Blahalla

For One NFL Team, Tackling Cyber Threats Is Basic Defense

www.darkreading.com · 10 months ago

The NFL's cyberattack surface is expanding at an unprecedented rate. To find out more, we spoke with a cyber-defense coordinator from the Cleveland Browns.
Daniel Miessler on the AI Attack/Defense Balance

www.schneier.com · 10 months ago

His conclusion: Context wins Basically whoever can see the most about the target, and can hold that picture in their mind the best, will be best at finding the vulnerabilities the fastest and taking advantage of them. Or, as the defender, applying patches or mitigations the fastest. And if you’re on the inside you know what the applications do. You know what’s important and what isn’t. And you can use all that internal knowledge to fix things, hopefully before the baddies take advantage. Summary and prediction Attackers will have the advantage for 3-5 years. For less-advanced defender teams, this will take much longer.
Red Hat Investigates Widespread Breach of Private GitLab Repositories

www.darkreading.com · 10 months ago

A threat actor claimed 28,000 private repositories had been compromised, and the Linux software maker said it had "initiated necessary remediation steps."
Confucius Hackers Hit Pakistan With New WooperStealer and Anondoor Malware

thehackernews.com · 10 months ago

The threat actor known as Confucius has been attributed to a new phishing campaign that has targeted Pakistan with malware families like WooperStealer and Anondoor. "Over the past decade, Confucius has repeatedly targeted government agencies, military organizations, defense contractors, and critical industries -- especially in Pakistan, using spear-phishing and malicious documents as initial
Neue Phishing-Variante greift Gmail-Nutzer an

www.csoonline.com · 10 months ago

srcset="https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock2423047525.jpg?quality=50&strip=all 7008w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock2423047525.jpg?resize=300%2C168&quality=50&strip=all 300w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock2423047525.jpg?resize=768%2C432&quality=50&strip=all 768w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock2423047525.jpg?resize=1024%2C576&quality=50&strip=all 1024w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock2423047525.jpg?resize=1536%2C864&quality=50&strip=all 1536w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock2423047525.jpg?resize=2048%2C1152&quality=50&strip=all 2048w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock2423047525.jpg?resize=1240%2C697&quality=50&strip=all 1240w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock2423047525.jpg?resize=150%2C84&quality=50&strip=all 150w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock2423047525.jpg?resize=854%2C480&quality=50&strip=all 854w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock2423047525.jpg?resize=640%2C360&quality=50&strip=all 640w, https://b2b-contenthub.com/wp-content/uploads/2025/10/shutterstock2423047525.jpg?resize=444%2C250&quality=50&strip=all 444w" width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px" Hacker haben gefälschte PDF-Dateien an Gmail-Nutzer verschickt, die täuschend echt wirken. PraeStudio, shutterstock.com Forscher des Sicherheitsunternehmens Varonis haben eine raffinierte Phishing-Methode entdeckt, die auf Gmail-Nutzer zielt. Dabei kommt eine Malware zum Einsatz, die sich nicht nur als PDF-Anhang tarnt, sondern die Opfer automatisch dazu auffordert, diesen zu öffnen. „Der Dateityp.PDF ist im privaten und geschäftlichen Bereich allgegenwärtig geworden“, erklärt Erik Avakian, technischer Berater bei der Info-Tech Research Group. „Das schafft Vertrauen. Die Leute sehen eine PDF-Datei und gehen davon aus, dass sie sicher ist. Sie löst auch nicht die gleichen Alarmglocken aus wie andere Dateitypen, beispielsweise.exe oder.zip.“ So funktioniert der Angriff Die Angreifer haben ein Toolkit namens MatrixPDF entwickelt, das Phishing- und Malware-Funktionen in einem Builder bündelt. Es bettet gefälschte Eingabeaufforderungen, JavaScript-Aktionen und automatische Weiterleitungen in scheinbar legitime PDF-Dateien ein. Kriminelle Akteure können dabei den externen Link festlegen, zu dem die PDF-Datei weiterleitet. Zudem ermöglicht es MatrixPDF, Dokumente so zu ändern, dass sie überzeugend wirken. Zum Beispiel durch Einfügen eines Vorhängeschloss-Symbols oder eines Firmenlogos. Das Toolkit kann aber auch dazu verwendet werden, um den Inhalt des Dokuments zu verbergen. Die Forscher von Varonis haben zwei Möglichkeiten identifiziert, wie Angreifer MatrixPDF einsetzen: Im ersten Fall nutzen sie die Vorschaufunktion von Gmail aus. Die von ihnen erstellte PDF-Datei kann Sicherheitsvorkehrungen und Filter umgehen, da sie nur Skripte und einen externen Link enthält, aber keinen Standard-URL-Hyperlink, der normalerweise mit Malware in Verbindung gebracht wird. Die PDF-Datei wird normal gerendert, aber der Text des Dokuments ist unscharf, und die Benutzer erhalten eine Aufforderung zum „Öffnen des sicheren Dokuments”, die im Wesentlichen ein Phishing-Köder ist. Wenn das Opfer auf die Schaltfläche klickt, öffnet sich eine externe Website in seinem Browser. Die Forscher fanden sogar ein Beispiel, bei dem der eingebettete Link zu einem Download für einen legitimen SSH-Client auf einer öffentlichen Website führte. Angreifer umgehen Gmail-Sicherheitsfunktion „Die Methode umgeht die Sicherheitsvorkehrungen von Gmail, da die Malware-Prüfung nichts ‚Verdächtiges‘ findet“, erklären die Forscher. Der schädliche Inhalt wird nur abgerufen, wenn der Benutzer aktiv darauf klickt, was Gmail als von diesem initiiert und daher als ungefährlich interpretiert. Außerdem erfolgt der Datei-Download außerhalb der Antiviren-Sandbox der E-Mail-Plattform, sodass Sicherheitsfilter nicht eingreifen können. Die zweite MatrixPDF-Methode verwendet in PDF eingebettetes JavaScript. Das Opfer lädt die PDF-Datei herunter oder öffnet sie in einem Desktop-Reader (wie Adobe Acrobat) oder einem Browser-nativen Viewer und führt das Skript aus. Die PDF-Datei verbindet sich dann automatisch mit der Payload-URL und ruft eine Datei ab. „In der Regel zeigen PDF-Reader eine Sicherheitswarnung an, die den Benutzer darauf hinweist, dass ein Dokument versucht, auf eine externe Ressource zuzugreifen“, so die Security-Spezialisten. Bei dieser Methode wird das PDF jedoch so konfiguriert, dass es eine kurze URL aufruft, die „vage legitim“ erscheint. Das Opfer erhält daraufhin ein Popup mit einer Zugriffsanfrage. Klickt der Nutzer auf „Zulassen“, ruft das Skript den schädliche Workload ab und ´startet den Download; das Dokument wird dann auf dem Gerät des Benutzers gespeichert und die Malware ausgeführt. „Diese Methode ist erfolgreich, da der Benutzer keinen Link anklicken muss. Sie setzt jedoch darauf, dass der Benutzer die Berechtigung zum Zugriff erteilt“, heißt es im Forschungsbericht. „Als Waffe eingesetzte PDF-Dateien in Phishing-E-Mails sind seit langem ein Problem“, mahnt David Shipley von Beauceron Security. „Dieses Tool macht es Cyberkriminellen kinderleicht, solche Dateien zu erstellen.“ Nutzung privater E-Mails erhöht das Risiko für Unternehmen Mitarbeiter greifen zunehmend von Firmen-PCs aus auf private E-Mail-Konten zu, insbesondere in hybriden und Remote-Arbeitsumgebungen. Angesichts der Tatsache, dass Hacker Zugang zu einfach zu bedienenden Tools wie MatrixPDF haben, raten Experten Unternehmen jedoch zu erhöhter Wachsamkeit. „CISOs und CIOs sollten Möglichkeiten in Betracht ziehen, entweder den Zugriff auf private Webmail-Konten über die Unternehmensinfrastruktur zu beschränken oder festzustellen, wo dies tatsächlich erforderlich ist“, rät Avakian von InfoTech. „Private E-Mails verfügen einfach nicht über die gleichen Sicherheitsvorkehrungen wie E-Mail-Sicherheitsdienste von Unternehmen.“ Ensar Seker, CISO beim Threat-Intelligence-Unternehmen SOCRadar, bezeichnet diesen neuen E-Mail-Angriffsvektor als eine „gefährliche Weiterentwicklung des Social Engineering “. Er fügt hinzu: „Dadurch wird der Endpunkt zum schwächsten Glied in der Kill Chain. Sobald ein einzelnes Gerät kompromittiert ist, kann es zum Dreh- und Angelpunkt für laterale Bewegungen, den Diebstahl von Anmeldedaten oder den ersten Zugriff für die Bereitstellung von Ransomware werden.“ Wie sich Unternehmen wappnen können Die gute Nachricht ist jedoch laut Shipley von Beauceron, dass Phishing-Angriffe mit Anhängen tendenziell eine geringere Erfolgsquote haben. Das liegt daran, dass sie zusätzliche kognitive Anstrengungen und Schritte seitens des Benutzers erfordern, im Gegensatz zum einfachen Klicken auf einen Link in einer E-Mail. „Unternehmen sollten ein Gleichgewicht zwischen Investitionen in E-Mail-Filter und häufigen und effektiven Awareness-Schulungen finden“, merkte er an. „Letztendlich müssen die Mitarbeiter motiviert werden, wachsam zu bleiben.“ Seker von SOCRadar ergänzt: „CISOs müssen über technische Abwehrmaßnahmen hinausgehen und klare Leitplanken festlegen.Das bedeutet, bekannte schädliche Dateitypen zu blockieren, robuste Sandboxing-Lösungen für Anhänge einzusetzen und Endpunkt-Erkennung zu nutzen, um verdächtiges Dateiverhalten nach der Zustellung zu überwachen.“ Zudem empfiehlt er Unternehmen, Richtlinien durchsetzen, die es Mitarbeitern verbieten, auf Unternehmensgeräten auf private E-Mails zuzugreifen. „Die Aufklärung der Mitarbeiter über die Funktionsweise dieser Angriffe ist besonders wichtig in einer Zeit, in der selbst eine harmlos aussehende PDF-Datei die Spitze einer Spear-Phishing-Kampagne sein kann“. Seker fügte hinzu: „Letztendlich muss eine mehrschichtige Verteidigung nicht nur Zero Trust für Benutzer, sondern auch Zero Assumption für die Dateisicherheit umfassen.“ Avakian von Info-Tech stimmt zu. Angriffe vom Typ MatrixPDF böten eine „fantastische Gelegenheit“, um Sensibilisierungsmaßnahmen und Schulungen mit einfachen Visualisierungen und realistischen „Was-wäre-wenn“-Szenarien zu integrieren. Unternehmen sollten auch eine „Think Before You Click“-Kultur fördern und es ihren Mitarbeitern, der ersten Verteidigungslinie, leicht machen, verdächtige E-Mails zu melden. Ebenso wichtig sei es, dass Unternehmen darauf achten, „Mitarbeiter zu belohnen, die dies richtig machen“. „Anerkennung hat eine große Wirkung“, so Avakian. „Indem sie Mitarbeiter belohnen, die Phishing-Versuche erkennen und melden, können Sicherheitsverantwortliche das Bewusstsein schrittweise verbessern und eine sicherheitsbewusste Kultur fördern.“ (jm)
DeepSeek AI Models Are Easier to Hack Than US Rivals, Warn Researchers

