F6 описала новый сценарий атак.

Учителя пишут экзамены, а кто-то читает их раньше срока.

Один петаFLOP в корпусе на 140 ватт.

Пока модели учатся писать рекомендации для ядра, комьюнити спорит, можно ли ему верить.

С 1 сентября в России заработает сервис “вторая рука”.

Обновиться или смотреть, как свой VPN работает на чужих.

H.R. 4988: рецепт XVIII века против пиратов XXI-го.

Отчёт о новой опасной уязвимости в FreePBX.

Пока вы спорили, какой облачный сервис лучше, хакеры уже изучили их все и нашли самый слабый.

При этом как в мире, так и в России малый и средний бизнес (СМБ) подвержен в целом тем же угрозам, что и крупный.

В целом опрошенные нами эксперты согласны с тем, что угрозы для СМБ-компаний в целом те же, что и для крупных.

С другой стороны, продукты для СМБ всегда являются набором компромиссов как для заказчика, так и для разработчика.

Другим направлением, по его мнению, является автоматизация и возможность работать с минимальным вовлечением специалиста и с низкой квалификацией.

Они могут расти от антивируса, и, хотя и не обеспечивают уровень защиты, необходимый для крупного бизнеса, вполне достаточны для малого.

Контроль настроек, критически важных для безопасности виртуальной среды, осуществляется при помощи политик безопасности, реализованных в vGate.

Функция доступна только для vGate Enterprise Plus и vGate Premium.

ОтчётностьФункция доступна в vGate Enterprise, Enterprise Plus и vGate Premium.

Вкладка «Отчёты» в vGate 5.1Формирование сводок в формате PDF осуществляется через веб-консоль vGate.

SSL-сертификаты в vGate 5.1Архитектура vGate 5.1vGate включает в себя следующие компоненты:Сервер авторизации.

В эфире AM Live эксперты рассказали, с чего начать и в каком направлении двигаться, чтобы стать востребованным на рынке труда ИБ.

Денис Батранков, директор по развитию бизнеса, группа компаний «Гарда»Блиц: топ-3 профессий в сфере ИБ, в которые стоит идтиСергей Зеленин:«‎Аналитик SOC, инженер информационной безопасности, пентестер».

Как быстро войти в ИБ с зарплатой 150 000 рублейЛев Николаев напомнил, что всё ещё актуальна проблема с импортозамещением.

Андрей Иванов добавил, что и в вузе, и в компании человек вынужден постоянно учиться, так как отрасль развивается.

Сергей Кулаков:«Диверсификация нужна не только в том, чем ты занимаешься, но и в том, как ты мыслишь».

Российские исследования подтверждают растущую роль мессенджеров в бизнесе.

Влияние мессенджеров на переговоры согласно исследованию Pact и «Дела PR»В маркетинговом контексте ценится высокая открываемость сообщений в мессенджерах.

Это и утечки данных, и социальная инженерия, и отсутствие централизованного контроля.

В 2022 году в даркнете продавали номера телефонов 500 млн пользователей из 84 стран, полученные из популярного мессенджера.

Это будет гарантировать доступ к корпоративной переписке в любое время и в любом месте, что упростит взаимодействие между сотрудниками.

Дополнительные риски связаны и с временным доступом для подрядчиков и партнёров — их действия зачастую невозможно проконтролировать в должной степени.

Автоматизирует рутинные задачи по управлению привилегированным доступом, позволяет отслеживать действия пользователей в сессиях и фиксировать нарушения в реальном времени.

Стартовая страница Infrascope версии 1.3 (для сравнения)Встроенная система разграничения доступа получила расширенные возможности: реализована поддержка политик доступа для отдельных групп пользователей.

Объединение созданных политик в группы в Infrascope 25.1Добавлена поддержка отечественных криптографических алгоритмов для скремблирования данных, хранимых в СУБД.

Управлен…

Российские и белорусские вендоры, объединяя компетенции, способны создавать конкурентоспособные решения в области информационной безопасности и корпоративного ПО.

AWS и Microsoft Azure также приостановили регистрацию новых клиентов и продажи своих сервисов в Республике Беларусь и России.

Санкции против Республики Беларусь24 февраля 2025 года вступил в силу новый пакет санкций ЕС против Республики Беларусь, содержащий строгие ограничения в цифровой сфере.

Особое внимание уделяется подготовке кадров: на базе ведущих вузов России и Республики Беларусь реализуются образовательные программы в сфере кибербезопасности и ИТ-разработки.

В долгосрочной перспективе углубление сотрудничества между Росс…

ВведениеК выбору системы управления привилегированным доступом (PAM) в 2025 году нельзя подходить только с точки зрения соответствия требованиям регуляторов.

Андрей Лаптев добавил, что для продвижения в инфраструктуре и закрепления злоумышленники часто используют штатные инструменты, входящие в состав операционных систем, и инструментарий администраторов.

Александр Махновский:«‎Системный администратор пользовался одной и той же учётной записью для администрирования домена, входа на личный компьютер и на публично доступные ресурсы компании.

Игорь Еньков считает, что в первую очередь требуется интеграция с многофакторной аутентификацией, если в компании используется свой формат, отличающийся …

Если же речь заходит о высокопрофессиональных группировках, то фишинг (как правило, целевой) становится основным методом проникновения и закрепления в целевой инфраструктуре.

Использование нейросетевых инструментов позволяет добиться более высокой убедительности писем и с высокой степенью правдоподобия мимикрировать под легитимные ресурсы.

Не случайно, что именно тема обучения персонала стала одной из ключевых в ходе конференции «ИБ без фильтров», которую организовала «Контур.Эгида».

Также значительной статьей затрат для авиакомпании может стать восстановление работы систем и данных, в том числе с бумажных носителей.

В частности, они должны уметь определять недопустимые события, понимать, к…

Например, Владимир Дрюков, директор центра противодействия кибератакам Solar JSOC, показал это на примере статистики кибератак против российских компаний в 2022 году.

Привлекательность компаний для кибератак как критерий оценки угроз ИБКак же можно оценить готовность российских компаний к противостоянию кибератакам?

Открытый формат «Кибериспытания» позволяет оценить защищенность компаний с точки зрения общей структуры бизнеса: люди, процессы, ИТ-инфраструктура.

Проведенные кибериспытания показали, что нынешний уровень защищенности российских компаний невысокий, несмотря на регуляторные меры и значительную поддержку со стороны государства.

Вы выполняете задачу, не осознавая, что не знаете сп…

В приложении MAX наряду с функциями обмена сообщениями и мультимедиа присутствуют механизмы сбора данных и системы контроля.

Цифры при этом разные: у WhatsApp* 85 разрешений, у Telegram — 71, у MAX — 63.

В целом, набор разрешений в MAX соответствует его функциональности и не выходит за рамки стандартных практик для мессенджеров.

Количество разрешений у MAX не выходит за рамки обычной практики.

WhatsApp* и Telegram запрашивают ещё больше разрешений, и это не мешает им занимать первые строчки по популярности в магазинах приложений.

Brave даже блокирует создание снимков экрана при задействовании новой функции Windows Recall, которую уличили в «сливе» важных личных данных, в том числе платежных.

Обеспечивает удаление данных в одно касание (пользователи других браузеров могут воспользоваться ею с помощью дополнения для Firefox и Chromium).

Так, Iron не хранит и не отправляет отчеты об ошибках, не создает уникальных ключей при инсталляции, не «запоминает» время установки.

Некоторые из данных функций, например, отправка данных для автодополнения на серверы Google, замечены и у других браузеров на кодовой базе Chromium.

Внешний вид LibreWolfОднако разработчики изъяли многие функции, которые критиковали за «слив» данных и со…

Атаки стали массовыми, автоматизированными и дешёвыми в исполнении: вымогатели, фишинг и отказ в обслуживании (DDoS) доступны даже начинающим хакерам.

Алексей Киселёв добавил, что на Западе для обеспечения ИБ давно и успешно используются решения класса «детектирование и реагирование на конечных точках» (EDR), которые дают инструменты для обработки и расследования инцидентов.

Артём Голощапов, менеджер по продуктам ИБ и ПО, OCSСергей Мишин рассказал о программе для производителей сельхозтоваров, в том числе для малого и среднего бизнеса.

Алексей Киселёв уверен, что сервисы и аутсорсинг — единственный путь к получению реальной экспертной защиты от сложных атак для большинства компаний малого и…

ВведениеМобильные телефоны, ставшие неотъемлемой частью нашей жизни, открыли новые возможности не только для пользователей, но и для мошенников.

В маркетплейсах можно найти предложения как от крупных и известных компаний, так и от небольших разработчиков.

Обзор сервисов для защиты от спам-звонковПомимо приложений, отечественный рынок предлагает широкий выбор сервисов, которые включают защиту от спама в качестве дополнительной услуги (как правило, от операторов связи).

Бесплатная защита от спама и телефонных мошенников доступна всем абонентам, также можно подключить платную версию для записи и расшифровки звонка.

«Защита от спама» от «Т-Мобайла»Сервис «Защита от спама» является частью беспла…

Поэтому давайте подробно разберём, как она работает, и как можно избежать потенциальных проблем.

Как работает eBPF на примере Hello WorldДля понимания, как работает eBPF, рассмотрим примитивную программу, печатающую Hello World в Stacktrace.

Немного о защите: в eBPF есть механизм Linux LSM — это специально расставленные разработчиками Linux ловушки в коде ядра.

Создаем в файловой системе файл, заполняем его случайными данными и в бесконечном цикле открываем и закрываем.

eBPF — это не только средство наблюдения, но и потенциальный вектор атаки при неправильной настройке.

Я Полина Спиридонова, product owner двух продуктов для подготовки специалистов по защите информации — Standoff Cyberbones и Standoff Defend.

Команды SOC могут тренироваться на Standoff Defend не подвергая опасности свою «боевую» инфраструктуру и не тратя время на создание экспериментальных площадок.

Как проходят тренировки на Standoff DefendЧто входит в продукт:🔹 Регулируемые атакиРегулируемые атаки на Standoff Defend запускаются с помощью специального модуля Archer, который симулирует пользовательскую активность и действия хакеров.

Реальные атаки — реальные навыкиЕще очень хочется поделиться историей о том, как мы смогли упаковать сложные атаки в понятный для клиентов месседж.

Наш продукт …

🔷 Почему это важно для Solana-DeFiВыход RWA в Solana — это не просто «новый тип токенов», а фундаментальное изменение профиля ликвидности в экосистеме.

Для Solana это шаг к статусу инфраструктуры не только для Web3-стартапов, но и для глобальной финансовой системы.

И всё это — в Solana, с низкими комиссиями, атомарными расчётами и бесшовной интеграцией в уже существующие DeFi-протоколы.

Но вопрос, который беспокоит меня уже сейчас:Какие стратегии с RWA на Solana будут самыми прибыльными и устойчивыми в горизонте 1–2 года?

Какие стратегии с RWA на Solana, на ваш взгляд, могут выстрелить сильнее всего — кредит, хедж, корзины активов, страховки или что-то ещё?

Упрощенная схема работы фаззинг-движкаОсобенно это заметно при использовании persistent mode — режима, при котором тестируемая функция многократно вызывается в одном процессе.

Структура массива argv представляет собой:argv[0] - имя программы Каждая строка ( argv[i] - параметр ) должна быть корректно нуль-терминированаТо есть содержимое из фаззера нужно нарезать на строки и в каждую добавить \0 .

Обычно используется в контейнерах (Docker, LXC), в браузерах (Chrome), и в фаззинге (чтобы "глушить" сеть или файл).

stdin используется в функциях стандартной библиотеки, которые читают данные из стандартного потока ввода:Построчно:fgets(buf, size, stdin); — читает строку.

fscanf(stdin, "%s", str);Б…

На практике же такой подход напоминает покупку самого дешёвого замка на дверь в криминогенном районе: кажется, что сэкономил, но на самом деле — заранее оплатил будущий взлом.

Ведь дело не в бюджетах как таковых.

Базовый минимум защиты: во что это упираетсяЛюбой бизнес должен выстроить фундаментальный периметр.

Стоимость: от 10 тыс.

Потери от простоя каждый бизнес рассчитывает индивидуально, в общем виде это стоимость часа предоставляемых услуг всем клиентам, умноженная на количество часов простоя, к которой прибавляем расходы на содержание инфраструктуры в это же время.

На этот раз вас ждет цикл статей на тему «eBPF глазами хакера».

