Author: Staff Writer

Fast Facts Funding Boost: CyberNut, a K-12 focused AI-driven security platform, received minority growth investment from Growth Street Partners to enhance product innovation and expand market efforts. Targeted Solutions: The platform offers AI automation, phishing simulations, and gamified training specifically for K-12 environments, empowering faculty and students to combat modern cyber threats. Rapid Adoption: With over 400,000 faculty and 1.4 million students served, CyberNut has gained traction among districts like Dallas Independent School District and Fulton County School District. Strategic Mission: CyberNut aims to fill a critical gap in K-12 cybersecurity by addressing human vulnerabilities in schools, with plans for…

Integration of AI in Cybersecurity: AI is now a fundamental element in cybersecurity, essential for managing threats in complex environments characterized by cloud infrastructure, remote workforces, and identity-based attacks. Rising Threats and Detection Challenges: Approximately 60% of cyber intrusions originate from external exposures, using compromised identities and legitimate tools, making traditional security controls ineffective against subtle, blended attacks. Adoption of Zero Trust Framework: Organizations are increasingly implementing zero trust security measures, which eliminate implicit trust and require continuous verification, necessitating AI for effective scale and real-time risk assessments. AI and Human Collaboration: The future of zero trust cybersecurity relies on…

Top Highlights Threat actors are exploiting the React2Shell vulnerability (CVE-2025-55182) to compromise NGINX web servers, primarily targeting Asian organizations and Chinese hosting infrastructure, aiming to hijack traffic and inject malware. Attackers use compromised sites to fingerprint web traffic, deploy malware, or redirect users to malicious landing pages, damaging website reputation and end-user security. Exploitation activities are now concentrated, with two IPs responsible for 56% of attempts, illustrating a shift towards targeted, automated attacks on server infrastructure. CSOs are advised to enhance security by monitoring configuration file integrity, maintaining up-to-date patches, and tracking security advisories to defend against React2Shell exploitation. Key…

Summary Points CISA’s Vulnerability Updates Lacking Transparency: Researcher Glenn Thorpe highlights that CISA has silently updated the Known Exploited Vulnerabilities (KEV) catalog to indicate many vulnerabilities being exploited in ransomware attacks without public announcements. Critical Changes in Risk Posture Ignored: The shift from “Unknown” to “Known” ransomware status for 59 vulnerabilities poses significant risk changes that organizations may overlook unless they regularly monitor the catalog. Ineffective Threat Intelligence Handling: Organizations excel at responding to new threats but struggle to notice when existing threats evolve, risking inadequate prioritization of vulnerabilities. Proactive Solutions Implemented: Thorpe created an RSS feed to track CISA’s…

Fast Facts The SystemBC malware family, active since 2019, has grown into a global botnet controlling over 10,000 devices, mainly functioning as a SOCKS5 proxy and backdoor for hiding malicious traffic. Its resilient “backconnect” architecture, even after law enforcement disruptions like Europol’s Operation Endgame, now focuses on hijacking hosting providers instead of residential networks, extending infection durations beyond 38 days on average. A new Perl-based variant, designed to evade detection, is used to launch further attacks, with infected assets in high-profile environments including government servers in Vietnam and Burkina Faso. The botnet’s expansion and sophisticated tracking underscore its role as…

Fast Facts The Interlock ransomware group operates as a small, sophisticated team that develops proprietary malware, primarily targeting the education sector in the US and UK, and uses a double-extortion tactic involving data theft and encryption. Their attacks often start with MintLoader infections via social engineering, then deploy tools like NodeSnakeRAT and AZcopy to establish persistence, move laterally, and exfiltrate data before encryption. A key innovation is their use of “Hotta Killer,” a custom evasion tool leveraging a zero-day vulnerability in gaming drivers (CVE-2025-61155), enabling them to disable EDR and antivirus defenses by terminating security processes. Organizations must enhance defenses…

Top Highlights The European Network for Cyber Security (ENCS) and Dutch Institute for Vulnerability Disclosure (DIVD) signed an MoU to collaborate on identifying and managing vulnerabilities in critical infrastructure, especially energy systems, with immediate effect. The partnership combines ENCS’s security testing expertise with DIVD’s experience in vulnerability disclosure and CVE registration, aiming to improve coordinated discovery, reporting, and resolution of high-impact vulnerabilities. ENCS launched a high-power IoT security testing program to highlight the importance of responsible vulnerability disclosure, with findings coordinated through DIVD’s processes to enhance cybersecurity for critical grids. The collaboration supports EU efforts like the Cyber Resilience Act,…

Summary Points Over 76% of cybersecurity professionals are concerned about the risks posed by AI agents accessing sensitive data and critical systems, with 47% of security executives being very concerned. Despite high awareness of AI-related risks—such as data exposure and misuse—only 37% of organizations have formal policies for secure AI deployment, reflecting a governance gap. AI-driven threats are escalating, with 73% of professionals perceiving significant impacts, including increased attack volume (87%) and sophistication (89%), especially through advanced phishing, malware, and deepfakes. Darktrace’s new solution, Darktrace / SECURE AI, aims to address visibility and control gaps by enabling organizations to monitor,…

Essential Insights Cyber threats against the energy and utilities sector have significantly increased, with 43% of observed advanced persistent threat campaigns targeting the industry in the recent period, up from 13%, mainly driven by China-linked and Russian actors. Ransomware incidents in the sector surged over 60%, with 72 verified victims, indicating a growing focus by cybercriminals, especially targeting oil, gas, and electric utilities across multiple countries. The majority of attack activity involved web applications and operating systems, with threats concentrated in the U.S., Japan, India, South Korea, and Australia, reflecting widespread, opportunistic targeting. Vulnerability disclosures reveal persistent remote code execution…

Fast Facts A sophisticated “shadow” network hijacks home routers to redirect DNS queries through malicious servers, often steering users to scams or malicious sites. The campaign primarily exploits older routers and employs an EDNS0 evasion technique that renders it invisible to standard security scans. Threat actors use compromised DNS resolvers hosted by Aeza International, manipulating traffic while bypassing detection by ignoring EDNS0 queries. Users are advised to audit router DNS settings, update firmware, and replace outdated hardware to prevent infection and protect their home networks. The Issue A hidden and sophisticated “shadow” network has been quietly hijacking home internet connections…