www.techrepublic.com · 10 months ago

The US Commerce Chief has also issued a warning about DeepSeek that reliance on those AI models is "dangerous and shortsighted."
Phishing Is Moving From Email to Mobile. Is Your Security?

www.darkreading.com · 10 months ago

With SMS, voice, and QR-code phishing incidents on the rise, it's time to take a closer look at securing the mobile user.
Alert: Malicious PyPI Package soopsocks Infects 2,653 Systems Before Takedown

thehackernews.com · 10 months ago

Cybersecurity researchers have flagged a malicious package on the Python Package Index (PyPI) repository that claims to offer the ability to create a SOCKS5 proxy service, while also providing a stealthy backdoor-like functionality to drop additional payloads on Windows systems. The deceptive package, named soopsocks, attracted a total of 2,653 downloads before it was taken down. It was first
'Confucius' Cyberspy Evolves From Stealers to Backdoors in Pakistan

www.darkreading.com · 10 months ago

The long-running South Asian advanced persistent threat (APT) group is advancing its objectives against Pakistani targets, with a shift to deploying Python-based surveillance malware.
Automating Pentest Delivery: 7 Key Workflows for Maximum Impact

thehackernews.com · 10 months ago

Penetration testing is critical to uncovering real-world security weaknesses. With the shift into continuous testing and validation, it is time we automate the delivery of these results. The way results are delivered hasn’t kept up with today’s fast-moving threat landscape. Too often, findings are packaged into static reports, buried in PDFs or spreadsheets, and handed off manually to
ThreatsDay Bulletin: CarPlay Exploit, BYOVD Tactics, SQL C2 Attacks, iCloud Backdoor Demand & More

thehackernews.com · 10 months ago

From unpatched cars to hijacked clouds, this week’s Threatsday headlines remind us of one thing, no corner of technology is safe. Attackers are scanning firewalls for critical flaws, bending vulnerable SQL servers into powerful command centers, and even finding ways to poison Chrome’s settings to sneak in malicious extensions. On the defense side, AI is stepping up to block ransomware in real
Google Mandiant Probes New Oracle Extortion Wave Possibly Linked to Cl0p Ransomware

