New research from Palo Alto Networks has revealed that cybercriminals are taking advantage of high-profile sporting events to conduct scams, phishing, and malware attacks through suspicious domain registrations and other malicious activities. Domain Abuse Surges During Paris Olympics For example,…
Category: Information Security Buzz
It’s Beginning to look a lot like Grinch bots
Almost three-quarters (71%) of UK consumers believe that nefariously named ‘Grinch bots’ are ruining Christmas by acquiring all the best presents. This was one of the findings of new research from Imperva, a Thales company. Grinch bots are automated programs…
Not Every Gift Comes from Santa Claus: Avoiding Cyber Scams This Holiday Season
The holidays are a time for joy, connection, and giving, but amidst the festive cheer lies a growing cyber threat that’s anything but jolly. As we fill our online shopping carts with gifts for loved ones, scammers are busy crafting…
How to Defend Against High Cyberthreat Activity During the Holidays
Imagine if Santa’s workshop were brought down by a ransomware attack in December — children around the world would be disappointed. A multitude of holidays between Thanksgiving and New Year’s creates an optimal opportunity for cybercriminals, with government reports confirming…
SpartanWarriorz Phish Kits: Uncovered
Cybercriminals are using phish kits developed by authoring group SpartanWarriorz to target over 300 global brands, new research from Fortra has revealed. Attackers using the kits tend to target financial institutions in North America and Europe, retail, delivery services, and…
No User Interaction, no Alerts: Azure MFA Cracked in an Hour
If you look inside your cybersecurity Christmas cracker later this month to discover a riddle asking – What takes an hour to execute, requires no user interaction, and doesn’t generate any notifications? You might be spitting your sherry out when…
Glazed and Confused: Krispy Kreme Battles Cyberattack
Doughnut giant Krispy Kreme has disclosed a cyberattack that happened on 29 November and has led to significant operational disruptions, particularly affecting its online ordering system in parts of the United States. The doughnut chain disclosed the cyberattack in an 8-K…
FCC Responds to telecoms attack dubbed ‘worst in our nation’s history’
The FCC has released a statement calling for urgent actions to strengthen U.S. communications systems against cyberattacks in light of recent foreign intrusions, with ‘state-sponsored cyber actors from the People’s Republic of China’’ directly named as a perpetrator. In the…
Phishers Nabbed in International Sting
In a major international crackdown, Belgian and Dutch authorities, supported by Europol and Eurojust, have dismantled a phone phishing gang responsible for large-scale financial fraud across Europe. The operation resulted in eight arrests and significant seizures. Action Day Results Law…
Massive Data Breach Hits Senior Dating Website, Exposing Over 765,000 Users
The 40+ dating platform Senior Dating has been the victim of a data breach, compromising the personal information of 765,517 users. The breach, linked to an exposed Firebase database, has raised serious concerns about protecting sensitive data in online matchmaking…
Cybersecurity in the Digital Frontier: Reimagining Organizational Resilience
The digital landscape has become treacherous, and organizations must constantly reinvent their defensive strategies. Gone are the days of simple firewalls and basic security protocols. Today’s cyber challenges demand a revolutionary approach that combines strategic thinking, technological innovation, and human…
Massive Data Harvesting Operation Exploits AWS Customer Misconfigurations
Independent cybersecurity experts Noam Rotem and Ran Locar have exposed a sophisticated cyber operation targeting vulnerabilities in public websites, leading to unauthorized access to sensitive customer data, infrastructure credentials, and proprietary source code. The researchers collaborated with the AWS Fraud…
Ransomware Disrupts Operations at Leading Heart Surgery Device Maker
Artivion, a prominent manufacturer of heart surgery devices, disclosed a significant ransomware attack that has disrupted its operations. The incident involved the encryption and acquisition of company files, prompting Artivion to take immediate measures to contain the breach. According to…
50% of M&A Security Issues are Non-Malicious
More than half of M&A security incidents in 2024 were non-malicious, resulting instead from integration-induced investigation delays, policy and compliance challenges, and issues baselining internal tools, a report from ReliaQuest has revealed. These findings suggest that inherited assets present a…
Brand Impersonations Surge 2000% During Black Friday
