This week was a financial one. Polymarket, Binance and others took real losses, and the pattern behind them isn't new. Everybody focuses on workstation compromise, but basic update maintenance and business standards failures can bring down even large companies.
Your vendors are part of your attack surface. Polymarket lost $2.7M because one of its vendors, DebugBear, had its DNS taken over, and the script Polymarket loaded on its site was swapped for a malicious one. Your security boundary is not limited to your own infrastructure. It includes every vendor whose code, service or data you depend on. Know your dependencies and watch them. Don't wait for a vendor to tell you there's a problem, the same way you don't want your customers to be the ones telling you. A DNS change on a vendor you depend on can be spotted quickly with basic free tools.
The devices that run your business are targets too. C3RB3R ransomware is hitting Synology NAS boxes through a flaw that was patched in December 2024, almost two years ago. More than 380,000 of them are reachable from the internet. Nobody runs EDR on a NAS, and for a lot of businesses that one box is both the file server and the backup. If it gets encrypted, both are gone at once.
None of this is advanced. It's patching, knowing what you depend on, and having visibility beyond your own laptops and servers. Do your basic security, know your dependencies, and expand your visibility to them.
If you want a simple way to watch a vendor's DNS, run this every 5 minutes with cron or a scheduled task:
dig +short NS vendor.com > now.txt
diff -q last.txt now.txt || echo "vendor.com nameservers changed"
mv now.txt last.txtReplace vendor.com with each vendor whose scripts or services you load, and send that alert to email or Slack.
Basic hygiene is huge for businesses, and it's also the least fun part of security. The speed of AI makes everything feel complicated, and sometimes it is. But week after week, we still see the easy fixes ignored: the patch that sat for two years, the vendor nobody was watching, the backup that lived on the same box it was supposed to protect. Get those right first.
Matt Lucas
Founder, RedEye Security