В результате eBPF стал новым инструментом в арсенале продвинутых атак: в последние годы были зафиксированы примеры малвари, использующей eBPF (семейства Boopkit, BPFDoor, Symbiote и др).

Далее будет подробно рассмотрено внутреннее устройство eBPF и его использование «глазами хакера» – то есть, как злоумышленник может применять eBPF для наблюдения за системой, вмешательства в её работу и маскировки своего присутствия.

• Другие: eBPF интегрирован и в другие механизмы (например, perf events для профилирования, BPF-таймеры и др.

Поэтому актуальность своевременного обновления ядра и ограничения доступа к eBPF не менее важны, чем тех…

По данным Судебного департамента при Верховном Суде РФ, общее количество дел, связанных с охраной интеллектуальных прав, демонстрирует стабильный рост.

В 2021 году в федеральные арбитражные суды поступило 33 978 дел и присуждено к взысканию 4,7 млрд.

Авторские праваДела, связанные с авторскими правами, занимают значительное место в судебной практике: число таких дел увеличилось с 6 867 в 2021 году до 13 290 в 2024 году.

Смежные праваКоличество споров по смежным правам сравнительно невелико, всего 74 в 2024 году с присуждённой суммой взысканий 8 175 тыс.

Патентные праваПатентные споры составляют сравнительно небольшую часть судебной нагрузки — 106 дел в 2021 году и 203 дела в 2024 году.

В этом гайде разбираем установку и первичную инициализацию программно-аппаратного комплекса «Соболь» версии 4.5.

По умолчанию она отключена (ВЫКЛ) и автоматически сбрасывается при любых изменениях загрузки.

Общие параметры комплексаПервым шагом при настройке общих параметров комплекса «Соболь» является выбор режима идентификации: по умолчанию используется идентификация только по идентификатору, но можно включить и смешанный режим (идентификатор или логин).

По умолчанию — 8.

По умолчанию — выключено.

Компания Anthropic сообщает, что пресекла масштабную вредоносную операцию, в рамках которой, в июле 2025 года, злоумышленники использовали Claude для кражи персональных данных и вымогательства.

В опубликованном отчете Anthropic предупреждает, что инструменты на основе ИИ теперь широко применяются для совершения киберпреступлений и содействия мошенничеству.

Северокорейские хакеры задействовали Claude в рамках мошеннических схем, связанных с удаленными ИТ-сотрудниками.

ИИ применялся для создания детально проработанных фиктивных личностей с убедительными профессиональными биографиями и историями проектов, как в процессе трудоустройства, так и для помощи в повседневной работе в случае успешного…

ИБ-специалист обнаружил, что шесть популярнейших менеджеров паролей, которыми пользуются десятки миллионов людей, уязвимы перед кликджекингом, что позволяет атакующим похищать учетные данные, коды двухфакторной аутентификации и данные банковских карт.

Но клики по этим элементам попадают на скрытые элементы управления менеджером паролей, что приводит к заполнению форм конфиденциальной информацией.

Также исследователь продемонстрировал использование метода, при котором UI следует за курсором мыши, и в итоге любой клик пользователя, где бы он ни был, провоцирует автозаполнение данных.

В результате исследователь протестировал 11 парольных менеджеров на уязвимость перед кликджекингом и установил…

Команда Arch Linux сообщает, что уже больше недели отражает продолжительную DDoS-атаку, которая влияет на работу большинства ресурсов проекта.

Атака началась еще 16 августа, и из-за нее Arch User Repository (AUR), сайт Arch Linux, Wiki и форумы могут быть недоступны.

Хотя в минувшие выходные сервисы практически восстановили свою работоспособность, в настоящее время проблемы сохраняются и периодически работа ресурсов ухудшается, как видно на статус-странице проекта.

Также мы оцениваем провайдеров защиты от DDoS-атак, тщательно рассматривая такие факторы, как стоимость, безопасность и этические стандарты», — сообщает команда Arch Linux.

В настоящее время представители Arch Linux не раскрывают…

Сос­тояние гон­ки иног­да поз­воля­ет вме­шать­ся в алго­рит­мы обра­бот­ки дан­ных: от опла­ты кор­зины в интернет‑магази­не до механи­ки перевы­пус­ка API-клю­чей с повыше­нием при­виле­гий.

На при­мерах с HTTP/2 и single-packet attack я покажу, как пра­виль­но подоб­ранный момент ата­ки дает воз­можность «выр­вать­ся впе­ред на поворо­те» и бук­валь­но перепи­сать биз­нес‑логику при­ложе­ния.

Мы здесь можем пов­лиять толь­ко на пер­вый и вто­рой шаги, а имен­но изме­нение сос­тояния кор­зины и отправ­ку кор­зины на опла­ту.

Но что, если в нашей гон­ке мы запус­тим одновре­мен­но добав­ление товара в кор­зину и ее опла­ту?

Смо­жет ли веб‑сайт успеть до­бавить в кор­зину товар и одновре­ме…

Специалисты компании ESET обнаружили необычного вредоноса, который получил название PromptLock.

Невзирая на отсутствие фактических заражений, пример PromptLock показывает, что ИИ может существенно облегчать «работу» для киберпреступников.

Исследователи объясняют, что PromptLock использует модель gpt-oss-20b от OpenAI, которая является одной из двух бесплатных open-weight моделей, опубликованных компанией ранее в этом месяце.

Она работает локально на зараженном устройстве через Ollama API и «на лету» генерирует вредоносные Lua-скрипты.

PromptLock использует 128-битный алгоритм SPECK для шифрования файлов, а сам вымогатель написан на Go.

Сегод­ня мы с тобой пос­мотрим на оте­чес­твен­ную DCAP-сис­тему ком­пании «Сёр­чИнформ», которая дол­жна помогать в нелег­ком деле защиты информа­ции.

На той же панели, что и FileAuditor, который я буду тес­тировать, есть и дру­гие модули, так что гла­за понача­лу раз­бега­ются.

«Сёр­чИнформ FileAuditor» не стал исклю­чени­ем, и для поис­ка сек­ретных дан­ных нуж­но сна­чала задать пра­вила, на осно­вании которых и будет опре­делять­ся, что защищать тре­бует­ся, а что — нет.

Для это­го на левой панели ком­понен­та EndpointController есть раз­дел FileAuditor, а в нем — «Авто­мати­чес­кая клас­сифика­ция дан­ных».

Ана­логич­ным обра­зом работа­ют и руч­ные мет­ки, которые сох­раня­ются внут­…

Минцифры РФ подготовило второй пакет мер по борьбе с кибермошенниками.

К примеру, предлагается ограничить количество банковских карт — до 10 на человека и ввести уголовную ответственность за DDoS-атаки.

Можно будет отозвать согласие на обработку и подать жалобу на оператора персональных данных.

Операторов хотят обязать передавать в систему ГИС «Антифрод» данные о номерах, которые могут использоваться мошенниками, и в случае подтверждения — блокировать номер на 24 часа.

Появится новая статья 272.2 — «злостное воздействие на информационную систему, информационно-телекоммуникационную сеть, компьютерную информацию или сеть электросвязи».

Французская розничная сеть Auchan уведомила сотни тысяч клиентов о том, что их персональные данные были украдены во время хакерской атаки.

В уведомлениях, отправленных пользователям на прошлой неделе, компания сообщает, что утечка затронула имена, почтовые адреса, email-адреса, номера телефонов и номера карт лояльности.

Auchan заявляет, что предприняла все необходимые меры для локализации атаки и улучшения безопасности своих систем, а также уведомила правоохранительные и регулирующие органы об инциденте.

Представители ритейлера заявили французским СМИ, что инцидент затронул «сотни тысяч клиентов».

Однако в компании не сообщили, как именно произошла утечка данных, кто стоял за кибератакой, и…

Атака строится на использовании изображений с высоким разрешением, на которые наносят невидимые человеку промпты.

Вредоносные подсказки проявляются лишь при снижении качества и размеров изображения с помощью алгоритмов пересэмплинга.

Когда пользователи загружают изображения в ИИ-системы, те автоматически уменьшают картинки, снижая их качество ради повышения производительности и экономии затрат.

Однако исследователи подтвердили, что такие атаки работают против Google Gemini CLI, Vertex AI Studio (с бэкендом Gemini), в веб-интерфейсе Gemini, через API Gemini через LLM CLI, в Google Assistant на Android-смартфоне, а также в Genspark.

В рамках этого исследования в Trail of Bits разработали и оп…

Еще в 2023 году в магазине Google Play Store появились похожие требования, и в компании заявляют, что это привело к резкому снижению количества вредоносных программ и случаев мошенничества.

В Google сравнивают новые требования с проверкой документов в аэропорту.

Сообщается, что проведенный недавно анализ показал, что в сторонних источниках, приложения из которых устанавливаются с помощью sideloading’а, в 50 раз больше малвари, чем в приложениях, доступных в магазине Google Play.

Сначала требование о верификации вступит в силу в сентябре 2026 года в Бразилии, Индонезии, Сингапуре и Таиланде.

В Google объясняют, что эти страны «особенно затронуты такими формами мошеннических приложений».

Авто­ры GrapheneOS при­ложи­ли серь­езные уси­лия, что­бы человек не толь­ко вер­нул кон­троль над сво­им телефо­ном, но и не потерял в ком­форте.

Это и не уди­витель­но, пос­коль­ку плат­форма мак­сималь­но откры­тая, исходни­ки дос­тупны каж­дому, а зна­чит, и вари­антов одной и той же сис­темы с раз­ными модифи­каци­ями куда боль­ше.

Из недос­татков — при­ложе­ний мало, и все они доволь­но спе­цифи­чес­кие (сер­висы Google Play, Android Auto, GrapheneOS Auditor и подоб­ные).

Если ты решишь поль­зовать­ся Android Auto в GrapheneOS, прос­то имей в виду, что песоч­ница тут не нас­толь­ко неп­риступ­ная, как в слу­чае с дру­гими при­ложе­ниями.

Google Location API Сер­висы геоло­кации Google…

Критическая уязвимость в декстопной версии Docker для Windows и macOS позволяла скомпрометировать хост-систему, запустив вредоносный контейнер, даже если активна защита Enhanced Container Isolation (ECI).

«Вредоносный контейнер, работающий в Docker Desktop, мог получить доступ к Docker Engine и запустить дополнительные контейнеры без необходимости монтирования Docker socket, — объясняют разработчики Docker в бюллетене безопасности.

Так, ему удалось создать файл в домашней директории пользователя Windows, но этого нельзя достичь в macOS без разрешения пользователя.

«В Windows, поскольку Docker Engine работает через WSL2, атакующий может смонтировать с правами администратора всю файловую сист…

"Under President Trump, Treasury is committed to protecting Americans from these schemes and holding the guilty accountable."

The key players targeted include Vitaliy Sergeyevich Andreyev, Kim Ung Sun, Shenyang Geumpungri Network Technology Co., Ltd, and Korea Sinjin Trading Corporation.

The latest effort expands the scope of sanctions imposed against Chinyong Information Technology Cooperation Company in May 2023.

"Sinjin is a DPRK [Democratic People's Republic of Korea] company subordinate to the U.S.-sanctioned DPRK Ministry of People's Armed Forces General Political Bureau," the Treasury said.

"The company has received directives from DPRK government officials regarding the DPRK IT work…

The financially motivated threat actor known as Storm-0501 has been observed refining its tactics to conduct data exfiltration and extortion attacks targeting cloud environments.

"Storm-0501 has continued to demonstrate proficiency in moving between on-premises and cloud environments, exemplifying how threat actors adapt as hybrid cloud adoption grows," the company said.

These efforts ultimately enabled Storm-0501 to identify a non-human synced identity with a Global Admin role in Microsoft Entra ID on that tenant, and lacking in multi-factor authentication (MFA) protections.

The company said it has enacted a change in Microsoft Entra ID that prevents threat actors from abusing Directory Sy…

Cybersecurity company ESET has disclosed that it discovered an artificial intelligence (AI)-powered ransomware variant codenamed PromptLock.

Written in Golang, the newly identified strain uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts in real-time.

"PromptLock leverages Lua scripts generated from hard-coded prompts to enumerate the local filesystem, inspect target files, exfiltrate selected data, and perform encryption," ESET said.

"These Lua scripts are cross-platform compatible, functioning on Windows, Linux, and macOS."

