Spain and Portugal rule out cyberattack as cause of power outage.

Announcement

Last chance to enjoy CISO Perspectives for free.

Just a reminder that today’s episode of CISO Perspectives is the final episode of the season available to everyone. The rest of this season will be available exclusively to our N2K Pro subscribers. If you’d like to continue following Kim's conversations and access the full season, head over to thecyberwire.com/pro to learn more about becoming a Pro subscriber.

Live discussion: Strengthen Your Web App Defenses.

Web applications remain a top attack vector for cybercriminals, according to the latest Verizon DBIR. Join Outpost24’s Laura Enríquez and their Ghostlabs team for a live discussion with N2K CyberWire’s Dave Bittner on today’s web application threats, vulnerabilities, and practical strategies to strengthen your defenses. Don’t miss this expert conversation. Register now to join live or access it on-demand.

Summary

By the CyberWire staff

At a glance.

Spain and Portugal rule out cyberattack as cause of power outage.
Cyberattack against Marks & Spencer tied to Scattered Spider.
Rhysida ransomware group posts data allegedly stolen from Oregon's Department of Environmental Quality.

Spain and Portugal rule out cyberattack as cause of power outage.

Authorities in Spain and Portugal have ruled out a cyberattack as the cause of a massive power outage that hit the Iberian Peninsula yesterday, the BBC reports. The exact cause of the outage is still under investigation, but preliminary reports suggest transmission issues originating within Spain's power grid.

NBC News says power is almost fully restored across the region, though Spain and Portugal remain under a state of emergency.

Control what runs in your environment. Reduce your attack surface.

ThreatLocker helps organizations reduce risk by allowing trusted applications to run while limiting their access to only the resources they need. It’s a straightforward, default deny approach that gives you more control and visibility—without slowing down operations. Explore how ThreatLocker can help simplify your security strategy.

Cyberattack against Marks & Spencer tied to Scattered Spider.

BleepingComputer reports that the disruptive cyberattack against British retailer Marks & Spencer (M&S) was a ransomware attack launched by the Scattered Spider criminal group. BleepingComputer cites sources as saying the threat actors gained access after stealing M&S's Windows NTDS.dit file, which contains hashed passwords for Windows accounts. These hashes were then cracked, and the credentials were used to spread throughout the Windows domain. According to BleepingComputer's sources, the threat actors finally "deployed the DragonForce encryptor to VMware ESXi hosts on April 24th to encrypt virtual machines."

M&S hasn't shared details on the nature of the incident. Sky News reported yesterday that around 200 agency staff workers at the retailer's main distribution center have been told to stay home as M&S deals with the incident.

Only the Right Users, Only the Right Access—Is Your Security Strong Enough?

Secure Access is crucial for U.S. Public Sector missions, ensuring that only authorized users can access certain systems, networks, or data - are your defenses ready? Cisco's Security Service Edge delivers comprehensive protection for your network and users. Experience the power of zero trust and secure your workforce, wherever they are. Elevate your security strategy by visiting: cisco.com/go/sse.

Rhysida ransomware group posts data allegedly stolen from Oregon's Department of Environmental Quality.

Oregon Public Radio reports that the Rhysida ransomware group has published 2.4 terabytes of data allegedly stolen from Oregon's Department of Environmental Quality (DEQ). Rhysida demanded 30 bitcoin ($2.5 million) in ransom but says the DEQ refused to pay. A DEQ spokesperson told CyberScoop, "DEQ is aware of these claims and they are under investigation."

The leaked data appears to contain sensitive personal information belonging to DEQ employees. Oregon Public Radio notes that DEQ collects vehicle inspection and registration data for Oregonians in the Portland and Medford areas, but it's unclear if this data was breached.

Notes.

Today's issue includes events affecting Portugal, Spain, and the United Kingdom the United States.

Attacks, Threats, and Vulnerabilities

Barracuda Finds That 23% of HTML Email Attachments Are Malicious (Cision PR Newswire) /PRNewswire/ -- Barracuda Networks, Inc., a leading cybersecurity company providing complete protection against complex threats for all sized businesses, today...

Active exploitation of SAP NetWeaver Visual Composer CVE-2025-31324 | Rapid7 Blog (Rapid7) On Thursday, April 24, enterprise resource planning company SAP published a CVE (and a day later, an advisory behind login) for CVE-2025-31324, a zero-day vulnerability in NetWeaver Visual Composer that carries a CVSSv3 score of 10.

Trends

The Top Ransomware Groups Targeting the Healthcare Sector (Flashpoint) In this post, we identify and analyze the top ransomware groups that have been actively targeting the healthcare sector.

The Human Factor 2025: Vol. 1 Social Engineering | Proofpoint US (Proofpoint) The Human Factor report focuses on how technology and psychology combine to make people so susceptible to modern cyber threats.

Optiv Report Finds Increased Cybersecurity Incidents, Strategic Budget Shifts as Organizations Combat Evolving Threat Landscape (Optiv) Findings from Optiv's report are based on responses from 620 U.S.-based IT and IT security practitioners familiar with their organizations’ strategies to manage threats and risks.

Marketplace

Sol Rashidi Joins Cyera as Chief Strategy Officer for Data and AI, Joining Wave of Industry Leaders Betting on the AI-Native Security Revolution (BusinessWire) Veteran execs from AWS, Zscaler, and Palo Alto Networks join Cyera to shape the future of data security in the age of AI

BeyondTrust Names Industry Veteran Sean Malone as Chief Information Security Officer (BeyondTrust) Experienced security leader joins BeyondTrust to drive innovation and strengthen identity security leadership

LayerX Security Extends Series A Funding to $37M to Power Next-Gen Enterprise Browser Security, Challenges SSE Solutions and Enterprise Browsers (GlobeNewswire News Room) Series A Extension of $11M led by Jump Capital, added to $26M, underscores LayerX's leadership in securing all browsers against GenAI data risks, web...

