Blahalla

Cisco warns of unpatched AsyncOS zero-day exploited in attacks

www.bleepingcomputer.com · 7 months ago

Cisco warned customers today of an unpatched, maximum-severity Cisco AsyncOS zero-day actively exploited in attacks targeting Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances.
SonicWall Fixes Actively Exploited CVE-2025-40602 in SMA 100 Appliances

thehackernews.com · 7 months ago

SonicWall has rolled out fixes to address a security flaw in Secure Mobile Access (SMA) 100 series appliances that it said has been actively exploited in the wild. The vulnerability, tracked as CVE-2025-40602 (CVSS score: 6.6), concerns a case of local privilege escalation that arises as a result of insufficient authorization in the appliance management console (AMC). It affects the following
Kimwolf Botnet Hijacks 1.8 Million Android TVs, Launches Large-Scale DDoS Attacks

thehackernews.com · 7 months ago

A new distributed denial-of-service (DDoS) botnet known as Kimwolf has enlisted a massive army of no less than 1.8 million infected devices comprising Android-based TVs, set-top boxes, and tablets, and may be associated with another botnet known as AISURU, according to findings from QiAnXin XLab. "Kimwolf is a botnet compiled using the NDK [Native Development Kit]," the company said in a report
New spyware discovered on Belarusian journalist’s phone after interrogation

therecord.media · 7 months ago

Researchers at the nonprofit Reporters Without Borders discovered a previously unknown spyware tool on the phone of a Belarusian journalist who had been detained by security services.
Roblox in talks with Russia to restore access after platform ban sparks backlash

therecord.media · 7 months ago

false
Sonicwall warns of new SMA1000 zero-day exploited in attacks

www.bleepingcomputer.com · 7 months ago

SonicWall warned customers today to patch a vulnerability in the SonicWall SMA1000 Appliance Management Console (AMC) that was chained in zero-day attacks to escalate privileges.
Access Fabric: A modern approach to identity and network access

www.microsoft.com · 7 months ago

false
Attackers Use Stolen AWS Credentials in Cryptomining Campaign

www.darkreading.com · 7 months ago

Threat actors wielding stolen AWS Identity and Access Management (IAM) credentials leverage Amazon EC and EC2 infrastructure across multiple customer environments.
Critical React2Shell flaw exploited in ransomware attacks

www.bleepingcomputer.com · 7 months ago

A ransomware gang exploited the critical React2Shell vulnerability (CVE-2025-55182) to gain initial access to corporate networks and deployed the file-encrypting malware less than a minute later.
European police bust Ukraine-based call center network behind $11 million in scams

therecord.media · 7 months ago

The group recruited employees from the Czech Republic, Latvia, Lithuania and other European countries, bringing them to Ukraine to work in the call centers.
APT28 Targets Ukrainian UKR-net Users in Long-Running Credential Phishing Campaign

thehackernews.com · 7 months ago

The Russian state-sponsored threat actor known as APT28 has been attributed to what has been described as a "sustained" credential-harvesting campaign targeting users of UKR[.]net, a webmail and news service popular in Ukraine. The activity, observed by Recorded Future's Insikt Group between June 2024 and April 2025, builds upon prior findings from the cybersecurity company in May 2024 that
New ForumTroll Phishing Attacks Target Russian Scholars Using Fake eLibrary Emails

thehackernews.com · 7 months ago

The threat actor linked to Operation ForumTroll has been attributed to a fresh set of phishing attacks targeting individuals within Russia, according to Kaspersky. The Russian cybersecurity vendor said it detected the new activity in October 2025. The origins of the threat actor are presently unknown. "While the spring cyberattacks focused on organizations, the fall campaign honed in on
A ‘recession’ is arriving for people who want jobs in technology

www.washingtonpost.com · 7 months ago

false
Your MFA Is Costing You Millions. It Doesn't Have To.

www.bleepingcomputer.com · 7 months ago

Passwords and app-based MFA add hidden costs through lost productivity, frequent resets, and risk of phishing and social engineering attacks. Token explains how wireless biometric, passwordless authentication eliminates credential-based attacks and delivers measurable financial returns by reducing login time across the enterprise.
NMFTA Warns of Surge and Sophistication of Cyber-Enabled Cargo Theft

www.securityweek.com · 7 months ago

The trucking industry group has released its 2026 Transportation Industry Cybersecurity Trends Report.
Kimsuky Hackers Use Weaponized QR Codes to Distribute Malicious Mobile Apps

gbhackers.com · 7 months ago

Threat researchers have uncovered a sophisticated mobile malware campaign attributed to North Korea-linked threat actor Kimsuky, leveraging weaponized QR codes and fraudulent delivery service impersonations to trick users into installing remote access trojans on their smartphones. The ENKI WhiteHat Threat Research Team identified the latest iteration of “DOCSWAP” malware being distributed through an intricate social
France investigates Interior Ministry email breach and access to confidential files

therecord.media · 7 months ago

France's Interior Ministry said it is investigating the “reality and scope” of a post on a cybercrime forum by a user claiming to have hacked the institution.
Hacker Conversations: Alex Hall, One-Time Fraudster

www.securityweek.com · 7 months ago

A first-person journey from undetected fraud to defending trust, how life events, neurodiversity, and hard-won insight shaped a former fraudster into a fraud fighter.
New $150 Cellik RAT Grants Android Control, Trojanizes Google Play Apps

www.securityweek.com · 7 months ago

The malware provides full device control and real-time surveillance capabilities like those of advanced spyware.
Microsoft asks admins to reach out for Windows IIS failures fix

www.bleepingcomputer.com · 7 months ago

Microsoft has asked businesses to reach out for advice on how to temporarily mitigate a Message Queuing (MSMQ) issue causing enterprise apps and Internet Information Services (IIS) sites to fail.
ForumTrol Operation Uses Chrome Zero-Day in Fresh Phishing Attacks

gbhackers.com · 7 months ago

The ForumTroll APT group has resurfaced with a sophisticated phishing campaign targeting Russian academics, marking a significant escalation in their ongoing operations against entities in Russia and Belarus. While the group initially gained notoriety for exploiting CVE-2025-2783, a zero-day vulnerability in Google Chrome, their latest offensive relies on refined social engineering tactics and commercial red
Deliberate Internet Shutdowns

