Blahalla

When Hackers Wear Suits: Protecting Your Team from Insider Cyber Threats

www.bleepingcomputer.com · 8 months ago

Hackers impersonate IT pros with deepfakes, fake resumes, and stolen identities, turning hiring pipelines into insider threats. Huntres sLabs explains how stronger vetting and access controls help stop these threats.
The CISO’s paradox: Enabling innovation while managing risk

www.csoonline.com · 8 months ago

We can keep it real here. One of the main jobs CISOs have is to stop being the “Department of No.” We have to figure out how to enable the rapid delivery of products and services for the business without introducing risks to the same business. That’s the paradox in a nutshell. In an environment where product teams must constantly test new technologies and ship updates at record speed, traditional end-of-line audits wouldn’t keep up. Security has to move upstream. It must be built into everyday operations, with proactive, actionable measures that empower innovation instead of slowing it down. CISOs, then, must work more closely with teams from the initial stages to establish clear and practical risk tolerances and build security into development workflows. Partner early to shape outcomes CISOs don’t get leverage by showing up at the finish line. They must ditch the gatekeeper mindset and become true partners from Day Zero. In the past, when security measures were only brought in at the final stage, decision-makers were left with a difficult choice: accept project delays or face unmitigated risks. When product cycles were quarterly and speed did not determine competition, this approach made sense. In today’s reality with AI-driven product development, such a process breaks in an environment now made up of weekly sprints, continuous delivery and vendor-driven dependencies. When security understands revenue goals, customer promises and regulatory exposure, guidance becomes specific and enabling. Begin by embedding a security liaison with each product squad so there is always a known face to engage in identity, data flows, logging and encryption decisions as they form. We should not want to see engineers opening two-week tickets for a simple question. There should be open “office hours,” chat channels and quick calls so they can get immediate feedback on decisions like API design, encryption requirements and regional data moves. Bureaucracy must be deprecated in our environment. Show up at sprint planning and early design reviews to ask the questions that matter, authentication paths, least-privilege access, logging coverage and how changes will be monitored in production through SIEM and EDR. When security officers sit at the same table, the conversation changes from “Can we do this?” to “How do we do this securely?” and better outcomes follow from day one. Set risk tolerances and guardrails Teams slow down when they are unsure how to proceed. Take away some of the decision-making and ensure an integration of authentication, authorization and accounting into the development process. For authentication, establish and leverage enterprise identity management solutions rather than allowing the development of accounts written to databases that can be easily compromised. CISOs must also ensure they define standard role-based access control levels that ensure clear separation of duties is in place in the solution design. For accounting, don’t just create logs; ensure high-cardinality data is being captured for anomaly detection and this data is being integrated into a central security operations center for threat detection and response. Product development teams should not be tasked with security operations responsibilities; other teams should maintain the eye-on-glass visibility into the threats facing the solutions in production. CISOs must define the organization’s risk appetite in business language that removes ambiguity. Specify which third-party profiles require deep assessment and which can run as bounded pilots with compensating controls. State which vulnerability severities must block a merge and which can proceed with a time-bound remediation plan. Clarify what data classifications may cross regions and what protections must travel with them. Then translate those choices into automation. Bake guardrails into CI/CD and infrastructure-as-code so enforcement is consistent and visible. Scan each code commit for vulnerabilities, and if a change breaches a critical policy, the build fails with a clear reason and a path to resolution. If it sits within tolerance, it moves forward without manual intervention. The result is governance as an accelerator: predictable, transparent and aligned with how design engineers work. Build secure-by-design into fast developer lifecycles When developers deploy code multiple times a day, a “final security review” before launch just wouldn’t work. This traditional, end-of-line gating model doesn’t just block innovation but also fails to catch real-world risks. To be effective, security must be embedded during development, not just inspected after. If the secure path is harder than the insecure path, developers will choose the easy way every single time. Our job isn’t to hand out a 50-page PDF; it’s to bake security right into their developer environment, giving them pre-vetted, hardened templates that are secure by default. This means offering standard service templates with authentication and authorization already built in. When the secure component is easier to use than the insecure alternative, developers can adopt it easily and will adopt it every time. Automation is the enforcement layer for this strategy. When security tools are integrated directly into the CI/CD pipeline, feedback becomes available almost in real-time. This allows the team to “fail fast” on critical risks while providing actionable fixes. This discipline must further extend into production. Even with world-class DevSecOps, we know a zero-day or configuration drift can happen. That’s why we rely on over-arching web application shielding solutions that integrate a robust web application firewall with runtime application attack mitigation and self-protection. These solutions mitigate vulnerabilities and risks in real-time while the application is running in production. They buy the development teams the crucial time they need to resolve the underlying issue without service interruption or breach, ensuring that even if all other controls fail, we have a way to block and tackle in the critical moment. Runtime telemetry and risk-based alerting are the final checks on this coverage. This promotes a cultural change that enables engineers to take full ownership of their applications, from the initial line of code all the way to production. Security, in turn, achieves thorough, lasting coverage without becoming a bottleneck. This article is published as part of the Foundry Expert Contributor Network. Want to join?
ShadyPanda browser extensions amass 4.3M installs in malicious campaign

www.bleepingcomputer.com · 8 months ago

A long-running malware operation known as "ShadyPanda" has amassed over 4.3 million installations of seemingly legitimate Chrome and Edge browser extensions that evolved into malware.
New Albiriox Android Malware Developed by Russian Cybercriminals

www.securityweek.com · 8 months ago

Albiriox is a banking trojan offered under a malware-as-a-service model for $720 per month.
Qualcomm Alerts Users to Critical Flaws That Compromise the Secure Boot Process

gbhackers.com · 8 months ago

Qualcomm Technologies, Inc. has issued an urgent security bulletin warning customers about multiple critical vulnerabilities affecting millions of devices worldwide. The most severe flaw threatens the secure boot process, a fundamental security mechanism that protects devices from malicious software during startup. The security update, published today, addresses six high-priority vulnerabilities discovered in Qualcomm’s proprietary software.
Banning VPNs