thehackernews.com · 10 months ago

Google Mandiant and Google Threat Intelligence Group (GTIG) have disclosed that they are tracking a new cluster of activity possibly linked to a financially motivated threat actor known as Cl0p. The malicious activity involves sending extortion emails to executives at various organizations and claiming to have stolen sensitive data from their Oracle E-Business Suite. "This activity began on or
How to Close Threat Detection Gaps: Your SOC's Action Plan

thehackernews.com · 10 months ago

Running a SOC often feels like drowning in alerts. Every morning, dashboards light up with thousands of signals; some urgent, many irrelevant. The job is to find the real threats fast enough to keep cases from piling up, prevent analyst burnout, and maintain client or leadership confidence. The toughest challenges, however, aren’t the alerts that can be dismissed quickly, but the ones that hide
Warning: Beware of Android Spyware Disguised as Signal Encryption Plugin and ToTok Pro

thehackernews.com · 10 months ago

Cybersecurity researchers have discovered two Android spyware campaigns dubbed ProSpy and ToSpy that impersonate apps like Signal and ToTok to target users in the United Arab Emirates (U.A.E.). Slovak cybersecurity company ESET said the malicious apps are distributed via fake websites and social engineering to trick unsuspecting users into downloading them. Once installed, both the spyware
Android Spyware in the UAE Masquerades as ... Spyware

www.darkreading.com · 10 months ago

In a clever, messed-up twist on brand impersonation, attackers are passing off their spyware as a notorious UAE government surveillance app.
Intel- und AMD-Chips physisch angreifbar

www.csoonline.com · 10 months ago

Chips von Intel und AMD sind laut Forschern anfällig für physische Cyberattacken. IM Imagery, shutterstock.com Mit „ Battering RAM “ und „ Wiretrap “ haben Forscher zwei mögliche Angriffsvektoren auf Chips von Intel und AMD entdeckt, wie sie etwa in Servern von Rechenzentren und Cloud-Anbietern verbaut werden. Wie das Nachrichtenportal Ars Technica berichtet, umgehen die Attacken Sicherheitsmaßnahmen der Hersteller auf der Hardware, so dass eigentlich verschlüsselte Informationen eingesehen, manipuliert und sogar mit Backdoors versehen werden können. Um Geheimnisse auf Chips zu schützen, speichern Hersteller bestimmte Prozesse und Daten in sogenannten Trusted Execution Enclaves (TEEs). Das sind dedizierte, verschlüsselte Subsysteme auf den Platinen. Intel nennt seine Variante davon SGX, bei AMD heißt es SEV-SNP. Die Attacken heben diese Verschlüsselung aus. Der Teufel im Detail Sowohl Battering RAM als auch Wiretrap funktionieren über einen sogenannten Interposer, ein Zwischenstück, das als physische, elektrische Brücke zwischen verschiedenen Chips und Komponenten dient. Dieser Interposer wird zwischen der CPU und dem Speichermodul installiert. Damit kann das Gerät Daten auslesen, die zwischen beiden Komponenten fließen. Die Krux liegt darin, dass sowohl AMD als auch Intel eine deterministische Verschlüsselung verwenden. Dabei wird aus denselben Klarinformationen mit einem bestimmten Schlüssel immer derselbe verschlüsselte Chiffretext generiert. Bei Daten, die ruhen und nicht verändert werden, beispielsweise auf einer Festplatte, ist dieser Verschlüsselung effektiv. Wenn die Daten aber in Bewegung sind, können Angreifer Veränderungen im Chiffretext beobachten, wenn der Klartext geändert wird. Im Gegensatz dazu ist die probabilistische Verschlüsselung gegen solche Angriffe resistent, da derselbe Klartext bei der Verschlüsselung in eine Vielzahl von Chiffretexten umgewandelt werden kann, die während des Verschlüsselungsprozesses zufällig ausgewählt werden. Battering RAM und Wiretrap kurz erklärt Battering RAM verwendet einen speziell angefertigten analogen Schalter als Interposer, der entweder innerhalb der Lieferkette oder vor Ort in den Rechenzentrenten eingebaut wird. Dieser führt dann entweder eine virtuelle Maschine oder eine Anwendung an einem ausgewählten Speicherort aus und liest zunächst den unlesbaren Chiffretext aus. Um diesen zu knacken, erstellt das Gerät anschließend Speicher-Aliase, bei denen zwei verschiedene Speicheradressen auf denselben Speicherort im Speichermodul verweisen. Später spielen die Angreifer den gestohlenen Chiffretext wieder ab, der, da er in dem Bereich ausgeführt wird, auf den der Angreifer Zugriff hat, dann als Klartext wiedergegeben wird. So können verschlüsselte Daten gestohlen und manipuliert werden. Mit Wiretrap können verschlüsselte Daten zwar ausgelesen, aber nicht verändert werden. Die physische Kompromittierung ähnelt Battering RAM: Über den Interposer wird Chiffretext abgefangen und mit einer Liste an bekannten Klartext-Teilen, aus denen die Chiffre erstellt wurde, verglichen. Mit der Zeit können Angreifer dann genügend Chiffretext klären, um den verwendeten Schlüssel zu rekonstruieren. Physische Sicherheit schützt vor physischen Attacken Sowohl Intel als auch AMD schließen physische Angriffe wie Battering RAM und Wiretap aus dem Bedrohungsmodell aus, gegen das ihre TEEs ausgelegt sind. Die einzig praktikable Lösung ist aktuell daher, anfällige Server vor dem physischen Zugriff durch Angreifer zu schützen, etwa durch Sicherheitsmaßnahmen im Rechenzentrum und Lieferantenmanagement, wie sie die ISO/IEC 27001 vorschreibt.
Disaster recovery and business continuity: How to create an effective plan