www.schneier.com · 7 months ago

For two days in September, Afghanistan had no internet. No satellite failed; no cable was cut. This was a deliberate outage, mandated by the Taliban government. It followed a more localized shutdown two weeks prior, reportedly instituted “to prevent immoral activities.” No additional explanation was given. The timing couldn’t have been worse: communities still reeling from a major earthquake lost emergency communications, flights were grounded, and banking was interrupted. Afghanistan’s blackout is part of a wider pattern. Just since the end of September, there were also major nationwide internet shutdowns in
Five Cybersecurity Predictions for 2026: Identity, AI, and the Collapse of Perimeter Thinking

www.securityweek.com · 7 months ago

The perimeter is gone. Credentials are no longer sufficient. And security can no longer rely on static controls in a dynamic threat environment.
Microsoft Desktop Window Manager Flaw Allows Privilege Escalation

gbhackers.com · 7 months ago

A critical vulnerability has been discovered in the Windows Desktop Window Manager (DWM) that could allow attackers to escalate privileges to system level. The flaw, tracked as CVE-2025-55681, resides in the dwmcore.dll component and was disclosed during the TyphoonPWN Windows security competition, where it earned second place recognition. The Vulnerability The vulnerability exists within the CBrushRenderingGraphBuilder::AddEffectBrush function in the DWM
JumpCloud agent turns uninstall into a system shortcut

www.csoonline.com · 7 months ago

JumpCloud’s Remote Assist for Windows agent contained a critical local privilege escalation flaw, allowing full system compromise. Disclosed by XM Cyber, the vulnerability stems from insecure file operations during uninstall or update flows that execute with Windows NT AUTHORITY\SYSTEM privileges. The bug could allow a low-privileged local user to elevate themselves to full system control or induce denial-of-service conditions on corporate machines. JumpCloud’s agent is widely used in enterprise environments as part of its cloud-based Directory-as-a-service platform, managing device access and remote support features across Windows endpoints. According to XM Cyber’s Hillel Pinto, attackers only need a local foothold to exploit the flaw, generally obtainable from phishing, remote support sessions, or developer machines. Systems running Remote Assist for Windows before version 0.317 are vulnerable and need to be updated immediately to mitigate risks. Privileged uninstall in a untrusted temp space The flaw, tracked as CVE-2025-34352 and rated at CVSS 8.5 out of 10, highlights risks from improper handling of privileged operations on Windows endpoints. During uninstall or update operations, the JumpCloud agent triggers the Remote Assist uninstaller with system-level privileges, the highest possible authority in Windows. However, that routine performs create, write, execute, and delete actions on files in a user-writable %TEMP% subdirectory without validating the trustworthiness of the path or resetting access control lists. Because the uninstaller performs privileged file operations inside a user-controlled %TEMP% directory, a low-privileged attacker can abuse those operations to overwrite or delete protected system files. “What we have is a JumpCloud process with NT AUTHORITY\SYSTEM privileges that is deleting, writing, and executing a file with a predictable filename from an untrusted path,” Pinto said in a blog post. “The core of the exploit involves Link Following, utilizing mount points and symbolic links to redirect the privileged I/O operation.” Full privilege escalation and denial of service The vulnerability opens two primary exploitation vectors with significant operational impact: full privilege escalation to system level, and denial of service (DoS). By manipulating filesystem paths and leveraging race conditions, an attacker can redirect the uninstaller’s operations to delete or overwrite protected installer configuration targets, ultimately triggering techniques that give them a system-level command prompt. System access on an enterprise endpoint effectively grants control over policy enforcement, credential theft paths, and lateral movement capabilities. Alternatively, attackers can get the privileged process to write arbitrary data to sensitive system files (such as drivers), corrupting them and forcing blue screen of death ( BSOD ) conditions. This not only knocks machines offline but can require substantial remediation effort, particularly across distributed fleets. Pinto said that updating to JumpCloud Remote Assist for Windows version 0.317.0 or later will remediate this issue. “My team and I responsibly disclosed the vulnerability to JumpCloud, which confirmed the findings and promptly released a patch.” While NIST ’s National Vulnerability Database (NVD) marks the flaw as fixed and references the JumpCloud Agent release notes for patching, there is currently no note dedicated to the flaw on the page or on JumpCloud’s support site. JumpCloud did not immediately respond to CSO’s request for comments.
Fix SOC Blind Spots: See Threats to Your Industry & Country in Real Time

thehackernews.com · 7 months ago

Modern security teams often feel like they’re driving through fog with failing headlights. Threats accelerate, alerts multiply, and SOCs struggle to understand which dangers matter right now for their business. Breaking out of reactive defense is no longer optional. It’s the difference between preventing incidents and cleaning up after them. Below is the path from reactive firefighting to a
China-Linked Ink Dragon Hacks Governments Using ShadowPad and FINALDRAFT Malware

thehackernews.com · 7 months ago

The threat actor known as Jewelbug has been increasingly focusing on government targets in Europe since July 2025, even as it continues to attack entities located in Southeast Asia and South America. Check Point Research is tracking the cluster under the name Ink Dragon. It's also referenced by the broader cybersecurity community under the names CL-STA-0049, Earth Alux, and REF7707. The
Russische APT-Gruppe greift westliche KRITIS-Betreiber an

