Fortinet VPN Bypass Under Active Exploitation as Pro-Russian Hackers Strike French Postal Service; CISA Adds Critical NVR Flaw to KEV Catalog

Critical Infrastructure Intelligence Briefing

Report Date: Thursday, December 25, 2025

Reporting Period: December 18–25, 2025

1. Executive Summary

This week's intelligence highlights significant developments across multiple threat vectors affecting critical infrastructure:

Active Exploitation Alert: Fortinet has issued an urgent warning regarding active exploitation of a five-year-old FortiOS SSL VPN vulnerability (CVE-2020-12812) that bypasses two-factor authentication. Organizations using FortiOS SSL VPN should immediately verify patching status and review authentication configurations.
Nation-State Activity: Pro-Russian hacktivist group NoName057(16) claimed responsibility for a significant DDoS attack against France's national postal service (La Poste), disrupting operations during the critical holiday period. This attack underscores continued targeting of Western critical infrastructure by Russian-aligned threat actors.
CISA KEV Addition: CISA added a critical remote code execution vulnerability in Digiever DS-2105 Pro network video recorders to its Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Organizations using these devices in physical security operations should prioritize remediation.
Strategic Acquisitions: ServiceNow's $7.75 billion acquisition of OT security specialist Armis signals significant market consolidation in the operational technology security space, with implications for critical infrastructure protection capabilities.
International Law Enforcement Success: Interpol's coordinated operation across 19 countries resulted in significant disruption of cybercriminal operations, demonstrating the value of international cooperation in combating threats to critical infrastructure.

2. Threat Landscape

Nation-State and Hacktivist Activity

Pro-Russian Hacktivists Target French Critical Infrastructure: The pro-Russian hacktivist group NoName057(16) claimed responsibility for a DDoS attack that knocked central computer systems at France's national postal service La Poste offline on Monday, December 23. The attack disrupted postal operations during the peak holiday shipping period, demonstrating the group's continued focus on Western critical infrastructure and essential services.
Source: SecurityWeek
Assessment: This attack aligns with established patterns of Russian-aligned hacktivist groups targeting NATO member states' critical services. The timing—during the Christmas holiday period—was likely deliberate to maximize operational disruption and public visibility. Infrastructure operators should anticipate continued targeting of logistics, transportation, and communications sectors.

Cybercriminal Developments

Interpol Operation Disrupts Global Cybercrime Networks: A coordinated Interpol sweep across 19 countries successfully disrupted multiple cybercriminal operations. While specific details remain limited, this operation demonstrates enhanced international cooperation in combating transnational cyber threats.
Source: CSO Online
FBI Seizes Credential Theft Infrastructure: U.S. authorities seized the domain 'web3adspanels.org' and its associated database, which was used by cybercriminals to store banking credentials stolen from American victims through account takeover attacks. This action disrupts an active financial fraud operation targeting the banking sector.
Source: Bleeping Computer
Webrat Malware Exploits Security Research: A new threat dubbed "Webrat" has been identified turning legitimate GitHub proof-of-concept (PoC) exploits into malware distribution vectors. Security researchers and vulnerability management teams should exercise heightened caution when testing PoC code from public repositories.
Source: CSO Online

Emerging Attack Vectors

VPN Proxy Extension Intercepts AI Communications: Research has revealed that Urban VPN Proxy browser extension surreptitiously intercepts conversations across ten AI platforms. This represents a concerning trend of threat actors targeting AI-assisted workflows, which are increasingly integrated into critical infrastructure operations and decision-making processes.
Source: Schneier on Security
Typosquatting Campaign Distributes PowerShell Malware: A typosquatted domain impersonating Microsoft Activation Scripts (MAS) is being used to distribute malicious PowerShell scripts that deploy the 'Cosmali Loader' malware. IT administrators should verify download sources and implement application whitelisting controls.
Source: Bleeping Computer
MacSync Stealer Bypasses Apple Security: A new variant of the MacSync information stealer uses digitally signed and notarized Swift applications to bypass Apple Gatekeeper protections. This technique represents an evolution in macOS-targeting malware that could affect enterprise environments with mixed operating system deployments.
Source: The Hacker News

Fraud and Social Engineering

AI-Powered Investment Scams Surge: The "Nomani" fraudulent investment scheme has increased 62% according to ESET research, with campaigns now leveraging AI-generated deepfake advertisements across multiple social media platforms beyond Facebook. Critical infrastructure organizations should include awareness of these tactics in employee security training.
Source: The Hacker News
SEC Charges Crypto Platforms in $14M Fraud: The U.S. Securities and Exchange Commission filed charges against multiple companies involved in a cryptocurrency scam that defrauded investors of more than $14 million using fake AI-themed investment tips. This enforcement action highlights regulatory focus on emerging technology fraud.
Source: The Hacker News
Fake Job Ads Target MENA Region: A coordinated wave of fraudulent online job advertisements targeting the Middle East and North Africa has been uncovered, exploiting remote work trends to conduct credential theft and financial fraud.
Source: Infosecurity Magazine