www.schneier.com · 8 months ago

This is crazy. Lawmakers in several US states are contemplating banning VPNs, because…think of the children! As of this writing, Wisconsin lawmakers are escalating their war on privacy by targeting VPNs in the name of “protecting children” in A.B. 105 / S.B. 130. It’s an age verification bill that requires all websites distributing material that could conceivably be deemed “sexual content” to both implement an age verification system and also to block the access of users connected via VPN. The bill seeks to broadly expand the definition of materials that are “harmful to minors” beyond the type of speech that states can prohibit minors from accessingpotentially encompassing things like depictions and discussions of human anatomy, sexuality, and reproduction
Data breach hits 'South Korea's Amazon,' potentially affecting 65% of country’s population

therecord.media · 8 months ago

South Korean online retail giant Coupang apologized for a data breach that prompted an emergency meeting by senior government officials.
⚡ Weekly Recap: Hot CVEs, npm Worm Returns, Firefox RCE, M365 Email Raid & More

thehackernews.com · 8 months ago

Hackers aren’t kicking down the door anymore. They just use the same tools we use every day, code packages, cloud accounts, email, chat, phones, and “trusted” partners, and turn them against us. One bad download can leak your keys. One weak vendor can expose many customers at once. One guest invite, one link on a phone, one bug in a common tool, and suddenly your mail, chats, repos, and
Chinese Front Companies Offering Advanced Steganography Tools for APT Groups

gbhackers.com · 8 months ago

The Chinese government’s cyber ecosystem continues to attract significant scrutiny from security researchers worldwide. Following revelations from Intrusion Truth, the i-Soon leaks, tracking of EagleMsgSpy, and exposure of Great Firewall components, a recent analysis has uncovered details about two technology companies allegedly linked to China’s Ministry of State Security (MSS). BIETA and its subsidiary CIII
Australian Man Jailed for Running Fake Wi-Fi Attacks at Airports and Onboard Flights

gbhackers.com · 8 months ago

A Perth man has been sent to jail for stealing private videos from women and creating a fake Wi-Fi network to trick airline passengers. The 44-year-old’s crimes have shocked the aviation industry and left many victims feeling violated. The Fake Wi-Fi Scheme The trouble started in April 2024 when workers at Qantas spotted something suspicious.
Google deletes X post after getting caught using a ‘stolen’ AI recipe infographic

www.bleepingcomputer.com · 8 months ago

Google is facing backlash on X after a viral post for its NotebookLM appeared to use a food blogger's work without credit.
Webinar: The "Agentic" Trojan Horse: Why the New AI Browsers War is a Nightmare for Security Teams

thehackernews.com · 8 months ago

The AI browser wars are coming to a desktop near you, and you need to start worrying about their security challenges. For the last two decades, whether you used Chrome, Edge, or Firefox, the fundamental paradigm remained the same: a passive window through which a human user viewed and interacted with the internet. That era is over. We are currently witnessing a shift that renders the old
KimJongRAT Strikes Windows Users via Malicious HTA Files

gbhackers.com · 8 months ago

Security researchers have confirmed that KimJongRAT, a sophisticated remote access Trojan attributed to the Kimsuky group and believed to be backed by North Korea, is being actively distributed via weaponized.hta files targeting Windows users. The discovery reveals a carefully orchestrated attack chain designed to harvest sensitive credentials and system information from compromised machines. The
Ermittler zerschlagen Plattform für Online-Geldwäsche

www.csoonline.com · 8 months ago

Im Zuge der Operation Olympia wurde die kriminelle Handelsplattform “cryptomixer.io” abgeschaltet. Bundeskriminalamt Ermittlern aus Deutschland und der Schweiz ist ein Schlag gegen Online-Geldwäsche mit Kryptowährungen gelungen. Wie die Behörden mitteilten, wurde die Serverinfrastruktur eines sogenannten Bitcoin-Mixers beschlagnahmt und die Plattform erfolgreich abgeschaltet. Dabei wurden Kryptowährungen im Wert von umgerechnet rund 25 Millionen Euro sichergestellt. An den Ermittlungen waren die Generalstaatsanwaltschaft Frankfurt am Main, die Kantonsstaatanwaltschaft Zürich, das Bundeskriminalamt und Europol beteiligt, der Zugriff erfolgte laut Mitteilung am vergangenen Mittwoch. “Diese Operation ist ein weiterer, bedeutsamer Schritt bei der internationalen Bekämpfung von Online-Geldwäsche durch Krypto-Mixer”, sagte Vize-Präsidentin Bundeskriminalamt Martina Link. Großteil der getauschten Vermögenswerte “kriminellen Ursprungs” Die seit 2016 aktive Plattform cryptomixer.io sei zur Verschleierung von Finanzströmen genutzt worden, teilte das BKA mit. Dabei konnten Kryptowährungen anonym ein- und ausgezahlt werden. Es bestehe der dringende Verdacht, dass ein Großteil der dort getauschten Vermögenswerte kriminellen Ursprungs war, so das BKA. Den Betreibern wird daher gewerbsmäßige Geldwäsche sowie das Betreiben einer kriminellen Handelsplattform vorgeworfen. In der Schweiz wurden die Serverinfrastruktur, mehrere Mailaccounts beschlagnahmt und Datenmaterial als Beweismittel gesichert. (dpa/jm)
Shai-hulud 2.0 Variant Threatens Cloud Ecosystem

www.darkreading.com · 8 months ago

The latest attack from the self-replicating, npm-package poisoning worm can also steal credentials and secrets from AWS, Google Cloud Platform, and Azure.
CISA Warns of ScadaBR Vulnerability After Hacktivist ICS Attack

www.securityweek.com · 8 months ago

CISA has added CVE-2021-26829 to its Known Exploited Vulnerabilities (KEV) catalog.
Hackers Shift to ‘Living Off the Land’ Tactics to Evade EDR on Windows Systems

gbhackers.com · 8 months ago

Security researchers have discovered that modern attackers are abandoning traditional offensive tools and instead weaponizing legitimate Windows utilities to conduct cyberattacks without triggering security alarms. This shift in tactics, known as “Living Off the Land,” poses a significant challenge for organizations trying to protect their systems. Living off the Land refers to using only the
Authorities Shut Down ‘Cryptomixer’ Platform Used for Cybercrime and Money Laundering

gbhackers.com · 8 months ago

Law enforcement authorities from Switzerland and Germany, with support from Europol, have successfully dismantled a primary cryptocurrency mixing service called ‘Cryptomixer’ that was facilitating cybercrime and money laundering operations worldwide. The coordinated action took place between November 24 and 28, 2025, in Zurich, Switzerland. During the operation, authorities seized three servers and confiscated the cryptomixer.io
AI may discriminate against you at work. Some states are making it illegal.