www.csoonline.com · 7 months ago

Eine russische Cyberspionage-Kampagne zielt auf Energieversorger. EvgenyV, shutterstock.com Das Team von Amazon Threat Intelligence stellte fest, dass eine vom russischen Staat geförderte Cyberspionagegruppe vermehrt Energieunternehmen und Anbieter kritischer Infrastrukturen (KRITIS) ins Visier genommen hat. Die Gruppe ist demnach seit mindestens 2021 aktiv und hat es vor allem auf Fehlkonfigurationen von Geräten abgesehen. Die Angreifer nutzen aber auch bekannte Schwachstellen wie CVE-2022-26318 in WatchGuard Firebox- und XTM-Geräten, CVE-2021-26084 und CVE-2023-22518 in Confluence oder CVE-2023-2753 in Veeam Backup aus. Laut den von Amazon gesammelten Telemetriedaten hat sich die Gruppe in diesem Jahr jedoch stark auf Fehlkonfigurationen konzentriert und sich von Zero-Day- oder N-Day-Schwachstellen abgewendet. Die Hauptziele waren demnach Enterprise Router und Routing-Infrastrukturen, VPN-Konzentratoren und Remote-Access-Gateways, Netzwerkmanagement-Appliances, Kollaborations- und Wiki-Plattformen sowie Cloud-basierte Projektmanagementsysteme. „Diese taktische Anpassung ermöglicht die gleichen operativen Ergebnisse, nämlich das Sammeln von Anmeldedaten und laterale Bewegungen innerhalb der Online-Dienste und Infrastrukturen der Opfer, während gleichzeitig die Entdeckungsgefahr und der Ressourcenaufwand der Akteure reduziert werden“, so die Security-Spezialisten. Verbindungen zu Sandworm und Curly COMrades Die Telemetriedaten zeigen, dass es Überschneidungen zwischen der Infrastruktur der Gruppe und Sandworm gibt, die auch als APT44 und Seashell Blizzard bekannt ist und mit dem russischen Militärgeheimdienst GRU in Verbindung steht. Zudem besteht ein Zusammenhang mit einer Gruppe, deren Aktivitäten in der Vergangenheit von Bitdefender unter dem Namen Curly COMrades dokumentiert wurden. Es könnte sich jedoch um zusammenarbeitende Untergruppen innerhalb des GRU handeln: Während die von Amazon verfolgte Gruppe den ersten Zugriff und die laterale Bewegung übernimmt, stellt Curly COMrades die Persistenz des Hosts durch seine benutzerdefinierten Malware-Implantate CurlyShell und CurlCat sicher. Amazon entdeckte Angriffe auf Netzwerk-Edge-Geräte von Kunden, die auf AWS-EC2-Instanzen gehostet werden. Dabei stellten die Angreifer über von ihnen kontrollierte IP-Adressen dauerhafte Verbindungen her. Dies deutet auf einen interaktiven Zugriff auf die kompromittierten Geräte hin. Abgriff von Anmeldedaten Die Sicherheitsforscher beobachteten auch Credential-Replay-Angriffe auf andere Online-Dienste der Opfer, bei denen gestohlene Domain-Anmeldedaten nach der Kompromittierung von Netzwerk-Edge-Geräten verwendet wurden. Das Amazon-Team geht davon aus, dass die Täter Anmeldedaten sammeln, indem sie die Funktionen der kompromittierten Geräte zur Erfassung und Analyse des Datenverkehrs nutzen. „Die zeitliche Lücke zwischen der Kompromittierung der Geräte und den Authentifizierungsversuchen gegen die Dienste der Opfer deutet eher auf eine passive Sammlung als auf einen aktiven Diebstahl von Anmeldedaten hin“, heißt es im Forschungsbericht. Beim Abfangen des Netzwerkverkehrs gehen die Angreifer ähnlich vor wie Sandworm. Die gezielte Ausrichtung auf Netzwerk-Edge-Geräte versetzt sie dabei in die Lage, Anmeldedaten während der Übertragung abzufangen. Tipps zum Schutz für KRITIS-Betreiber Die Gruppe konzentriert sich stark auf den Energiesektor. Dazu zählen zudem MSSPs (Managed Security Service Provider) mit Kunden aus der Energieversorgung. Die Angreifer haben jedoch auch Technologie- und Cloud-Dienstleister sowie TK-Anbieter in mehreren Regionen ins Visier genommen. Amazon rät Unternehmen, ihre Netzwerk-Edge-Geräte auf unauthorisierte Packet Capture Files oder -Dienstprogramme zu überprüfen. Zudem wird empfohlen, Gerätekonfigurationen zu checken und Verwaltungsschnittstellen zu isolieren sowie eine Multi-Faktor-Authentifizierung zu implementieren. Unternehmen sollten außerdem Authentifizierungsprotokolle prüfen und Authentifizierungsversuche aus unerwarteten geografischen Standorten überwachen. Zudem empfiehlt sich, eine Anomalieerkennung für Authentifizierungsmuster für alle Online-Dienste zu implementieren. Auch die Verwendung von Klartextprotokollen, die Anmeldedaten während der Übertragung offenlegen könnten, sollte kontrolliert werden. Der Amazon-Bericht enthält zudem Indikatoren für Kompromittierungen im Zusammenhang mit dieser Angriffskampagne sowie spezifische Sicherheitsempfehlungen speziell für AWS-Umgebungen. (jm)
From Linear to Complex: An Upgrade in RansomHouse Encryption

unit42.paloaltonetworks.com · 7 months ago

Operators behind RansomHouse, a ransomware-as-a-service (RaaS) group, have upgraded their encryption methods from single-phase to complex and layered.
Hackers Can Seize Control of Car Dashboards Through Modem Vulnerabilities

gbhackers.com · 7 months ago

Imagine cruising down the highway in your brand-new electric car when suddenly the multimedia display fills with Doom, the iconic 3D shooter game completely replacing your navigation map and vehicle controls. Shockingly, this isn’t science fiction. Security researchers have demonstrated that this scenario is entirely possible in today’s connected vehicles, exposing a critical vulnerability in
GhostPoster Firefox Extensions Hide Malware in Icons

www.securityweek.com · 7 months ago

The malware hijacks purchase commissions, tracks users, removes security headers, injects hidden iframes, and bypasses CAPTCHA.
What Trump’s Embrace of Crypto Has Unleashed

www.nytimes.com · 7 months ago

A boundary-pushing array of new crypto ventures have reached the stock market, enticing investors and leading to more risk taking.
Chinese Hackers Turn Compromised Servers Into ShadowPad Nodes

