Author: Staff Writer

Summary Points Strategic Partnership: NetWitness and Lumifi Cyber have teamed up to deliver a comprehensive Managed Detection and Response (MDR) solution for IT and operational technology environments, addressing the increasing complexity of cyber threats. Enhanced Security Services: Combining NetWitness’ advanced analytics with Lumifi’s experienced SOC team, the partnership offers 24/7 managed monitoring, threat detection, and incident response, helping organizations maximize their existing security tools. Tailored Detection Engineering: Lumifi’s extensive threat detection experience and custom detection library ensure tailored protections for unique OT environments, addressing gaps created by the convergence of IT and OT systems. Transformative Security Model: The collaboration provides…

Adapted Threat Modeling: Traditional threat modeling needs to evolve for AI systems due to their nondeterministic behavior and complex input spaces, requiring a focus on a range of potential behaviors and the unique risks they pose. Expanded Risks: AI-specific risks include adversarial attacks and data integrity issues, alongside traditional concerns, emphasizing the importance of treating human-centered risks—like trust erosion and biased outputs—as critical. Ongoing Responsibility: Threat modeling is a shared commitment across engineering, product, and design teams, integrating continuous assessment of risks, especially where untrusted data impacts system behavior. Proactive Mitigations: Designing architectural safeguards—such as separation of untrusted content, human-in-the-loop…

Essential Insights Data Breach Blame Game: A prominent fintech firm, Marquis, is suing its firewall vendor, SonicWall, for damages following a ransomware attack that compromised the personal data of over 780,000 individuals. Shift in Liability: This lawsuit marks a trend where companies are increasingly suing their cybersecurity vendors for negligence, altering the industry dynamics and making vendors potential co-defendants in breach cases. Historical Precedent: While rare, this case follows previous instances where companies, such as Zoll Services, attempted to hold security vendors accountable for breaches, often with limited success. Changing Risk Landscape: The growing inclination to blame vendors could lead…

Quick Takeaways A global law enforcement initiative, Project Compass, led by Europol with support from 28 countries including the Five Eyes, has arrested 30 individuals and identified hundreds involved in The Com, a vast cybercrime network targeting minors. The Com is divided into Hacker, In Real Life, and Extortion groups, with crimes involving masking identities, laundering money, and targeting children through digital spaces. The operation emphasizes international cooperation, data sharing, and early intervention to safeguard victims and disrupt perpetrators, with efforts still ongoing as many members remain at large. Notable arrests include leaders of the offshoot 764 involved in child…

Essential Insights The Senate Health, Education, and Labor Committee advanced the bipartisan Health Care Cybersecurity and Resiliency Act, aiming to overhaul cybersecurity practices at the Department of Health and Human Services (HHS). The bill mandates HHS to develop a cybersecurity incident response plan, partner with CISA on oversight, and create guidance tailored for rural healthcare providers. It designates the HHS Administration for Strategic Preparedness and Response as the Sector Risk Management Agency and updates the HIPAA law to enforce modern cybersecurity standards. The legislation was driven by recent high-profile cyberattacks like the 2024 Change Healthcare breach, highlighting vulnerabilities across the…

Essential Insights The Microsoft Copilot DLP bypass revealed a deeper issue of data trust fragility, exposing how sensitive data sprawl and permission creep undermine security even with controls in place. AI’s ability to quickly surface sensitive information highlights the need for a solid, continuously validated data foundation—trust in data classification and enforcement is crucial. Relying solely on platform security is insufficient; organizations must implement comprehensive data discovery, classification, real-time monitoring, and automated remediation to achieve true data trust. Building a modern, AI-native data security architecture like MIND ensures sustained data protection, enabling secure AI innovation without increasing exposure risks. Underlying…

Fast Facts Less than 1% of over 48,000 CVEs disclosed in 2025 were exploited in the wild, yet those few caused disproportionate operational damage, highlighting a focus on weaponized vulnerabilities quickly exploited by threat actors. Ransomware groups are increasingly leveraging zero-day exploits, with over 56% of ransomware-related CVEs first identified through active exploitation, signaling a shift to faster, more aggressive attack tactics. Despite many vulnerabilities having proof‑of‑concept or exploit code, only a small fraction (~1%) were actively exploited, with advanced ransomware campaigns often keeping attack chains private to avoid detection. Major ransomware groups like Cl0p and DragonForce continue to exploit…

Essential Insights Oblivion is a sophisticated Android Remote Access Trojan (RAT) sold for as little as $300/month, capable of silently taking over devices and targeting Android versions 8-16 with minimal user effort. It features advanced capabilities such as intercepting SMS, reading push notifications, keystroke logging, and remotely managing apps, with a unique hidden VNC (HVNC) system for undetectable control. Deployment relies on social engineering via fake Google Play updates, bypassing Android’s accessibility permissions across various custom interfaces, and can even bypass protections used by banking apps. The malware demonstrates meticulous development, tested over four months before release, highlighting a deliberate,…

Essential Insights Steaelite, a sophisticated remote access trojan, combines data theft and ransomware functions in a seamless browser-based control panel, making it accessible and easy to weaponize for low-skilled cybercriminals. It automates data exfiltration immediately upon system connection, harvesting credentials and session tokens before manual operator intervention, and consolidates the full attack chain into one tool. The malware extends beyond Windows with an announced Android ransomware module, potentially compromising both corporate endpoints and mobile devices, significantly increasing the attack surface. Its advanced, stealthy features—including full control over victims’ systems and automatic credential harvesting—require organizations to monitor outbound traffic, enforce strict…

Quick Takeaways Cyberattackers are achieving network access in an average of just 29 minutes in 2025, a 65% faster rate than the previous year, with some cases taking only 27 seconds. The rapid increase in attack speed is primarily driven by the widespread use of AI tools, which have boosted attacker activity by 89%. State-backed and criminal groups, such as “Fancy Bear” and “Famous Chollima,” are leveraging AI-generated malware and identities to automate data gathering and large-scale insider operations. The evolving threat landscape highlights a cybersecurity “arms race,” with organizations needing to act faster than cybercriminals to protect their systems…