www.washingtonpost.com · 8 months ago

New regulations aim to prevent discrimination from artificial intelligence and automated systems as it relates to employment.
Operation Hanoi Thief: Pseudo-Polyglot Payloads Targeting IT Professionals

gbhackers.com · 8 months ago

SEQRITE Labs APT-Team has uncovered a sophisticated cyberattack campaign dubbed “Operation Hanoi Thief,” targeting IT departments and human resources recruiters across Vietnam with weaponized resume documents. The campaign, first detected on November 3, 2025, employs an innovative pseudo-polyglot payload technique to disguise malware as legitimate job application materials. The operation begins with a malicious ZIP
Devolutions Server Hit by SQL Injection Flaw Allowing Data Theft

gbhackers.com · 8 months ago

A critical security vulnerability has been discovered in Devolutions Server, a popular centralized password and privileged access management solution. The flaw, rated critical severity by experts, could allow attackers to steal sensitive data or modify internal records. Devolutions, the company behind the software, released a security advisory (DEVO-2025-0018) on November 27, 2025, detailing three separate
Kevin Lancaster Joins the usecure Board to Accelerate North American Channel Growth

gbhackers.com · 8 months ago

Claymont, Delaware, December 1st, 2025, CyberNewsWire Lancaster’s arrival brings significant North American channel experience and expertise, supporting usecure’s ambition to cement its position as the market-leading human risk management solution for MSPs. usecure today announced the appointment of Kevin Lancaster as a Non-Executive Director. Kevin joins usecure with a wealth of experience in the North
I tested 80 Uber and Lyft rides and found a powerful way to save

www.washingtonpost.com · 8 months ago

We tested prices on 80 ride-share routes. It shows how people are leaving money on the table.
Hackers Launch 2,000+ Fake Holiday Shops in Massive Payment Theft Scheme

gbhackers.com · 8 months ago

Cybersecurity researchers have uncovered a massive network of over 2,000 fraudulent online storefronts deliberately activated during the Black Friday and Cyber Monday shopping season to harvest consumer payment information and execute unauthorized financial transactions. The discovery reveals two distinct but potentially coordinated phishing clusters that leverage shared infrastructure, automated templates, and brand impersonation tactics to
Australian Man Sentenced to Prison for Wi-Fi Attacks at Airports and on Flights

www.securityweek.com · 8 months ago

Michael Clapsis has been sentenced to 7 years and 4 months in prison for stealing sensitive information.
Police takes down Cryptomixer cryptocurrency mixing service

www.bleepingcomputer.com · 8 months ago

Law enforcement officers from Switzerland and Germany have taken down the Cryptomixer cryptocurrency-mixing service, believed to have helped cybercriminals launder stolen funds.
New Albiriox MaaS Malware Targets 400+ Apps for On-Device Fraud and Screen Control

thehackernews.com · 8 months ago

A new Android malware named Albiriox has been advertised under a malware-as-a-service (MaaS) model to offer a "full spectrum" of features to facilitate on-device fraud (ODF), screen manipulation, and real-time interaction with infected devices. The malware embeds a hard-coded list comprising over 400 applications spanning banking, financial technology, payment processors, cryptocurrency
Kevin Lancaster Joins the usecure Board to Accelerate North American Channel Growth

www.csoonline.com · 8 months ago

Lancaster’s arrival brings significant North American channel experience and expertise, supporting usecure’s ambition to cement its position as the market-leading human risk management solution for MSPs. usecure today announced the appointment of Kevin Lancaster as a Non-Executive Director. Kevin joins usecure with a wealth of experience in the North American channel and a strong background in human risk management and security awareness. He founded ID Agent, which was later acquired by Kaseya, and has led the Channel Program as CEO, building one of the most established channel communities in the market. Kevin will work with the board and executive team to support usecure’s continued expansion in the North American channel and help advance the company’s goal of becoming the number one human risk management solution for managed service providers. Kevin’s appointment comes at a time of rapid momentum for usecure. The company protects half a million end users around the world and works with a broad partner ecosystem, including more than 1,800 MSP partners. In North America, usecure’s growth is supported by leading distribution partners, including Pax8, Contronex, and Sherweb. These partnerships enable MSPs across the region to access and deploy human risk management services through their preferred marketplaces and distributors. “Kevin is an outstanding addition to usecure’s board,” said Charles Preston, Founder and CEO of usecure. “He brings hands-on channel leadership, deep knowledge of security awareness and human risk management, and a track record of scaling channel-first product and community businesses. Kevin will be instrumental in helping us accelerate the growth we are already seeing in the channel and expand our footprint in North America.”Kevin Lancaster commented on the appointment, saying he is excited to join usecure’s board and support the company’s ambitions. “usecure is at a pivotal moment in the evolution of Human Risk Management, and I am thrilled to help accelerate its mission. The team has built something genuinely innovative, and I am looking forward to guiding usecure through its next phase of growth,” said Lancaster. usecure’s recent industry recognition reflects this momentum. The company was named a finalist in CRN’s ‘Security Vendor of the Year’ and ‘Rising Star’ categories, earning praise from judges in the ‘Security Vendor of the Year’ category. These accolades highlight the company’s commitment to delivering partner-led innovation and measurable human risk reduction for MSPs and their customers. About Kevin Lancaster Kevin Lancaster is a leading channel expert and tech entrepreneur, best known as the founder of ID Agent, acquired by Kaseya, and as the CEO of Channel Program and BetterTracker. He has built and led channel programs that have driven billions in revenue, scaling cybersecurity and SaaS businesses across the MSP ecosystem. Kevin is widely respected for his deep expertise in cybersecurity innovation and building channel-first communities that accelerate partner success. About usecure usecure provides human risk management solutions built for the channel. The platform combines automated phishing simulations, bite-sized training, dark web monitoring, and compliance features to help MSPs and internal IT teams reduce human cyber risk through behaviour change and data-driven insights. Today, usecure supports hundreds of thousands of end users and more than 1,800 MSP partners globally and has been recognised by industry awards and peer reviews for its partner-focused approach and impact on reducing human risk. Contact Channel Marketing Manager Hetty Roach usecure [email protected]
12 signs the CISO-CIO relationship is broken — and steps to fix it

