Welcome to our weekly newsletter where we share some of the major developments on the future of cybersecurity that you need to know about. Make sure to follow my LinkedIn page as well as Echelon’s LinkedIn page to receive updates on the future of cybersecurity!
To receive these and other curated updates to your inbox on a regular basis, please sign up for our email list here: https://echeloncyber.com/ciw-subscribe
Cyber Intelligence Weekly
The Human Side of Cybersecurity is back for Season 2! For those new to the series, this is a podcast where I sit down with CISOs and security leaders who are in the seat, navigating real leadership pressure, complex risk decisions, and the human realities of building and sustaining security programs. What they share is experience, earned through moments of progress, frustration, growth, and reflection.
Last season, 15 conversations across industries pointed to the same truth: the human side of this work is what actually moves the needle. Season 2 goes deeper into exactly that, and we are keeping it rolling with conversations I think you'll really enjoy.
Frank DePaola (NPRO) — “Don’t do security for security’s sake.”
In this episode, I sat down with Frank DePaola, VP and CISO at Sonoco, whose path into security started in the US Army doing voice and data communications and wound through systems engineering, a hospitality company that had just survived a data breach, Humana, GE, and ultimately Sonoco and Enpro, where he became the company’s first CISO and built their global security program from the ground up.
What stood out most was how clearly Frank connects leadership back to the military principle of extreme ownership, and how he has carried that through every role since. For him, it is not enough for a security leader to own the work. The goal is to build a team where everyone acts as an owner. When that happens, he said, it becomes a superpower. Watching that come to life during a significant business email compromise incident, long hours, a team he had trained, processes they had co-created together, was the moment he knew he was in exactly the right career.
He also pushed back gently on something I hear often: the idea that communication is a soft skill. Frank’s take is that it accounts for roughly 80 percent of what it actually takes to succeed in this role. Getting the message right matters. Knowing when to send it, to whom, and how to frame it for a non-technical audience, that is where most security leaders either build credibility or quietly lose the room.
Additional takeaways from the conversation:
- People-first leadership is not a philosophy, it is a strategy. Frank learned early in the military that focusing on his people, investing in their development, and removing their barriers to success is what gives a mission its best chance. He has carried that through every security team he has built since.
- Extreme ownership works in both directions. It means the leader owns the outcomes, and it means building a culture where every team member does the same.
- Communication is 80 percent of the job. Knowing how to translate a technical risk into a business conversation, and how to frame a change so it lands rather than creates friction.
- The AI risk problem is real and the market hasn’t caught up. Business leaders are pushing adoption faster than security governance can keep pace. The vendor solutions exist, but most are still early in their maturity. Frank’s concern is that a lot of organizations are going to have some very difficult weeks before this stabilizes.
- Humility is a superpower. The leaders Frank admires most, are the ones who carry tremendous experience without letting it get in the way of still learning.
His billboard message was straightforward: Don’t do security for security’s sake. Do security to enable your business. It is a reminder that the mission was never about the controls, it was about the people and the organization those controls are there to protect.
If there was one thread that ran through this conversation, it was this: the security leaders who build programs that last are the ones who lead people first, communicate relentlessly, and never lose sight of why the business needs them to succeed.
Watch the Full Interview Here: Human Side of Cybersecurity | Linktree
Echelon Events & Thought Leadership Highlight
AI is being adopted across almost every organization. In many cases, leadership teams want to move even faster with it.
But there's a problem with that. Most security and compliance programs weren’t built for AI.
On November 18, join our very own Josh Fleming along with Vanta's Connor Snyder, CPA, CISA to talk about what security leaders can do about it.
Save your spot: https://lnkd.in/eUs9iaq5
Away we go!
1. Hackers Steal $6.3 Billion From Binance in Just 20 Minutes as North Korea Suspected
Hackers have pulled off what appears to be the largest cryptocurrency theft in history, stealing approximately $6.3 billion from Binance in an attack that unfolded in just 20 minutes. The October 29 breach targeted internet-connected cryptocurrency wallets belonging to the world's largest crypto exchange, with stolen assets transferred across at least ten blockchains, including Bitcoin, Ethereum, Tron and Solana. Binance quickly suspended deposits and withdrawals as investigators worked to contain the damage. Blockchain intelligence firms TRM Labs, Chainalysis and Elliptic have identified similarities between the attack and previous operations attributed to North Korean hackers, although neither Binance nor law enforcement has formally identified the perpetrators.