3. Sector-Specific Analysis

Communications & Information Technology

Threat Level: ELEVATED

FortiOS SSL VPN Active Exploitation: Fortinet has confirmed "recent abuse" of CVE-2020-12812, a vulnerability in FortiOS SSL VPN that allows attackers to bypass two-factor authentication under certain configurations. Despite being a five-year-old vulnerability, active exploitation indicates many organizations remain unpatched.
Source: The Hacker News
Recommended Actions:
- Immediately verify FortiOS version and patch status
- Review 2FA configuration for SSL VPN implementations
- Monitor authentication logs for anomalous access patterns
- Consider implementing additional network segmentation for VPN endpoints
MongoDB RCE Vulnerability: MongoDB has issued an urgent warning regarding a high-severity remote code execution vulnerability affecting MongoDB servers. Administrators should apply patches immediately.
Source: Bleeping Computer
Microsoft Teams Security Enhancement: Microsoft announced that security administrators will soon be able to block external users from initiating communications via Teams through the Defender portal. This capability will help organizations reduce social engineering attack surface.
Source: Bleeping Computer

Transportation & Logistics

Threat Level: ELEVATED

French Postal Service Disruption: The DDoS attack on La Poste demonstrates continued threat actor interest in disrupting logistics and transportation infrastructure. The attack's timing during peak holiday operations maximized impact on both commercial operations and public services.
Implications for U.S. Infrastructure: Similar attacks against U.S. postal services, package delivery networks, or logistics providers could significantly impact supply chain operations. Organizations should:
- Review DDoS mitigation capabilities
- Ensure business continuity plans account for extended service disruptions
- Coordinate with sector ISACs on threat intelligence sharing

Financial Services

Threat Level: MODERATE

Credential Theft Infrastructure Disrupted: The FBI's seizure of web3adspanels.org and its credential database represents a tactical victory against financial fraud operations. However, organizations should assume that stolen credentials may have been exfiltrated prior to the seizure.
Recommended Actions:
- Monitor for account takeover indicators
- Implement behavioral analytics for anomalous account activity
- Consider mandatory password resets for high-risk accounts

Physical Security Infrastructure

Threat Level: ELEVATED

Network Video Recorder Vulnerability: CISA's addition of the Digiever DS-2105 Pro NVR vulnerability to the KEV catalog indicates active exploitation of physical security systems. Organizations using these devices for surveillance and access control should prioritize remediation.
Source: The Hacker News
Stadium and Arena Security Guidance: CISA released new guidance supporting security leaders in protecting large venues. This resource is particularly relevant given upcoming New Year's Eve events and the ongoing threat environment.
Source: Security Magazine

Research & Scientific Infrastructure

CERN Risk Management Insights: New reporting examines how CERN, the European Organization for Nuclear Research, manages cybersecurity risk across its complex international research infrastructure. The case study offers valuable lessons for other research institutions and critical infrastructure operators managing distributed, high-value assets.
Source: CSO Online

4. Vulnerability & Mitigation Updates

Critical Vulnerabilities Requiring Immediate Attention

CVE	Product	Severity	Status	Action Required
CVE-2020-12812	FortiOS SSL VPN	HIGH	Actively Exploited	Patch immediately; verify 2FA configuration
CVE-TBD	Digiever DS-2105 Pro NVR	CRITICAL	Added to CISA KEV	Apply vendor patches; isolate from network if unpatched
CVE-TBD	MongoDB Server	HIGH	Patch Available	Apply patches immediately

CISA Advisories and Actions

KEV Catalog Update: CISA added the Digiever NVR RCE vulnerability to the Known Exploited Vulnerabilities catalog, triggering mandatory remediation timelines for federal agencies and serving as a strong indicator for private sector prioritization.
Stadium Security Guide: New CISA guidance provides comprehensive security recommendations for large venue operators, addressing both physical and cyber threats to event infrastructure.

Recommended Defensive Measures

VPN Security:
- Audit all VPN implementations for known vulnerabilities
- Verify multi-factor authentication is properly configured and enforced
- Implement network segmentation to limit VPN endpoint exposure
- Monitor for anomalous authentication patterns
Physical Security Systems:
- Inventory all network-connected surveillance and access control devices
- Segment physical security systems from primary IT networks
- Apply firmware updates and patches promptly
- Monitor for unauthorized access or configuration changes
Supply Chain Security:
- Verify software downloads from official sources only
- Implement code signing verification for all deployments
- Exercise caution with proof-of-concept code from public repositories

5. Resilience & Continuity Planning

Lessons from Recent Incidents

La Poste DDoS Attack: The disruption to French postal services during peak holiday operations highlights the importance of:
- Robust DDoS mitigation capabilities for customer-facing systems
- Business continuity plans that account for extended service degradation
- Clear communication protocols for public-facing service disruptions
- Redundant processing capabilities for critical operations

Holiday Period Security Considerations

Reduced Staffing Awareness: With many organizations operating with skeleton crews during the holiday period, threat actors may exploit slower incident response times. Ensure:
- On-call procedures are clearly documented and tested
- Escalation paths are current and accessible
- Automated monitoring and alerting systems are functioning properly
- Critical patches can be deployed with available personnel

