. When an alarm is triggered, the system automatically initiates the necessary actions, such as notifying dispatch, activating specific cameras, and generating real-time reports.  

Visual tracking is another huge advantage. Instead of manually searching multi-camera feeds for a suspect, operators can use their VMS to follow a subject across various views. Assisted tracking significantly speeds up suspect identification and prevents losing crucial visual information when a person moves from one camera’s field of view to another. 

Incident storyboarding further streamlines the investigation process by allowing operators to compile relevant video footage into a single, clear timeline. By dragging and dropping clips, security teams can reconstruct events, highlight key moments, and build a comprehensive visual report ready for review and sharing. 

While exploring these features, make sure your system is time-tested. Will the system have the resilience that your organization requires? It’s important that you can capture and view the footage you need when you need it.

Finding critical evidence faster 

The biggest challenge in any investigation is sifting through hours of video data to pinpoint the relevant footage. Traditional manual searches can take hours or even days, but AI-powered video analytics, combined with automatic bookmarking tools, make this process almost instantaneous. 

Forensic search capabilities and camera partner plug-ins allow investigators to find people, vehicles, and objects. Security professionals can quickly identify and retrieve crucial evidence by setting specific search parameters, such as time, location, object type, or color. 

Metadata search also helps by overlaying key data on video footage. Whether it’s alarms, sensor inputs, or access logs, metadata provides context to the footage, helping investigators understand what happened, why, and how it occurred. A modern VMS can record and organize metadata, allowing security teams to cross-reference information across multiple sources in one place. 

Another critical part of modern investigations is maintaining an unbroken chain of custody. Instead of dealing with cumbersome physical copies, digital evidence management systems ensure secure storage and sharing of video, images, and documents. Evidence that isn’t correctly handled can be thrown out, wasting resources and preventing justice from being served. With digital evidence management systems, investigators can share case files with law enforcement or stakeholders at the click of a button, while strict access controls maintain data integrity and compliance. 

Reconstructing events with advanced data visualization 

Investigations often need to reconstruct events clearly. A VMS with advanced data visualization tools allows security teams to recreate timelines, providing a clearer picture of what happened. 

Multi-angle playback and synchronization offer an in-depth review by displaying live and recorded footage side by side. Investigators can loop specific segments, zoom into particular moments, and analyze events from multiple perspectives. These tools make it easier to isolate key details and establish an accurate sequence of events. 

Custom dashboards improve situational awareness by providing a centralized view of system health, incident metrics, and investigative trends. Instead of manually compiling reports, security teams can use real-time visual dashboards to track performance indicators and identify anomalies as they emerge. 

Integrating data from other sources like Internet of Things (IoT) devices and third-party systems further improves event reconstruction. A VMS can transform fragmented information into a complete and actionable intelligence picture by incorporating sensor data, GPS coordinates, intercom logs, and even point-of-sale records. These insights help security teams identify patterns, predict risks, and refine their response strategies. 

Ensuring secure collaboration and evidence integrity 

Once the initial stages of an investigation are complete, the focus shifts to evidence management and collaboration. Some investigations take months or years. A secure platform ensures evidence remains protected. With cloud-based solutions, sharing case files no longer requires physical copies, making the process faster and more secure. 

Encrypted evidence sharing eliminates the risk of tampering or unauthorized access. Investigators can securely export video files, grant access to specific stakeholders, and track all activity through audit logs. Footage can be organized by incident or investigation, so investigators can easily track evidence. 

Automated redaction tools like facial masking help protect people’s privacy without compromising evidentiary integrity. Robust access controls determine who can view and modify footage, ensuring that only authorized personnel handle critical evidence. Data retention policies can be configured to align with legal and organizational requirements, determining how long incident-related evidence remains in the system. 

Lastly, cybersecurity measures built into modern VMS platforms strengthen evidence protection. Features like end-to-end encryption, zero-trust security models, and real-time system monitoring prevent tampering and unauthorized access. Teams can also set retention periods for cases and files to meet regulatory or compliance requirements. 

The future of investigations with the right VMS 

A modern VMS goes beyond simple video surveillance, equipping teams with automation, AI-powered search tools, and data visualization for faster investigations, better collaboration, and less paperwork.

Whether tracking a suspect, reconstructing an event, or sharing evidence, the right VMS transforms security operations. Investing in the right technology now means stronger security, faster responses, and staying ahead of risks before they become bigger problems. 

https://www.securitymagazine.com/articles/101928-first-line-of-defense-the-role-of-modern-vms-in-supercharging-investigations