- Published
- Source
- Cybersecurity Dive
- Reported by
- 5 publishers
- Filed under
- Ransomware, Attacks, Malware & exploits
Multiple threat actors have exploited a high-severity flaw in the company’s GlobalProtect portal.
What defenders check after a story like this
- Backups kept offline or immutable – and a restore you have actually tested.
- Multi-factor authentication on every remote way in, with VPNs and firewalls patched first.
- Alerts for the warning signs: new admin accounts, security tools switched off, mass file changes, large uploads.
More helpNCSC: mitigating malware and ransomware attacks (opens in a new tab)
Also reported by 4 more publishers
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Data Encrypted for Impact
ImpactWhat a defender checks
- Isolate affected hosts from the network to stop the spread.
- Confirm backups are offline and restorable – then test a restore.
- Hunt for what came first: new admin accounts, disabled security tools, remote-access software.
Build the skillBlue Team Engineer · Incident Management & Response Engineering
External Remote Services
Persistence, Initial AccessWhat a defender checks
- List every VPN, remote desktop and remote-access gateway you expose.
- Require MFA on all of them, and keep them patched.
- Alert on sign-ins from new countries, networks or devices.
Build the skillBlue Team Engineer · Network Security Engineering
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Blue Team Specialist
Breaches like this get investigated, not just reported.
Blue Team Specialist takes the Analyst curriculum and adds the investigator's work: one incident owned end to end, hypothesis-led threat hunting with MITRE ATT&CK and KQL, breach analysis, and a root cause report people can act on.
- Scope, attacker path and dwell time
- Threat hunting with ATT&CK and KQL
- Root cause analysis and reporting
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