www.csoonline.com · 10 months ago

The core principles of disaster recovery (DR) and business continuity have remained relatively unchanged for decades: identify risks, conduct a business impact analysis, set recovery time objectives (RTOs), create a backup and restore plan, perform periodic testing. In simpler times, data lived on-prem, cyberthreats were less sophisticated, natural disasters were rare, organizations could probably get by with an outage that lasted hours, even days, weekly backups were sufficient, and regulations regarding data breaches were virtually nonexistent. Today, the volume of enterprise data has exploded and that data is everywhere (public cloud, SaaS, edge, IoT, OT, LLMs); AI-generated ransomware attacks are on the horizon; natural disasters are occurring far more often due to climate change; business units want to be up and running within minutes; and penalties for not reporting a cyberattack in a timely manner or failing to protect customer data are severe. If your disaster recovery and business continuity plan has been gathering dust on the shelf, it’s time for a full rebuild from the ground up. Key components include strategies such as minimum viable business (MVB); emerging technologies such as AI and generative AI; and tactical processes and approaches such as integrated threat hunting, automated data discovery and classification, continuous backups, immutable data, and gamified tabletop testing exercises. Backup-as-a-service (BaaS) and disaster recovery-as-a-service (DRaaS) are also becoming more popular, as enterprises look to take advantage of the scalability, cloud storage options, and ease-of-use associated with the “as-a-service” model. In fact, Gartner predicts that by 2029, 85% of large enterprises will adopt BaaS, alongside customer-managed deployments, to back up cloud and on-premises workloads, compared with 25% in 2025. Here are the steps CISOs need to take to build out a successful DR/business continuity plan in 2025. Step 1: Build C-level support, obtain funding, create a team Effective disaster recovery/business continuity requires significant upfront work and constant attention. It’s also costly in terms of additional storage resources, software tools, and staff time and effort. Ryan Whelan, global head of cyber intelligence at Accenture, says he recently surveyed CISOs in the retail and hospitality verticals on their priorities, and found that disaster recovery and business continuity skyrocketed from “not even in the top 10” in 2024 to No. 3 in 2025. Whelan says this shift is being driven at the C-suite and board level, where concerns over regulatory compliance, legal ramifications, and brand damage loom large. Whereas DR/business continuity was in the past primarily the domain of risk management and legal departments, with security playing a background role, CISOs are now at the forefront of these efforts, says Whelan. That prioritization of DR/business continuity is translating into increased funding. According to Forrester’s State of Resilience 2025 report, 37% of respondents expect funding to increase over the next 12 months, while only 4% expect it to decrease. The rest anticipated level funding. As Todd Renner, senior managing director in the cybersecurity practice at FTI Consulting, puts it, “Before something bad happens it’s harder to get the money; after something bad happens, it’s easier to get the money.” Once C-level support has been obtained, the next critical step is building a standing team that includes security, data center, storage, compliance, legal, risk management, business process, and internal and external communications. Organizations need to break down silos and create an interdisciplinary group that will continue to function as an ongoing entity, continually evolving to meet new threats. Specific roles include incident reporter, the person responsible for communicating with stakeholders; a plan manager, whose role is to make sure everyone performs the tasks assigned to them; and an asset manager, who is responsible for securing and protecting critical assets and reporting back on their status throughout the incident. Step 2: Identify risk, and locate all your data Identifying risk in a large, distributed enterprise is a complex task. Risks are everywhere, starting with cyberattacks (including insider attacks), and encompass human error, system failures (hardware, software, network), natural disasters, and third-party vulnerabilities associated with supply chains, cloud service providers, and SaaS providers. When Forrester asked survey respondents to identify the root cause of invocations of their DR/business continuity plans, the top causes were IT failure, natural disaster, IT security incident, supply chain disruption, and power outage. Each type of risk calls for a different response plan. Renner says that organizations often struggle to answer basic questions such as “Where is my data?” and “Who owns the data?” He adds, “The more complex the system is, the harder it is to identify system owners and to identify where the data is residing, including structured and unstructured data.” The good news is that there are AI-driven software tools that can scan structured and unstructured enterprise data to identify vulnerabilities, perform data discovery, and classify the data. Gartner predicts that by 2029, 90% of backup and data protection platforms products will integrate genAI to improve management and support operations, compared with fewer than 25% in 2025. Step 3: Conduct a business impact analysis Data doesn’t exist for its own sake; it’s there to support the business, so enterprises need to understand the business impact of a disaster and back up only what’s necessary. Still, when organizations go through the exercise of identifying all the bits and pieces of a complex business process, it can become overwhelming, particularly in a hybrid or multicloud environment rife with microservices, containers, APIs, identity and access controls, SaaS applications, and so on. Accenture’s Whelan says that rather than try to restore the entire business in the event of a disaster, a better approach might be to create a skeletal replica of the business, an MVB, that can be spun up immediately to keep mission-critical processes going while traditional backup and recovery efforts are under way. This type of “out-of-the-box” fail-over system could include a core functions such as email, which would enable the organization to communicate internally and externally, while other, less time-sensitive functions like ERP are recovered. This MVB approach requires tight integration between business units and technology teams, Whelan says. They need to work together to conduct dependency mapping aimed at identifying critical business functions and the technology components associated with that function. Step 4: Backups strategies shift from 3-2-1 to 3-2-1-1-0 The basic 3-2-1 backup strategy that has been standard for many years is no longer sufficient. The idea of having three copies of data on two different backup formats, with one copy located offsite, is being replaced with 3-2-1-1-0. The two additional elements are: one offline, immutable, or air-gapped backup that will enable organizations to get back on their feet in the event of a ransomware attack, and a goal of zero errors. Immutable data is “the gold standard,” Whelan says, but there are complexities associated with proper implementation. For example, in the event of a disaster, how does an enterprise know when the last snapshot occurred? And how does an enterprise verify that the data being saved in an immutable data store is accurate and not corrupted? “We’re still finding that data cleanliness and providence is a major issue for organizations,” he adds. FTI’s Renner points out that AI-driven backup and restore platforms can continuously scan enterprise data for accuracy, and develop recommendations for how often snapshots should be taken, where data should be stored, and what data needs to be backed up. And Gartner estimates that 35% of enterprises will implement agentic AI to perform autonomous backup operations by 2029, up from less than 2% in 2025. Step 5: Create the plan and test it There are many templates for creating the actual plan document, and AI systems can automate the process. The plan needs to be clear, and it needs to document procedures for incident detection and reporting, communication with internal and external stakeholders, emergency response in the event of a natural disaster, IT recovery, business continuity, and roles and responsibilities for relevant parties. But the plan must be tested. According to the Forrester report, “Unfortunately, the testing situation is largely unchanged since 2008. For all test types, most organizations only test once per year with plan walk-throughs and tabletop exercises, and as tests become more extensive, test frequency declines, 41% of respondents said that they never performed a full simulation.” Forward-thinking companies are trying to make tabletop exercises more effective by switching from a static PowerPoint presentation to interactive, gamified experiences that are more realistic and compelling, Renner says. “I’ve never seen a tabletop not be effective in teaching someone a portion of their business they weren’t thinking about ahead of time,” he adds. Step 6: Managing the aftermath The final piece of the puzzle is the post-mortem, taking stock in the aftermath of a disaster. Organizations need to pinpoint what went wrong and determine how it can be prevented in the future. And Gartner analyst Michael Hoeck argues that backup copies of enterprise data don’t have to just sit there; they can be put to good use. He predicts that by 2029, 30% of enterprises will make use of backup copies of data for analytics and inference, up from less than 5% in 2025.
When a Driverless Car Makes an Illegal U-Turn, Who Gets the Ticket?