Phishing scams impersonating major holiday brands like Walmart, Target, and BestBuy increased by more than 2000% during Black Friday week, new research from Darktrace has revealed. These findings come as part of a wider increase in phishing activity during the…
The Next Frontier: Predictions Driving Tech and Security in 2025
As we unveil the third edition of Information Security Buzz’s 2025 predictions, we are thrilled by the incredible response. In this installment, we dive even deeper into the evolving cybersecurity landscape, where advancements in AI, quantum computing, and cloud technologies…
Data Governance and the Mandate for Tougher Security in 2025
The challenges around data governance are evolving rapidly, driven by the rapid adoption of generative AI, stringent regulatory requirements, and heightened cybersecurity risks. As we approach 2025, organisations are realising that traditional approaches to data governance are no longer sufficient.…
The EU Cyber Resilience Act: Enhancing Digital Security in the AI Era
On 20 November 2024, the EU Cyber Resilience Act (CRA) was published in the Official Journal of the EU, kicking off the phased implementation of the CRA obligations. The European Union has introduced the Cyber Resilience Act to bolster the cybersecurity…
New Report Highlights Open Source Trends and Security Challenges
The Linux Foundation, in collaboration with the Laboratory for Innovation Science at Harvard, has unveiled a comprehensive study, “Census III of Free and Open Source Software – Application Libraries (Census III).” The report identifies the most widely used free and…
Developing Responsible AI in 2025: The Path to Trust and Compliance
Artificial intelligence (AI) is transforming industries at an unprecedented pace, offering solutions to some of the world’s most complex challenges. But with its immense potential come significant risks—bias, discrimination, data privacy breaches, and security vulnerabilities. Governments worldwide have enacted AI…
Kiteworks 2025 Cybersecurity Report Unveils Critical Trends and Strategies for Protecting Sensitive Data
As 2025 approaches, the cybersecurity landscape is set to face a new slew of challenges fueled by evolving threats and stringent regulations. According to Kiteworks’ newly released “2025 Forecast for Managing Private Content Exposure Risk” report, there are 12 transformative…
Avoiding cyber complacency as a small business
As a small business owner reading endless news stories about cyberattacks against well-known enterprise names, it can be easy to think it won’t happen to you. In reality, hackers don’t discriminate: businesses of all sizes can and do find themselves…
Critical Vulnerabilities Found in Veeam Service Provider Console
Two critical vulnerabilities (CVE-2024-42448 and CVE-2024-42449) have been identified in Veeam Service Provider Console (VSPC), prompting an urgent call for users to update their systems. According to Veeam’s latest security advisory, the vulnerabilities affect all builds of VSPC versions 7…
SmokeLoader Malware Targets Companies in Taiwan
A sophisticated cyberattack using the SmokeLoader malware targeted multiple industries in Taiwan in September 2024, new research from FortiGuard Labs has revealed. SmokeLoader is notorious for its versatility, advanced evasion techniques, and modular design, which allow it to perform a…
SpyLoan Apps: The New Face of Financial Exploitation
The McAfee mobile research team has identified a significant global rise in predatory loan applications, commonly referred to as SpyLoan apps, which primarily target Android users. These applications, classified as potentially unwanted programs (PUP), utilize social engineering tactics to manipulate users…
As Device Dependency Grows, So Do the Risks
It’s no stretch to say connected devices are taking over the world. In every sector and country, endpoints are driving newfound efficiencies inside the smart home, office, and warehouse. These devices – from sensors to smart meters and industrial controllers…
Anticipating Change: Key Cybersecurity Trends to Watch in 2025
Thanks to the fantastic response we received, we’re excited to continue our exploration of the evolving cybersecurity landscape. As we approach 2025, the challenges and threats facing businesses, governments, and individuals are becoming increasingly complex. Following our initial insights, we…
Navigating Australia’s Evolving Cyber Threat Landscape: Insights on AI-Driven Scams, Ransomware, and more
Cyber threats evolve rapidly in our current digital world—and Australia is no exception. AI-driven scams, ransomware, and social engineering tactics are only getting more sophisticated. In this interview with Gaidar Magdanurov, President of Acronis, we explore the latest trends in…
APIs and the Demise of Direct Database Access: A Safer World?
