- Engineer — Act: CISA KEV-listed RCE in WatchGuard Firebox is now confirmed ransomware-leveraged; patch Firebox to the latest available version immediately and audit edge-device logs for signs of pre-patch compromise.
- SOC/IR — Act: Ransomware actors exploiting an RCE in a perimeter firewall is an assume-breach scenario — sweep for lateral movement originating from WatchGuard appliances and hunt for IOCs tied to this campaign since CISA’s December KEV addition.
- Leader — Act: Ransomware exploitation of a perimeter firewall is board-level risk; confirm this week whether WatchGuard Firebox is in your estate, verify emergency patching is underway, and brief leadership before an incident forces the conversation.