"PromptLock uses Lua scripts generated by AI, which means that indicators of compromise (IoCs) may vary between execu…

Anthropic on Wednesday revealed that it disrupted a sophisticated operation that weaponized its artificial intelligence (AI)-powered chatbot Claude to conduct large-scale theft and extortion of personal data in July 2025.

"The actor targeted at least 17 distinct organizations, including in healthcare, the emergency services, and government, and religious institutions," the company said.

"The actor employed Claude Code on Kali Linux as a comprehensive attack platform, embedding operational instructions in a CLAUDE.md file that provided persistent context for every interaction."

Subsequently, the tool was employed to create customized ransom notes and multi-tiered extortion strategies based o…

A threat activity cluster known as ShadowSilk has been attributed to a fresh set of attacks targeting government entities within Central Asia and Asia-Pacific (APAC).

The hacking group shares toolset and infrastructural overlaps with campaigns undertaken by threat actors dubbed YoroTrooper, SturgeonPhisher, and Silent Lynx.

YoroTrooper was first publicly documented by Cisco Talos in March 2023, detailing its attacks targeting government, energy, and international organizations across Europe since at least June 2022.

The Singaporean company has assessed that the operators of the YoroTrooper group are fluent in Russian, and are likely engaged in malware development and facilitating initial ac…

For CISOs and security leaders like you, the challenge is clear: you don't want to slow AI adoption down, but you must make it safe.

If the app connects to any other systems in your environmentThe golden rule: context matters.

The golden rule: data needs a seatbelt.

Data protection is the backbone of safe AI adoption.

Safe AI adoption is not about saying "no."

A widespread data theft campaign has allowed hackers to breach sales automation platform Salesloft to steal OAuth and refresh tokens associated with the Drift artificial intelligence (AI) chat agent.

Salesloft, in an advisory issued August 20, 2025, said it identified a security issue in the Drift application and that it has proactively revoked connections between Drift and Salesforce.

"A threat actor used OAuth credentials to exfiltrate data from our customers' Salesforce instances," Salesloft said.

"Upon detecting the activity, Salesloft, in collaboration with Salesforce, invalidated active Access and Refresh Tokens, and removed Drift from AppExchange.

We then notified affected customers,…

Cybersecurity researchers have discovered five distinct activity clusters linked to a persistent threat actor known as Blind Eagle between May 2024 and July 2025.

These attacks, observed by Recorded Future Insikt Group, targeted various victims, but primarily within the Colombian government across local, municipal, and federal levels.

This is evidenced in their recent campaigns, which have involved banking-related keylogging and browser monitoring as well as targeting government entities using various remote access trojans (RATs).

The operations predominantly span Colombia, Ecuador, Chile, and Panama, and, in some cases, Spanish-speaking users in North America.

This setup is further enhance…

Citrix has released fixes to address three security flaws in NetScaler ADC and NetScaler Gateway, including one that it said has been actively exploited in the wild.

The vulnerabilities in question are listed below -CVE-2025-7775 (CVSS score: 9.2) - Memory overflow vulnerability leading to Remote Code Execution and/or Denial-of-Service(CVSS score: 9.2) - Memory overflow vulnerability leading to Remote Code Execution and/or Denial-of-Service CVE-2025-7776 (CVSS score: 8.8) - Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial-of-Service(CVSS score: 8.8) - Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial-of-Service CVE…

A team of academics has devised a novel attack that can be used to downgrade a 5G connection to a lower generation without relying on a rogue base station (gNB).

As a result, the threat model does not require knowledge of the UE's credentials to sniff uplink/downlink traffic or inject messages.

Such an attacker actively listens for any RAR message from the gNB, which provides the RNTI to decode further UE messages."

The Global System for Mobile Communications Association (GSMA), a non-profit trade association that represents mobile network operators worldwide and develops new technologies, has acknowledged the multi-stage, downgrade attack, and assigned it the identifier CVD-2024-0096.

"We …

Cybersecurity researchers are calling attention to a sophisticated social engineering campaign that's targeting supply chain-critical manufacturing companies with an in-memory malware dubbed MixShell.

The activity has been codenamed ZipLine by Check Point Research.

"What follows are weeks of professional, credible exchanges, often sealed with fake NDAs, before delivering a weaponized ZIP file carrying MixShell, a stealthy in-memory malware."

The LNK file responsible for initiating the execution chain also displays a lure document present in the ZIP file so as not to arouse the victim's suspicion.

That said, Check Point noted that not all ZIP files served from the Heroku domain are malicious…

If left to fester, it can have a significant impact on the mental health and even physical wellbeing of your kids.

In this context, it’s vital that you’re able to spot the warning signs of cyberbullying before things spiral out of control.

They may be embarrassed to tell you, or scared that it could make things worse.

If you’re keen to do so, remember to explain first to your child why you’re doing it.

A worst-case scenarioIf you discover your child is being bullied online, don’t panic.

The discovery of PromptLock shows how malicious use of AI models could supercharge ransomware and other threatsESET researchers have discovered what they called "the first known AI-powered ransomware".

“The PromptLock malware uses the gpt-oss-20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts on the fly, which it then executes.

PromptLock leverages Lua scripts generated from hard-coded prompts to enumerate the local filesystem, inspect target files, exfiltrate selected data, and perform encryption," said ESET researchers.

"The PromptLock ransomware is written in Golang, and we have identified both Windows and Linux variants uploaded to VirusTotal," added the …

Like many online phenomena, half-truths, myths and misconceptions can distort the reality of cyberbullying – and make it harder for you to make the right parenting decisions.

What happens online stays onlineLike many online trends, bullying is enabled by technology, but has its roots deep in the human psyche.

There are many reasons why kids may engage in bullying behavior, from peer pressure to low self-esteem, attention seeking and domestic abuse.

It’s almost impossible to identify online bulliesSometimes the cloak of anonymity online does empower bullies – just as it enables cybercrime to thrive.

Social media platforms are to blameSocial media and messaging platforms are often demonized f…

Keep regulators happy by demonstrating your commitment to fast, effective threat detection and response.

You need enterprise-grade SOC expertise that works like an extension of your IT security team to handle daily monitoring, proactive threat hunting and incident response.

You need enterprise-grade SOC expertise that works like an extension of your IT security team to handle daily monitoring, proactive threat hunting and incident response.

Leading research capabilities : Vendors that run renowned malware research labs will be best placed to stop emerging threats, including zero days.

: Vendors that run renowned malware research labs will be best placed to stop emerging threats, including z…

Unfortunately, scammers are preying on this need with increasingly sophisticated schemes on social media.

How do financial deepfake scams work?

Investment scams have been the biggest money-maker for cybercriminals for several years, according to the FBI.

These are usually deployed as a lure to trick the victim into either handing over personal information or direct them straight to an investment scam.

Others use deepfake Instagram stories featuring banking investment strategists to harvest personal info and/or lure them to investment scam-themed WhatsApp groups.

Does your business truly understand its dependencies, and how to mitigate the risks posed by an attack on them?

That’s because when bombs start dropping and the physical elements of war are under way, the misinformation spreading through digital channels becomes less important.

What this means for your businessMoving beyond the panel discussion, this raises a critical question for businesses: do they really understand their dependencies to be operationally resilient?

A real-world example might be an attack on a catering company that is contracted to feed patients in a hospital.

If we can’t get to a point of resilience, then we at least need to understand the risk posed by the dependencies.

First, they are more likely to be online than their older counterparts, according to a detailed study from the National Cybersecurity Alliance.

Gen Z (65%) along with Millennials (64%) are far more likely to report that they’re always connected.

And Gen Z (38%) and Millennials (36%) are more likely than the Silent Generation (23%) to have over 10 online accounts.

Yet at the same time, there are signs that Gen Z in particular has relatively poor digital hygiene.

Similarly, Gen Z and Millennials are more likely to lose money or data to online scams than Boomers and Silent Generation.

The attacks used spearphishing campaigns to target financial, manufacturing, defense, and logistics companies in Europe and Canada, ESET research findsESET researchers have uncovered a previously unknown vulnerability in WinRAR, actively being exploited by Russia-aligned group RomCom.

Tracked as CVE-2025-8088, the path traversal flaw affects WinRAR's Windows version and lets threat actors execute arbitrary code by crafting malicious archive files.

This marks at least the third time RomCom has leveraged a significant zero-day bug to conduct its operations, which underscores the group’s willingness to invest serious resources into its campaigns.

Meanwhile, if you use WinRAR, you should update…

This is at least the third time that RomCom has been caught exploiting a significant zero-day vulnerability in the wild.

On July 18 th , 2025, ESET researchers discovered a previously unknown zero-day vulnerability in WinRAR being exploited in the wild.

Upon further analysis, we found that the attackers were exploiting a previously unknown vulnerability affecting WinRAR, including the then-current version, 7.12.

Spearphishing emails observed in ESET telemetrySender Subject Attachment Simona <[email protected]> Experienced Web3 Developer – CV Attached for Consideration Eli_Rosenfeld_CV2 - Copy (100) - Copy - Copy - Copy - Copy - Copy - Copy.rar Eli_Rosenfeld_CV2 - Copy (100) - C…

When a cyber risk insurance quote lands on your desk and the premium is sky high, it’s natural to assume that the insurer is judging your environment to be high risk.

According to one of the many cyber insurance presentations at Black Hat USA 2025, the reason may not be so obvious: it may be that the insurer is limiting its risk exposure to a product or service you use, rather than finding a risk within your environment.

Yet my risk is the same to all insurers, and it’s likely that some insurers are capping their risk exposure to certain car manufacturers by pricing themselves out of the market.

As the cyber insurance and cybersecurity industries become further entwined, the data-based insi…

Read on to learn more about how adware works, and how you can keep your Android device adware-free.

In general, “adware” refers to any unwanted or potentially malicious software that displays intrusive ads on your device without your consent.

Adware developers have devised various ways to trick you into installing adware.

The adware accounted for over a quarter (28%) of detections across the Android adware category in H1 2025.

If you think your device may have already been compromised with adware, disconnect your device from Wi-Fi and mobile data.

The above was a comment from a policy panel at Black Hat USA 2025.

In part, it may be true, but improved cybersecurity posture is probably a result of financial risk.

Financial risk, including any regulatory issues, is often mitigated through insurance, and cyber risk is no different to the more traditional insurances a company holds, which is why the cyber risk insurance market continues to grow.

Another interesting comment from the panel concerned AI tools that provide confirmation of compliance with regulations and policy.

The takeaway from the panel session for me is that there will continue to be more policy and compliance requirements.

Another comment was more philosophical: do companies adapt to the culture of technology or do they adapt technology to their culture?

It’s important that companies think seriously about the culture question posed.

As AI becomes more widespread, the culture question becomes even more important.

It never mentions it was a link that the cybersecurity team failed to stop from getting to the user.

For me, though, the comment sparked yet another thought: do companies reduce their cybersecurity investment if all the threats are detected and nothing happens, ultimately increasing the risk of a cyber-incident?

They explain how this technique went from non-existent a year ago to the second most prevalent threat today, and why it’s so effective.

Moving from emerging threats to positive developments, the second segment highlights recent law enforcement disruptions of infostealers.

Aryeh and Ondrej discuss what made these infostealer-as-a-service ventures attractive to affiliates, the impact of the disruptions, and ESET research’s specific contributions to these takedowns.

If ransomware, infostelaers or new social engineering techniques are your thing, tune in and subscribe to the ESET Research Podcast.

For a more detailed version, download the ESET Threat Report H1 2025 from the Threat Reports secti…

Here's what you need to know about the inner workings of modern spyware and how to stay away from apps that know too muchThe world of espionage has gone digital.

Rather than involving trench coats and secret missions, it's now about silent cyberthreats that can turn phones into secret surveillance devices.

In this episode of Unlocked 403, the show's host Becks is joined by Lukas Stefanko, a malware researcher at ESET, to unpack the evolution of spying in the digital age and to shed light on the ins and outs of modern spyware.

Lukas also shares his findings about tools such as BadBazaar, discovered by ESET, as well as his best tips for spotting and getting rid of spyware.

Lukas is a familiar…

Cycuity introduces Radix-ST, a new product in its Radix portfolio of security solutions designed to leverage static analysis techniques to identify potential weaknesses early in the design cycle without requiring simulation or emulation.

As hardware designs become increasingly complex and security threats grow, semiconductor design teams require effective tools capable of proactively identifying issues during the development process.