HYPR Continues Global Expansion with New Belgrade Office Amid Shift to Passkeys and Rising Deepfake Threats (GlobeNewswire News Room) HYPR announces the opening of a new European Center in Belgrade and the promotion of Douglas McLaughlin to Senior Vice President of Worldwide Sales....

Products, Services, and Solutions

Anetac Extends Identity Vulnerability Management Platform with Human Link Pro to Secure Both Human and Non-Human Identities (BusinessWire) Expands Anetac's platform to address critical security gaps by discovering and managing vulnerabilities for both human and non-human identities

Flashpoint Unveils New AI-Powered Risk Discovery, Curated Threat Feeds, and On-Demand Data Source Expansion at RSA Conference 2025 (BusinessWire) Newest advancements to Flashpoint Ignite make industry-leading threat data and intelligence more accessible so teams can extract more value and take action faster.

Purple Book Community and ArmorCode Announce New Research, ‘The Rise of the AppSec Leader’ (BusinessWire) Eighty-four percent recognize the role of the AppSec leader as more important now than ever as organizations face growing challenges of AI-generated code and open source software.

Sentra Introduces Data Security for AI Agents Solution to Secure the Next Generation of Business Automation (Cision PR Newswire) /PRNewswire/ -- Sentra, the global leader in cloud-native data security for the AI era, today announced the launch of its Data Security for AI Agents solution,...

Huntress Empowers Businesses to Take Control of Their Identity Security with Enhanced Managed Identity Threat Detection & Response Solution (GlobeNewswire News Room) Huntress unveils newly enhanced Managed ITDR solution alongside new research on the growing threat of identity-based attacks....

OWASP BLADE: Business Logic Attack Definition Framework (OWASP BLADE: Business Logic Attack Definition Framework) The OWSAP Business Logic Attack Definition (BLADE) Framework, is an open-source knowledge-base created to help cybersecurity professionals fight cyber threats.

CrowdStrike Delivers Managed Threat Hunting Across Third-Party Data (CrowdStrike) Read this press release on CrowdStrike's delivery of the industry-first managed threat hunting across third-party data.

CrowdStrike Unleashes New Agentic, Outcome-Driven AI Innovations (CrowdStrike) Read this press release on how Charlotte AI unites intelligent automation with human expertise, accelerating detection, investigation and response.

Forescout Taps NVIDIA Accelerated Computing to Improve Critical Infrastructure Security (Forescout) The Forescout 4D Platform™ Integration with NVIDIA BlueField DPUs Accelerates Data Processing While Reducing the Number of Physical Appliances

New Rubrik Identity Resilience Designed to Mitigate the Most Targeted Point of Cyber Attacks (Rubrik) In a world of nonstop cyberattacks, Rubrik (NYSE: RBRK) today announced its newest upcoming solution, Identity Resilience, designed to secure the entire identity landscape alongside data. Identity Resilience aims to protect the most common entry points for attackers – human and non-human identities (NHIs) – to help organizations maintain operations with minimal downtime.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

RSA Conference 2025 (San Francisco, California, USA, Apr 28 - May 1, 2025) At RSAC 2025, you're not just attending a conference—you're stepping into a vibrant, thriving community of thinkers, innovators, and achievers. Though we come from different corners of the cybersecurity world, we are united by a common mission: to foresee risks, counter threats, and embrace the challenges ahead. Together, we shape the future of security. Together, we shine as one.

CYSAT (Paris, France, May 14 - 15, 2025) In today’s society, we heavily rely on space-based assets, and considering the continuously evolving cyber threats in the current geopolitical environment, securing space data is a major challenge. Since 2021, CYSEC has been organizing CYSAT to bring together all the players in the space cybersecurity domain.

CyberWiseCon Europe 2025 (Vilnius and virtual, Lithuania, May 21 - 23, 2025) CyberWiseCon is a premier IT security conference that brings together cybersecurity experts, industry leaders, and IT professionals from around the Europe.

NICE Conference (Denver, Colorado, USA, Jun 1 - 4, 2025) The NICE Conference is the annual convening of community members and thought leaders from education, government, industry, and non-profits to explore ways of developing a skilled cybersecurity workforce ready to meet the challenges of the future. This event provides an opportunity to share best practices from around the world and across sectors in order to build the workforce we need to confront cybersecurity risks today and in years to come.

2025 Space Regulatory Bootcamp (Albuquerque and Virtual, New Mexico, USA, Jun 10 - 11, 2025) ACSP's Bootcamps educate new and established space professionals on must-know fundamentals and arm them for success. The 2025 Space Regulatory Bootcamp, hosted in Albuquerque, New Mexico, is a two day comprehensive industry deep dive with advanced training and meaningful networking. Learn directly from leading subject matter experts on topics including space law, export controls, space telecommunications, government contracting, and more.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 04.29.25

Last chance to enjoy CISO Perspectives for free.

Live discussion: Strengthen Your Web App Defenses.

At a glance.

Spain and Portugal rule out cyberattack as cause of power outage.

Cyberattack against Marks & Spencer tied to Scattered Spider.

Rhysida ransomware group posts data allegedly stolen from Oregon's Department of Environmental Quality.

Notes.

Attacks, Threats, and Vulnerabilities

Trends

Marketplace

Products, Services, and Solutions

Events