gbhackers.com · 7 months ago

A sophisticated Chinese threat actor tracked as Ink Dragon has been weaponizing a custom ShadowPad IIS Listener module to convert compromised servers into distributed relay nodes, according to research by Check Point Research. The tactic represents a significant escalation in the group’s operational capabilities, enabling attackers to establish persistent, multi-layered command-and-control infrastructure that spans victim
Surveillance at sea: Cruise firm bans smart glasses to curb covert recording

www.bitdefender.com · 7 months ago

If you're planning a cruise for your holidays, and cannot bear the idea of being parted from your Ray-Ban Meta smart glasses, you may want to avoid sailing with MSC Cruises. The cruise line has updated its list of prohibited items, specifically banning smart glasses and similar wearable devices from public areas. Read more in my article on the Hot for Security blog.
Singularity Linux Kernel Rootkit with klogctl Detection Evasion

gbhackers.com · 7 months ago

Singularity, a stealth-focused Linux Kernel Module (LKM) rootkit targeting modern 6.x kernels, has added a powerful log‐evasion capability that prevents its detection through traditional kernel logging interfaces such as klogctl. Designed as a “final boss” rootkit for defenders, Singularity notes deep kernel hooking, advanced log sanitization, and EDR evasion techniques to stay invisible on compromised systems.
Nagios XI 2026R1.1 Released to Patch Privilege Escalation Vulnerability

gbhackers.com · 7 months ago

Nagios has released version 2026R1.1 to address a critical privilege escalation vulnerability affecting earlier versions of its monitoring platform. The flaw, tracked as CVE-2025-34288, poses a significant risk to enterprise infrastructure by enabling local attackers to execute arbitrary code with root privileges. Vulnerability Details The vulnerability stems from an unsafe interaction between sudo permissions and
Auto Parts Giant LKQ Confirms Oracle EBS Breach

www.securityweek.com · 7 months ago

LKQ said the personal information of thousands of individuals was compromised as a result of the hacker attack.
Microsoft to Block Exchange Online Access from Outdated Devices

gbhackers.com · 7 months ago

Microsoft has announced a significant update to its device connectivity policies for Exchange Online, aimed at enhancing security and ensuring users are on modern protocols. Starting March 1, 2026, mobile devices running Exchange ActiveSync (EAS) versions older than 16.1 will no longer be able to connect to Exchange Online mailboxes. Exchange ActiveSync version 16.1 was originally
CISA Adds Actively Exploited Fortinet Signature Verification Flaw to KEV Catalog

gbhackers.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency (CISA) has officially added CVE-2025-59718 to its Known Exploited Vulnerabilities (KEV) catalog, marking the latest Fortinet vulnerability being actively exploited in the wild. The flaw affects multiple Fortinet products and poses a significant threat to organisations relying on FortiCloud single sign-on (SSO) authentication. Vulnerability Details CVE-2025-59718 represents an improper
Telekom startet System gegen Betrugsanrufe

www.csoonline.com · 7 months ago

Der Call Check der Deutschen Telekom soll Smartphone-Kunden künftig vor betrügerischen Anrufen schützen. Sandwish Studio, shutterstock.com Jemand ruft an, die Nummer ist im eigenen Adressbuch nicht eingespeichert. Egal, man geht mal dran, und lässt sich von einem Unbekannten in ein Gespräch verwickeln. Das ist meistens keine gute Idee. Der sogenannte Call Check der Deutschen Telekom soll ab sofort automatisch alle Kundinnen und Kunden vor möglicherweise betrügerischen Anrufen schützen. Wenn jemand im Telekom-Netz von einer inländischen oder ausländischen Nummer angerufen wird, die in einer Datenbank als unseriös oder betrügerisch erfasst ist, dann erscheint auf dem Smartphone-Display den Angaben zufolge der Hinweis “Vorsicht, möglicher Betrug!”. Vodafone ist voraus, O2 lässt auf sich warten Vodafone hat ein ähnliches Warnsystem bereits im Mai aktiviert, seither hat dieser Spam-Warner Firmenangaben zufolge bereits 50 Millionen Mal Alarm geschlagen. Nur 12 Prozent der Anrufe werden trotzdem angenommen, bei anonymen Anrufen, also wenn keine Nummer im Display erscheint, liegt die Annahmequote bei 60 Prozent. Die Anrufe, bei denen vorher der Betrugshinweis sichtbar war, dauerten laut Vodafone in 90 Prozent der Fälle weniger als 30 Sekunden, also sehr kurz, was ein gutes Zeichen ist: Vermutlich waren die allermeisten Angerufenen auf der Hut und legten ruckzuck wieder auf, noch bevor der Betrüger seine rhetorischen Winkelzüge vollziehen konnte. Die Betrugsanrufe kamen nicht nur aus Deutschland, sondern besonders häufig auch aus den Niederlanden, aus Österreich, Italien und dem Vereinigten Königreich. Betrüger wollen Bankdaten oder Passwörter “Betrüger sind oft sehr geschickt darin, Vertrauen aufzubauen, sei es durch vermeintliche Gewinnspiele oder Umfragen”, warnt Marc Atkins, Leiter der Cyber-Sicherheitszentrale von Vodafone Deutschland. Solche Methoden dienten häufig dazu, sensible Informationen wie Bankdaten oder Passwörter zu erlangen. “Seien Sie skeptisch und geben Sie keine persönlichen Daten am Telefon preis”, warnt der Sicherheitsexperte. Der dritte etablierte Handynetz-Betreiber in Deutschland, O2 Telefónica, hat noch kein solches Betrugswarnsystem für seine Kundinnen und Kunden aktiviert (dpa/jm).
GhostPoster Malware Found in 17 Firefox Add-ons with 50,000+ Downloads

thehackernews.com · 7 months ago

A new campaign named GhostPoster has leveraged logo files associated with 17 Mozilla Firefox browser add-ons to embed malicious JavaScript code designed to hijack affiliate links, inject tracking code, and commit click and ad fraud. The extensions have been collectively downloaded over 50,000 times, according to Koi Security, which discovered the campaign. The add-ons are no longer available.
GhostPoster Attack Uses PNG Icons to Compromise 50,000 Firefox Users