When they’re building an application, developers have to consider how that application will connect to the data sources that will help it function. To date, the most common options have been to build and use an API that connects to…
Iranian “Dream Job” Cyber Campaign Targets Aerospace Sector
In a new and sophisticated cyber campaign dubbed the “Iranian Dream Job Campaign,” the Iranian threat group TA455 is using deceptive job offers to infiltrate the aerospace industry, ClearSky Cyber Security reported. The campaign relies on distributing SnailResin malware, which…
Google Debuts Online Fraud and Scams Advisory
Google has launched a regular fraud and scams advisory to combat the growing volume and sophistication of online scams. Multinational crime entities are increasingly using advanced technology and complex schemes to target victims worldwide. To protect users and the broader…
Ransomware Attacks on Healthcare Sector Surge in 2024
Ransomware attacks on the healthcare sector surged in 2024, analysis from SafetyDetectives reveals. The year has already seen 264 attacks on healthcare providers by September, nearly surpassing the 268 attacks recorded for all of 2023. Escalating Cyber Threats SafetyDetectives argues…
Examining the Role of Asset Recovery in Safeguarding Data: Ten Points IT Professionals Should Know
As cybersecurity threats evolve, it’s become even more important to protect data at every point in its life cycle — including on decommissioned assets that may still hold sensitive information. IT asset recovery, the practice of securely managing retired devices,…
Machine Identities Outnumber Human Ones: 69% of Companies Face Rising Security Risks”
Sixty-nine percent of organizations now manage more machine identities than human ones, with nearly half handling ten times as many. Machine identities—ranging from applications, databases, and bots to IoT devices and SaaS tools—are becoming more prevalent, with nearly three-quarters (72%)…
Cyware Attains FedRAMP Ready Status
Cyware, a provider of threat intelligence management and cyber fusion solutions, has attained Federal Risk and Authorization Management Program (FedRAMP) Ready status. With FedRAMP Ready status, Cyware says it is positioned to accelerate the authorization process, facilitate broader implementation of…
Horizon3.ai Debuts NodeZero Kubernetes Pentesting to Strengthen Critical Infrastructure Defense
Horizon3.ai, a provider of autonomous security solutions, has debuted NodeZero Kubernetes Pentesting, a feature designed to empower entities with advanced offensive security capabilities within Kubernetes environments. Available to all NodeZero users, this tool helps security teams simulate real-world attacks within…
Volt Typhoon Gang and Botnet Re-Emerge Targeting Critical Infrastructure
Volt Typhoon, a stealthy and resilient state-sponsored cyber-espionage group has re-emerged as a severe and silent threat to critical infrastructure worldwide, demonstrating increased sophistication and determination. In January this year, the US Department of Justice said it disrupted the People’s…
Sophisticated Infostealers Top Malware Rankings
Cybercriminals are leveraging increasingly sophisticated attack methods, including the strategic deployment of infostealers, research from Check Point Software’s October 2024 Global Threat Index reveals. The report also notes that the ‘Lumma Stealer’ malware, which leverages fake CAPTCHA pages to infiltrate…
New Tool “GoIssue” Unleashes Advanced Phishing Threat to GitHub Users
A newly discovered tool named “GoIssue,” marketed on a prominent cybercrime forum, is bringing fresh concerns to the cybersecurity community with its ability to mine email addresses from GitHub profiles and send bulk phishing emails to targeted inboxes. Discovered by…
New Wave of Phishing Attacks Exploits Microsoft Visio Files for Two-Step Credential Theft
Researchers at cybersecurity firm Perception Point have identified a new type of two-step phishing attack that exploits Microsoft Visio files (.vsdx) and Microsoft SharePoint. This strategy uses the .vsdx format to embed malicious URLs, effectively bypassing conventional security measures and…
New Phishing Campaign Delivers Advanced Remcos RAT Variant
Fortinet’s FortiGuard Labs has uncovered a sophisticated phishing campaign distributing a new variant of the Remcos Remote Access Trojan (RAT). The campaign begins with a phishing email containing a malicious Excel document designed to exploit vulnerabilities and deliver the Remcos…
Six Questions to Ask Your Would-Be SIEM Provider
Gathering and deciphering data insights for usable solutions forms the foundation of a strong cybersecurity strategy. However, organizations are swimming in data, making this task complex. Traditional Security Information and Event Management (SIEM) tools are one method that organizations have…
An Ultimate Guide to Exchange Server Database Recovery
Databases in Exchange Server play a crucial role in the smooth functioning of an organization as all the critical information, such as emails, contacts, tasks, notes, calendars, etc., is stored in them. Sometimes, databases become corrupted due to server failure…