www.csoonline.com · 8 months ago

Despite the need for collaboration between security and IT, all is not well in the CISO-CIO relationship. And it’s not about newly minted CISOs trying to find their footing, as Gartner research has found that while around a third of CISOs with less than two years of experience report conflicts with their CIOs on key security-related areas, half of CISOs with five or more years of experience report conflicts in most of those same areas, including improving the organization’s cyber resilience and negotiating enterprise cyber risk appetite. Conflict can be a sign that the CIO-CISO relationship is broken, says Christine Lee, vice president of research and content leader for Gartner’s cybersecurity research team, but not always. In fact, other signs may be more telling indicators that the CIO and CISO are not working in concert, according to researchers, experienced executives, and executive advisors. Signs of trouble Security leaders and advisors offer CISOs the following signs that indicate there may be trouble worth addressing in their relationship with their CIO colleagues: 1. The CIO commonly disregards or overrides the CISO’s recommendations and decisions. Aimee Cardwell, CISO in residence at tech company Transcend and former CISO of UnitedHealth Group, says this situation often plays out with the CIO saying, “Thank you for your input, but we’re going to do what we want anyway.” 2. The CIO and CISO can’t resolve conflict. Conflict can be healthy for moving an organization forward. Diversity of perspectives and opinions can provide top executives with new possibilities and opportunities for compromise that benefit the organization overall. But if the CIO and CISO can’t resolve differences without escalating their disagreement to more senior executives, then a fundamental problem may be taking root. “Are you shoulder to shoulder or nose to nose? Because if you’re going nose to nose, then there’s misalignment,” Cardwell says. Gartner research notes that 87% of experienced CISOs describe their relationship with the CIO as “good” or “excellent” when it comes to resolving conflicts. Gartner’s Lee says this figure shows that conflict itself doesn’t mean the relationship is problematic. Rather, “it’s the inability to make progress or get to agreement that is a sign the CIO-CISO relationship is broken,” she says. 3. The CIO isn’t sharing information. “That’s a gigantic red flag,” Transcend’s Cardwell says. 4. The CIO alters or blocks the CISO’s message to the board. It’s problematic enough when the CISO doesn’t present directly to the board on a regular basis, but Cardwell says it’s even more troubling when the CIO is changing the information the CISO believes the board needs to have. “This goes beyond advice like, ‘You can word this a better way,’ or ‘You can tell the story in a better way.’ It’s not just the CIO coaching. It’s cutting facts that need to be elevated or making changes that could create a real moral problem for you as a CISO,” she explains. 5. The CIO otherwise undermines the CISO’s agenda to the board and other executives. “If the CIO is actively undermining the CISO’s credibility and opinions, if the CIO is mediating every conversation between the CISO and the board and executive team, that’s not a good sign,” Lee says. Trouble here also includes the CIO’s failure to advocate for the CISO’s priorities in important meetings and the organization’s IT strategy overall. 6. The CISO is not consulted on business initiatives involving IT. True partnership on any IT initiative would see the CIO and CISO working together from step one. But if the CISO is finding out about important tech initiatives late in the process or only by asking probing questions, it’s time to reset the relationship. “If someone says something about a new project or vendor or migration and the CISO doesn’t know something about it, then that’s a problem, because you’re then bolting on security,” says Dale Hoak, CISO for software firm RegScale. “In a good relationship, there are no surprises because you’re having continuous conversations and you’re sharing dashboards.” 7. There are no one-on-one conversations. LevelBlue CIO Maria Cardow says CIOs and CISOs who share information only via emails, through group meetings or between CIO and CISO subordinates (assuming that information will flow up) do not have a healthy rapport. “We have too much information in front of us to not be talking to each other directly; there is no substitute for conversations on a regular and on an ad-hoc basis,” she says. 8. The CIO and CISO don’t know each other’s priorities, challenges, strategies, etc. “As a CIO I should have a good idea of what my CISO’s concerns are and the CISO should know what’s going on in my world,” Cardow says. 9. The CISO and CIO clash on who should be doing what work. A similar sign of trouble is when one side blames the other for shortcomings in areas where they had joint responsibilities. 10. One buys technology with capabilities the other already has. This sign of trouble in the relationship goes both ways, but a related problem involves the CIO dictating the products the CISO must buy or the vendors or service providers the CISO must use. “In some cases those might be the right answer for security, but in some cases they might not be the right answer,” says Ayan Roy, EY’s Americas cybersecurity competency leader. “But just being told means there is not the right analysis being done. The CIO should give the CISO the latitude to pick the right solution; the CISO needs to be able to do the evaluation and to make the right pick.” 11. The CIO isn’t prioritizing cyber hygiene. One of the most common indications here is failing to or foregoing patching vulnerabilities that the security team has identified and prioritized for remediation. 