www.nytimes.com · 10 months ago

California approved a law last year allowing the police to cite autonomous vehicles, but it did not specify any penalties, and the law doesn’t take effect until 2026.
That innocent PDF is now a Trojan Horse for Gmail attacks

www.csoonline.com · 10 months ago

Enterprise users know by now that they shouldn’t click on suspicious-looking links or download strange files. But what about innocuous, ever-present PDFs? Researchers at security company Varonis have uncovered a crafty new Gmail phishing attack that not only masquerades as a PDF attachment, but automatically prompts victims to open it. The MatrixPDF toolkit fools victims by using blurred content and overlays, and embeds JavaScript to bypass filters and fetch malicious payloads without user knowledge. “The.pdf file type has become ubiquitous in personal and business use,” said Erik Avakian, a technical counselor at Info-Tech Research Group. “This leads to trust. People see a.pdf and assume it’s safe. It doesn’t really raise the same red flags as other attachment file types might, such as.exe or.zip.” Why MatrixPDF works MatrixPDF embeds fake prompts, JavaScript actions, and automatic redirecting into seemingly legitimate PDF files. Malicious actors can specify the external link the PDF directs to when victims click on a prompt, modify the document’s appearance so it appears convincing (incorporating a padlock icon or corporate logo, for example), and blur documents to conceal their content. The Varonis researchers identified two ways attackers use MatrixPDF: In the first, they exploit Gmail’s preview function. The PDF they generate can slip past security safeguards and filters because it only contains scripts and an external link, not a standard URL hyperlink typically associated with malware. The PDF renders normally, but document text is blurred, and users get a prompt to “Open Secure Document,” which is essentially a phishing lure. When the victim clicks the button, an external site opens in their browser. Researchers even found one example where the embedded link pointed to a download for a legitimate SSH client hosted on a public site. The method evades Gmail’s security because malware scanning finds nothing “incriminating,” the researchers point out; malicious content is only fetched when the user actively clicks, which Gmail interprets as user-initiated and therefore not dangerous. Further, the file download occurs outside the email platform’s antivirus sandbox, so security filters can’t intervene. The technique reveals how attackers can split an attack across an email (the delivery) and the web (the payload retrieval) to avoid detection, according to the researchers. The second MatrixPDF method uses PDF-embedded JavaScript; the victim downloads or opens the PDF in a desktop reader (like Adobe Acrobat) or a browser-native viewer, executing the script. The PDF then automatically connects to the payload URL and fetches a file. Typically, PDF readers display a security warning alerting users that a document is attempting to access an external resource, the researchers note. But this method configures the PDF to reach out to a short URL that seems “vaguely legitimate,” and the victim gets a pop-up permission request. When they click “allow,” the script fetches the malicious payload and initiates a download; the document is then saved to the user’s device and malware is executed. This method is successful because the user doesn’t have to click on a link; it does, however, hinge on the user granting permission to access it, according to the researchers. “Weaponized PDFs in phishing e-mails have been a longstanding pain,” said David Shipley of Beauceron Security. “What this tool does is make it dirt simple for cybercriminals to create them.” Personal email use increases enterprise risk Employees are increasingly accessing personal email accounts from corporate machines; it is commonplace in hybrid and remote work environments. But considering that hackers have access to easily-usable tools like MatrixPDF, experts advise enterprises to be more vigilant. CISOs and CIOs should consider opportunities to either restrict access to personal webmail when on corporate infrastructure, or identify where it is legitimately needed, said InfoTech’s Avakian. Personal email simply doesn’t have the same safeguards as corporate email security services. PDFs don’t raise the same red flags as other attachment files such as.exe or.zip, he noted. “The bad guys know this and prey upon this type of psychological norm,” said Avakian. When successful, they can gain access to a network and move laterally, further escalate privileges, and plant more malware. This new email attack vector is a “dangerous evolution of social engineering,” noted Ensar Seker, CISO at threat intel company SOCRadar. “[It turns] the endpoint into the weakest link in the kill chain,” he said. “Once compromised, a single device can become a pivot point for lateral movement, credential theft, or initial access for ransomware deployment.” How enterprises can arm themselves The good(ish) news, however, according to Beauceron’s Shipley, is that of the various types of phishes, from link-based, to attachment-based, to QR-code scanning, attachments tend to have a lower success rate. This is because they require additional cognitive effort and steps performed by the user, versus just clicking on a link in an e-mail. Organizations should balance investment in email filters with security awareness training that’s done “frequently and effectively,” he noted. Ultimately, employees have to be motivated to remain vigilant. CISOs must go beyond technical defenses and establish clear guardrails, advised SOCRadar’s Seker. This means blocking known-bad file types, deploying robust attachment sandboxing, and using endpoint detection to monitor suspicious file behavior post-delivery. Enterprises should also enforce policies that prohibit employees from accessing personal email on corporate devices, he said. Educating employees on how these attacks work is especially important in an era where “[even] a benign-looking PDF can be the tip of a spear phishing campaign.” Seker added: “Ultimately, layered defense must include not just zero trust for users, but zero assumption for file safety.” Info-Tech’s Avakian agreed, saying the MatrixPDF type of attack provides a “fantastic opportunity,” particularly during Cybersecurity Awareness Month, to bake in awareness measures and training with simple visualizations and real-world “What-If” scenarios. Enterprises should also support a “Think Before You Click” culture and make it easy for employees, the first line of defense, to report suspicious emails. Just as importantly, he advised organizations to make a point of “catching people doing this right.” “Recognition goes a long way,” said Avakian. “By recognizing employees who spot and report phishing attempts, security leaders can incrementally improve awareness and enable a security-minded culture.”
Cisco IOS and IOS XE Software TACACS+ Authentication Bypass Vulnerability

sec.cloudapps.cisco.com · 10 months ago

A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to view sensitive data or bypass authentication. This vulnerability exists because the system does not properly check whether the required TACACS+ shared secret is configured. A machine-in-the-middle attacker could exploit this vulnerability by intercepting and reading unencrypted TACACS+ messages or impersonating the TACACS+ server and falsely accepting arbitrary authentication requests. A successful exploit could allow the attacker to view sensitive information in a TACACS+ message or bypass authentication and gain access to the affected device. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-tacacs-hdB7thJw This advisory is part of the September 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. <br/Security Impact Rating: High <br/CVE: CVE-2025-20160
Smashing Security podcast #437: Salesforce’s trusted domain of doom

grahamcluley.com · 10 months ago

Researchers uncovered a security flaw in Salesforce’s shiny new Agentforce. The vulnerability, dubbed "ForcedLeak", let them smuggle AI-read instructions in via humble Web-to-Lead form... and ended up spilling data for the low, low price of five dollars. And we discuss why data breach communicationss still default to "we take security seriously" while quietly implying "assume no breach" - until the inevitable walk-back. Plus, we take a look at ITV's phone-hacking drama with David Tennant, and take a crack at decoding the history of the Rosetta Stone. Hear all this and more in episode 437 of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley, joined this week by special guest Paul Ducklin.
Cisco Cyber Vision Center Stored Cross-Site Scripting Vulnerabilities