gbhackers.com · 7 months ago

A sophisticated malware campaign dubbed “GhostPoster” has compromised approximately 50,000 Firefox users by exploiting browser extension icons. Security researchers at Koi Security discovered that malicious actors are embedding hidden malware payloads directly within PNG logo files, turning seemingly innocent visual elements into dangerous delivery mechanisms that evade traditional security scanning. The campaign spans 17 Firefox
Dux Emerges From Stealth Mode With $9 Million in Funding

www.securityweek.com · 7 months ago

false
CASB buyer’s guide: What to know about cloud access security brokers before you buy

www.csoonline.com · 7 months ago

Cloud access security brokers (CASBs) explained As the name suggests, a cloud access security broker (CASB) manages access between enterprise endpoints and cloud resources from a security perspective. CASBs can be deployed on-premises or in the cloud; as a hardware appliance or software-only, as a proxy, reverse proxy, or through specific APIs. Enterprises have untold numbers of endpoints, both managed (corporate-owned devices) and unmanaged (devices owned by employees or third-party contractors). Endpoints can be on-premises or remote. And endpoints can include internet of things (IoT) devices. [ Download our editors’ PDF cloud access security broker (CASB) enterprise buyer’s guide today! ] In this buyer’s guide: Cloud access security brokers (CASBs) explained Why enterprises need cloud access security brokers (CASBs) What to look for in a cloud access security broker (CASB) tool Core cloud access security broker (CASB) services Leading cloud access security broker (CASB) vendors What to ask before cloud access security broker (CASB) tool Essential reading In a multicloud environment, each endpoint could connect to multiple cloud resources over the course of a single day, productivity apps (like Microsoft 365), SaaS apps (like Salesforce and Workday), collaboration apps (like Slack and Zoom), and cloud storage (like Amazon Web Services and Dropbox). Not to mention homegrown apps that have been migrated to the cloud, or apps that have been developed in the cloud (that is, cloud-native). CASBs sit between an organization’s endpoints and cloud resources, acting as a gateway that monitors everything that goes in or out, providing visibility into what users are doing in the cloud, enforcing access control policies, and looking out for security threats. Some vendors have begun incorporating additional features into core CASB functionality, such as data loss prevention (DLP), secure web gateway (SWG), cloud security posture management (CSPM), and user and entity behavior analytics (UEBA). However, it is important to note that CASBs are also a key component of a broader security strategy that goes by several names: Gartner calls that broader strategy Secure Service Edge (SSE), an integration of CASB, secure web gateway (SWG), and zero trust network access (ZTNA). According to Gartner, by 2026, 85% of organizations seeking to secure their web, SaaS, and private applications will obtain the security capabilities from a Security Service Edge (SSE) offering. The Gartner nomenclature has become the de facto standard. They and others have used a second acronym, Security Access Service Edge (SASE). IDC defines the category as network edge security as a service (NESaaS), with the same three core components: CASB, SWG, and ZTNA. “The network security market is in the process of a much-needed convergence trend. Security vendors have shifted from a focus on à la carte, individualized security services to a consolidated, cloud-delivered network security platform that treats individual services as optional modules,” IDC states. Why enterprises need cloud access security brokers (CASBs) The original use case for CASBs was to address shadow IT. When security execs deployed their first CASB tools, they were surprised to discover how many employees had their own personal cloud storage accounts, where they squirreled away corporate data. CASB tools can help security teams discover and monitor unauthorized or unmanaged cloud services being used by employees. This has grown to also include shadow AI services, as more enterprise users pick various machine learning models and use personal accounts to access public-facing generative AI tools. Today, CASBs encompass a variety of other use cases: Data protection: The COVID-19 pandemic drove employees to remote work and applications to the cloud, where they could be more easily accessed. The pandemic has passed, and many employees have returned to the office, but those applications and that data are still in the cloud. Organizations must protect sensitive data as it moves across a hybrid cloud environment. Today’s CASB often integrates DLP functionality. Compliance: Data privacy regulations continue to tighten. CASBs are an important tool in an organization’s overall regulatory compliance framework, enforcing data privacy policies. Remote workforce: Regardless of the location of employees, CASBs allow enterprises to implement more consistent security standards and secure remote access to cloud resources. Threat detection: CASBs can detect malicious activity, intrusion attempts, ransomware, and other types of security events. CASB tools can generate real-time alerts to enable quick response by security teams and feed these alerts into other security platforms to mitigate and resolve them. What to look for in a cloud access security brokers (CASB) tool From a purely functional perspective, there are four key features of a CASB tool: Visibility: CASBs provide comprehensive visibility into cloud usage, user activities, and data flows. Control: CASBs offer granular control over user permissions and data access. Data protection: CASB solutions provide data protection capabilities to safeguard sensitive information across multiple cloud services. Compliance: CASB tools help maintain compliance with data privacy regulations. Beyond those core features, organizations need to make sure the CASB tool well integrates with existing cloud services, applications, and security infrastructure. There are three deployment modes: forward proxy, reverse proxy and API-based. Most experts say that API-based CASBs provide better functionality, but organizations need to make sure that the vendor’s list of application programming interface (API) connections matches up with the organization’s inventory of cloud apps. Core CASB services Take note about the use or requirements for deploying various agents with each product. This is where the CASB vendors often place their secret sauce, which could be an issue depending on how agent-friendly or agent-adverse your IT department is. For example, Skyhigh uses a single agent that functions across all three operational modes. Some of the other CASBs have multiple agents, such as for specific functional areas like antivirus, DLP, or