Author: Staff Writer
Staff Writer
John Marcelli is a staff writer for the CISO Brief, with a passion for exploring and writing about the ever-evolving world of technology. From emerging trends to in-depth reviews of the latest gadgets, John stays at the forefront of innovation, delivering engaging content that informs and inspires readers. When he's not writing, he enjoys experimenting with new tech tools and diving into the digital landscape.
Quick Takeaways VulnCheck disclosed 14 flaws in Copeland/Dixell XWEB EVO refrigeration systems; testing found each could enable administrative or “root” access, and at least two are reportedly exploited in the wild. The vulnerabilities have been patched, but unupdated legacy systems remain exposed; Copeland urges customers to install updates and keep units off the public internet. XBOW honeypots mimicking refrigeration controllers drew probes within a day, including attempted logins and changes to simulated freezer temperatures. The findings come amid hacks affecting French supermarkets and suspected attacks on U.S. military refrigeration units, highlighting the risks of internet-connected industrial equipment. The Issue CyberScoop…
Fast Facts SBI customer data surfaced on the dark web: 3,897 identified records exposed contact, identity, address, branch and loan-related details. Recurring breach routes include compromised credentials, exposed third-party servers and cryptographic vulnerabilities. Breaches may evade internal detection: external threat-intelligence providers and agencies flagged the SBI incident. 1. Threat, Techniques, and Targets State Bank of India (SBI) reported that its preliminary analysis identified 3,897 customer records with personal information among about 375,000 records found on the dark web. The exposed data reportedly included names, contact details, dates of birth, addresses, branch details, customer identifiers, and loan or lead metadata. The…
Active ScreenConnect abuse: Since November 11, 2026, attackers have accessed MSP cloud instances and used them to deploy unauthorized remote-access clients and SCKit. SCKit persists and spreads: The toolkit installs hidden clients, scheduled tasks, and registry entries, then uses RelayTrap to target technicians connecting from vulnerable workstations. Technician sessions are at risk: SCKit can steal ScreenConnect browser authentication cookies and use console access to distribute payloads to other managed devices. Investigate beyond client removal: Check technician and customer endpoints, disable affected extensions, update technician clients, revoke exposed sessions, and remove persistence and unauthorized access. Remote Support Is Part of the…
Top Highlights The U.K. NCSC launched the Cyber Adversary Simulation (CyAS) scheme to help critical infrastructure and other organizations test their resilience against realistic cyberattacks. NCSC-assured providers will conduct tailored, end-to-end simulations—going beyond standard penetration tests—to assess organizations’ ability to prevent, detect and respond to attacks. CyAS can reveal weaknesses, validate monitoring and incident response, and inform security investment; it is best suited to organizations with established security foundations and risk controls. The scheme is in an approximately 18-month pilot, developed with regulators and government bodies to refine its standards and support more consistent assessment of cyber resilience. Underlying Problem…
Fast Facts AI-related DevOps incidents are surging: 84 were tracked in the first half of 2026—nearly triple the same period in 2025—and one-third of surveyed leaders have experienced an AI-linked security incident. Prompt injections can turn trusted agents into data thieves: Malicious instructions hidden in tickets, files, or tool descriptions can make overprivileged agents expose source code, credentials, and secrets. Autonomous agents create operational and supply-chain risks: Unchecked agents may disrupt live infrastructure, while attackers can exploit self-healing tools, tampered integrations, or AI-generated malware. Secure AI with layered safeguards: Restrict agent permissions, isolate execution, review untrusted inputs, require human approval…
Essential Insights Police in nine countries disrupted three malware services under Operation Endgame, seizing 235 servers and 257 domains used to support ransomware, data theft and fraud. CastleRAT, Gootloader and StealC were targeted: together, they enabled remote access, ransomware entry and theft of passwords and other credentials. Investigators identified credentials linked to 6.4 million victims. Gootloader alone infected at least 25,000 computers and was linked to about $28.8 million in losses since 2018. Victims will be able to check whether their data was exposed. Authorities also urged WordPress users to update passwords, enable multi-factor authentication and patch vulnerabilities. Underlying Problem…
Summary Points Attackers transferred about $6.34 billion from Binance wallets using malicious Ethereum smart-account authorizations. They gained signing access by compromising developers through a tampered software tool and a fake job interview. The EIP-7702 “sweeper” bypassed normal withdrawal controls and kept moving funds for nearly four hours; Binance says it froze or recovered about $2.85 billion. Crypto firms need real-time authorization monitoring, developer protections, and a tested kill switch to revoke access and halt transfers fast. Binance Breach Highlights Control Weaknesses at Crypto Orgs A hidden authorization kept moving funds On Oct. 29, attackers moved about $6.34 billion in cryptocurrency…
Top Highlights The DOJ seized cloud infrastructure used by North Korean hackers and obtained court authorization to seize more than $1.2 billion in cryptocurrency stolen from Binance. The FBI attributes the Binance theft—more than $6 billion—to the North Korean group TraderTraitor; partners have frozen over $2.7 billion in stolen funds. The FaceStealer scheme uses hijacked accounts and fake video-meeting sites to capture webcam footage; the FBI found more than 900 videos used to impersonate victims. The campaign has stolen over $400 million from crypto and Web3 targets in 18 months, and has also threatened open-source software supply chains. The Issue…
Fast Facts Compromised mobile-operator equipment in at least six Asian countries injected SS7/Diameter signaling to divert targeted calls and texts, mainly in Taiwan. Some diversions intercepted 2FA codes immediately, potentially enabling access to victims’ other accounts; no account takeovers were confirmed. SilentAir sent large volumes of hidden SMS, mostly to Taiwan, apparently to check whether interception diversions were working. Threat, Techniques, and Targets • Enea identified SilentAir, a group that used compromised equipment inside mobile operators in at least six Asian countries. Enea assessed with high confidence that the group acted at a state level. It linked the group to…
Quick Takeaways Microsoft 365 suffered a major outage on November 12–13, 2026, disrupting access to Exchange Online and potentially Outlook, Teams, SharePoint, Copilot and Defender XDR; not all customers were confirmed affected. Microsoft traced the disruption to failing infrastructure and server health checks. Servers became unavailable or unresponsive under traffic, reducing capacity; the root cause remains unconfirmed. Recovery was still underway: initial fixes underperformed, and Microsoft was shifting traffic, exploring capacity workarounds and considering configuration rollbacks. Full restoration and a completion time were not confirmed. Administrators should monitor incidents EX1550543 and MO1550821 in the Microsoft 365 admin center or Microsoft’s…