Malicious PyPI Package Steals AWS Credentials
A malicious package on the Python Package Index (PyPi) has been quietly exfiltrating Amazon Web Service credentials from developers for over three years, a new report from cybersecurity researchers at Socket has revealed. The package “fabrice” is a typosquat of the…
Ciso Playbook: Cyber Resilience Strategy
In this era of advanced technology, cyber threats are on the rise, and they’re evolving with cutting-edge finesse. As we continue to witness a rise in the frequency and sophistication of cyber-attacks, recent hacker incursions into high-profile enterprises like Equifax, Uber, Facebook, and Capital…
Credential Abuse Market Flourishes Despite Setbacks
Despite the recent takedown of the RedLine malware variant and a crackdown on “problematic” Telegram content, the credential abuse market is as vibrant as ever. This was revealed by new research from ReliaQuest. According to the company, cybercriminals appear undeterred by…
Large-Scale Phishing Campaign Exposed Using New Version of Rhadamanthys Malware
Check Point Research has uncovered a sophisticated phishing campaign that uses a newly updated version of the Rhadamanthys Stealer, a notorious malware that steals sensitive data from infected systems. The campaign, identified as “Rhadamanthys.07,” deceives victims through emails that appear…
Network Penetration Testing in the Age of Automation: A Conversation with an Ethical Hacker
For decades, businesses have employed penetration testing, simulating cyberattacks on their IT systems—to uncover vulnerabilities that hackers could exploit. Traditionally, this process was manual, requiring skilled professionals to probe defenses meticulously, look for any chink in the security armor, and…
New Malware Campaign Targets Windows Users Through Gaming Apps
A new malware strain, Winos4.0, is actively used in cyberattack campaigns. Discovered by FortiGuard Labs, this advanced malicious framework, which evolved from the infamous Gh0strat, is equipped with modular components enabling a range of malicious activities on compromised devices. These…
JFrog Uncovers Critical Vulnerabilities in Machine Learning Platforms
Software supply chain company JFrog revealed on Monday that it had discovered 22 software vulnerabilities across 15 machine learning-related open-source software projects. The results, presented in JFrog’s latest ML Bug Bonanza blog, shed light on the security challenges organizations face…
Fry Another Day: The Hidden Surveillance Powers of Smart Appliances
A new investigation by the consumer advocacy group Which? reveals a worrying trend: everyday smart devices, from air fryers to televisions, are collecting excessive amounts of user data, often with no clear explanation or transparency on how it will be…
Google Cloud to Mandate Multi-Factor Authentication for All Users by 2025
In a move to improve account security, Google Cloud has announced that it will require multi-factor authentication (MFA) for all users worldwide by the end of 2025. This decision aims to enhance security, especially as cloud environments become increasingly vulnerable…
CISA’s Cyber Hygiene Services
We all know CISA as the governing agency for federal cybersecurity and the national operating hub for critical infrastructure security. But what are the free critical cyber hygiene services provided by the Cybersecurity and Infrastructure Security Agency (CISA), and how…
Google’s Big Sleep AI Tool Finds Zero-Day Vulnerability
In a major breakthrough, Google’s AI-powered research tool, Big Sleep, discovered a vulnerability in SQLite, one of the most widely used database engines in the world. The Google Project Zero and Google DeepMind teams recently shared this milestone in an…
Attackers Exploit DocuSign API to Send Fraudulent Invoices, Bypassing Security Filters
Attackers are leveraging DocuSign’s API to distribute authentic-looking invoices at scale, exploiting legitimate business channels to bypass traditional security measures. Using paid DocuSign accounts and customized templates, malefactors mimic reputable companies, such as Norton, to send convincing invoices through the…
500,000 Affected in Columbus Data Breach, Followed by Lawsuit Against Security Researcher
In July 2024, the City of Columbus, Ohio, experienced a ransomware attack that exposed the personal information of approximately 500,000 residents. While officials quickly took systems offline to contain the incident and reported halting the attack before ransomware encryption could…
AI & API Security
Artificial Intelligence (AI) and Application Programming Interfaces (APIs) are integral to technological advancement in today’s digital age. As gateways allowing different software applications to communicate, APIs are crucial in AI’s evolution, powering everything from cloud computing to machine learning models.…
Proactive Ways To Bridge The Cybersecurity Talent Gap
