In this month's newsletter:

Chinese hackers accessed US Treasury in 'major' cybersecurity incident
Get an inside look at UpGuard at our Weekly Product Deep Dive Webinar
Utilize our new AI-Risk Essentials Questionnaire to address key AI-security risks
Top 8 vendor monitoring solutions in 2025

Welcome to the January 2025 edition of What's New at UpGuard! As we kick off the new year, this newsletter is jam packed with highlights—including breaking cycbersecurity news, cutting-edge product improvements, and free cybersecurity resources for your organization.

Read on to stay up-to-date with everything UpGuard has to offer!

Security News Roundup

Chinese Hackers Accessed US Treasury Workstations in 'Major' Cybersecurity Incident

🇺🇸 United States | SecurityWeek | Government

Hackers remotely accessed US Treasury Department workstations and unclassified documents after compromising a cloud-based service operated by BeyondTrust. The incident has been attributed to a China state-sponsored APT actor.

Cybersecurity firm's Chrome extension hijacked to steal users' data

🌎 Global | Bleeping Computer | Technology

Cyberhaven, a data loss prevention company, disclosed a breach after a successful phishing attack on an administrator account for the Google Chrome store. At least five other Chrome extensions were also compromised in this coordinated attack.

Old BitLocker vulnerability exploited to bypass encryption on updated Windows 11

🌎 Global | Tech Spot | Vulnerabilities

Hackers identified an exploit in a previously fixed vulnerability, bypassing many security features to compromise a fully-updated Windows 11 setting. Originally identified in 2022, this BitLocker Security Feature Bypass Vulnerability is still being leveraged in new attack campaigns.

Company Highlights

UpGuard BreachSight is now Breach Risk

You may have noticed our attack surface management platform has a new name! UpGuard BreachSight is now UpGuard Breach Risk, but don't worry—nothing has changed on the platform. We're working to align our cybersecurity products as we introduce exciting new updates, releases, and features this year. Interested in learning more about Breach Risk? Read more here.

Join us for UpGuard's Weekly Product Deep Dives

Curious about how UpGuard can help you elevate your third-party risk management? Join our Weekly Product Deep Dive Webinar for an interactive walkthrough of some of our platform's most powerful features, as well as Q&A with our product experts. Learn how to streamline your TPRM program and reduce cyber risks by attending our next free weekly webinar. Register here.

Product Updates

Users can now address key AI-related security risks with our AI-Risk Essentials Questionnaire. Based on emerging frameworks and best practices, this questionnaire ensures that AI systems provided by your vendors align with your risk tolerance, regulatory requirements, and operational resilience goals. We've also updated our Multi-Framework Questionnaire to include AI-specific questions and risks for vendors building or integrating AI systems. Learn more here.

New Verified Vulnerability for Mitel MiCollab CVE-2024-35286

We've added CVE-2024-35286 to our platform's list of verified vulnerabilities. This vulnerability allows an unauthenticated attacker to conduct a SQL injection attackdue to insufficient sanitization of user input. Users can view verified vulnerabilities in their risk profile and use them in remediation and risk waiver workflows.

Updated Ability to Set Default Permissions for New Users

Admin users can now configure the default set of permissions granted when a user is automatically added to their account, adjusting the default read-only access. If your organization has the Manage roles feature, you can also create new custom roles, which will be available in the Default setting dropdown menu.

Ready to see UpGuard in action?

Start Your 7 Day Free Trial