Supply Chain Security Developments

GitHub PoC Weaponization: The Webrat malware campaign's use of legitimate-appearing proof-of-concept code underscores supply chain risks in security research and vulnerability management workflows. Organizations should:
- Implement isolated testing environments for PoC evaluation
- Verify code provenance before execution
- Consider automated scanning of downloaded code

6. Regulatory & Policy Developments

European Union

NIS2 Implementation Guidance: New analysis provides practical guidance for organizations implementing the EU's Network and Information Security Directive 2 (NIS2) requirements without excessive bureaucratic burden. U.S. organizations with EU operations or partnerships should monitor compliance requirements.
Source: CSO Online
Italy Antitrust Action: Italy's €98.6 million fine against Apple over App Tracking Transparency rules signals continued European regulatory scrutiny of major technology platforms. While not directly security-related, this action reflects broader regulatory trends affecting technology governance.
Source: The Hacker News

United States

SEC Cryptocurrency Enforcement: The SEC's charges against cryptocurrency platforms for fraud demonstrate continued regulatory focus on emerging technology sectors. Organizations in financial services should ensure compliance programs address cryptocurrency-related risks.
NIST-MITRE AI Security Partnership: NIST and MITRE announced collaborative launch of two centers focused on advancing AI security for U.S. manufacturing and critical infrastructure, with $20 million in initial funding. This initiative will develop standards and best practices for secure AI deployment in critical systems.
Source: Infosecurity Magazine

Market Developments with Policy Implications

ServiceNow-Armis Acquisition: ServiceNow's $7.75 billion acquisition of OT security specialist Armis represents significant consolidation in the operational technology security market. This deal, expected to close in H2 2026, will combine IT service management capabilities with OT asset visibility and security, potentially reshaping the critical infrastructure protection vendor landscape.
Source: Infosecurity Magazine

7. Training & Resource Spotlight

New Resources

CISA Stadium and Arena Security Guide: Newly released guidance provides comprehensive security recommendations for large venue operators, addressing threat assessment, physical security measures, cybersecurity considerations, and emergency response planning. Recommended for:
- Venue security directors
- Event management professionals
- Local law enforcement liaisons
- Emergency management coordinators
Source: Security Magazine
NIST-MITRE AI Security Centers: The newly announced $20 million initiative will establish centers focused on AI security for manufacturing and critical infrastructure. Organizations should monitor for:
- Emerging standards and frameworks
- Best practice guidance
- Training and certification opportunities
- Research collaboration possibilities

Security Awareness Focus Areas

AI-Powered Social Engineering: The 62% surge in Nomani investment scams using AI deepfakes highlights the need for updated security awareness training that addresses:
- Recognition of AI-generated content
- Verification procedures for investment opportunities
- Reporting mechanisms for suspected fraud
Supply Chain Verification: Multiple incidents this week involving typosquatted domains and weaponized PoC code underscore the importance of:
- Source verification procedures
- Code signing validation
- Isolated testing environments

Case Study: CERN Risk Management

The detailed examination of CERN's approach to managing cybersecurity risk across its complex international research infrastructure offers valuable lessons for critical infrastructure operators. Key takeaways include approaches to managing distributed assets, international collaboration on security, and balancing openness with protection requirements.

8. Looking Ahead: Upcoming Events

Heightened Awareness Periods

New Year's Eve (December 31, 2025): Large public gatherings present elevated physical security concerns. The new CISA stadium and arena security guide provides timely guidance for venue operators. Cyber threats may also increase as threat actors exploit reduced staffing levels.
Holiday Period Through January 2, 2026: Continued reduced staffing across many organizations may slow incident detection and response. Ensure automated monitoring systems are functioning and on-call procedures are clear.

Anticipated Developments

NIST Secure Hardware Standards (January 2026): NIST's SUSHI (Secure Hardware) initiative is expected to release next-generation secure hardware standards guidance, with implications for semiconductor supply chain security and critical infrastructure hardware procurement.
ServiceNow-Armis Integration Planning: Following the announced acquisition, organizations should monitor for:
- Product roadmap announcements
- Integration timelines
- Potential changes to existing Armis deployments
NIS2 Compliance Milestones: Organizations with EU operations should track upcoming NIS2 implementation deadlines and prepare compliance documentation.

Threat Considerations

Post-Holiday Ransomware Activity: Historical patterns suggest increased ransomware deployment following holiday periods when organizations may have accumulated unpatched systems or unreviewed logs. Plan for comprehensive security reviews in early January.
Continued Russian-Aligned Hacktivist Activity: The La Poste attack suggests continued targeting of Western critical infrastructure by pro-Russian groups. Transportation, logistics, and communications sectors should maintain elevated monitoring.

This intelligence briefing is derived from open-source reporting and is intended to support critical infrastructure protection decision-making. Recipients are encouraged to verify information through official channels and adapt recommendations to their specific operational environments.

Report Prepared: Thursday, December 25, 2025

Disclaimer

This briefing is generated using AI analysis of public news sources. Always verify critical information through authoritative sources before taking action.