The need for robust cybersecurity measures has never been greater in a time when cyber threats are evolving rapidly, and breaches have become an inevitability for businesses in every sector. Managing this complex threat landscape requires advanced solutions and skilled experts who…
Advanced Variant of FakeCall Malware Targets Mobile Users with Sophisticated Vishing Attacks
Mobile security company Zimperium’s zLabs team has uncovered an advanced variant of the FakeCall malware that employs “Vishing” (voice phishing) to deceive mobile users into sharing sensitive information, such as login credentials and banking details. This sophisticated malware campaign highlights…
Microsoft Warns of Major Credential Theft by Chinese Hackers Via Covert Network Attacks
Since August last year, Microsoft has identified a surge in intrusion activity with attackers using sophisticated password spray techniques to steal credentials from multiple customers. The company has linked this wave of attacks to a network of compromised devices known…
The Invisible Shield: Beyond Wrap-around Cyber Protection
Cyber threats are evolving at an unprecedented pace. AI-driven malware, sophisticated phishing schemes, and adaptive attack methods are outmaneuvering standard security measures. Traditional defenses are no longer sufficient. Businesses need an invisible shield that offers comprehensive, proactive protection to stay…
Redline Stealer Dominates: VIPRE’s Q3 Report Highlights Sophisticated BEC Tactics and Evolving Malware Trends
VIPRE Security Group’s Q3 2024 Email Threat Trends Report reveals the increasing sophistication of email-based threats, particularly business email compromise (BEC) and malspam campaigns, which have intensified across industries. Analyzing 1.8 billion emails globally, of which 208 million were identified…
Russian Actor Midnight Blizzard Conducts Massive Spear-Phishing Campaign Using RDP Files
Microsoft Threat Intelligence has issued an alert following the detection of a sophisticated spear-phishing campaign orchestrated by the Russian threat actor known as Midnight Blizzard. Active since 22 October this year, this operation has distributed spear-phishing emails aimed at government…
A Halloween Haunting: Unveiling Cybersecurity’s Scary Stats
This Halloween, it’s not just ghosts and goblins sending chills down our spines—this season brings some truly spine-tingling stats about the state of cybersecurity in 2024. In our “Spooky Security Stats” roundup, we’re revealing findings from several reports published over…
3 Key DSPM Takeaways from the Latest Gartner Report
Data Security Posture Management (DSPM) is a rising star in the cybersecurity world, and for good reason. With so many diverse environments, complex pipelines, and random repositories, important data often ends up in the wrong places, or worse – lost…
US Joins International Crackdown on RedLine and META Infostealers
The US Department of Justice, in collaboration with international law enforcement partners, has launched a major crackdown on RedLine and META, two of the world’s most prolific infostealer malware variants responsible for stealing sensitive data from millions of victims worldwide.…
Cyware and ECS Partner to Enhance Government Cybersecurity with Advanced Threat Intel Exchange
Cyware, a provider of threat intelligence management and cyber fusion solutions, has teamed up with ECS, a player in technology solutions for US public sector and defense organizations, to bolster government cybersecurity through an enhanced Intel Exchange platform. This partnership…
Malicious npm Packages Found to Distribute BeaverTail Malware
Three malicious packages uploaded to the npm registry were discovered to harbor BeaverTail, a JavaScript downloader and information stealer associated with a continuing North Korean campaign known as Contagious Interview. The packages—passports-js, bcrypts-js, and blockscan-api collectively amassed 323 downloads, and…
Combatting Human Error: How to Safeguard Your Business Against Costly Data Breaches
It’s no secret that human error accounts for a disproportionate number of data breaches. Last year, it accounted for 74%; this year, the Verizon 2024 Data Breach Investigations Report noted that it rose to 76% per the same criteria. States…
Enhancing Email Security: The Pivotal Role of AI in Defending Against Evolving Cyber Threats
Malware‘s rise presents a rigorous challenge for organizations, meaning their security teams must remain ever-vigilant. Unfortunately, business email compromise (BEC), which takes advantage of communication channel vulnerabilities, has become a significant attack vector that has impacted many organizations. For example,…
Safely Scale Your Data Center With These Five Cybersecurity Measures
Datacenter cybersecurity is critical because of the vast industries using these facilities. Healthcare, finance, education, and other sectors rely on this storage solution to protect records and sensitive information. Companies may adjust their storage needs based on demand, so understanding…
US Energy Sector Faces Growing Cybersecurity Threats