VPN, that can get messy, not to mention tough to deal with unmanaged endpoints such as personal mobile phones and embedded devices such as internet of things controllers. The following three basic services that all CASBs offer are at the core of what CASBs do and why you would buy one: Monitor and control your most sensitive data flows: CASBs were originally designed to stem the tide of shadow IT products and to control and make SaaS applications more secure. Now they have broadened their use and can fit into a variety of situations, including operating across multiple cloud providers and mixing SaaS, mobile, and on-premises applications, too. Apply uniform DLP policies across all servers and apps: As your data appetite increases, you need better ways to ensure that you aren’t leaking customer- and business-sensitive information, either through a malicious insider or inadvertently through a bad combination of security loopholes. While DLP products have been around for years, having DLP-like features in your CASB can be a nice way to track these potential weak spots, especially as more of your data moves into the cloud and is accessed by unmanaged mobile devices. Manage cloud-native encryption keys: Ideally, your CASB should automatically keep track of your encryption needs and keys so you don’t have to do this manually, and so you can encrypt more of your data. Some CASB tools are better at some things than others. For example: Bitglass has an Ajax virtual machine-like layer that handles near-real-time DLP on unmanaged devices. The only caveat is that these devices have to access data through their browsers. Some CASBs, such as Fortra, has field-level encryption on some SaaS structured data services, which can be a handy mechanism for protecting sensitive information. Beyond these basics, all CASBs offer the potential to operate in one (or more) of three different modes: Forward proxy, usually deployed with endpoint agents or VPN clients. Reverse proxy, which doesn’t require agents and can work better for unmanaged devices. API control, which provides visibility into data already stored in cloud repositories or data that is used in a cloud process that never enters a corporate network. Feature sets across CASB operational modes vary Part of the CASB evaluation challenge is understanding how the feature set extends to each operational mode if indeed the product operates in more than one mode. Broadcom’s Symantec CASB, for example, has reverse proxies just for Microsoft 365 and no other application. Meanwhile, Cisco Systems and Palo Alto Networks both offer API-only CASB products. Such differences mean you need to understand the types of protection and not just which apps are supported but how they are supported, and what is the exact API portfolio that is covered by each product. You really need the API support if you want to get granular with your CASB protection to understand the state of your public cloud security exposure and to stop any cloud-based malware too. API deployments also can trap cloud-to-cloud activities and to retrospectively inspect archived traffic flows. You will also need some level of proxying to handle application gateways and for implementing specific security policies. It pays to read the fine print and develop an appropriate test plan that will reveal the relevant features for each vendors’ product. Nice-to-have sets of CASB features: Conduct continuous risk assessments and compliance audits on demand: A CASB can show in a single place where a corporation has the most risk and summarizes issues that a security team can quickly focus on for suspicious behavior that other products couldn’t easily do. Forcepoint, Netskope, and Proofpoint all have nice risk summary dashboards that you can customize to display the things you need to understand how your environment is behaving and what needs immediate attention. Apply uniform adaptive authentication policies across all logins, servers, and apps: This should include read-only access (Gartner suggests this would be a good situation for unsanctioned SaaS services that are nonetheless needed), step-up authentication, and more granular access rights management. Identity management and single sign-on (SSO) tools are the usual go-to reasons for these sorts of tasks, and one important trend is that more CASBs are integrating with traditional SSO products. The trick is to understand that the typical level of integration happens (usually) in reverse proxy mode only, and the SSO authentication is only passed to the CASB at the initial application login moment. This means that if you want a more complete adaptive authentication to trap when more risky behavior happens, you will probably have to stick with your dedicated SSO product. As you can see, CASBs touch a lot of different existing security products across your enterprise. The challenge for successful integration is being able to understand these interactions and ensure that you overall security profile is enhanced rather than degraded with their use. Leading cloud access security broker (CASB) vendors The list of leading CASB vendors (in alphabetical order) includes pure-play companies as well as traditional security vendors that have added CASB capabilities to their portfolios either by acquisition or through internal development. Most vendors would not share their pricing details, but we have found approximate clues on AWS and Azure marketplaces where we could. Cloudflare CASB is an add-on to their One SASE platform, using the same overall agent. There is a free version for under 50 users which allows two SaaS components, and prices start at $7/user/month above that level, with custom pricing for larger installations. The CASB product is now four years old and integrates with visibility and control of various AI services such as ChatGPT and Google Gemini. It doesn’t support reverse proxies, includes DLP and integrates with the risk scores and metadata sources available with Microsoft’s cloud services, such as with protecting Office 365 documents and emails. Cisco Cloudlock: Cisco Systems has had a CASB since it acquired Cloudlock back in 2016. Cisco Cloudlock is a cloud-native CASB that protects users, data, and apps with an automated approach that uses APIs to manage the risks in the cloud app ecosystem. It integrates with Cisco’s SSE platform for its protective policies and a uniform dashboard. Cloudlock uses advanced machine learning algorithms to detect anomalies. It also provides DLP functionality and targets shadow IT with policy-based controls that can block dangerous activities, depending on permissions and risk levels. It uses machine learning to produce risk scores for more than 1,300 applications along with having tools to manage AI supply chains. Forcepoint ONE CASB: Forcepoint bought Bitglass in 2021, one of the original standalone CASB vendors and a leader in Gartner’s Magic Quadrant for