12. Technology products are commonly released with security flaws or control gaps. “The question then is, ‘Why didn’t we figure that out during the product design lifecycle,’ and the answer is usually poor collaboration between IT and security,” says Sara Madden, CISO of Convera, a global payments and foreign exchange company. The CIO-CISO relationship matters The CIO and CISO need to have a strong relationship for either of them to succeed, says MK Palmore, founder and principal adviser for advisory firm Apogee Global RMS and a former director in the Office of the CISO at Google Cloud. “It’s critical that those in these two positions get along with each other, and that they’re not only collegial but collaborative,” he says. Yes, they each have their own domain and their own set of tasks and objectives, but the reality is that each one cannot get that work done without the other. “So they have to rely on one another, and they have to each recognize that they must rely on each other.” Moreover, it’s not just the CIO and CISO who suffer when they aren’t collegial and collaborative. Palmore and other experts say a poor CIO-CISO relationship also has a negative impact on their departments and the organization as a whole. “A strained CIO-CISO relationship often shows up as misalignment in goals, priorities, or even communication,” says Marnie Wilking, CSO at Booking.com. “When technology and security leaders are not on the same page, it becomes clear in both operations and outcomes, from missed project deadlines to increased vulnerabilities.” Multiple factors can contribute to a strained relationship. To start, the security department is still sometimes seen as, and acts like, the department of “no,” Cardwell says. “The CIO never has the luxury of saying ‘no.’ The CIO’s job is to enable what the business is trying to do. So the CISO needs to have that mindset, too: ‘The business wants to do this thing, and my job is to figure out how to make that possible,’” she explains. Even if security doesn’t act like the department of “no,” Cardwell says, it may take the CISO too long to get to “yes.” “There are a hundred ways, depending on what the problem is, to solve the problem quickly,” she says. “As a CISO, I like to provide several solutions with different price points and timelines with pros and cons and security scores, from fastest on or least secure or most secure on this timeline, to give the CIO and the business options.” Another reason for a poor relationship: Sometimes the CIO doesn’t place a high enough priority on security. “Maybe the CISO is only security-minded but not thinking as a business-enabler; or maybe the CIO isn’t at all security-minded and only focused on business enablement,” Palmore says. In other cases, the CIO wants tight control of all things IT and excludes security, or vice versa. “Some security leaders believe that they alone own security and find themselves on an island without a boat to get them home,” says Kory Daniels, chief security and trust officer at LevelBlue, a managed security services provider. Other factors that can lead to a poor CIO-CISO relationship are more structural, experts say. It may be that the organization has not defined each position’s responsibilities. “When roles and responsibilities aren’t clearly defined, overlaps or gaps in accountability can create unnecessary risk,” Wilking says. Or it could be that the organization’s funding process turns them into “adversaries for the same dollar,” Cardow says. Much of these problems stem from what Wilking says is “a lack of shared context and alignment around enterprise risk.” “The CIO is typically measured on uptime, scalability, and agility, while the CISO is focused on protecting data, ensuring compliance, and mitigating threats. Without a unified view of how those priorities intersect, the two can seem at odds,” she explains. “Too often, cybersecurity gets treated like the gatekeeper instead of a true partner. Teamwork ends up feeling transactional instead of collaborative. At Booking.com we emphasize embedding cybersecurity into business strategy from the start, ensuring it’s part of every conversation about product design, data, and customer trust.” How to improve a poor relationship CIOs and CISOs both have incentives to improve a problematic relationship. As Lee explains, “The CIO-CISO relationship is critical. They both have to partner effectively to achieve the organization’s technology and cybersecurity goals. All tech comes with cybersecurity exposure that can impact the successful implementation of the tech and business outcomes; that’s why CIOs have to care about cybersecurity. And CISOs have to know that cybersecurity exists to achieve business outcomes. So they have to work together to achieve each other’s priorities.” CISOs can take steps to develop a better rapport with their CIOs, using the disruption happening today, whether from AI or the uncertainty in the economy, as an opportunity to check in, reset the relationship, and address any issues that have stymied collaboration. Steps for CISOs include: Establishing alignment with the CIO as well as members of the C-suite and the board on the organization’s position on risk. Ensuring security is aligned with the organization’s strategy and its IT roadmap. Transcend’s Cardwell says it’s important for CISOs to think, “The CIO has a great thing here. I’d like to find how to make it secure.” Getting clarity on CIO and CISO responsibilities. “You need clarity on where the lines are drawn,” LevelBlue’s Daniels says. Making regular and ad hoc direct communication with the CIO a priority. Focusing on relationship management. “Communicate, be willing to meet, get teams to meet, establish trust,” Daniels says. Seeking to understand the CIO’s priorities, incentives, and challenges and sharing yours. “Find a way to walk a mile in the other’s shoe,” Daniels adds. Shifting to a business-enablement mindset. “Instead of leading with ‘no,’ lead with ‘How do we get there securely,’” RegScale CISO Hoak says.
APT36 Deploys Python-Based ELF Malware in Targeted Attacks on Indian Government Agencies