sec.cloudapps.cisco.com · 10 months ago

Multiple vulnerabilities in the web-based management interface of Cisco Cyber Vision Center could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. These vulnerabilities exist because the web-based management interface of an affected system does not sufficiently validate user-supplied input. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit CVE-2025-20356, the attacker must have valid administrative credentials that allow access to the Sensor Explorer page. By default, Admin and Product user roles have this access, as do any custom users that are configured to allow access to the Sensors page. To exploit CVE-2025-20357, the attacker must have valid administrative credentials that allow access to the Reports page. By default, all pre-defined user roles have this access, as do any custom users that are configured to allow access to the Reports page. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cv-xss-rwRAKAJ9 <br/Security Impact Rating: Medium <br/CVE: CVE-2025-20356,CVE-2025-20357
Cisco Unified Communications Manager Stored Cross-Site Scripting Vulnerability

sec.cloudapps.cisco.com · 10 months ago

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-stored-xss-Fnj66YLy <br/Security Impact Rating: Medium <br/CVE: CVE-2025-20361
Chinese APT group Phantom Taurus targets gov and telecom organizations

www.csoonline.com · 10 months ago

Researchers have documented a previously unknown threat actor that aligns with China’s intelligence collection interests. The group primarily targets government and telecommunications organizations from Africa, the Middle East, and Asia with the goal of maintaining long-term covert access to critical systems. Over the past two years researchers from Palo Alto Networks have investigated separate clusters of malicious activity that have now been attributed to the same group: Phantom Taurus. Before, the company tracked these attacks under temporary names, such as CL-STA-0043, TGR-STA-0043, or Operation Diplomatic Specter. “Our observations show that Phantom Taurus’ main focus areas include ministries of foreign affairs, embassies, geopolitical events, and military operations,” the researchers wrote in their new report. “The group’s primary objective is espionage. Its attacks demonstrate stealth, persistence and an ability to quickly adapt their tactics, techniques and procedures (TTPs).” Part of the group’s extensive toolset of custom-developed malware tools includes a suite of three previously undocumented backdoors for Microsoft Internet Information Services (IIS) web servers that the researchers dubbed NET-STAR. Other tools include in-memory Visual Basic script implants, a malware family called Specter that includes the TunnelSpecter DNS tunneling program and SweetSpecter remote access trojan, Agent Racoon, PlugX, Gh0st RAT, China Chopper, Mimikatz, Impacket, and many other dual-use tools and system administration utilities. A change in tactics Previously, Phantom Taurus focused on harvesting mailboxes of interest from Exchange servers that were compromised using known vulnerabilities such as ProxyLogon (CVE-2021-26855) and ProxyShell (CVE-2021-34473). But this year the researchers noticed that the attackers had started searching for and extracting data from SQL databases. The group uses the Windows Management Instrumentation (WMI) tool to execute a script called mssq.bat that connects to an SQL database using the sa (system administrator) ID with a password previously obtained by the attackers. It then performs a dynamic search for specific keywords specified in the script, saving the results as a CSV file. “The threat actor used this method to search for documents of interest and information related to specific countries such as Afghanistan and Pakistan,” the researchers said. NET-STAR malware suite A newly discovered addition to Phantom Taurus’ toolset this year is a set of web-based backdoors designed to interact with IIS web servers. The main component, called IIServerCore, operates within the memory of the w3wp.exe IIS worker process and is capable of loading other fileless payloads directly into memory, executing arbitrary commands and command-line arguments. “The initial component of IIServerCore is an ASPX web shell named OutlookEN.aspx,” the researchers wrote. “This web shell contains an embedded Base64-compressed binary, the IIServerCore backdoor. When the web shell executes, it loads the backdoor into the memory of the w3wp.exe process and invokes the Run method, which is the main function of IIServerCore.” Another component, called AssemblyExecuter V1, is designed to execute.NET assembly bytecode in memory, whereas the enhanced version, AssemblyExecuter V2, is capable of bypassing the Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW). “The component’s seemingly benign code structure results in minimal flagging by antivirus engines on VirusTotal, at the time of writing this article,” the researchers said. “This demonstrates a technique that threat actors can use to create tools that avoid overt code, which detection systems might interpret as malicious.” Phantom Taurus uses APT operational infrastructure associated in the past exclusively with other Chinese threat actors, such as Iron Taurus (aka APT27), Starchy Taurus (aka Winnti), and Stately Taurus (aka Mustang Panda). However, the specific infrastructure components used by Phantom Taurus have not been observed with the other groups, suggesting this is a separate group that compartmentalizes its operations.
Google Sheds Light on ShinyHunters' Salesforce Tactics

www.darkreading.com · 10 months ago

Mandiant provided proactive defenses against UNC6040's social engineering attacks that have led to several Salesforce breaches.
Shutdown Threatens US Intel Sharing, Cyber Defense

www.darkreading.com · 10 months ago

Lapse of critical information sharing and mass furloughs at CISA are just some of the concerns.
What Does the Government Shutdown Mean for Cybersecurity?

www.techrepublic.com · 10 months ago

CISA is among the government agencies affected. The shutdown is a reminder for government contractors to harden their cybersecurity.
Heaviest Users of Snapchat Will Face a Small Charge for Storage

www.nytimes.com · 10 months ago

The social media company will charge after users reach five gigabytes of free storage, which is in line with other tech giants’ policies.
Your favourite phone apps might be leaking your company’s secrets

www.fortra.com · 10 months ago

Most of the apps on your phone are talking to a server somewhere - sending and receiving data through messages sent through APIs, the underlying infrastructure that allows apps to communicate. And here's the problem - hackers have determined that the APIs of mobile apps, when left visible and exploitable, can be a goldmine. Read more in my article on the Fortra blog.
Google Adds AI-Powered Ransomware Protection and Recovery to Drive for Desktop

www.techrepublic.com · 10 months ago

This new ransomware detection is available in beta in Google Drive for desktop on Windows or macOS, with a general release expected by the end of the year.
New WireTap Attack Extracts Intel SGX ECDSA Key via DDR4 Memory-Bus Interposer

thehackernews.com · 10 months ago

In yet another piece of research, academics from Georgia Institute of Technology and Purdue University have demonstrated that the security guarantees offered by Intel's Software Guard eXtensions (SGX) can be bypassed on DDR4 systems to passively decrypt sensitive data. SGX is designed as a hardware feature in Intel server processors that allows applications to be run in a Trusted Execution
UK Police Convicts Pair in £5.5 Billion Bitcoin Launder Case

www.techrepublic.com · 10 months ago

Two defendants pleaded guilty in a Bitcoin laundering case tied to the UK's record crypto seizure. The Met’s seven-year probe moves to sentencing 10, 11 November.
Microsoft plots new path for Sentinel, adding agentic AI features