A recent cybersecurity report by SecurityScorecard and KPMG reveals that the US energy sector remains at high risk of cyber threats, particularly from third-party sources. This analysis, evaluating 250 top US energy companies, highlights vulnerabilities across the energy supply chain—from…
A Dangerous Alliance: Scattered Spider, RansomHub Join Forces
ReliaQuest has released a detailed investigation into a cyber intrusion that impacted a manufacturing company in October 2024. The attack has been attributed with high confidence to the predominantly English-speaking cyber collective “Scattered Spider,” now partnering with the notorious “RansomHub”…
Cybersecurity Awareness Month 2024: Wrapping Up with Actionable Insights to Secure Our World
As we wrap up our Cybersecurity Awareness Month series, we’d like to extend a huge thank you to everyone who contributed their insights and expertise. The response to this series has been incredible, and we’re grateful for the valuable advice…
WhatsApp Debuts New Features for Contact Management with Enhanced Privacy Protections
WhatsApp is rolling out a series of updates aimed at making it easier for users to manage their contacts privately across devices. Previously, users could only add contacts via their mobile device by entering a phone number or scanning a…
The Lazarus APT Strikes Again: New Zero-Day Exploit Targets Investors through DeFi Games
In a new and sophisticated campaign, the infamous North Korean-affiliated Lazarus APT group and its BlueNoroff subgroup have once again proven their expertise in exploiting zero-day vulnerabilities. The group, known for targeting financial institutions, governments, and even cryptocurrency platforms, has…
CISA Proposes New Security Measures to Safeguard Sensitive Data from Adversary States
The US Cybersecurity and Infrastructure Security Agency (CISA) has announced a set of proposed security requirements aimed at protecting Americans’ sensitive personal data and government-related information from foreign adversaries. These measures are part of the implementation of Executive Order 14117,…
Five Ways to Improve Your Security Posture, Fast
Cybersecurity has become a critical concern for businesses of all sizes. With cyber threats becoming more sophisticated and frequent, the cost of cybersecurity breaches continues to rise dramatically. In fact, the Netwrix 2024 Hybrid Security Trends Report found that 79% of organizations…
Cyber Attackers Set Their Sights on the Manufacturing Industry
The manufacturing industry has emerged as the most targeted by cyber attacks, accounting for more than 25% of incidents across the top 10 sectors, with 45% of these involving malware. The industry’s appeal to malefactors has grown, largely due to…
Attackers Exploit Roundcube Webmail Vulnerability
Cybersecurity experts from Positive Technologies’ Security Expert Center (PT ESC) have uncovered an exploit targeting Roundcube Webmail, an open-source email client written in PHP. According to the researchers, Roundcube’s “extensive functionality and the convenient access it gives users to email accounts via a browser—without the…
Cyber Attackers Set Their Sights on Manufacturing
The manufacturing industry has emerged as the most targeted by cyber attacks, accounting for more than 25% of incidents across the top 10 sectors, with 45% of these involving malware. The industry’s appeal to malefactors has grown, largely due to…
Google Mandiant: Time-to-Exploit Falls, Zero Day Exploits Rise
A staggering 70% of exploited vulnerabilities in 2023 were leveraged as zero days, meaning threat actors exploited the flaws in attacks before the impacted vendors knew of the bug’s existence or had been able to patch them. In addition, the…
NHS App to Provide Full Medical Records Under Digital Overhaul Plan
The NHS App is set to undergo a major transformation, with plans to make full medical records, test results, and doctor’s letters accessible to patients across England. This initiative is part of a new 10-year strategy aimed at revolutionizing how…
Nearly half (44%) of CISOs Fail to Detect Breaches
A staggering 44% of CISOs were unable to detect a data breach in the last 12 months using existing security tools. Moreover, nearly three-quarters (70%) of CISOs feel their current security tools are ineffective at detecting breaches due to limited…
Fortra Report Reveals Surge in Domain Impersonation, Social Media Attacks, and Dark Web Activity
Fortra’s Q2 2024 report has unveiled a series of concerning trends in the digital threat landscape, analyzing hundreds of thousands of attacks on enterprises, their employees, and brands across domains, social media, counterfeit websites, and the dark web. The findings…
These 7 Practices Are Building Cybersecurity Safeguards in the Construction Industry
Cybersecurity is becoming necessary across multiple industries as they adapt to a technologically driven society. Construction is a perfect example, as most operations a decade ago would consist of human labor. Technological advancements explicitly built for the sector — like…
