10 Oct Security Report – 10 Oct 2025
Microsoft 365 has become an essential tool for businesses of all sizes. Its widespread adoption and deeply integrated suite of tools offer immense value not just to its users, but also to attackers looking to exploit them. They understand that one compromised account can open the doors to emails, documents, collaboration tools, calendars and sensitive business information. To threat actors, this means a huge payout potential. And they’re exploiting every possible entry point — from sophisticated phishing campaigns and OAuth app abuse to session token hijacking. The more integrated and vital M365 becomes to your business, the more attractive it becomes as a target for theirs. To better protect your Microsoft 365 accounts, you need a proactive defense strategy. Defending your organisation’s mission-critical Microsoft 365 accounts is possible with the right mix of strong policies, strict MFA enforcement and constant vigilance.
Recent Breaches
Japan – Asahi Group Holdings, Ltd. – Agriculture & Food
Exploit: Ransomware & Malware
Risk to Business: Moderate: Asahi Group Holdings, Ltd., one of Japan’s largest beverage companies, has confirmed that it was the victim of a ransomware attack. The company shared the update on October 3, about a week after disclosing the cyberattack, which forced it to suspend some domestic operations. During its ongoing investigation, Asahi discovered a potential unauthorised transfer of data from its systems. The company has not yet determined the nature or scope of the compromised information, nor has it disclosed whether the attackers issued a ransom demand.
United States – Cisco – Technology
Exploit: Third-Party Data Breach
Risk to Business: Moderate: Cybersecurity agencies worldwide, including CISA and the U.K. National Cybersecurity Center (NCSC), warned of an “advanced threat actor” actively targeting devices running Cisco’s Adaptive Security Appliances (ASA) firewall software. According to the agencies, the “widespread” campaign exploits zero-day vulnerabilities in Cisco devices, allowing attackers to run malicious code and deploy malware. Impacted equipment includes certain Cisco ASA 5500-X Series devices, which act as firewalls protecting corporate networks from intrusions. In a statement, Cisco analysts said they have “high confidence” the campaign is tied to ArcaneDoor — a state-sponsored threat actor the vendor first identified in 2024. In an emergency directive issued last Thursday, CISA ordered government cyber teams to locate all affected devices within just over one day, scan them for malicious activity and apply the security updates designed to patch the vulnerabilities.
Talk to a TCT team member today about implementing IT strategy plan for your business.
Robert Brown
10/10/2025
Related Articles:
Invest Smart, Grow Fast
Copilot in Microsoft Teams