Radix-ST processes the design RTL and produces a detailed report that highlights detected weaknesses, pinpoints their locations in the source code, and automatically maps them to the relevant hardware CWE (Common Weakness Enumeration) from the MITRE-maintained …

Scam calls have long been a problem for consumers and enterprises, but a new study suggests they may soon get an upgrade.

ScamAgent system architectureResearchers at Rutgers University have shown how LLM agents can be used to carry out convincing scam conversations that bypass current AI guardrails.

This is different from the single-prompt attacks that most AI safety controls are designed to stop.

Badhe’s work shows a gap in current AI safety designs.

While scam calls are still mostly carried out by people, the tools to automate them already exist and do not require advanced technical skills.

On one side, security teams want strong isolation and boundaries.

Observability becomes critical when dealing with AI workloads because the cost of getting it wrong is higher.

How does the move toward strategic maturity change the conversation between security teams, data scientists, and DevOps engineers?

Are there parallels between traditional manufacturing yield optimization and how we should approach AI infrastructure from both performance and security standpoints?

However, the optimization strategy for AI workloads depends entirely on what you’re producing.

Port cybersecurity is managed separately by various public, private, and non-governmental actors.

Without common procedures for identifying, communicating about, or mitigating cyber incidents, it is hard to mount a coordinated response.

While competition and self-preservation are natural, sharing insights about cyber incidents, vulnerabilities, or supply chain risks can help protect the entire transportation system.

Regulatory landscapeRegulatory authorities are responding to these challenges by strengthening the enforcement of cybersecurity standards in the maritime sector.

Companies are urged to perform regular cyber risk assessments, establish incident response plans, and evaluate third-…

When analysts at RH-ISAC found themselves spending 10 hours a week just collecting threat intelligence, they knew their process wasn’t sustainable.

After adopting Feedly Threat Intelligence, the team reduced that time by more than 70 percent, dropping from 10 hours to just 2-3 hours a week.

Feedly Threat Intelligence is designed to address that imbalance by automating data collection and adding context that helps analysts move faster from discovery to action.

Josh Darby MacLellan, a staff threat intelligence advisor at Feedly, has seen the shift first-hand.

For more specialized needs, the Feedly REST API provides programmatic access to enriched threat intelligence data, from article metadat…

Three in five CISOs see generative AI as a security risk, with many worried about sensitive data leaking through public tools.

Source: Proofpoint 2025 Voice of the CISO reportThe people problemFor another year, CISOs rank human behavior as the top vulnerability.

Even though many CISOs say their staff understand security best practices, training and insider risk programs are inconsistent.

Two-thirds of CISOs say the expectations placed on them are excessive.

Some see a future where the CISO role splits into separate tracks, one focused on defense and incident response and the other on governance and compliance.

How did UNC6395 access Salesforce instances?

To access the targeted organizations’ Salesforce instances, the threat actor first compromised OAuth (access) tokens associated with the Salesloft Drift, an AI-driven live chat tool integrated into the Salesloft revenue orchestration platform.

“We have determined that this incident did not impact customers who do not use our Drift-Salesforce integration.”Those who did should consider their Salesforce data compromised and have been urged to investigate and take remediation steps.

“On Aug. 20, 2025 Salesloft, in collaboration with Salesforce, revoked all active access and refresh tokens with the Drift application.

In addition, Salesforce removed th…

A new report from Anthropic shows how criminals are using AI to actively run parts of their operations.

Instead of using AI only for advice, the attacker gave it operational instructions, then relied on the model to make tactical and strategic choices.

The AI scanned networks, harvested credentials, built malware to avoid detection, and even analyzed stolen data to decide which ransom amounts to demand.

Anthropic documented attackers using AI for reconnaissance, privilege escalation, malware obfuscation, data theft, and ransom negotiations.

For example, one actor used AI to process massive amounts of stolen log data, turning it into behavioral profiles of victims.

Unit21 has launched its Build Your Own Agent (BYOA) for banks, credit unions, and fintechs.

The product enables risk and compliance teams to automate fraud and AML tasks, turning hours of manual data gathering, sorting and sifting into just minutes of analysis and action.

Unit21’s no-code BYOA integrates custom AI agents into your most common fraud and AML workflows, such as sanctions, transaction monitoring, and check fraud, while delivering structured, explainable insights directly into alert views.

Check fraud agent – Detect fraudulent checks by analyzing images and transaction data for altered details, duplicates, or mismatched information.

Unit21’s BYOA is available as a standalone or …

Qwiet AI has unveiled updates to its application security platform.

The latest release from Qwiet AI is a testament to its developer-first approach, as it integrates security into the tools engineers already use.

The prevalence of delayed patching, a key driver of breaches with up to 80% traced back to unpatched vulnerabilities, further underscores the need for a solution like Qwiet AI.

Qwiet AI is helping its customers overcome these hurdles by consolidating workflows and accelerating remediation.

With these updates now available, Qwiet AI continues to deliver on its mission to integrate security into the software development lifecycle.

Over 300,000 internet-facing Plex Media Server instances are still vulnerable to attack via CVE-2025-34158, a critical vulnerability for which Plex has issued a fix for earlier this month, Censys has warned.

About CVE-2025-34158Plex Media Server (PMS) is software that allows users to turn their Windows/Linux/macOS computer or their network-attached storage devices into a personal media server.

Upgrade your Plex Media ServerA few days after the security update was released, Plex took the unusual (but not unheard of) step of contacting users via email to urge them to upgrade to Plex Media Server version 1.42.1.10060 or later to fix the issue.

Last Friday, Censys flagged 428,083 devices – pred…

Where current thinking falls shortMost AI security discussions focus on one slice of the problem.

Two sides of the mapThe AI Security Map divides AI security into two linked parts.

“The AI Security Map correctly highlights that misuse can cause harm even when AI systems function as intended.

How to use the mapCISOs can apply the AI Security Map in several ways:Map known vulnerabilities in AI systems to possible stakeholder impacts.

“The first step to include both technical and societal impacts of AI security in a risk assessment is to map the AI functionality.

AI is moving faster than regulation, and that creates opportunities and risks for compliance teams.

How should compliance teams prepare for the fact that AI-specific regulations will likely differ across jurisdictions?

To prepare, compliance teams should adopt a “global-first, local-fast” mindset: establish a foundation in universal principles, then adjust quickly as local requirements emerge.

Since AI risks are inherently global, applying proven risk management practices (identify, assess, mitigate, and monitor) provides stability across geographies.

How does AI change the way compliance teams must handle data privacy requirements, especially with sensitive or regulated datasets?

This month’s roundup features exceptional open-source cybersecurity tools that are gaining attention for strengthening security across various environments.

Buttercup: Open-source AI-driven system detects and patches vulnerabilitiesButtercup is a free, automated, AI-powered platform that finds and fixes vulnerabilities in open-source software.

EntraGoat: Vulnerable Microsoft Entra ID infrastructure to simulate identity security misconfigurationsEntraGoat is a purpose-built tool that sets up a vulnerable Microsoft Entra ID environment to mimic real-world identity security issues.

LudusHound: Open-source tool brings BloodHound data to lifeLudusHound is an open-source tool that takes BloodHoun…

Nice indirect prompt injection attack:Bargury’s attack starts with a poisoned document, which is shared to a potential victim’s Google Drive.

(Bargury says a victim could have also uploaded a compromised file to their own account.)

But inside the document, Bargury hid a 300-word malicious prompt that contains instructions for ChatGPT.

Instead, the hidden prompt tells the LLM that there was a “mistake” and the document doesn’t actually need to be summarized.

But as per the prompt’s instructions, the URL now also contains the API keys the AI has found in the Google Drive account.

Here’s the story:Three Dutch security analysts discovered the vulnerabilities­—five in total—­in a European radio standard called TETRA (Terrestrial Trunked Radio), which is used in radios made by Motorola, Damm, Hytera, and others.

The encryption algorithm used for the device they examined starts with a 128-bit key, but this gets compressed to 56 bits before it encrypts traffic, making it easier to crack.

It’s not clear who is using this implementation of the end-to-end encryption algorithm, nor if anyone using devices with the end-to-end encryption is aware of the security vulnerability in them.

[…]The end-to-end encryption the researchers examined recently is designed to run on top of TE…

About Bruce SchneierI am a public-interest technologist, working at the intersection of security, technology, and people.

I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998.

I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc.

This personal website expresses the opinions of none of those organizations.

About Bruce SchneierI am a public-interest technologist, working at the intersection of security, technology, and people.

I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998.

I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc.

This personal website expresses the opinions of none of those organizations.

I’m Spending the Year at the Munk SchoolThis academic year, I am taking a sabbatical from the Kennedy School and Harvard University.

I will be spending the Fall 2025 and Spring 2026 semesters at the Munk School at the University of Toronto.

I will be organizing a reading group on AI security in the fall.

I will be working with Citizen Lab, the Law School, and the Schwartz Reisman Institute.

Posted on August 22, 2025 at 3:00 PM • 0 Comments

AI Agents Need Data IntegrityThink of the Web as a digital territory with its own social contract.

This will change many things about what’s often described as the “CIA triad” of digital security: confidentiality, integrity, and availability.

This will be critical in a world where AI agents don’t just answer our questions but act on our behalf.

Why Data Integrity Matters in AIFor AI systems, integrity is crucial in four domains.

How to Build AI Systems With IntegrityImagine an AI system as a home we’re building together.

Well, this is interesting:The auction, which will include other items related to cryptology, will be held Nov. 20.

RR Auction, the company arranging the sale, estimates a winning bid between $300,000 and $500,000.

“You could not make any mistake with 1,800 letters,” he said.

“It could not be repaired.”Mr. Sanborn’s ideal winning bidder is someone who will hold on to that secret.

He also hopes that person is willing to take over the system of verifying possible solutions and reviewing those unending emails, possibly through an automated system.

The likes of Cisco have deployed AIops in a conversational interface that admins can use to prompt for information about system performance.

In this work, we perform the first security analysis of AIOps solutions, showing that, once again, AI-driven automation comes with a profound security cost.

We demonstrate that adversaries can manipulate system telemetry to mislead AIOps agents into taking actions that compromise the integrity of the infrastructure they manage.

To counter this threat, we propose AIOpsShield, a defense mechanism that sanitizes telemetry data by exploiting its structured nature and the minimal role of user-generated content.

Ultimately, this work exposes AIOps as an emer…

Zero-Day Exploit in WinRAR FileA zero-day vulnerability in WinRAR is being exploited by at least two Russian criminal groups:The vulnerability seemed to have super Windows powers.

It abused alternate data streams, a Windows feature that allows different ways of representing the same file path.

The exploit abused that feature to trigger a previously unknown path traversal flaw that caused WinRAR to plant malicious executables in attacker-chosen file paths %TEMP% and %LOCALAPPDATA%, which Windows normally makes off-limits because of their ability to execute code.

More details in the article.

Posted on August 19, 2025 at 7:07 AM • 0 Comments

About Bruce SchneierI am a public-interest technologist, working at the intersection of security, technology, and people.

I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998.

I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc.

This personal website expresses the opinions of none of those organizations.

About Bruce SchneierI am a public-interest technologist, working at the intersection of security, technology, and people.

I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998.

I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc.

This personal website expresses the opinions of none of those organizations.

Porn sites are hiding code in .svg files:Unpacking the attack took work because much of the JavaScript in the .svg images was heavily obscured using a custom version of “JSFuck,” a technique that uses only a handful of character types to encode JavaScript into a camouflaged wall of text.

Once decoded, the script causes the browser to download a chain of additional obfuscated JavaScript.

The final payload, a known malicious script called Trojan.JS.Likejack, induces the browser to like a specified Facebook post as long as a user has their account open.

“This Trojan, also written in Javascript, silently clicks a ‘Like’ button for a Facebook page without the user’s knowledge or consent, in this…

LLM Coding Integrity BreachHere’s an interesting story about a failure being introduced by LLM-written code.

This is an integrity failure.

Specifically, it’s a failure of processing integrity.

And while we can think of particular patches that alleviate this exact failure, the larger problem is much harder to solve.

Posted on August 14, 2025 at 7:08 AM • 0 Comments

AI Applications in CybersecurityThere is a really great series of online events highlighting cool uses of AI in cybersecurity, titled Prompt||GTFO.

Videos from the first three events are online.

And here’s where to register to attend, or participate, in the fourth.

Some really great stuff here.

Posted on August 13, 2025 at 12:28 PM • 0 Comments

Noah Michael Urban of Palm Coast, Fla. pleaded guilty in April 2025 to charges of wire fraud and conspiracy.