www.csoonline.com · 10 months ago

Microsoft has announced a raft of new AI features for Sentinel SIEM and Security Copilot as part of its push to turn them into fully “agentic platforms.” The announcement has several parts, starting with perhaps the biggest news: Sentinel, the company’s cloud SIEM platform first released nearly seven years ago in public preview, is getting the first of what might be a series of AI upgrades. This process began in July with the public preview of Sentinel data lake for customer evaluation, which this week has reached general availability (GA). However, this week that platform also gains significant new capabilities in the form of Sentinel graph, and Sentinel Model Context Protocol (MCP) Server, both in Public Preview versions that let customers evaluate new features before the GA launch. As its name implies, Sentinel data lake gives customers a place to store large volumes of structured and unstructured Sentinel log data they might otherwise have to dispose of for reasons of cost or practicality. Underlying this is the general-purpose Azure Data Lake Storage system, which makes Sentinel data lake a managed version of that oriented towards long-term data retention for up to 12 years. Sentinel graph gives defenders a system for mapping and visualizing the relationship between SIEM log data to better understand where an attacker might have left traces of entry. Instead of manually relating dozens of separate alerts, graph will correlate these automatically. The idea behind graph is to make these connections easier to see. Importantly, the graphs it generates can be ingested by AI agents, a pointer to the importance of these for the platform’s future. The new Sentinel MCP Server is an open protocol connector that ties Sentinel to its AI capabilities. This makes it possible for AI agents to hook into things like Sentinel graph using MCP as the communication protocol. As Microsoft said in its announcement, “MCP standardizes how an AI talks to systems. Instead of developers writing custom connectors for each application, the MCP server presents a menu of available actions to the AI in a language it understands. Any AI application that speaks MCP can connect.” Microsoft and its partners already offer a range of pre-built AI agents as part of Security Copilot. Now customers will be able to build their custom agents without the need to code this from scratch. Instead, through the Security Copilot portal, it will be possible to build an agent using natural language prompts to connect with wider infrastructure via MCP Server. Customers will be able to find third-party agents through a revamped Microsoft Security Store. Agent saviors? Microsoft is marketing the new features as the moment when its SIEM enters the agentic AI era, but does this stand up to scrutiny? Although Sentinel is still in the early days of its development as an agentic platform, an outline of where it wants to go with the technology is starting to emerge. Even with automation, security tools can be complex to manage, consuming precious skills and time. Agentic AI is Microsoft’s answer: Use agents to do more of the hard work and, in some cases, make decisions. These agents will communicate with established platforms and tools using MCP, allowing organizations to program them using time-saving prompts backed by vibe coding tools. According to Clive Watson, solutions director for UK Microsoft MSSP Quorum Cyber, the Sentinel announcements marked the biggest update to the platform since its launch. Quorum’s customers were already using the Sentinel data lake: “This benefits both ourselves and our customers as we can encourage them to store data that they may have decided not to keep in the past due to the costs,” said Watson. “Another benefit of the data lake is the separation of the storage from the query costs, ideal for the common type of data that data lake is designed for. Customers only pay for queries they use, storage costs are decoupled from query and compute costs.” “Storing data in the right classification or tier also aids Sentinel graph because the more data we have the better solutions like graph will be to show relationships,” he said. Commentators have long speculated that Microsoft might turn into a cyber security company by the back door. The latest announcement doesn’t go that far, it’s still a cloud and applications platform backed by a legacy OS, but it shows how AI-based cyber security services could turn into an important part of its evolving ecosystem. Agentic AI is emerging as the next big thing in security management. But despite its benefits, it still has limitations today, including a tendency to create noise and false positives. The other risk with machine-dominated security is that agentic AI itself becomes a new attack surface that inadvertently exposes data or assets. Bad actors will build their own agents, exploiting the same access to MCP or Google’s Agent-to-Agent (A2A) protocol, and will attempt to poison or socially engineer agents with hidden malicious prompts. This has already happened as a proof of concept. In June, researchers uncovered a way of tricking Microsoft 365 Copilot into revealing sensitive data in the first ever ‘no-click’ attack targeting agents ( CVE-2025-32711 ) using prompts hidden in the metadata of an email.
Cybersecurity Awareness Month: Security starts with you

www.microsoft.com · 10 months ago

At Microsoft, we believe that cybersecurity is as much about people as it is about technology. Explore some of our resources for Cybersecurity Awareness Month to stay safe online.
A $50 'Battering RAM' Can Bust Confidential Computing

www.darkreading.com · 10 months ago

Researchers have demonstrated an attack that can break through modern Intel and AMD processor technologies that protect encrypted data stored in memory.
Spam and Scams Proliferate in Facebook’s Political Ads

www.nytimes.com · 10 months ago

A new analysis of political advertisers found that the platform profits from ads that include deepfakes and other content prohibited by its own policies.
Undead Operating Systems Haunt Enterprise Security Networks

www.darkreading.com · 10 months ago

Windows 10 reaches end-of-life on Oct. 14, which will triple the number of vulnerable enterprise systems and create a massive attack surface for cybercriminals.
A Tech Expo Shows What China Can Make, but Not Who’ll Buy It All

www.nytimes.com · 10 months ago

The vast Global Digital Trade Expo in Hangzhou stood as a rebuke to U.S. efforts to hem in China’s technology. But the real competition is internal, and profits are hard to find.
OneLogin Bug Let Attackers Use API Keys to Steal OIDC Secrets and Impersonate Apps

thehackernews.com · 10 months ago

A high-severity security flaw has been disclosed in the One Identity OneLogin Identity and Access Management (IAM) solution that, if successfully exploited, could expose sensitive OpenID Connect (OIDC) application client secrets under certain circumstances. The vulnerability, tracked as CVE-2025-59363, has been assigned a CVSS score of 7.7 out of 10.0. It has been described as a case of
Learn How Leading Security Teams Blend AI + Human Workflows (Free Webinar)

thehackernews.com · 10 months ago

AI is changing automation, but not always for the better. That’s why we’re hosting a new webinar, "Workflow Clarity: Where AI Fits in Modern Automation," with Thomas Kinsella, Co-founder & Chief Customer Officer at Tines, to explore how leading teams are cutting through the hype and building workflows that actually deliver.The rise of AI has changed how organizations think about automation.
Red Hat OpenShift AI Flaw Exposes Hybrid Cloud Infrastructure to Full Takeover

thehackernews.com · 10 months ago

A severe security flaw has been disclosed in the Red Hat OpenShift AI service that could allow attackers to escalate privileges and take control of the complete infrastructure under certain conditions. OpenShift AI is a platform for managing the lifecycle of predictive and generative artificial intelligence (GenAI) models at scale and across hybrid cloud environments. It also facilitates data
Introducing Sophos Advisory Services

news.sophos.com · 10 months ago

See how your networks, systems, and employees stand up to simulated attacks before an adversary strikes.
Use of Generative AI in Scams

