Author: Staff Writer

Quick Takeaways The LAPSUS$ hacking group has resurfaced, claiming responsibility for a significant breach of AstraZeneca, involving a 3GB leak of sensitive data. They are attempting to sell this internal data, including source code, cloud infrastructure details, and confidential secrets, via secure messaging, indicating a shift toward extortion for profit. The leaked data reveals critical aspects of AstraZeneca’s supply chain and IT infrastructure, with samples showing internal repositories and project structures associated with vital logistical operations. AstraZeneca has not responded publicly, and no full leak has been released for free, suggesting the group’s primary motive is financial gain through targeted…

Top Highlights 1. SOC Prime’s DetectFlow Enterprise brings real-time threat detection to data ingestion, enabling earlier identification of threats before data reaches downstream systems. 2. By analyzing streaming data with Apache Flink and running thousands of Sigma-based rules, it enhances detection speed, reduces noise, and improves response times. 3. The platform performs attack chain correlation upfront, alleviating load on SIEMs and controlling operational costs while providing comprehensive threat insights. 4. Powered by over a decade of threat research and AI analysis, DetectFlow transforms raw telemetry into actionable intelligence, facilitating faster and more effective cybersecurity responses. Transforming Threat Detection at the…

Essential Insights A highly sophisticated supply chain attack compromised the Trivy GitHub Action by force-pushing 75 out of 76 tags with malicious commits, turning trusted versions into malware distributors and risking credential theft across over 10,000 CI/CD workflows. The attacker exploited residual access and cloned commit metadata to craft convincing forged commits, injecting a malicious script that executes prior to legitimate scans, enabling stealthy data collection and exfiltration. The malware, named “TeamPCP Cloud stealer,” deploys a three-stage process: targeted data collection from cloud providers and secrets, encrypted data exfiltration via a typosquatted domain or GitHub repos, and extensive harvesting of…

Essential Insights The UK government’s £1.5 billion loan guarantee to Jaguar Land Rover post-cyberattack raises concerns about setting a precedent for state intervention without a clear framework, potentially encouraging risky behaviors by critical companies. Experts warn that cyber incidents impacting major organizations can ripple through the economy, threatening GDP, employment, and exports, emphasizing the need for resilient cybersecurity strategies. There is a growing cyber insurance protection gap, necessitating structured public-private partnerships to effectively share and manage cyber risks, but current responses risk fostering complacency and underinvestment in security. Critics argue that government bailouts and reliance on insurance create dangerous incentives,…

Summary Points 1. Mimecast introduces adaptive security controls and AI-powered investigation tools to enhance real-time threat management and bridge human-AI security gaps. 2. The platform now dynamically adjusts security policies based on user risk levels, automating protections for high-risk individuals while maintaining flexibility for others. 3. Integration capabilities, including external AI platform connections and comprehensive risk signal aggregation, enable security teams to respond faster and more effectively. 4. With advanced detection systems achieving near-perfect accuracy and expanded BEC protections in multiple languages, Mimecast emphasizes securing the human-AI security interface in enterprise environments. Enhancing Security Through AI and Human Collaboration Mimecast’s…

Singapore is transitioning to an AI-enabled economy, requiring locally hosted, AI-native cybersecurity solutions to address unique risks like prompt injection and data leakage. The expansion of Palo Alto Networks’ Prisma AIRS platform into Singapore provides region-specific, comprehensive AI security for model safety, runtime protection, and agent security. The localized cloud landing supports Singapore’s strategic goal for secure AI deployment, ensuring data residency, regulatory compliance, and operational resilience. Palo Alto Networks affirms its commitment to Singapore’s digital growth, enabling secure innovation and strengthening the nation’s cyber resilience in an evolving AI landscape. How Prisma AIRS Supports Daily IT Tasks in Singapore…

Quick Takeaways The Cybersecurity and Infrastructure Security Agency (CISA) issued a rare and urgent advisory following a significant cyberattack on Stryker Corporation’s Microsoft environment on March 11, 2026. Attackers exploited a compromised Intune administrator account, creating a new global admin to escalate their access and control over managed devices. The breach primarily involved credential theft, highlighting weaknesses in privileged access controls and endpoint management security. CISA recommends implementing strict privileged access controls and enhanced endpoint security measures to prevent similar attacks. What’s the Problem? On March 11, 2026, a significant cyberattack targeted Stryker Corporation’s Microsoft environment, leading to widespread disruption.…

Top Highlights Ransomware attackers now extensively use EDR killers—tools that disable endpoint detection—to bypass security, evolving from solely exploiting vulnerable drivers to script-based, anti-rootkit, and driverless methods. The market for these EDR killers has matured into a commercial ecosystem where tools are bought, sold, and customized, with nearly 90 identified active tools, including popular commercial options like AbyssKiller and CardSpaceKiller. Disabling security defenses through EDR killers is now the primary focus for threat actors, as disrupting security software is easier and more reliable than avoiding detection of the payload itself. Effective defense requires layered detection strategies, proactive monitoring of driver…

Top Highlights A server hosting tools from the Beast ransomware group reveals shared tactics (TTPs) with other gangs, highlighting common tool usage for reconnaissance, exfiltration, and lateral movement. Many tools, such as AnyDesk and Mega, have legitimate uses but are exploited maliciously; blocking these can improve defenses. The group employs advanced techniques like backup deletion and log wiping, making resilient and off-site backups critical for prevention. Employing endpoint detection, allow-listing, and tracking attacker server tools is essential, as understanding the binary files helps attribute attacks to specific ransomware gangs. Ransomware Group Reveals Secrets Through Exposed Server Recently, security researchers discovered…

Fast Facts TÜV SÜD launches OT Risk Assessment-as-a-Service (OT-RaaS), a subscription-based program for continuous, proactive cybersecurity risk management in industrial operational technology (OT) environments. The service offers ongoing risk assessments, tailored to organizational risk profiles, with tiered subscriptions and optional compliance modules aligned with standards like IEC 62443 and NIST CSF. Designed to integrate seamlessly into existing workflows, OT-RaaS delivers prioritized risk registers and remediation roadmaps to enhance operational resilience amid rising threats, especially from ransomware and cyberattacks on connected systems. TÜV SÜD emphasizes that continuous OT security is vital for protecting personnel, facilities, and supply chains, with the assessment…