gbhackers.com · 8 months ago

Pakistan-linked cyberespionage group APT36 (Transparent Tribe) has escalated its campaign against Indian government institutions with the deployment of sophisticated Python-based ELF malware specifically designed to compromise Linux-based BOSS operating environments, according to research published by CYFIRMA. The threat actor, historically focused on Windows systems, has demonstrated expanded technical maturity through multi-platform tooling that bypasses conventional
PoC Released for Outlook “MonikerLink” RCE Flaw Allowing Remote Code Execution

gbhackers.com · 8 months ago

Security researchers have released a proof-of-concept (PoC) exploit for CVE-2024-21413, a critical remote code execution vulnerability in Microsoft Outlook dubbed “MonikerLink.” This flaw enables attackers to execute arbitrary code on victim systems via specially crafted emails, posing a serious risk to organizations worldwide. Field Details CVE ID CVE-2024-21413 Vulnerability Name MonikerLink Bug CVSS Score 9.8
Tomiris Shifts to Public-Service Implants for Stealthier C2 in Attacks on Government Targets

thehackernews.com · 8 months ago

The threat actor known as Tomiris has been attributed to attacks targeting foreign ministries, intergovernmental organizations, and government entities in Russia with an aim to establish remote access and deploy additional tools. "These attacks highlight a notable shift in Tomiris's tactics, namely the increased use of implants that leverage public services (e.g., Telegram and Discord) as
Linux 6.18 Rolls Out With Major Hardware Support Upgrades and Driver Enhancements

gbhackers.com · 8 months ago

Linus Torvalds has officially released Linux 6.18, the latest stable version of the Linux kernel. The announcement came on Sunday, November 30, 2025, marking another milestone for the open-source operating system that powers everything from smartphones to supercomputers. Torvalds shared the news through the Linux kernel mailing list, noting that while there was more bugfixing
Silicon Valley’s Man in the White House Is Benefiting Himself and His Friends

www.nytimes.com · 8 months ago

David Sacks, the Trump administration’s A.I. and crypto czar, has helped formulate policies that aid his Silicon Valley friends and many of his own tech investments.
A weird way to watch TV is bringing people a surprising amount of joy

www.washingtonpost.com · 8 months ago

Why do we keep watching old TV shows and movies in random order on social media? We talk to fans and experts about this modern comfort viewing habit.
CISA Adds Actively Exploited XSS Bug CVE-2021-26829 in OpenPLC ScadaBR to KEV

thehackernews.com · 8 months ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog to include a security flaw impacting OpenPLC ScadaBR, citing evidence of active exploitation. The vulnerability in question is CVE-2021-26829 (CVSS score: 5.4), a cross-site scripting (XSS) flaw that affects Windows and Linux versions of the software via
Beyond Nmap: Building Custom Recon Pipelines

www.reddit.com · 8 months ago

Sophisticated reconnaissance requires building custom pipelines that extend beyond the capabilities of standard tools like Nmap. These advanced techniques involve chaining multiple distinct methodologies and tools together. The resulting automation significantly increases the depth and efficiency of network discovery. Security professionals should focus on developing multi-stage, customized scripts for comprehensive asset mapping.
Japanese beer giant Asahi says data breach hit 1.5 million people

www.bleepingcomputer.com · 8 months ago

Asahi Group Holdings, Japan's largest beer producer, has finished the investigation into the September cyberattack and found that the incident has impacted up to 1.9 million individuals.
Analysis of 8 Foundational Cache Poisoning Attacks (HackerOne, GitHub, Shopify) - Part 1

www.reddit.com · 8 months ago

Analysis reveals multiple foundational cache poisoning vulnerabilities. These attacks manipulate how caching systems store and retrieve data, allowing unauthorized modification of content. By poisoning the cache, malicious actors can redirect users or inject false information into legitimate services. Understanding these foundational techniques is essential for building resilient security defenses.
Leak confirms OpenAI is preparing ads on ChatGPT for public roll out

www.bleepingcomputer.com · 8 months ago

OpenAI is now internally testing 'ads' inside ChatGPT that could redefine the web economy.
Tomiris Hacker Group Unveils New Tools and Techniques for Global Attacks

gbhackers.com · 8 months ago

A new wave of cyberattacks has been discovered targeting government officials and diplomats across Russia and Central Asia. The group, which has been active for several years, is known for focusing on high-value political targets. This latest investigation shows they are now using more advanced methods to hide their tracks, including popular apps like Telegram
Mystery OAST Tool Exploits 200 CVEs Using Google Cloud for Large-Scale Attacks

gbhackers.com · 8 months ago

A sophisticated threat actor has been operating a private Out-of-band Application Security Testing (OAST) service hosted on Google Cloud infrastructure to conduct a large-scale exploit campaign targeting more than 200 CVEs, according to new research from VulnCheck. Private OAST Domain Raises Red Flags Security researchers at VulnCheck identified unusual activity involving callbacks to detectors-testing.com, an unfamiliar
Albiriox Malware Emerges, Targeting Android Users for Full Device Takeover

gbhackers.com · 8 months ago

A dangerous new Android malware called Albiriox has been discovered by security researchers, posing a serious threat to mobile banking and cryptocurrency users worldwide. The malware operates as a Malware-as-a-Service (MaaS), allowing cybercriminals to rent access to this powerful hacking tool for monthly fees ranging from $650 to $720. The Cleafy Threat Intelligence team first identified Albiriox
CTF challenge Malware Busters

www.reddit.com · 8 months ago

There is a reverse engineering challenge called Malware Busters that is part of the Cloud Security Championship. It focuses on malware analysis with an assembly emphasis, offers a clean setup and surprising polish, and participants have asked whether others have tried it.
7 Security-Praktiken zum Abgewöhnen

