This Week in Cybersecurity | April 18, 2025

Welcome to This Week in Cybersecurity, our weekly series where we break down the latest threats, trends, and takeaways you need to know to keep your business safe.

Top Threats This Week

1. SonicWall Flags Old Vulnerability as Actively Exploited

SonicWall has updated its advisory for a previously patched vulnerability (CVE-2021-20035) in its SMA 100 series, now warning that the flaw is actively being exploited in the wild. Originally rated as medium severity, the vulnerability—an authenticated command injection issue—has been upgraded to high severity with a CVSS score of 7.2. It affects SMA 200, 210, 400, 410, and 500v models running outdated firmware versions. While exploitation requires authentication, the attacks may involve an additional vulnerability. CISA has added this flaw to its Known Exploited Vulnerabilities catalog, highlighting the ongoing risk to unpatched SMA 100 appliances. Businesses using these devices should ensure updates are applied immediately.

Takeaway: Even older, medium-rated vulnerabilities can become serious threats if exploited—especially when combined with other unknown flaws. Regular patching and vulnerability monitoring are key to protecting your network from evolving cyber risks.

(SecurityWeek)

2. Microsoft Addresses 134 Vulnerabilities in April Patch Tuesday

Microsoft's April 2025 security update includes fixes for 134 vulnerabilities, with 11 classified as critical. Notably, it addresses a zero-day vulnerability (CVE-2025-29824) exploited by the RansomEXX ransomware group. Small businesses are advised to apply these updates promptly to protect against potential threats.

Takeaway: Patch regularly. Unpatched systems are a top target for attackers. Enable automatic updates or work with your IT provider to manage patching across your network.

(Acronis)

3. Hijack Loader Malware Evolves with New Evasion Techniques

A more advanced version of the Hijack Loader malware is using call stack spoofing and virtual machine detection to evade defenses.

Takeaway: Threats are getting smarter. Relying solely on basic antivirus isn’t enough—consider layered security, including behavioral threat detection and endpoint detection & response (EDR).

(Acronis)

Cyber Tip of the Week

Don’t Just Hover—Verify Before You Trust

Phishing attempts are getting more sophisticated, often impersonating trusted brands and coworkers. It’s no longer enough to just "hover over links." Encourage employees to:

• Verify sender addresses carefully (watch for subtle misspellings)

• Check for unexpected tone or urgency

• Avoid downloading attachments they weren’t expecting

• Use a known contact method to confirm suspicious messages

Train your team to slow down and trust their instincts—one cautious click could save your business from a breach.

Stat of the Week

60% of small businesses that experience a cyberattack go out of business within six months

(Source: U.S. National Cyber Security Alliance)

That’s not a scare tactic—it’s a wake-up call. Building even a basic incident response plan can mean the difference between recovery and shutdown.

Final Thoughts

Cyber threats aren’t slowing down—but neither are the tools to stop them. Proactive defense, smart user training, and a well-prepared IT strategy are your best bets to stay resilient.

Need help evaluating your security posture? We’re here to guide the way.

Have questions about your cybersecurity posture? Let’s talk.