In November 2024 Urban was charged by federal prosecutors in Los Angeles as one of five members of Scattered Spider (a.k.a.

That phishing spree netted Urban and others access to more than 130 companies, including Twilio, LastPass, DoorDash, MailChimp, and Plex.

King Bob constantly bragged on the Com about stealing unreleased rap music recordings from popular artists, presumably through SIM-swapping attacks.

The Star Fraud SIM-swapping group gained the ability to temporarily move targeted mobile numbers to devices they controlled by constantly phishing employees of the major mobile pr…

A 22-year-old Oregon man has been arrested on suspicion of operating “Rapper Bot,” a massive botnet used to power a service for launching distributed denial-of-service (DDoS) attacks against targets — including a March 2025 DDoS that knocked Twitter/X offline.

Indeed, Rapper Bot was reportedly responsible for the March 10, 2025 attack that caused intermittent outages on Twitter/X.

The complaint notes the DCIS got involved because several Internet addresses maintained by the DoD were the target of Rapper Bot attacks.

A subpoena to Google showed the defendant searched security blogs constantly for news about Rapper Bot, and for updates about competing DDoS-for-hire botnets.

The government sta…

Undeterred by security controls at these trading platforms that block users from wiring funds directly out of accounts, the phishers have pivoted to using multiple compromised brokerage accounts in unison to manipulate the prices of foreign stocks.

Merrill said he has tracked recent ramp-and-dump activity to a bustling Chinese-language community that is quite openly selling advanced mobile phishing kits on Telegram.

Merrill said that in many ways the ramp-and-dump scheme is the perfect crime because it leaves precious few connections between the victim brokerage accounts and the fraudsters.

These technicians were needed to respond in real time to victims who were supplying the one-time code…

Microsoft today released updates to fix more than 100 security flaws in its Windows operating systems and other software.

Microsoft first warned about this bug on Aug. 6, saying it affects Exchange Server 2016 and Exchange Server 2019, as well as its flagship Exchange Server Subscription Edition.

The attack exploits a weakness in “delegated Managed Service Account” or dMSA — a feature that was introduced in Windows Server 2025.

Another critical patch involves CVE-2025-53733, a vulnerability in Microsoft Word that can be exploited without user interaction and triggered through the Preview Pane.

The reason is that after the Patch Tuesday on October 14, 2025, Microsoft will stop shipping free …

A new documentary series about cybercrime airing next month on HBO Max features interviews with Yours Truly.

The Lizard Squad later acknowledged that the stunt was planned to call attention to their new DDoS-for-hire service, which came online and started selling subscriptions shortly after the attack.

That incident was widely reported to have started with a Twitter post from the Lizard Squad, after Smedley mentioned some upcoming travel plans online.

But according to Smedley and Finnish investigators, the bomb threat started with a phone call from Kivimäki.

In April 2024, Kivimäki was sentenced to more than six years in prison after being convicted of extorting Vastaamo and its patients.

Since the Europol announcement, the XSS forum resurfaced at a new address on the deep web (reachable only via the anonymity network Tor).

One of the oldest Russian-language cybercrime forums was DaMaGeLaB, which operated from 2004 to 2017, when its administrator “Ar3s” was arrested.

Lockbitsupp didn’t share why he wanted Toha’s details, but he maintained that Toha’s real name was Anton Avdeev.

The ad listed the contact person as Anton Avdeev and gave the contact phone number 9588693.

However, N0kl0s also appears to be a lifelong Russian resident, and in any case seems to have vanished from Russian cybercrime forums several years ago.

Here’s a closer look at the social engineering tactics and remarkable traits of this sprawling network of more than 1,200 scam sites.

The gaming sites all require users to create a free account to claim their $2,500 credit, which they can use to play any number of extremely polished video games that ask users to bet on each action.

Those who deposit cryptocurrency funds are soon asked for additional payments.

However, any “winnings” displayed by these gaming sites are a complete fantasy, and players who deposit cryptocurrency funds will never see that money again.

Thereallo said the operators of this scam empire appear to generate a unique Bitcoin wallet for each gaming domain they deploy.

An Internet search for this email address reveals a humorous blog post from 2020 on the Russian forum hackware[.

]biz reference the technical contact of “Justy John” and the email address [email protected].

A search at DomainTools found [email protected] has been registering one-off phishing domains since at least 2012.

]biz, all of which at one point included the email address [email protected].

The same Nigerian phone number shows up in dozens of domain registrations that reference the email address [email protected], including 26i3[.

In an advisory about the SharePoint security hole, a.k.a.

The Cybersecurity & Infrastructure Security Agency (CISA) concurred, saying CVE-2025-53770 is a variant on a flaw Microsoft patched earlier this month (CVE-2025-49706).

Microsoft notes the weakness applies only to SharePoint Servers that organizations use in-house, and that SharePoint Online and Microsoft 365 are not affected.

“It is critical that affected servers rotate SharePoint server ASP.NET machine keys and restart IIS on all SharePoint servers.

This threat is already operational and spreading rapidly.”Microsoft’s advisory says the company has issued updates for SharePoint Server Subscription Edition and SharePoint Server 2019,…

As first reported by Wired, the researchers discovered that the weak password used by Paradox exposed 64 million records, including applicants’ names, email addresses and phone numbers.

Paradox.ai acknowledged the researchers’ findings but said the company’s other client instances were not affected, and that no sensitive information — such as Social Security numbers — was exposed.

“We are confident, based on our records, this test account was not accessed by any third party other than the security researchers,” the company wrote in a July 9 blog post.

Still, a review of the exposed passwords shows they included the Vietnamese administrator’s credentials to the company’s SSO platform — parad…

On July 13, Mr. Elez committed a code script to GitHub called “agent.py” that included a private application programming interface (API) key for xAI.

GitGuardian’s systems constantly scan GitHub and other code repositories for exposed API keys, and fire off automated alerts to affected users.

The code repository containing the private xAI key was removed shortly after Caturegli notified Elez via email.

However, Caturegli said the exposed API key still works and has not yet been revoked.

“If a developer can’t keep an API key private, it raises questions about how they’re handling far more sensitive government information behind closed doors,” Caturegli told KrebsOnSecurity.

Authorities in the United Kingdom this week arrested four alleged members of “Scattered Spider,” a prolific data theft and extortion group whose recent victims include multiple airlines and the U.K. retail chain Marks & Spencer.

The FBI warned last month that Scattered Spider had recently shifted to targeting companies in the retail and airline sectors.

The NCA said the defendants were charged in cyberattacks against Marks & Spencer, the U.K. retailer Harrods, and the British food retailer Co-op Group.

The bigger fish netted as part of the Scattered Spider dragnet is Thalha Jubair, a U.K. man whose alleged exploits under various monikers have been well-documented in stories on this site.

In…

Microsoft today released updates to fix at least 137 security vulnerabilities in its Windows operating systems and supported software.

While not listed as critical, CVE-2025-49719 is a publicly disclosed information disclosure vulnerability, with all versions as far back as SQL Server 2016 receiving patches.

This pre-authentication vulnerability affects any Windows client machine running Windows 10 1607 or above, and all current versions of Windows Server.

Microsoft also patched at least four critical, remote code execution flaws in Office (CVE-2025-49695, CVE-2025-49696, CVE-2025-49697, CVE-2025-49702).

CVE-2025-47178 involves a remote code execution flaw in Microsoft Configuration Manager…

But a new report finds the accused continues to operate a slew of established accounts at American tech companies — including Facebook, Github, PayPal and Twitter/X.

It is generally illegal for U.S. companies or individuals to transact with people sanctioned by the Treasury.

However, as Mr. Lizhi’s case makes clear, just because someone is sanctioned doesn’t necessarily mean big tech companies are going to suspend their online accounts.

Mr. Lizhi also maintains a working PayPal account under the name Liu Lizhi and username “@nicelizhi,” another nickname listed in the Treasury sanctions.

Another active Facebook account clearly connected to Lizhi is a tourism page for Ganzhou, China called “E…

Cephalus is a relatively new ransomware operation that emerged in mid-2025, and has already been linked to a wave of high-profile data leaks. Read more about it in my article on the Fortra blog.

All this and much more is discussed in the latest edition of “The AI Fix” podcast by Graham Cluley and Mark Stockley.

Hosts:Graham Cluley:@grahamcluley.com @[email protected]Mark Stockley:@ai-fix-mark.bsky.socialEpisode links:Support the show:You can help the podcast by telling your friends and colleagues about “The AI Fix”, and leaving us a review on Apple Podcasts or Podchaser.

If you would like to further support the podcast, and gain access to ad-free episodes, become a supporter by joining The AI Fix Plus!

Follow us:Follow the show on Bluesky, or subscribe for free in your favourite podcast app such as Apple Podcasts or Spotify, or visit our website for more information.

Follow Graham …

In the case of K-Pop star Jung Kook, the identity theft is thought to have taken place after he enlisted for his mandatory South Korean military service.

It has been reported that Jung Kook's Big Hit Music agency were quick thinking enough to spot the payout and have the funds returned.

After the Big Hit Music agency filed a law suit, the shares allegedly sold by the hacker to the third party have now been returned to Jung Kook.

Investigators say that the suspected hacker was tracked with the assistance of Interpol and Thai authorities, after it was determined he had entered Thailand in April.

Headlines in South Korea related to cybercrime have become common place in South Korea, with a mas…

A 26-year-old hacker, who breached websites in North America, Yemen, and Israel, and stole the details of millions of people has been sent to prison.

Al-Tahery Al-Mashriky was arrested in August 2022 by members of the National Crime Agency (NCA) in Rotherham, South Yorkshire, after he was linked to the Yemen Cyber Army hacking group through social media and email accounts.

The Yemen Cyber Army first emerged ten years ago, in the wake of the outbreak of the Yemeni civil war.

The Yemen Cyber Army also leaked login credentials, thousands of emails, documents, emails, presentations, and spreadsheets that they had stolen in the attack.

“Al-Mashriky’s attacks crippled the websites targeted, causi…

So it probably didn't seem so strange that an array of cybersecurity news outlets announced last week that Europol was offering a reward of up to $50,000 for information about two senior members of the Qilin ransomware gang.

As Bleeping Computer reports, a new Telegram channel called @europolcti was created earlier this month and that is where the fake news of the $50,000 reward was posted rather than on Europol's website, or official social media accounts.

A reward of up to $50,000 is offered for information that directly leads to the identification or location of these administrators.

So, why exactly did someone post news of a fake bounty for information leading to members of the Qilin ra…

Pakistan Petroleum Limited (PPL), a major producer of oil and gas in the country, was hit by the Blue Locker ransomware that targeted parts of its IT infrastructure, impacting the company's IT systems and financial operations.

Like other ransomware, Blue Locker encrypts the files of impacted organisations, and demands that a ransom be paid in exchange for a decryption key.

Specifically, Blue Locker can be recognised by its trait of appending the extension .blue to the filenames of encrypted data.

In an advisory published on its website, PPL described bow it had detected that ransomware had targeted parts of its IT infrastructure on 6th August.

The company said that it had received a ransom …

In episode 431 of the “Smashing Security” podcast, a self-proclaimed crypto-influencer calling himself CP3O thought he had found a shortcut to riches — by racking up millions in unpaid cloud bills.

All this and more is discussed in the latest edition of the “Smashing Security” podcast by cybersecurity veterans Graham Cluley, joined this week by special guest Allan “Ransomware Sommelier” Liska.

Support the show:You can help the podcast by telling your friends and colleagues about “Smashing Security”, and leaving us a review on Apple Podcasts or Podchaser.

Follow us:Follow the show on Bluesky, or join us on the Smashing Security subreddit, or visit our website for more episodes.

Follow Graham…

The Warlock ransomware has hit a number of organisations including government agencies and departments, and most recently UK-based telecoms firm Colt. Read more in my article on the Fortra blog.

A hack of the Netherlands' Public Prosecution Service has had an unusual side effect - causing some speed cameras to be no longer capturing evidence of motorists breaking the rules of the road.

And it is the disconnection of systems which has left many speed cameras in a non-functioning state - news that will bemuse cybercriminals, delight errant motorists, but is unlikely to be welcomed by those who care about road safety.