www.schneier.com · 10 months ago

New report: “ Scam GPT: GenAI and the Automation of Fraud.” This primer maps what we currently know about generative AI’s role in scams, the communities most at risk, and the broader economic and cultural shifts that are making people more willing to take risks, more vulnerable to deception, and more likely to either perpetuate scams or fall victim to them. AI-enhanced scams are not merely financial or technological crimes; they also exploit social vulnerabilities whether short-term, like travel, or structural, like precarious employment. This means they require social solutions in addition to technical ones. By examining how scammers are changing and accelerating their methods, we hope to show that defending against them will require a constellation of cultural shifts, corporate interventions, and effective legislation
Hackers Exploit Milesight Routers to Send Phishing SMS to European Users

thehackernews.com · 10 months ago

Unknown threat actors are abusing Milesight industrial cellular routers to send SMS messages as part of a smishing campaign targeting users in European countries since at least February 2022. French cybersecurity company SEKOIA said the attackers are exploiting the cellular router's API to send malicious SMS messages containing phishing URLs, with the campaigns primarily targeting Sweden, Italy
2025 Cybersecurity Reality Check: Breaches Hidden, Attack Surfaces Growing, and AI Misperceptions Rising

thehackernews.com · 10 months ago

Bitdefender’s 2025 Cybersecurity Assessment Report paints a sobering picture of today’s cyber defense landscape: mounting pressure to remain silent after breaches, a gap between leadership and frontline teams, and a growing urgency to shrink the enterprise attack surface. The annual research combines insights from over 1,200 IT and security professionals across six countries, along with an
Cyber-Bedrohungslage in der EU verschärft sich

www.csoonline.com · 10 months ago

Ransomware liegt weiter im Trend bei Cyberkriminellen. Studio-M, shutterstock.com Die Bedrohungslage für Europas digitale Infrastruktur hat sich weiter verschärft. Das geht aus dem neuen Bericht der EU-Agentur für Cybersicherheit ENISA hervor. In dem Report wird Erpresser-Software («Ransomware») als die Bedrohung mit den größten Auswirkungen in der EU genannt. Hohe Schäden durch Ransomware Ransomware ist eine spezielle Art von Schadsoftware, die den Computer oder die darauf gespeicherten Daten der Opfer quasi in Geiselhaft nimmt. Das bedeutet: Nach einer Infektion werden in der Regel wichtige Dateien oder sogar das ganze System so verschlüsselt oder gesperrt, dass kein Zugriff mehr möglich ist. Danach fordern die Täter vom Besitzer ein Lösegeld (englisch: «ransom»), meist in Kryptowährungen wie Bitcoin, und versprechen, die Sperre oder Verschlüsselung nach Zahlung wieder aufzuheben. Ein Befall mit Ransomware führte auch zu den jüngsten Computerstörungen an mehreren europäischen Flughäfen, darunter auch am BER von Berlin/Brandenburg und in London Heathrow. Die Schäden der Hackerangriffe sind in diesen Fällen oft enorm, weil es den Opfern nicht gelingt, ihre Systeme aus Backups wiederherzustellen. Zahlreiche DDoS-Angriffe Zahlenmäßig liegen jedoch sogenannte DDoS-Attacken im ENISA-Report an der Spitze. Sie machen mit 77 Prozent den Großteil der gemeldeten Vorfälle aus. Dabei überschütten die Angreifer die Rechner der Opfer mit so großen Mengen an Datenanfragen, dass die Server in die Knie gehen und nicht mehr funktionieren. Häufig fallen bei den Denial-of-Service-Attacken die Schäden nicht so hoch aus wie bei den Ransomware-Angriffen, weil nach der befristeten Attacke die Server wieder laufen und funktionieren. Die meisten der DDoS-Angriffe stammen von «Hacktivisten», während Cyberkriminelle nur eine kleinere Rolle spielten. Die Analyse basiert auf 4875 Vorfällen zwischen Juli 2024 und Juni 2025, wie die ENISA in Athen mitteilte. ENISA-Direktor Juhan Lepassaar sagte: «Die zunehmende Abhängigkeit von digitalen Systemen führt dazu, dass Störungen sich über gesamte Lieferketten hinweg auswirken können.» Öffentliche Verwaltung Ziel von Cyberangriffen Aus dem Bericht geht hervor, dass die öffentliche Verwaltung in der EU mit einem Anteil von 38,2 Prozent zu den am häufigsten angegriffenen Bereichen zählt. Im Fokus stehen dabei insbesondere diplomatische und staatliche Einrichtungen, die Ziel von Hacktivisten sowie staatlich unterstützten Gruppen im Rahmen von Cyber-Spionagekampagnen werden. An zweiter Stelle folgt der Verkehrssektor mit 7,5 Prozent der registrierten Vorfälle. Danach reihen sich digitale Infrastrukturen und Dienste (4,8 Prozent), der Finanzsektor (4,5 Prozent) sowie die Industrie (2,9 Prozent) ein. Künstliche Intelligenz verstärkt Angriffsstrategien Besorgniserregend ist nach Einschätzung der ENISA der verstärkte Einsatz von Künstlicher Intelligenz. Über 80 Prozent der global beobachteten Social-Engineering-Aktivitäten seien inzwischen KI-gestützt, heißt es in dem Bericht der EU-Agentur für Cybersicherheit, die ihren Sitz in Athen hat. Beim Social Engineering werden etwa gefälschte Anweisungen von Vorgesetzten mit KI erzeugt («Boss-Mails»), die Angestellte dazu verleiten, hohe Summen an die Angreifer zu überweisen. (dpa/ad)
TOTOLINK X6000R: Three New Vulnerabilities Uncovered

unit42.paloaltonetworks.com · 10 months ago

Researchers identified vulnerabilities in TOTOLINK X6000R routers: CVE-2025-52905, CVE-2025-52906 and CVE-2025-52907. We discuss root cause and impact.
Spotlight report: Securing the cloud

us.resources.csoonline.com · 10 months ago

Download the October 2025 issue of the Enterprise Spotlight from the editors of CIO, Computerworld, CSO, InfoWorld, and Network World. aria-label="Embed of Spotlight report: Securing the Cloud." Spotlight report: Securing the Cloud Download
New Android Banking Trojan “Klopatra” Uses Hidden VNC to Control Infected Smartphones

thehackernews.com · 10 months ago

A previously undocumented Android banking trojan called Klopatra has compromised over 3,000 devices, with a majority of the infections reported in Spain and Italy. Italian fraud prevention firm Cleafy, which discovered the sophisticated malware and remote access trojan (RAT) in late August 2025, said it leverages Hidden Virtual Network Computing (VNC) for remote control of infected devices and
Ukraine Warns of CABINETRAT Backdoor + XLL Add-ins Spread via Signal ZIPs

thehackernews.com · 10 months ago

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of new targeted cyber attacks in the country using a backdoor called CABINETRAT. The activity, observed in September 2025, has been attributed to a threat cluster it tracks as UAC-0245. The agency said it spotted the attack following the discovery of software tools taking the form of XLL files, which refer to Microsoft Excel