www.csoonline.com · 8 months ago

Aus der Zeit gefallen? Sergio Delle Vedove | shutterstock.com Schlechte Angewohnheiten abzustellen (oder bessere zu entwickeln), ist ein Prozess, der Geduld, Selbstbeherrschung und Entschlossenheit erfordert. Das gilt sowohl auf persönlicher als auch auf Security-technischer Ebene. In diesem Artikel haben wir sieben Sicherheitspraktiken für Sie zusammengestellt, deren Haltbarkeitsdatum schon eine ganze Weile abgelaufen ist. 1. Perimeter-Sicherheit für ausreichend halten Die meisten Arbeitsumgebungen sind heute Cloud-basiert, in vielen Fällen mit Remote-Anteil. Das beobachtet auch Amit Basu, CIO und CISO bei International Seaways, einem Transportdienstleister für Erdölprodukte. Seine Schlussfolgerung: “Die alte Praxis, eine fest definierte Grenze abzusichern, funktioniert einfach nicht mehr in hybriden und Cloud-First-Arbeitsumgebungen. Weil sich Benutzer und Daten sowohl innerhalb als auch außerhalb des traditionellen Perimeters befinden, sind Unternehmen, die ausschließlich auf Perimeter-Sicherheit setzen, gefährlichen Bedrohungen ausgesetzt.” Dazu gehören dem Sicherheits- und IT-Entscheider zufolge etwa Ransomware-Angriffe. Die bessere, zeitgemäßere Lösung sei es, auf Zero Trust zu setzen. 2. Security an der Compliance ausrichten In den Augen von George Gerchow, CSO beim Security-Dienstleister Bedrock Security, lassen sich zu viele Teams von Compliance leiten, wenn es darum geht, Sicherheitsprogramme auf die Beine zu stellen. Das laufe letztlich nur darauf hinaus, Checklisten abzuarbeiten, statt Herausforderungen im Bereich Cybersecurity zu lösen: “Diese GRC-orientierte Mentalität ist veraltet und dysfunktional.” Wie Gerchow ausführt, vermittle eine Compliance-orientierte Security ein falsches Gefühl der Sicherheit und binde Ressourcen, die eigentlich für tatsächliche Bedrohungen eingesetzt werden sollten: “Das kann dann dazu führen, dass große GRC-Teams ihre Arbeitszeit damit verbringen, Kundenfragebögen zu beantworten oder sich an Audits abzuarbeiten. Stattdessen käme es eher darauf an, Daten zu schützen, Zugriffskontrollen zu managen und neue Bedrohungen im Blick zu behalten.” Deshalb ist der CSO überzeugt, dass Unternehmen zu den grundlegenden Prinzipien der IT-Sicherheit zurückkehren müssen. Abbilden lässt sich das seiner Meinung nach über einen Zero-Trust-Ansatz sowie Continuous Monitoring, beispielsweise mit dem CARTA-Ansatz (Continuous Adaptive Risk and Trust Assessment). 3. Legacy-VPNs beibehalten Veraltete VPN-Instanzen können ineffizient und schwerfällig sein, was zu erheblichen Ausfallzeiten führen kann und es diffiziler gestaltet, sie zu managen. Auch Buck Bell, Leiter der globalen Sicherheitsstrategie beim IT-Dienstleister CDW, ist kein “Fan”: “Legacy-VPNs können die Anforderungen des modernen Arbeitsplatzes nicht erfüllen. Insbesondere weil Führungskräfte heute einen nahtloseren und flexibleren Zugriff auf Ressourcen für ihre Teams benötigen, unabhängig davon, ob diese im Büro oder remote arbeiten.” Zudem seien solche Legacy-Systeme nicht skalierbar, weil sie mit den sich verändernden Sicherheitsanforderungen wachsender Unternehmen nicht Schritt halten können, meint Bell: “Das führt mit zunehmender Angriffsfläche zu Herausforderungen. Dass veraltete VPNs oft nicht mehr regelmäßig mit Aktualisierungen und Patches versorgt werden, vergrößert das Risikopotenzial noch weiter.” Ein besserer Ansatz: auf Secure Access Service Edge (SASE) umsteigen und sich dem Zero-Trust-Ansatz verschreiben. Das kann auch Security-Experte Bell nur wärmstens empfehlen: “Diese Strategien erhöhen das Sicherheitsniveau, indem sie jeden Benutzer und jedes Gerät überprüfen, das auf Netzwerkressourcen zugreifen möchte.” 4. Nur auf EDR setzen Endpoint Detection and Response (EDR)-Lösungen stellen ohne Zweifel einen erheblicher Fortschritt gegenüber herkömmlicher Antivirus-Software dar. Allerdings reicht dieser Ansatz allein in der heutigen Bedrohungslandschaft nicht mehr aus, wie Michel Sahyoun, Chief Solutions Architect beim Security-Anbieter NopalCyber, erklärt: „EDR eignet sich hervorragend, um Aktivitäten an Endpunkten zu überwachen, darauf zu reagieren und komplexe Angriffe zu erkennen. Allerdings umgehen Angreifer Endpunkte zunehmend und nehmen stattdessen Cloud-Umgebungen, Netzwerkgeräte und eingebettete Systeme ins Visier.“ Eine übermäßige Abhängigkeit von EDR könne deshalb dazu beitragen, dass kritische Sicherheitslücken unbeachtet bleiben. Im schlimmsten Fall ermögliche das Cyberkriminellen, sich über längere Zeit unbemerkt im Unternehmensnetzwerk einzunisten, warnt der Manager: “Die Angreifer könnten beispielsweise OAuth-Token ausnutzen, um sich unbefugten Zugriff auf Cloud-Plattformen zu verschaffen, ohne jemals mit einem Endpunkt zu interagieren, der über EDR-Software abgesichert ist.” In ähnlicher Weise stellten Netzwerk- und IoT-Devices in vielen Fällen blinde Flecken dar, auch weil diese oft keine robusten Monitoring- und Forensik-Funktionen aufwiesen: “Cloud-Umgebung erschweren die Detection zusätzlich aufgrund begrenzter Logging- sowie kostenpflichtiger Visibility-Funktionen. Weil sich die Angriffe zunehmend darauf verlagern, Trust-Beziehungen, Identitäten und APIs auszunutzen, ist ein Endpoint-zentrierter Ansatz allein unzureichend”, konstatiert Sahyoun. 5. SMS für 2FA nutzen Die SMS-basierte Zwei-Faktor-Authentifizierung galt einst als enormer Fortschritt in Sachen Security (verglichen mit der Authentifizierung per Passwort). Doch auch dieses Verfahren ist inzwischen veraltet, und risikobehaftet. Aparna Himmatramka, Senior Security Assurance Lead bei Microsoft, erklärt: “Leider wurde die TK-Infrastruktur nicht mit Blick auf Sicherheitsaspekte konzipiert. Darüber hinaus verwenden Mobilfunknetze auch heute noch veraltete Protokolle, die ausgenutzt werden können, und der Prozess der Übertragung von Telefonnummern zwischen Netzbetreibern erfolgt in vielen Fällen ohne strenge Identitätsprüfung. Das öffnet SIM-Swapping-Angriffen Tür und Tor.” 6. On-Premises-SIEMs einsetzen Lokal installierte SIEM-Tools sind Security-Manager Gerchow ebenfalls ein Dorn im Auge. Denn sie führten oft zu einer Flut von Warnmeldungen und seien zudem in vielen Fällen nicht Cloud-fähig. “Das zwingt Unternehmen entweder dazu, enorme Datenmengen unter hohen Kosten zu verschieben und zu speichern, oder das Risiko einzugehen, wichtige Protokolle zu übersehen, die essenziell sind, um Cloud-Deployments abzusichern”, mahnt Gerchow. Er fügt hinzu: “Viele Unternehmen halten an lokalen SIEM-Installationen fest, weil sie sich scheuen, sensible Daten in der Cloud zu speichern. Aber seien wir ehrlich: Dieser Zug ist abgefahren, es ist Zeit, weiterzuziehen.” 7. Passivität zulassen Kaum jemand sieht sich selbst als potenzielles Opfer eines Phishing-Angriffs, dennoch fallen jeden Tag wieder viele Menschen auf Social-Engineering-Taktiken herein. Kevin Sullivan, Principal Technology Consultant beim Softwareanbieter XTIUM, ist überzeugt, dass eine aktive Sicherheitskultur die Lösung ist, um das im Unternehmensumfeld zu verhindern: “Die richtigen Sicherheits-Tools und -Praktiken sind für jedes Unternehmen wichtig. Entscheidend sind dabei jedoch gute Security-Awareness-Programme, die die Belegschaft aufklären und dazu befähigen, Daten, Systeme und Geschäftsprozesse aktiv zu schützen.” Unternehmen, die ein kontinuierliches Engagement für Weiterbildung vermissen ließen, sabotierten sich selbst, so der Berater, in diesem Fall würden auch erhebliche Investitionen in Security-Tools und -Strategien ins Leere laufen: “Eine gut geschulte und gut vorbereitete Benutzerbasis ist die erste und stärkste Verteidigungslinie.” Sie wollen weitere interessante Beiträge rund um das Thema IT-Sicherheit lesen? Unser kostenloser Newsletter liefert Ihnen alles, was Sicherheitsentscheider und -experten wissen sollten, direkt in Ihre Inbox.
"Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26)