Local media reports claim that fixed speed cameras, average speed checks, and portable speed cameras that are usually in one location for about two months before relocation are impacted by the outage - with the only type to escape the problem being those which look out f…

In episode 64 of The AI Fix, AI discovers new physics, a robot crab looks for love on the beaches of Portugal, the “Godfather of AI” thinks our only hope is to build motherly AI, a robot folds some laundry, the UK government has a terrible idea, and our hosts discover a long lost sixties soul hit, “Dusty Plasma”.

All this and much more is discussed in the latest edition of “The AI Fix” podcast by Graham Cluley and Mark Stockley.

Hosts:Graham Cluley:@grahamcluley.com@[email protected]Mark Stockley:@ai-fix-mark.bsky.socialEpisode links:Support the show:You can help the podcast by telling your friends and colleagues about “The AI Fix”, and leaving us a review on Apple Podcasts or Podchaser.

If…

A poisoned Google Calendar invite that can hijack your smart home, a man is hospitalised after ChatGPT told him to season his food with… pesticide, and some thoughts on Superman’s latest cinematic outing.

All this and more is discussed in the latest edition of the “Smashing Security” podcast by cybersecurity veterans Graham Cluley, joined this week by special guest Dave Bittner from The Cyberwire.

With Proton, only you can read your emails..Support the show:You can help the podcast by telling your friends and colleagues about “Smashing Security”, and leaving us a review on Apple Podcasts or Podchaser.

Follow us:Follow the show on Bluesky, or join us on the Smashing Security subreddit, or vi…

MedusaLocker, the ransomware-as-a-service (RaaS) group that has been active since 2019 is openly recruiting for penetration testers to help it compromise more businesses.

Initial access brokers specialise in gaining unauthorised access to computer networks, and then sell their access to other cybercriminals.

The ultimate goal of the initial access broker is to sell their remote network access to other cybercriminals who will most likely monetise the situation by stealing data and deploying ransomware.

As CISA warned back in 2022, MedusaLocker attacks have heavily relied upon vulnerabilities in RDP to access victims' networks in the past.

"Every company gets penetration tested, whether or no…

Plus, Mark cuts through the GPT-5 hype and asks – is it AGI or just a fancy purple background, and Graham looks at “deadbots” and a disturbing interview between Jim Acosta and an AI version of a teenager killed in a school shooting.

All this and much more is discussed in the latest edition of “The AI Fix” podcast by Graham Cluley and Mark Stockley.

Hosts:Graham Cluley:@grahamcluley.com@[email protected]Mark Stockley:@ai-fix-mark.bsky.socialEpisode links:Support the show:You can help the podcast by telling your friends and colleagues about “The AI Fix”, and leaving us a review on Apple Podcasts or Podchaser.

If you would like to further support the podcast, and gain access to ad-free episode…

The United States Department of Justice has revealed that the recent takedown of the BlackSuit ransomware gang's servers, domains, and dark web extortion site, also saw the seizure of US $1,091,453 worth of cryptocurrency.

A BlackSuit ransomware attack often culminates in a demand for between approximately one million to 10 million dollars, with payment requested in Bitcoin.

It explains that on or about April 4, 2023, a victim paid 49.3120227 Bitcoin after having their data encrypted by a ransomware attack.

Nonetheless, investigations into the activities of the BlackSuit ransomware gang will be welcomed by the more than 450 known victims in the United States alone, who include organisations…

Чаще всего причиной были уязвимости во всевозможных плагинах и темах для нее; впрочем, наши коллеги также наблюдали кейс, в котором злоумышленники распространяли трояны через плохо защищенные WordPress-сайты.

Случаи эксплуатации уязвимости «в дикой природе» включают использование уязвимости для загрузки ZIP-архивов с веб-шеллами, установки PHP-бэкдоров с паролем для удаленного доступа по HTTP, а также для создания скрытых администраторских аккаунтов.

WordPress-тема Motors: эксплуатация уязвимости CVE-2025-4322В том же июне злоумышленники активно атаковали сайты на WordPress с помощью уязвимости в другой премиум‑теме для WordPress под названием Motors.

Зловред Efimer: распространение через в…

Не стоит забывать, что брокеры данных, как и другие фирмы, тоже подвергаются кибератакам — и тогда собранные ими данные попадают в руки настоящих кибермошенников.

Найти брокеров данных и страницу, где можно запросить удаление информации, бывает очень сложно.

Запросы на удаление информации бывают сложными и многоэтапными, в них требуют еще больше персональных данных для доказательства, что вы — это вы и имеете право писать запросы.

Для этого и нужна таблица — отслеживать сроки ответов и по необходимости отправлять дополнительные запросы.

Данные о вас поступают брокерам постоянно, поэтому по тому же списку можно идти заново спустя три месяца или полгода.

На конференции Black Hat описали атаку BadCam, которая позволяет перепрошить камеру, а затем выполнять на компьютере, к которому она подключена, вредоносные действия.

Хотя исследование провели этичные хакеры и BadCam еще не используется в реальных атаках, злоумышленникам будет несложно разобраться в ней и воспроизвести нужные действия.

От BadUSB к BadCamИсследователи Eclypsium смогли повторить трюк по перепрограммированию прошивки с веб-камерами Lenovo 510 FHD и Lenovo Performance FHD.

Перепрошить камеру можно, запустив на компьютере ПО с правами обычного пользователя.

При этом никакие сканирования ПО на компьютере не обнаружат угрозу, и даже полная переустановка системы не устранит «заклад…

Постоянный доступ в Интернет и мобильная связь привычны, как электричество, и мы уже плохо представляем, как жили без них раньше.

Но представьте себе ситуацию, когда мобильного Интернета или сотовой связи нет, а вам нужно оставаться на связи с друзьями поблизости.

Для этих и других подобных случаев не идеально, но подойдут децентрализованные мессенджеры, которые не требуют подключения к Интернету.

Он также использует BLE, работает на iOS и Android, поддерживает сквозное шифрование и имеет два режима: личные сообщения и публичная трансляция.

Briar обеспечивает высочайший уровень приватности и защищенности, но есть и связанные с этим неудобства.

Поэтому мы не очень удивились, когда увидели и криптовалютный фишинг, направленный не только на домашних, но и на корпоративных пользователей.

Чему мы удивились, так это легенде и, в целом, качеству этого фишинга.

Фишинговая схемаСама по себе схема нацелена на пользователей аппаратных криптокошельков Ledger: Nano X и Nano S Plus.

Ну и абсолютно непонятно, что это за продвинутые методы расшифровки и откуда о них известно якобы представителям Ledger.

Оно даже отправлено не при помощи стандартных инструментов злоумышленников, а через легитимный сервис для рассылки SendGrid (разосланные через него письма имеют хорошую репутацию и часто пропускаются антифишинговыми фильтрами).

Суть работы исследователей Google заключается в повышении эффективности атаки Retbleed.

Retbleed можно считать развитием атаки Spectre v2: она также использует особенности работы системы предсказания ветвлений, но отличается принципом «инъекции» инструкций.

Стоит ли ожидать атак Retbleed в реальных атаках?

Наибольшую опасность атаки, подобные Spectre и Retbleed, представляют для облачных систем.

И в Google утверждают, что новый вариант атаки Retbleed позволяет сделать именно это.

В недавно опубликованном исследовании PCA Cyber Security описан новый способ — для взлома достаточно подключиться к развлекательной системе автомобиля по Bluetooth.

Под капотом PerfektBlueПодключить смартфон к автомобилю по Bluetooth для разговоров по громкой связи или прослушивания музыки можно в любом авто, выпущенном за последние 10 лет.

Это зависит от того, как реализован Bluetooth в конкретном автомобиле.

Изредка подключение к автомобильной системе по Bluetooth не требует никаких подтверждений от водителя и пассажира, система открыта для сторонних подключений.

Иногда автомобиль автоматически отклоняет соединение, если водитель не зашел в настройки и сам не включил там режим сопряжения.

В помощь родителям эксперты «Лаборатории Касперского» подготовили руководство Цифровой школьный портфель: руководство для родителей на учебный год (доступен в формате PDF).

Проявите интерес и не критикуйте ребенкаЕсли ваш ребенок говорит, что хочет стать блогером, то самый правильный шаг для вас — это не игнорировать и не критиковать, а обсуждать новую затею вместе.

Расскажите, что не стоит делиться домашним адресом, названием школы, распорядком дня, планами на отпуск или местами, которые они регулярно посещают.

Для ребенка это может показаться воплощением мечты, но реальность такова, что детям-блогерам очень часто пишут мошенники.

А если хотите узнать больше о безопасности ребенка в Интерн…

刷单 буквально означает «начищать заказы», но в русском языке нужный смысл несет слово «накручивать».

Иногда злоумышленники заранее рекламируют товар и присылают его жертве с ее согласия, но есть и разновидность, когда посылка приезжает внезапно.

Курьер говорит, что на ваше имя оформлена доставка и что он привез вашу посылку.

Впоследствии окажется, что в коробке лежит либо дешевая подделка под искомый товар, либо вообще мусор.

Их продают многократно, поэтому вас, вероятно, будут атаковать и по другим жульническим схемам.

В этом материале рассказываем, на что стоит обратить внимание при планировании отпуска с помощью ChatGPT и других ИИ-ассистентов.

Вообще-то это никак не препятствует полету в Англию, но работники, как позже выяснилось, поверили некорректной информации из Google AI Overviews.

Если не хотите, чтобы искусственный интеллект привел вас в закрытый ресторан или к несуществующей достопримечательности, то проверяйте информацию в реальном времени.

В общем, пока что самый надежный и эффективный способ планирования путешествий — это самостоятельно искать информацию и покупать все необходимое, а ИИ использовать только как вспомогательный инструмент.

Как спланировать путешествие с ИИ без рисков для безоп…

Какие новые уловки используют мошенники в мессенджере и как вовремя их распознать, чтобы не стать очередной жертвой?

Конечно, KYC-верификация в понимании мошенников — это не фото паспорта и не обязательный видеозвонок, чтобы подтвердить свою личность, а необходимость пополнить депозит в реальной криптовалюте.

О похожей схеме мы, кстати, подробно писали в материале Угон аккаунтов и криптокошельков в Telegram, читайте.

Но вовремя «переключить тумблер» в своей голове — непростая задачка, поэтому мы рекомендуем как можно больше читать о мошеннических схемах, чтобы в нужный момент быстро вспомнить о них и уберечь свой аккаунт в Telegram от угона.

Если же ваш аккаунт Telegram уже взломали, скорее…

Необходимые вводные: атаки по сторонним каналамSleepWalk относится к классу атак по сторонним каналам.

Мы можем подавать на вход алгоритма шифрования любой текст, но не знаем ключ, с помощью которого данные шифруются.

Более того, для извлечения секретного ключа авторы исследования воспользовались не только атакой SleepWalk, но и одной из слабых сторон самого алгоритма.

Традиционный и надежный (но не постквантовый) алгоритм AES-128 атака SleepWalk до конца взломать не смогла.

Внедрять алгоритмы, стойкие к анализу с помощью квантовых вычислений (так называемую постквантовую криптографию), важно, но не менее важно делать это правильно.

Даже компании со зрелой ИБ и достаточными инвестициями в это направление не застрахованы от киберинцидентов.

Сотрудники должны знать, как рассматриваются сообщения о нарушениях и инцидентах и как по ним принимаются решения.

Это должно быть описано как в подробных регламентах ИБ, так и в простом коротком документе, который дочитает и поймет каждый сотрудник.

Мотивируйте сотрудников не только сообщать об инцидентах, но и предлагать улучшения, думать о предотвращении проблем ИБ в своей повседневной работе.

Каждому начальнику важно понимать, как реагировать на сообщения подчиненных, куда и как передавать сообщение, как не создавать «островки обвинительной культуры» в общем океане «культуры без …

Если вы активно пользуетесь криптовалютой, но все еще качаете торренты и не представляете, как безопасно хранить сид-фразы, то у нас для вас плохие новости.

Мы обнаружили новый троян Efimer, который подменяет адреса криптокошельков прямо в буфере обмена.

Злоумышленники взламывают плохо защищенные сайты и публикуют на них посты с зараженными торрентами.

А если в буфере оказывается еще и адрес криптокошелька, Efimer незаметно меняет его на подставной.

Он умеет и красть криптовалюты, и подменять криптокошельки, одинаково опасен и для частных пользователей, и для организаций, способен при помощи скриптов взламывать WordPress-сайты и распространяться самостоятельно.

This is the purpose of the HIPAA Security Rule Update.