CASB. Forcepoint has integrated Bitglass technology with its own DLP capabilities to provide an SSE solution. Forcepoint excels in monitoring and reporting on shadow IT, and its user analytics feature is popular. The software also supports a zero-trust architecture, providing device and user authentication. Pricing is $120 per user per year on AWS Marketplace. Fortra’s CASB is the result of acquiringendpoint protection vendor Lookout who previously acquired CASB innovator CipherCloud. Fortra now has a solid SSE platform that covers zero trust access controls, advanced DLP capabilities to automate the data discovery process, and supports a range of purpose-built integrations that covers identity access management and security orchestration, among others. It can provide visibility across managed and unmanaged cloud-based applications, users, endpoints, and data. Netskope CASB: One of the original pure-play CASB vendors, Netskope is a leader in CASBs as well as SSE. According to Forrester Research, Netskope has shown innovation across its technology stack, including significant investments in an impressive new private global network, artificial intelligence and generative AI security. Netskope merged SWG functionality into its CASB tool and sells separate in-line and API versions each for $35,000 per year for 100 users on AWS Marketplace. Palo Alto Networks Prisma CASB. Palo Alto Networks touts its CASB as being “next-generation,” based on the proposition that it’s less a standalone product and more of a range of integrated solutions such as inline security, SSPM, and enterprise DLP. The Palo Alto Networks CASB is designed to secure apps and data across cloud and hybrid workforce environments, protects data in transit between users and SaaS providers, facilities regulatory compliance and minimizes risks from shadow IT. Proofpoint ’s CASB is focused on extending DLP and threat protection from email to cloud apps. Proofpoint takes a people-centric approach; it provides granular visibility into who creates sensitive data and who owns, downloads, uploads, shares and edits that data. It identifies users who have been successfully phished, and those who have been attacked the most by hackers. Skyhigh Security CASB supports all deployment modes and enables real-time control over user access to sanctioned and unsanctioned cloud services. Skyhigh (a unit of Indian IT tech provider Musarubra that also owns Trellix) focuses on providing comprehensive multimode coverage that feeds security events into a machine learning system to provide sophisticated event correlation, helping security teams to focus on real threats rather than false alarms. CASB is just part of its overall SSE platform which integrates across SWG, ZTNA, DSPM and DLP, along with remote browser isolation. Protective policies are developed platform-wide and include management of AI usage and prevention of shadow AI and crafting user risk scores from all these metrics. Pricing is based on per protected service per user per year, the unlimited services is $88/user/year, with extra charges for shadow services. Symantec, a division of Broadcom, offers its CloudSOC CASB to monitor and control the use of sanctioned SaaS apps through extensive API integrations and in-line traffic analysis. The Symantec CASB provides full visibility and automatic detection of high-risk users, compromised accounts, and malicious insiders. Individualized behavioral-based user threat scores allow fast identification of risky user accounts. The tool automates the classification regulated data flowing in and out of apps, and it enforces controls that align with corporate policies. The tool includes DLP functionality and CSPM. Versa’s CASB is part of its One Universal SSE Platform that contains a unified dashboard and policy rule set for a variety of security services, including DLP, ZTNA, applications firewall, analytics and reporting. All its modules were entirely developed in-house, include various AI-based tools, and it supports all three modes of operation. Users can create protective policies using natural language queries of its embedded AI, as well as explore alerts and remediations. Zscaler CASB offers inline, real-time capabilities and out-of-band scanning functionality to protect data, block threats, provide visibility, and assure compliance. Key features include agentless cloud browser isolation to secure BYOD and third-party devices where software installations are infeasible, advanced threat protection to stop malware from reaching cloud resources in real time, cloud sandboxing to detect new ransomware and other zero-day infections, shadow IT discovery to automatically identify unsanctioned apps used by employees and create a risk score for each. It uses AI to classify and detect data leaks and will have additional AI-based tools in early 2026. What to ask before buying a CASB tool Buying a CASB tool can be complex. There’s a laundry list of possible features that fall within the broad CASB definition (DLP, SWG, etc.) And CASB tools themselves are part of a larger trend toward SSE and SASE platforms that include features such as ZTNA or SD-WAN. Enterprises need to identify their specific pain points, whether that’s regulatory compliance or shadow IT, and select a vendor that meets their immediate needs and can also grow with the enterprise over time. Here are the key questions to ask yourself before buying a CASB tool: Do I have a good handle on what cloud services my users are accessing, including employees, contractors, and other third-parties? Do I have a solid data classification system in place, so that I know what types of data are sensitive or mission critical? Do I have policies in place for access control across both on-prem and cloud environments, including SaaS applications? Do I have clear objectives? What are my priorities when shopping for a CASB? How will a CASB tool integrate with my existing security infrastructure such as firewalls, endpoint protection and web gateways. Examine how it will protect my entire applications’ estate, including custom-written apps. What happens as I migrate apps from on-premises to the cloud or in reverse? Do I get DLP and SWG as part of the CASB, or are those additional modules? How will the purchase of a CASB tool play into my broader security roadmap that might include the adoption of SSE or SASE? What is the initial cost, as well as the longer-term total cost of ownership? Do I have the budget for a new tool? Can your product scale as my company grows? Does your product cover all the geographic regions where I operate? Do I have the inhouse staff to deploy and manage the tool on-premises, or should I take the cloud-based, managed service route? Essential reading How do you secure the cloud? New data points a way What is SASE? A cloud service that marries SD-WAN with security
Afripol Focuses on Regional Cyber Challenges, Deepening Cooperation