The speed of the theft was remarkable, but investigators say the operation was carefully prepared. According to TRM Labs, activity associated with the attack began at least 36 hours before the funds were stolen. The attackers conducted several small test transactions, deployed and refined malicious code, and rehearsed the operation before targeting Binance's hot wallets, which are connected to the internet to process customer withdrawals. Binance initially indicated that a compromised engineer's laptop may have played a role, although its investigation subsequently uncovered additional points of compromise. Once the attackers were ready, they rapidly drained wallets across multiple blockchain networks and transferred the assets to addresses under their control. The attack demonstrates how a relatively small initial foothold, combined with detailed knowledge of a company's systems, can lead to catastrophic financial losses.
Investigators believe the operation may be connected to TraderTraitor, a sophisticated North Korean hacking group previously linked to major cryptocurrency thefts. The FBI attributed the $1.5 billion Bybit breach in 2025 to the same group, which has a history of targeting employees at cryptocurrency companies through malicious applications and other carefully crafted attacks. Chainalysis reported that funds stolen from Binance were observed mixing with assets connected to a separate Bitget attack previously attributed to North Korean actors. Researchers also identified familiar tactics involving Tornado Cash, advance testing and rapid movement of stolen funds. While these findings strengthen suspicions of North Korean involvement, attribution remains preliminary. Investigators have also observed unusual laundering activity involving thousands of transactions apparently designed to complicate efforts to trace the money.
The financial consequences are staggering. Cryptocurrency companies and exchanges moved quickly to freeze portions of the stolen assets, with estimates suggesting that approximately $2.8 billion to $3 billion was initially immobilized. However, much of the remaining cryptocurrency cannot be directly frozen and may only be intercepted when it reaches exchanges or other services. Binance has pledged to cover losses while cooperating with law enforcement. For organizations operating cryptocurrency platforms or managing valuable digital assets, the incident underscores the importance of securing employee endpoints, protecting privileged access, limiting exposure through hot wallets and monitoring transactions for unusual activity. It also highlights the value of rehearsed incident response procedures and controls that can interrupt unauthorized transfers before they become irreversible. The attackers may have needed only 20 minutes to steal the money, but the security failures that made it possible were likely developing long before the first transaction occurred.
AWS Kubernetes Certificate Flaw Could Allow Unauthorized Certificate Issuance
AWS disclosed a security vulnerability on October 29 affecting its Private CA Connector for Kubernetes, a tool organizations use to automate digital certificate issuance for Kubernetes workloads. The flaw, tracked as CVE-2026-119115, involves improper authorization when the software determines which certificate issuer a request is permitted to use. Under certain conditions, an authenticated user authorized to request certificates from a namespace-specific issuer could instead obtain certificates from a more privileged, cluster-wide issuer. AWS warned that this could include subordinate certificate authority certificates, potentially extending the consequences beyond a single application or Kubernetes namespace.
Consider a company operating a shared Kubernetes environment that hosts applications for several internal business units. Each team may be authorized to request certificates for its own applications, while a central security team controls a cluster-wide certificate authority. If an attacker compromises a developer account with limited certificate-request permissions, this vulnerability could potentially allow that account to obtain certificates from the more privileged issuer. Depending on how the organization's certificate authorities are configured and trusted, improperly issued certificates could create opportunities for service impersonation or abuse of trusted identities. This is a certificate authorization problem, not a general authentication bypass or a confirmed compromise of AWS Private CA.
AWS has released a fix in aws-privateca-issuer version 1.10.1 and EKS add-on version 1.10.1-eksbuild.1. Organizations running earlier versions should update promptly. However, AWS warns that the patched version enforces stricter issuer configuration, meaning incorrectly configured certificate requests could stop renewing after the upgrade. Administrators should first review Kubernetes CertificateRequest, Certificate and Ingress resources to ensure the issuerRef.kind field correctly identifies either AWSPCAIssuer or AWSPCAClusterIssuer. Where immediate patching is not possible, AWS recommends restricting certificate approval policies and Kubernetes role-based access controls by both issuer name and issuer type.