2: HIPAA Security Rule Update Standards Mapped to Secure Workload CapabilitiesSecure Workload Key Capabilities and HIPAA Mapping:1.

Workload Runtime ObservabilityCisco Secure Workload provides comprehensive visibility into the runtime state of your workload environment.

While Cisco Secure Workload is not a patching or vulnerability management tool, it can complement this standard by leveraging vulnerability data from workloads and integrating with Cisco Secure Firewall Management Center.

13: Compensating Controls with Secure Workload and Secure FirewallTurning Compliance into Meaningful Outcomes with Cisco Secure WorkloadAlthough the up…

If your security service edge (SSE) platform can’t enforce consistent policies everywhere, it’s not protecting you the way you think it is.

Policies that don’t follow the userInconsistent access experiencesVisibility gaps that hide risk activity and slow responseOne Policy Fabric, One Security PipelineCisco Secure Access changes that.

Now, their policies follow the user across every app and connection type, cutting risk and operational overhead in the process.

Cisco Secure Access Is Built for This MomentCisco Secure Access delivers the unified SSE platform enterprises need right now, simplifying policy management, strengthening security, and improving user experience.

See how Cisco Secure A…

Cisco Security Cloud is a purpose-built platform that provides the scalability and protection agencies need to safeguard their applications, networks, and endpoints.

Cisco Secure Access for Government is our answer to that challenge.

Simplifying security management at scale: Cisco Security Cloud Control for GovernmentAs government agencies accelerate their cloud strategies, managing hybrid environments—on-premises, cloud, and virtual—has become increasingly complex.

Cisco Security Cloud Control for Government addresses this by unifying security management, streamlining policy updates, and centralizing control of Cisco’s Hybrid Mesh Firewall to deliver a distributed security fabric with cons…

Cisco and Endace have released the Findings Report from the Security Operations Center (SOC) at RSAC™ 2025 Conference.

The SOC Team at RSAC 2025 deployed the EndaceProbe packet capture platform, integrated with the suite of Cisco tools.

Also, SOC engineers used Cisco Security Cloud in the SOC, comprised of Cisco Breach Protection Suite and User Protection Suite, with the foundation of Secure Firewall.

Endace is also generating Metadata (including Zeek logs) and NetFlow data into Cisco Secure Network Analytics (SNA) and Splunk Platform.

The Findings Report includes sections about:The NetworkTechnology used in the SOC at RSAC ConferenceThe StatisticsSecurity Incident and Event ManagementXDR I…

Recently, KDDI announced its launch of Japan’s first fully managed, single-vendor SASE solution, powered by Cisco.

Cisco SASE empowers organizations to connect branches, secure remote workers, and protect cloud applications—all with centralized visibility and management.

KDDI: Delivering Integrated SASE for Japanese EnterprisesKDDI, a major Japanese service provider, in partnership with Cisco, is now delivering Japan’s first fully managed, single-vendor SASE solution.

KDDI utilizes Cisco’s SASE solution to provide businesses with seamless, secure connectivity across branch offices, remote users, and cloud applications.

“Through our partnership with Cisco, KDDI is proud to offer Japan’s firs…

After a rigorous evaluation of nine enterprise hybrid firewall solution vendors, Cisco has been recognized as a Leader in the IDC MarketScape: Worldwide Enterprise Hybrid Firewall 2025 Vendor Assessment.

“We’re excited to see Cisco recognized as a Leader in the IDC MarketScape: Worldwide Enterprise Hybrid Firewall 2025 Vendor Assessment,” said Stephanie Hagopian, VP of Security for CDW, a Cisco partner.

AI-native policy management with Cisco Security Cloud ControlTime-consuming, manual policy management hinders operational excellence, but Cisco changes this by using AI to intelligently automate policy management in Cisco Hybrid Mesh Firewall, delivered by Cisco Security Cloud Control.

Disco…

These publicly reachable endpoints become attractive targets for Denial-of-Service (DoS) attacks, wherein adversaries can flood the key exchange servers with a high volume of IKE traffic.

This approach reduces the processing burden on IKE servers by proactively filtering excessive traffic before it reaches the IKE server.

In parallel, we deployed a tracking system to identify source IPs exhibiting patterns consistent with IKE flooding behavior, enabling rapid response to emerging threats.

3: IKE Throttling in the VPP node graphFig.

5: IKE Throttling – IKE Throttling Reset MechanismProviding observability on high-rate initiators with a probabilistic approachTo complement the IKE throttling m…

Llama-3.1-FoundationAI-SecurityLLM-instruct-8B (Foundation-sec-8B-Instruct) layers instruction fine-tuning on top of our domain-focused base model, giving you a chat-native copilot that understands security context and follows natural-language directions straight out of the box.

Built for Security, Tuned for ConversationInstruction following — Foundation-sec-8B-Instruct obeys everyday prompts for summarization, question-answering, sentiment analysis, and creative text generation without any extra fine-tuning.

Compact footprint — A 4K-token context window lets Foundation-sec-8B-Instruct run on a single, high-memory GPU while we push toward much longer windows.

— A 4K-token context window let…

Elevating AI Supply Chain Security with Hugging FaceAt Cisco, we are on a mission to help every organization on the planet securely execute their AI strategy.

We’re proud to deliver our work on AI supply chain security to Cisco customers and now, the greater AI and security community.

Learn MoreThe Cisco Foundation AI team recently launched Cerberus, a 24/7 guard for the AI supply chain.

With the release of ClamAV 1.5, Cisco brings deeper visibility into the AI model supply chain to the security community.

All existing users of Cisco Secure Endpoint and Email Threat Defense are protected against malicious AI Supply Chain artifacts.

Email Threat Defense analyzes nearly 100 million emails every day, leveraging AI to protect thousands of customers from the latest threats.

Backed by over 20 years of experience in the email gateway space, we’re bringing the next wave of innovation to email security.

With the addition of our new UAE region, Email Threat Defense now operates in five regions globally expanding our reach while maintaining trusted, enterprise-grade security everywhere we serve.

By using Cisco Secure Email Threat Defense, businesses in the UAE can protect their communications, safeguard sensitive data, and keep their operations running smoothly with confidence.

Want to learn more about being an Email Threat Defe…

Our Secure Firewall 4225 is the first firewall ever to earn SE Labs’ coveted AAA rating in the ultra-tough Advanced Performance test, hot on the heels of its February AAA rating for efficacy.

Cisco Secure Firewall can tackle this challenge in multiple ways.

These capabilities led to the exceptional security efficacy and network performance highlighted in the SE Labs report.

In essence, the Cisco Secure Firewall 4225 doesn’t just block threats; it does so with industry-leading speed and efficiency, ensuring your network remains secure and your operations unhindered.

Explore the full SE Labs report to see how the Cisco Secure Firewall 4225 can secure your organization with uncompromised perfo…

A recent evaluation by SE Labs, a leading independent security testing firm, put Cisco Secure Email Threat Defense (ETD) under the microscope.

The SE Labs testing methodologySE Labs is known for its rigorous, real-world testing environments designed to simulate actual cyberattack scenarios using threats seen in the real-world at the time of testing.

1: SE Labs test case structureSecure Email Threat Defense: A clear standoutEmail Threat Defense excelled across both core evaluation areas.

What makes Email Threat Defense effective?

Email Threat Defense’s top score in SE Labs latest evaluation highlights its strength as credible and reliable threat protection in this space.

That’s why we’re excited to introduce Cisco XDR Connect—a new tool designed to make navigating this rich ecosystem easier than ever.

With a clean, intuitive interface and no Cisco XDR login required, XDR Connect lets users search, browse, and explore integrations and automation capabilities all in one place.

More than just a catalog, Cisco XDR Connect is a window into the breadth and depth of Cisco XDR’s interoperability.

Cisco XDR Connect fills that need, providing a streamlined way to explore what’s possible with Cisco XDR.

In Cisco XDR Connect, users can search, browse, and view the details of all available XDR integrations and automation content.

We’re pleased to share that customers reported significant increases in their level of satisfaction with our product’s ability to deliver security efficacy, simplified endpoint security and faster threat detection.

To address this, Cisco Talos doubled down on incorporating the latest threat landscape insights into Cisco Secure Endpoint detections, further strengthening our detection capabilities.

In fact, AV- Comparatives consistently assesses Cisco Secure Endpoint as having Low or Very Low False Positives in their Business Security Test.

Streamlined, User-Friendly Security ExperienceManaging endpoint security shouldn’t require a steep learning curve or a pile of disconnected tools.

We also…

That’s why we’re thrilled to announce that Universal Zero Trust Network Access (ZTNA) from Cisco has undergone rigorous independent testing by SE Labs, a leading authority in security testing, and has achieved its highest possible rating: AAA.

This marks a significant milestone as the industry’s first SE Labs test specifically focused on Universal ZTNA identity-based security.

The SE Labs test evaluated how effectively Universal ZTNA from Cisco could detect and block realistic, identity-focused attacks that mimic techniques used by advanced threat actors in the wild.

Across a total of 30 distinct attacks (12 Stolen Credentials, 8 MFA Brute-Forcing, and 10 Session Hijacking attempts), Univer…

Microsoft Threat Intelligence has observed financially motivated threat actor Storm-0501 continuously evolving their campaigns to achieve sharpened focus on cloud-based tactics, techniques, and procedures (TTPs).

Microsoft.Storage/storageAccounts/delete – Deletes the Azure storage account, which contains and organization’s Azure Storage data objects: blobs, files, queues, and tables.

The threat actor abused the Azure Storage encryption scopes feature and encrypted the Storage blobs in the Azure Storage accounts.

Mitigation and protection guidanceMicrosoft recently implemented a change in Microsoft Entra ID that restricts permissions on the Directory Synchronization Accounts (DSA) role in Mi…

As a result, for a third year a row, Microsoft has been ranked number one for modern endpoint security market share in the IDC report, “Worldwide Modern Endpoint Security Market Shares, 2024.” Our market share grew from 25.8% in 2023 to 28.6% in 2024, at a 28.2% growth rate.

As IDC notes in their report, the endpoint security market “is growing in response to an increasingly sophisticated threat” powered by AI.

It’s been a leap in our security maturity level, and with the native interoperability of our Microsoft security solutions, we achieved it much faster than we expected.” —Glauco Sampaio, Chief Information Security Officer, CieloWorldwide Modern Endpoint Security 2024 Share SnapshotSou…

Common failure points in autonomous agentsDespite their impressive capabilities, AI agents can still make mistakes.

Extending Microsoft Security to meet the momentTo meet organizational needs that come with autonomous agents, Microsoft is building on a strong foundation and extending our existing security products to meet the unique demands of the agentic era, grounded in a Zero Trust approach that protects both people and AI agents.

brings robust data security and compliance controls to AI agents, helping organizations prevent data oversharing, manage regulatory requirements, and gain visibility into AI-specific risks.

Learn more with Microsoft SecurityTo learn more about Microsoft Securit…

ClickFix landing page impersonating the US SSAThe landing page presented the user with a CAPTCHA human verification pop-up, which was part of the ClickFix technique.

ClickFix instructions from the spoofed US SSA domainMalvertisingMalvertising is another popular delivery method that leads to ClickFix landing pages.

Microsoft Defender Threat IntelligenceMicrosoft Security Copilot customers can also use the Microsoft Security Copilot integration in Microsoft Defender Threat Intelligence, either in the Security Copilot standalone portal or in the embedded experience in the Microsoft Defender portal to get more information about this threat actor.

For the latest security research from the Micros…

It is also an opportunity for every organization to address legacy technology and practices and implement improved cryptographic standards.

Creating a Quantum Safe ProgramIn 2023, Charlie Bell, Executive Vice President for Microsoft Security, outlined Microsoft’s vision to build a quantum-safe future, which led to the creation of the Microsoft Quantum Safe Program (QSP).

Foundational security componentsMicrosoft has integrated PQC algorithms into foundational components like SymCrypt, the primary cryptographic library that provides consistent cryptographic security across Windows, Microsoft Azure, Microsoft 365 and other platforms.

To learn more about Microsoft Security solutions, visit our…

The embedded payload is the PipeMagic malware, a modular backdoor that communicates with its C2 server over TCP.

Internal linked list structuresIn our analysis, we identified the use of four distinct doubly linked list structures, each serving a unique function within the backdoor’s architecture:Payload linked list: Stores raw payload modules in each node, representing the initial stage of modular deployment.

Instead, it delegates this task to a network module in the network linked list.

In the sample analyzed, the network module data is embedded within the backdoor binary.