www.darkreading.com · 7 months ago

false
The devil of proposed SEC AI disclosure rule is in the details

www.csoonline.com · 7 months ago

A US Securities and Exchange Commission committee has recommended a new rule that would mandate companies to analyze and report all AI efforts, including decisions to not use AI for some purposes. Attorneys who have studied the proposal note that the AI rule, just like the SEC’s cybersecurity rule from about two years ago, won’t technically require anything to be reported that wouldn’t have already required reporting. The new rule refers only to material AI efforts and ever since the creation of the SEC some 90 years ago, anything material has always required disclosure. But they theorize that the SEC committee believes that many public-company boards and their senior executives don’t fully understand the scope and potential impact of their various AI efforts. The new rule would force those executives to create committees and to formally review all AI decisions, potentially unearthing material issues that would otherwise not have occurred to those executives. Cybersecurity consultant Brian Levine, a former federal prosecutor who today serves as executive director of FormerGov, argues that this extra focus could make a significant difference for many enterprises. “It will help focus people. It puts it in front of everyone who needs to be thinking about AI,” Levine said. As for requiring companies to examine and disclose where they are either not using or where they might be underinvesting compared to rivals, Levine said that could help executives understand “that there is a risk that our implementation of AI may not keep up with stakeholders and competitors.” The proposed rule comes from the SEC Investor Advisory Committee (IAC) and was discussed during the Dec. 4 IAC meeting. Companies can write their own definitions of AI Another controversial aspect of the proposed rule is that it fails to define AI, instead instructing companies to write their own definitions. Some legal experts have suggested that the committee didn’t literally want companies to evaluate all uses of AI, given that the technology dates back to the 1950s and exists in some form in just about every piece of software that businesses use. They more likely intended for such evaluations to focus on relatively recent AI popularizations, especially generative AI and agentic AI. Under the proposed rule, companies would “self-define what they mean by artificial intelligence and then rely on that definition throughout its disclosures in describing AI-related risks, their AI deployment strategy if any and capital expenses and R&D expenditures related to the implementation and deployment of AI, amongst other material information.” Monica Washington Rothbaum, a senior attorney with J&Y Law, said that it would be “risky for a company to define AI differently” because it makes “apple to apple” investor comparisons difficult if not impossible. “Requiring companies to disclose AI-related risks is a smart move. But letting each company define AI however they see fit is a loophole waiting to be exploited. Without a consistent baseline, you risk turning disclosures into PR spin rather than meaningful accountability,” Rothbaum said. But Rothbaum does find value in forcing companies to disclose where management has opted to not use AI or to use it less than they might have otherwise. “Under-disclosing material risks like reliance on flawed AI models can expose companies to liability when things go wrong. Failing to invest in AI responsibly could also lead to competitive disadvantages that shareholders deserve to know about,” Rothbaum said. “This isn’t theoretical. AI is already shaping the way we look at hiring, customer service, and security. These are core operations that can affect a company’s value. If you can’t clearly explain how your AI decisions are made and who’s accountable for making them, then you’re already behind. Transparency like that has to be the cost of doing business today.” Braden Perry, a litigation, regulatory, and government investigations attorney with law firm Kennyhertz Perry, is not a fan of the proposed rule because he sees it unlikely to help investors make decisions. Asked the probability that such a rule would deliver useful information to investors and potential investors, Perry said, “None. In terms of an overall understanding from a shareholder, there will likely be zero usable information.” Will filing reveal anything useful? This concern is partly based on the many SEC cybersecurity filings that have used boilerplate language, and use SEC exemptions to reveal nothing specific. According to Perry, the key part of the AI definition portion is that the definition, once used, has to be used consistently throughout all filings. “Adopt a clear, enterprise-wide definition of AI and use it consistently across SEC filings, internal policies, and marketing, so you do not redefine the term to suit the story you want to tell in a given quarter,” Perry said. “The IAC recommendation explicitly contemplates requiring issuers to define what they mean by AI, in part because inconsistent definitions are already making disclosures hard for investors to compare. Allowing companies to define AI themselves is a double-edged sword, since it can either promote honest, business-specific clarity or invite opportunistic word games.” Some attorneys suggested that companies should be careful about AI phrasing or face potential actions from the SEC and the US Federal Trade Commission (FTC). “ Be very cautious about AI marketing. The SEC has already shown, through its AI washing enforcement actions, that it is willing to charge firms that exaggerate their AI capabilities or mislead investors about how embedded AI is in their products and processes,” Perry said. “A disclosure regime that asks companies to explain where AI is used, how it is governed, and how it affects operations will only make it easier for the SEC to test whether those claims are real.” Lexi Reese, CEO of AI vendor Lanai, also expressed concern about allowing companies to write their own AI definitions. “Giving companies the freedom to define AI may reduce short-term compliance friction, but it creates exactly the kind of fragmented, incomparable disclosure environment that leaves investors guessing,” Reese said. “If one company calls an autonomous decision system AI and another calls the same thing a data-driven tool, their disclosures will look compliant while describing two different universes of risk.” AI specialist Rob Lee, chief of research for the cybersecurity training firm the SANS Institute, said the rule might prove helpful in raising board and C-level awareness about what companies are actually doing with AI. But as with the earlier SEC cybersecurity rule, Lee said he was unhappy that the rule includes “a massive number of get-out-of-jail-free cards. Who is going to actually disclose anything? What are they disclosing? They don’t even mention shadow IT. How do you track unsanctioned AI use in your company?” Not even all members of the IAC were happy with the rule’s phrasing. IAC member John Gulliver submitted an official dissent to the proposed rule, expressing particular concern with each company’s ability to write its own AI definition. “These definitions would likely change from year-to-year or quarter-to-quarter. I don’t see how this benefits investors,” Gulliver wrote. But he also said that he doubted the details required are realistic. The proposed rule would “require public companies to provide highly specific disclosures of how their use of AI impacts employees at their company and the company’s customers. It’s good that this is only required when the use of AI is financially material to the company. But unfortunately, I think this is an impossible task,” Gulliver wrote. “Does the SEC really have the AI expertise necessary to determine what these line-item disclosures should be? And how is a company supposed to know the precise impact of AI on hiring or their customers? There are many macroeconomic and industry-specific factors that affect jobs and customers. In my view, accurately isolating AI-specific impacts would be a difficult guessing game.”
Parked Domains Emerge as a Primary Channel for Malware and Phishing

gbhackers.com · 7 months ago

The landscape of domain parking has transformed dramatically over the past decade, shifting from a relatively benign monetization strategy to a sophisticated vector for cybercrime. New research into the modern parking ecosystem reveals a startling reality: over 90% of visitors to parked domains encounter malicious content, scams, or phishing attacks a stark reversal from conditions
ClickFix Spoof of “Word Online” Used to Spread DarkGate Malware

gbhackers.com · 7 months ago

A sophisticated social engineering campaign leveraging a fake “Word Online” extension error message has been discovered distributing the notorious DarkGate malware. This attack employs the increasingly popular “ClickFix” technique, where threat actors manipulate users into executing malicious commands disguised as legitimate troubleshooting steps, bypassing traditional security defenses through human interaction rather than technical exploits. The
New Moonwalk++ PoC Demonstrates How Malware Can Forge Windows Call Stacks to Evade Detection

gbhackers.com · 7 months ago

Security researchers have unveiled a dangerous new technique that allows malware to completely hide its tracks by faking Windows call stacks a method designed to bypass modern endpoint detection systems. The technique, called Moonwalk++, extends previous research on Stack Moonwalking and demonstrates a critical vulnerability in how security tools validate whether malware is calling sensitive
Cellik Android Malware Uses One-Click APK Builder to Hide in Play Store Apps

gbhackers.com · 7 months ago

A newly discovered Android Remote Access Trojan (RAT) called Cellik is democratizing sophisticated mobile surveillance attacks by bundling advanced spyware capabilities with an automated tool that allows attackers to inject malicious code into legitimate Google Play Store applications seamlessly. The malware address a significant escalation in Android-targeted threats, combining complete device control, real-time surveillance, and