The incident highlights an often-overlooked cloud security concern: the systems responsible for issuing trusted identities can become a source of risk when authorization boundaries are not enforced correctly. Security teams should inventory certificate issuers, review who can request and approve certificates, monitor for unexpected issuance and validate certificate renewal after upgrading. In cloud-native environments, protecting the authority to issue an identity is just as important as protecting the identity itself.
2. Apple Patches Previously Exploited iPhone Vulnerability in Sweeping Security Update
Apple has released a major round of security updates addressing hundreds of vulnerabilities across its operating systems, including a previously exploited flaw that remained unpatched on certain older iPhones and iPads. The October 26 release addresses approximately 304 security issues spanning iOS, iPadOS, macOS, Safari and other Apple products. Among the most significant fixes is CVE-2026-86950, a high-severity vulnerability in Apple's CoreGraphics framework that could allow an attacker to execute malicious code by getting a device to process a specially crafted file. The vulnerability carries a CVSS score of 8.8 and was already known to have been exploited in targeted attacks when Apple initially addressed it in newer operating systems in September.
The vulnerability involves an out-of-bounds write, a memory corruption issue that can occur when software processes data outside its intended boundaries. In this case, a maliciously crafted file could trigger the flaw when handled by CoreGraphics, a component responsible for processing and displaying graphics across Apple's platforms. The potential consequences are particularly concerning because attackers may be able to exploit vulnerabilities in underlying operating system components through files or content that appear routine to users. Apple has not publicly disclosed extensive details about the attacks exploiting this flaw, but the company's acknowledgment of targeted exploitation makes the update especially important for organizations whose employees use older devices to access corporate systems.
Apple previously addressed the vulnerability in newer operating systems, including iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. The latest release extends protection to older devices through iOS 18.7.11 and iPadOS 18.7.11, covering supported hardware that has not moved to newer operating systems. The October updates also address other notable security weaknesses, including CVE-2026-86990, which could allow a malicious application to access a device's camera without permission, and CVE-2026-28864, which could allow a local attacker to access sensitive Keychain information. Apple released additional updates across its product ecosystem, including iOS and iPadOS 27.2, macOS Golden Gate 27.2 and updated versions of Safari and other operating systems.
For organizations managing Apple devices, the immediate priority should be to identify systems running outdated operating systems and confirm that the appropriate security updates have been installed. Mobile device management platforms can help IT teams inventory devices, enforce minimum operating system requirements and monitor patch compliance. Employees using personally owned devices for work should also be encouraged to install updates promptly, particularly when those devices have access to corporate email, cloud applications or sensitive business information. While Apple's decision to backport this fix provides important protection for older hardware, organizations should not treat occasional security updates as a substitute for a long-term device replacement and upgrade strategy. A smartphone that still works perfectly well can still become a significant security liability if its software falls behind.
AWS Patches AI Agent Vulnerability That Could Expose Cloud Credentials and API Keys
AWS disclosed a security vulnerability on October 28 affecting Strands Agents Tools, an open-source Python package that helps developers give AI agents the ability to interact with applications and operating environments. The flaw, tracked as CVE-2026-115415, could allow an attacker to trick an AI agent into revealing sensitive information stored in its host environment, including cloud credentials and API keys. The vulnerability affects versions 0.1.0 through 0.8.5 and involves the package's environment tool, which allows agents to inspect and manage environment variables. Although the tool normally masks sensitive values, researchers discovered that the AI model itself could be instructed to disable that protection.
The attack illustrates how prompt injection can undermine security controls in AI applications. Imagine a company using an AI agent to review documents, summarize customer information or automate internal business processes. An attacker could place malicious instructions inside a document or other content the agent is expected to process. If the agent follows those instructions, it could call the vulnerable environment tool with secret masking disabled, causing the tool to return environment variables in plaintext. Those variables might contain credentials used to access AWS resources, third-party APIs or internal business systems. The vulnerability does not automatically transmit the credentials to an attacker, but it could expose them within the agent's processing context, where additional malicious instructions or integrations might enable further disclosure.
