Author: Staff Writer

Summary Points Asset discovery alone identifies IT assets but lacks the ability to connect vulnerabilities, identities, and attack paths necessary for effective exposure management. True exposure management merges vulnerability assessment, attack path analysis, and identity security across hybrid environments, prioritizing remediation based on exploitability and impact. Passive discovery tools are limited, often superficial, and miss deep vulnerabilities; comprehensive platforms like Tenable One use multiple detection methods for richer, accurate risk insights. Effective exposure management incorporates AI security, attack path analysis, compliance monitoring, and risk scoring—integrating these elements to proactively reduce breach risks and ensure regulatory adherence. Key Challenge The story…

Top Highlights A0Backdoor, linked to the Black Basta ransomware group, employs social engineering via Microsoft Teams and Quick Assist to infiltrate systems, beginning with mass spam emails and impersonation of IT support. The malware uses DLL sideloading with digitally signed MSI packages disguising malicious code as legitimate Microsoft applications, enabling stealthy installation and persistence. Once installed, A0Backdoor collects system info, communicates through DNS tunneling on legitimate-looking domains, and avoids detection by blending into normal network traffic. Organizations are advised to restrict Quick Assist use, verify IT contacts, monitor for suspicious MSI files and DNS activity, and block unrecognized external Teams…

Quick Takeaways Cybersecurity is entering a “new phase” where mature AI tools allow threat actors to respond and scale attacks faster than traditional defense methods can keep up. Attackers leverage AI, particularly large language models (LLMs), to identify vulnerabilities quickly, exploit them at machine speed, and operate with increased efficiency and scale. Current cybersecurity defenses, which rely on slower, human-driven processes, struggle to counteract AI-enhanced threats, requiring organizations to adapt with automation and pre-planned AI response strategies. While AI offers defensive potential, handing critical functions to automated systems presents risks, emphasizing the urgent need for balanced, well-regulated AI use in…

Quick Takeaways Industrial cybersecurity has advanced with detection and preventive tools, but response capabilities, including playbooks and roles, are lacking, risking safety and production during crises. The book emphasizes that effective incident management relies not just on technology but equally on people, communication, authority, and cultural readiness, integrating operational and leadership coordination. The ICS4ICS framework tailored for cyber incidents fills a gap in traditional incident response, offering clear roles, decision-making structures, and repetitive practices specific to industrial environments. Three critical principles for organizations are: establishing clear authority delegation, defining decision and communication flows across teams, and practicing scenario-based coordination to…

Top Highlights Data theft for extortion is increasingly prevalent, with 77% of ransomware incidents involving data leaks, highlighting a shift from traditional encryption-based attacks. The industry struggles with accurately measuring ransomware’s true scope due to inconsistent reporting and reliance on problematic indicators like data leak sites. Attack vectors are evolving, with vulnerabilities in widely used virtual private networks and firewalls being exploited, and virtualization infrastructure increasingly targeted to maximize impact. Successful deployment of ransomware is decreasing, but cybercriminals continue to refine their tactics, focusing on data theft and targeting complex environments like hypervisors to complicate investigations. The Issue The story…

Quick Takeaways X-PHY partners with RoBridgeAI to expand AI-powered hardware cybersecurity in India, enhancing global security reach. Evolver consolidates multiple brands under a single identity to strengthen cybersecurity and digital transformation services. Microchip broadens its Trust Platform with new authentication ICs to meet global cybersecurity compliance requirements. Keeper Security continues to reinforce identity-first cybersecurity through its partnership with Atlassian Williams F1 Team and Microsoft Azure integration. Latest Collaborations and Brand Unifications in Cybersecurity This week, the cybersecurity world saw significant collaborations that could shape future defenses. For example, X-PHY teaming up with RoBridgeAI marks a move toward stronger hardware security…

Quick Takeaways Climate change and extreme weather events are significantly expanding vulnerabilities in industrial critical infrastructure, combining physical and cyber threats, and outpacing current security measures. The increasing integration of renewable energy sources, microgrids, and digital technologies like IoT devices has created new attack surfaces, making traditional perimeter defenses inadequate against sophisticated cyber and physical threats. There is a widespread disconnect between climate resilience planning and cybersecurity strategies, with most organizations managing them in silos, which hampers effective response to compound crises. Addressing these evolving risks requires urgent, scaled investments in integrated, resilient cybersecurity frameworks, grid flexibility, and joint operational…

Microsoft Defender uncovered a credential theft campaign by Storm-2561 using SEO poisoning to distribute fake VPN installers signed with revoked certificates, aiming to harvest user credentials. The attack involves redirecting search users to malicious websites, downloading ZIP files hosting fake VPN clients, which install malware and steal login info, then redirect users to legitimate sites to evade detection. The malware employs digital signature abuse, persists via registry keys, and uses social engineering tactics like fake error messages to mask theft activity, with exfiltrated data sent to attacker-controlled servers. Microsoft recommends enhanced endpoint protections, MFA enforcement, web filtering, and specific detection…

Fast Facts Over 72 countries dismantled more than 45,000 malicious IP addresses and servers in the six-month INTERPOL-led “Operation Synergia III,” disrupting global cybercriminal networks involved in ransomware, malware, and phishing campaigns. The operation resulted in 94 arrests, the seizure of 212 devices, and active investigations into 110 suspects, significantly impairing the infrastructure used for cyberattacks worldwide. Key victories included neutralizing over 33,000 fraudulent websites in Macau and arresting 40 suspects involved in financial cybercrimes in Bangladesh, illustrating diverse tactics from hacking to social engineering. The success underscores the importance of international cooperation and partnership with private cybersecurity firms in…

Quick Takeaways Keeper Security has launched two native Jira integrations to embed security incident response and privileged access governance directly into Jira workflows, centralizing enforcement within the Keeper platform. These integrations connect security detection, response, and access approval processes, enabling automatic incident tracking and seamless access requests without manual or insecure methods like email or screenshots. They support configurable, time-bound access permissions and maintain cryptographic controls within Keeper, ensuring compliance with zero-knowledge security principles. Built on Atlassian Forge, the integrations enhance security operations by unifying incident management, access governance, and audit trails across cloud, hybrid, and on-premise environments, while integrating…