unit42.paloaltonetworks.com · 8 months ago

Self-replicating worm “Shai-Hulud” has compromised hundreds of software packages in a supply chain attack targeting the npm ecosystem. We discuss scope and more.
New Shai-Hulud worm spreading through npm, GitHub

www.csoonline.com · 8 months ago

A new Shai Hulud 2.0 credentials stealing worm is expanding through the open npm registry by using compromised package maintainer accounts to publish trojanized versions that execute during the preinstall phase and self propagate, with researchers observing thousands of attacker created GitHub repositories added every 30 minutes and hundreds of compromised packages. The malware exfiltrates developer and CI CD secrets to randomized repositories, injects malicious payloads into users packages, and adds capabilities including privilege escalation, DNS hijacking, and data deletion; indicators include files named setupbun.js and bunenvironment.js and known compromises include popular packages used by Zapier, ENS Domains, PostHog, Postman, and the AsyncAPI specs package which had more than 100 million lifetime downloads and is believed to be patient zero. Users who pulled affected packages during the November 21 through 23 window should assume compromise and are advised to clear npm caches, remove nodemodules, reinstall from clean versions or pin to pre malicious releases, rotate npm tokens GitHub personal access tokens SSH keys and cloud credentials, enable phishing resistant multifactor authentication, and in CI CD environments restrict lifecycle scripts and limit outbound network access and token lifetimes.
What OpenAI Did When ChatGPT Users Lost Touch With Reality

www.nytimes.com · 8 months ago

There are reports that OpenAI tweaked ChatGPT to appeal to more users, changes that critics and researchers say made the chatbot riskier for vulnerable people, especially young users, prompting concern about mental health and manipulation. There are now safety updates deployed by the company, including new moderation and parental controls and promises of stronger privacy protections, but officials and industry analysts warn that tighter safeguards could slow user growth and product adoption. There are also ongoing legal and regulatory pressures, including court fights over the production of millions of ChatGPT conversations and lawsuits alleging the chatbot harmed teenagers, which have both driven and complicated OpenAI's safety changes.
Split-Second Side Doors: How Bot-Delegated TOCTOU Breaks The CI/CD Threat Model

www.reddit.com · 8 months ago

There is a class of bot delegated time of check to time of use race conditions where automation bots with workflow write permissions can be tricked into promoting untrusted code from forks into trusted repositories, enabling insertion of malicious workflows that can access repository secrets. Exploitation typically occurs when a maintainer approval or bot trigger arrives, an attacker swaps benign content in the brief window before the bot copies the pull request head into an in repository branch, and the promoted malicious workflow runs with tokens that expose secrets or allow merges. This pattern was observed in multiple incidents including a copy pr bot used by NVIDIA, a GitHub Copilot assistant variant, and a Jupyter Notebook plugin, and coordinated disclosures led to fixes by the affected vendors. Recommended mitigations include pinning approvals to immutable commit SHAs, preferring pull request review events over issue comment triggers, removing workflow write permissions, using repository rulesets to prevent any identity from pushing to the repository workflows directory, storing sensitive secrets in environment secrets that require human reviewers, and ensuring security checks fail closed.
ShadowRay 2.0 Turns AI Clusters into Crypto Botnets

www.darkreading.com · 8 months ago

A threat actor is actively exploiting a remote code execution vulnerability in the open source Ray framework to hijack internet exposed AI clusters and convert them into self propagating cryptomining and data theft botnets. Attackers operating as IronErn440 leverage exposed Ray dashboards and job submission APIs, deliver AI generated payloads via GitLab and GitHub, deploy XMRig and Rigel miners, and exfiltrate MySQL credentials, cloud tokens and proprietary AI models; the flaw is tracked as CVE-2023-48022 and scans also flagged many clusters vulnerable to CVE-2025-48022. Organizations are advised to ensure Ray dashboards are not internet exposed, apply available hardening tools and best practices, and add an authorization layer to the Ray dashboard because the lack of a definitive patch and assumptions about self securing clusters have left many environments exploitable.