AWS has released Strands Agents Tools version 0.8.6 to address the issue. The update prevents the AI model from disabling secret masking and places that decision under the control of the application operator. AWS has also deprecated the affected environment tool. Organizations using Strands Agents should upgrade immediately, remove the environment tool from existing agents where possible and rotate credentials that were present in environments where the vulnerable tool was loaded. Developers should also avoid storing long-lived cloud credentials in agent environment variables, use short-lived credentials and restrict outbound network connections to approved destinations. If an immediate update is not possible, AWS specifically recommends removing the environment tool from deployed agents.
The broader lesson is that AI security cannot depend entirely on telling a model to behave appropriately. AI agents increasingly have access to files, credentials, business applications and cloud infrastructure. Security controls must therefore be enforced by the underlying software rather than left to the model's discretion. Organizations should inventory the tools available to their AI agents, limit access to sensitive information and test whether malicious instructions embedded in untrusted content can influence privileged actions. An AI agent should never have the authority to turn off the security controls designed to protect the systems it operates.
3. Revolve Data Breach Exposes Customer Payment Card Information in Automated Cyberattack
Online fashion retailer Revolve has disclosed a cybersecurity incident in which hackers accessed multiple company systems and stole sensitive customer information, including payment card numbers and expiration dates. The company revealed the breach in a filing with the U.S. Securities and Exchange Commission, explaining that attackers used automated methods to collect information from customers who had saved payment details in their online shopping accounts. The compromised data also included customer names and contact information. Revolve, which operates a major e-commerce platform serving shoppers across more than 1,600 fashion brands, has not publicly disclosed when the attack occurred or the total number of customers affected.
The scope of the incident is beginning to emerge through state breach notification filings. Revolve reported that approximately 127,200 Texas residents had information compromised, along with another 1,328 individuals in Vermont. Additional breach notifications were submitted in Massachusetts. The company has notified federal law enforcement and engaged an outside cybersecurity firm to investigate the intrusion and support recovery efforts. Interestingly, Revolve reported that the incident did not interrupt its business operations and said it does not expect a material financial impact. That distinction is important because a cyberattack does not have to take systems offline or involve ransomware to cause serious harm. In this case, attackers were apparently able to extract valuable customer information while the company's shopping platform continued operating.
The use of automation is another notable aspect of the attack. While Revolve has not disclosed the specific techniques used to gain access to its systems, automated collection of stored customer information raises important questions about how e-commerce platforms detect suspicious activity, restrict access to payment data and identify unusual patterns of account or database access. For example, an attacker who gains access to a privileged application account or vulnerable system could potentially use automated requests to retrieve large volumes of customer records before security teams recognize the activity. Revolve has not confirmed that this particular scenario occurred, but it illustrates why organizations need more than traditional perimeter defenses. Payment information remains an attractive target for cybercriminals, and the retail industry has experienced a steady series of attacks affecting major brands, including Levi Strauss, ASOS, Mango and The North Face.
For retailers and other businesses that store customer payment information, the Revolve incident reinforces the importance of minimizing sensitive data retention and closely monitoring access to customer records. Organizations should review whether they need to store payment card numbers directly or can rely on tokenization through a payment processor. Strong authentication, least-privilege access, application security testing and automated detection of unusual data access can help reduce exposure. Security teams should also evaluate whether their monitoring systems can identify large-scale data extraction even when normal business operations appear unaffected. Customers who receive breach notifications should monitor their payment accounts for unauthorized transactions and consider requesting replacement cards from their financial institutions. The most troubling aspect of this breach may be that nothing visibly broke. The website kept running, customers kept shopping and attackers still managed to walk away with sensitive financial information.
Thanks for reading!
About us: Echelon is a full-service cybersecurity consultancy that offers wholistic cybersecurity program building through vCISO or more specific solutions like penetration testing, red teaming, security engineering, cybersecurity compliance, and much more! Learn more about Echelon here: https://echeloncyber.com/about