Decrypting network module dataUsing the decrypted module data, the malware populates the following structure represent…

Because security can’t waitThe security community comes together at Microsoft Ignite to explore the latest innovations, share real-world insights, and connect with peers and industry leaders, including Charlie Bell, Executive Vice President, Microsoft Security, and Vasu Jakkal, Corporate Vice President, Microsoft Security Business.

Microsoft Security Forum (Monday, November 17, 2025)Kick off Microsoft Ignite a day early with a half-day pre-conference forum dedicated to security.

Security is a team sport—and Microsoft Ignite is your chance to connect with the best in the business.

Connect with the Security Community at Microsoft Ignite 2025Join Microsoft Security leaders on Tuesday, November…

Microsoft recently spoke with Mario Ferket, Chief Information Security Officer for Dow, about the company’s approach to AI in security.

The post Dow’s 125-year legacy: Innovating with AI to secure a long future appeared first on Microsoft Security Blog.

The Phishing Triage Agent in Microsoft Defender is now available in Public Preview. It tackles one of the most repetitive tasks in the SOC: handling reports of user-submitted phish. The post Announcing public preview: Phishing triage agent in Microsoft Defender appeared first on Microsoft Security Blog.

We’re excited to launch Microsoft Secure Future Initiative (SFI) patterns and practices: a new library of actionable guidance designed to help organizations implement security measures at scale.

Introducing SFI patterns and practices taxonomyJust as software design patterns provide reusable solutions to common engineering problems, SFI patterns and practices offer repeatable, proven approaches to solving complex cybersecurity challenges.

Like design patterns in software architecture, these security patterns are modular, extensible, and built for reuse across diverse environments.

Joining the SFI patterns and practices journeySFI patterns and practices is your guide to turning architecture i…

Defender Experts now offers 24/7, expert-driven protection for cloud workloads, beginning with hybrid and multicloud servers in Microsoft Defender for Cloud. Additionally, third-party network signals can be used in Microsoft Defender Experts for XDR to enhance incidents for faster and more accurate detection and response.

The post Elevate your protection with expanded Microsoft Defender Experts coverage appeared first on Microsoft Security Blog.

As a complete Zero Trust access solution, the Microsoft Entra Suite unifies identity governance, protection, verification, and network access security to deliver consistent, granular access controls across your environment.

The Total Economic Impact™ study of the Microsoft Entra SuiteTo quantify the Suite’s impact, Microsoft commissioned Forrester Consulting to conduct a Total Economic Impact™ (TEI) study of Microsoft Entra Suite.

The momentum behind these results is fueling the next wave of Microsoft Entra innovation, as mentioned later in this blog and which will be highlighted this week at the Microsoft Entra Suite Summer Camp!

Microsoft Entra Suite empowers organizations to converge acc…

The combination of the individual Microsoft identity solutions is great.

The Identity Security initiative offers an identity-specific view of recommended actions from across on-premises and cloud identities, identity infrastructure, and third-party identity providers.

Where the integration truly shines, however, is our identity threat response capabilities.

Microsoft Identity Threat Detection and Response Get comprehensive protection for all of your identities and identity infrastructure.

Learn more about Microsoft Identity Threat Detection and Response.

Secret Blizzard is attributed by the United States Cybersecurity and Infrastructure Agency (CISA) as Russian Federal Security Service (Center 16).

Secret Blizzard AiTM infection chainApolloShadow malwareApolloShadow uses two execution paths depending on the privilege level of the running process.

Defending against Secret Blizzard activityMicrosoft recommends that all customers, but especially sensitive organizations operating in Moscow, should implement the following recommendations to mitigate against Secret Blizzard activity.

For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To hear stories and insights fro…

After discovering the bypass technique during proactive hunting for processes with privileged entitlements, we shared our findings with Apple through Coordinated Vulnerability Disclosure (CVD) via Microsoft Security Vulnerability Research (MSVR).

We thank the Apple security team for their collaboration in addressing this vulnerability and encourage macOS users to apply these security updates as soon as possible.

The determination of UTI for dynamic types can be done with the uttype utility, even if the calling app does not have TCC access to the right directory.

Strengthening protection against TCC bypass attacksAttackers with the ability to bypass TCC protections on macOS devices can acces…

Today marks a watershed moment and new benchmark for open-source security and the future of consumer electronics.

Google is proud to announce that protected KVM (pKVM), the hypervisor that powers the Android Virtualization Framework, has officially achieved SESIP Level 5 certification.

This makes pKVM the first software security system designed for large-scale deployment in consumer electronics to meet this assurance bar.

With this level of security assurance, Android is now positioned to securely support the next generation of high-criticality isolated workloads.

Achieving Security Evaluation Standard for IoT Platforms (SESIP) Level 5 is a landmark because it incorporates AVA_VAN.5, the hi…

Today we're excited to announce OSS Rebuild, a new project to strengthen trust in open source package ecosystems by reproducing upstream artifacts.

Infrastructure definitions to allow organizations to easily run their own instances of OSS Rebuild to rebuild, generate, sign, and distribute provenance.

With an estimated value exceeding $12 trillion, open source software has never been more integral to the global economy.

For publishers and maintainers of open source packages, OSS Rebuild can...

If you're a developer, enterprise, or security researcher interested in OSS security, we invite you to follow along and get involved!

Android recently announced Advanced Protection, which extends Google’s Advanced Protection Program to a device-level security setting for Android users that need heightened security—such as journalists, elected officials, and public figures.

This is particularly useful for Advanced Protection users, since in 2023, plaintext HTTP was used as an exploitation vector during the Egyptian election.

JavaScript Optimizations and Security Advanced Protection reduces the attack surface of Chrome by disabling the higher-level optimizing Javascript compilers inside V8.

Javascript optimizers can be disabled outside of Advanced Protection Mode via the “Javascript optimization & security” Site Setting.

We…

Below we describe our prompt injection mitigation product strategy based on extensive research, development, and deployment of improved security mitigations.

A layered security approachGoogle has taken a layered security approach introducing security measures designed for each stage of the prompt lifecycle.

From there, a key protection against prompt injection and data exfiltration attacks occurs at the URL level.

Users are encouraged to become more familiar with our prompt injection defenses by reading the Help Center article.

Moving forwardOur comprehensive prompt injection security strategy strengthens the overall security framework for Gemini.

The Chrome Root Program Policy states that Certification Authority (CA) certificates included in the Chrome Root Store must provide value to Chrome end users that exceeds the risk of their continued inclusion.

To safeguard Chrome’s users, and preserve the integrity of the Chrome Root Store, we are taking the following action.

Apple policies prevent the Chrome Certificate Verifier and corresponding Chrome Root Store from being used on Chrome for iOS.

Beginning in Chrome 127, enterprises can override Chrome Root Store constraints like those described in this blog post by installing the corresponding root CA certificate as a locally-trusted root on the platform Chrome is running (e.g., install…

Google Quantum AI's mission is to build best in class quantum computing for otherwise unsolvable problems.

In 2019, using the same physical assumptions – which consider qubits with a slightly lower error rate than Google Quantum AI’s current quantum computers – the estimate was lowered to 20 million physical qubits.

Normally more error correction layers means more overhead, but a good combination was discovered by the Google Quantum AI team in 2023.

Another notable error correction improvement is using "magic state cultivation", proposed by the Google Quantum AI team in 2024, to reduce the workspace required for certain basic quantum operations.

These algorithms can already be deployed to d…

Our dedication to your security is validated by security experts, who consistently rank top Android devices highest in security, and score Android smartphones, led by the Pixel 9 Pro, as leaders in anti-fraud efficacy.

Now, Google Play Protect live threat detection will catch apps and alert you when we detect this deceptive behavior.

We’ve made Google Play Protect’s on-device capabilities smarter to help us identify more malicious applications even faster to keep you safe.

Google Play Protect now uses a new set of on-device rules to specifically look for text or binary patterns to quickly identify malware families.

This update to Google Play Protect is now available globally for all Android…

To enhance these existing device defenses, Android 16 extends Advanced Protection with a device-level security setting for Android users.

Advanced Protection gives users:Best-in-class protection, minimal disruption: Advanced Protection gives users the option to equip their devices with Android’s most effective security features for proactive defense, with a user-friendly and low-friction experience.

Advanced Protection gives users the option to equip their devices with Android’s most effective security features for proactive defense, with a user-friendly and low-friction experience.

Defense-in-depth: Once a user turns on Advanced Protection, the system prevents accidental or malicious disab…

Tech support scams are an increasingly prevalent form of cybercrime, characterized by deceptive tactics aimed at extorting money or gaining unauthorized access to sensitive data.

Tech support scams on the web often employ alarming pop-up warnings mimicking legitimate security alerts.

Chrome has always worked with Google Safe Browsing to help keep you safe online.

Standard Protection users will also benefit indirectly from this feature as we add newly discovered dangerous sites to blocklists.

Beyond tech support scams, in the future we plan to use the capabilities described in this post to help detect other popular scam types, such as package tracking scams and unpaid toll scams.

Today, we’re announcing Sec-Gemini v1, a new experimental AI model focused on advancing cybersecurity AI frontiers.

This is why we are making Sec-Gemini v1 freely available to select organizations, institutions, professionals, and NGOs for research purposes.

Sec-Gemini v1 outperforms other models on key cybersecurity benchmarks as a result of its advanced integration of Google Threat Intelligence (GTI), OSV, and other key data sources.

Sec-Gemini v1 outperforms other models on CTI-MCQ, a leading threat intelligence benchmark, by at least 11% (See Figure 1).

If you are interested in collaborating with us on advancing the AI cybersecurity frontier, please request early access to Sec-Gemini v1…

In partnership with NVIDIA and HiddenLayer, as part of the Open Source Security Foundation, we are now launching the first stable version of our model signing library.

These challenges are addressed by using Sigstore, a collection of tools and services that make code signing secure and easy.

These features are why we recommend Sigstore’s signing mechanism as the default approach for signing ML models.

Today the OSS community is releasing the v1.0 stable version of our model signing library as a Python package supporting Sigstore and traditional signing methods.

This model signing library is specialized to handle the sheer scale of ML models (which are usually much larger than traditional so…

The Chrome Root Program launched in 2022 as part of Google’s ongoing commitment to upholding secure and reliable network connections in Chrome.

It is non-normative and considered distinct from the requirements detailed in the Chrome Root Program Policy.

Last spring, the Chrome Root Program led ecosystem-wide experiments, emphasizing the need for linting adoption due to the discovery of widespread certificate mis-issuance.

We recently landed an updated version of the Chrome Root Program Policy that further aligns with the goals outlined in “Moving Forward, Together.” The Chrome Root Program remains committed to proactive advancement of the Web PKI.

We continue to value collaboration with web…

We’re excited to announce that starting today, Titan Security Keys are available for purchase in more than 10 new countries:IrelandPortugalThe NetherlandsDenmarkNorwaySwedenFinlandAustraliaNew ZealandSingaporePuerto RicoThis expansion means Titan Security Keys are now available in 22 markets, including previously announced countries like Austria, Belgium, Canada, France, Germany, Italy, Japan, Spain, Switzerland, the UK, and the US.

What is a Titan Security Key?

How do I use a Titan Security Key?

Where can I buy a Titan Security Key?

You can buy Titan Security Keys on the Google Store.

In December 2022, we released the open source OSV-Scanner tool, and earlier this year, we open sourced OSV-SCALIBR.

With guided remediation support for Maven, you can remediate vulnerabilities in both direct and transitive dependencies through direct version updates or overriding versions through dependency management.

We also introduced machine readable output for guided remediation that makes it easier to integrate guided remediation into your workflow.

VEX Support: We're planning to add support for Vulnerability Exchange (VEX) to facilitate better communication and collaboration around vulnerability information.

Try OSV-Scanner V2You can try V2.0.0 and contribute to its ongoing developme…

Posted by Dirk GöhmannIn 2024, our Vulnerability Reward Program confirmed the ongoing value of engaging with the security research community to make Google and its products safer. This was evident as we awarded just shy of $12 million to over 600 researchers based in countries around the globe across all of our programs.Vulnerability Reward Program 2024 in NumbersYou can learn about who’s reporting to the Vulnerability Reward Program via our Leaderboard – and find out more about our youngest security researchers who’ve recently joined the ranks of Google bug hunters.VRP Highlights in 2024In 2024 we made a series of changes and improvements coming to our vulnerability reward programs and rel…