ConfusedPilot Exposes Vulnerability in AI Systems Used by Major Enterprises
A novel attack, dubbed ConfusedPilot, has been discovered, targeting widely used Retrieval Augmented Generation (RAG)-based AI systems such as Microsoft 365 Copilot. This method allows malicious actors to manipulate AI-generated responses by introducing malicious content into documents referenced by these…
Building Digital Resilience: Insider Insights for a Safer Cyber Landscape
Due to the tremendous feedback we received on our first two articles, which shared invaluable cybersecurity advice from industry experts, we’re excited to continue the series with even more insights. In this third installment, we delve deeper into the theme…
The Battle for Identity Security: Key Insights from the ManageEngine Identity Security Survey 2024
Identity management, particularly privileged identity management, forms the backbone of an effective cybersecurity strategy. The ManageEngine Identity Security Survey 2024 sheds light on the current state of identity management, gathering insights from security decision-makers worldwide. The Importance of Identity Management…
AI Companies Are Not Meeting EU AI Act Standards
Leading artificial intelligence (AI) models are failing to meet key European regulatory standards in areas such as cybersecurity resilience and prevention of discriminatory outputs, according to data obtained by Reuters. The EU AI Act is being implemented in phases over…
Iranian Cyber Actors Compromise Critical Infrastructure Using Brute Force and Credential Access Tactics
Iranian cyber actors are targeting organizations across critical infrastructure sectors, using brute force techniques to obtain user credentials and sell sensitive information on cybercriminal forums. The attacks have affected healthcare, government, information technology, engineering, and energy sectors. This was announced…
Stronger Together: AI and Human Collaboration in the Battle Against Evolving Threats
Sophisticated and complex threats fuel rapid and profound change in the cybersecurity landscape. Malicious actors are exploiting advanced technologies, like artificial intelligence (AI), to launch more targeted, destructive attacks that are harder to detect. As yesterday’s security solutions battle to…
Chinese Researchers Use Quantum Computer to Hack Secure Encryption
In a potentially concerning advancement for global cybersecurity, Chinese researchers have introduced a technique leveraging D-Wave’s quantum annealing systems to breach traditional encryption, which may hasten the timeline for when quantum computers could pose a genuine threat to widely used…
E.U. Court Restricts Meta’s Use of Facebook Data for Targeted Advertising
The Court of Justice for the European Union (CJEU) has ruled that Meta Platforms, the owner of Facebook, must minimize the amount of people’s data it uses for personalized advertising. “An online social network such as Facebook cannot use all…
New Threat Actor Tool EDRSilencer Repurposed for Malicious Use
The Trend Micro Threat Hunting Team has identified an alarming new trend in cyber attacks: malefactors are adopting EDRSilencer, a red team tool designed to interfere with endpoint detection and response (EDR) systems. Originally developed as a tool for security…
Enhance Cyber Resilience to Secure Your Organization
As Cybersecurity Awareness Month unfolds with the continuing theme from 2023, “Secure Our World,” it’s a timely reminder of the importance of taking daily actions to safeguard your organization’s digital ecosystem. In an increasingly interconnected world, where devices, data, and…
TrickMo’s Latest Trick – Stealing PINs and Unlock Patterns
Mobile device and app security firm Zimperium has discovered a new capability in the notorious banking Trojan TrickMo. Some of the samples the company analyzed are able to steal a device’s unlock pattern or PIN. This new feature enables the…
Veeam Vulnerability Actively Exploited by Ransomware Gangs
NHS England’s National Cyber Security Operations Centre (CSOC) has issued a high-severity cyber alert in response to the active exploitation of a critical vulnerability, CVE-2024-40711, in Veeam’s Backup & Replication software. This alert follows Veeam’s security bulletin from September, which…
Check Point’s threat index emphasizes the shift towards AI-driven malware tactics in the current cyber landscape
Several interesting trends are emerging in the cybersecurity landscape, particularly the emergence of artificial intelligence (AI)-driven malware, as well as the ongoing dominance of ransomware threats. Threat actors have started using GenAI as part of their attack infrastructure, which illustrates…
OpenAI says bad actors are using ChatGPT to write malware, sway elections
Cybercriminals are increasingly exploiting OpenAI’s model, ChatGPT, to carry out a range of malicious activities, including malware development, misinformation campaigns, and spear-phishing. A new report revealed that since the beginning of 2024, OpenAI has disrupted over 20 deceptive operations worldwide,…