Author: Staff Writer

Summary Points AI in Malware Development: Threat actors are leveraging large language models (LLMs) like Google Gemini and Hugging Face to create malware, enabling them to rewrite code and automate attacks, thus evading detection mechanisms. Innovative Malware Types: Google’s report outlines new malware such as PROMPTFLUX and PROMPTSTEAL, which utilize AI to adapt and improve their effectiveness in exploiting system vulnerabilities. Access and Evasion Techniques: Cybercriminals are using AI to generate legitimate-seeming applications and bypass security measures, including tactics like disguising their requests as participation in capture-the-flag exercises to gain malicious code. Future Security Challenges: As AI becomes integrated into…

Summary Points Rising Importance of Non-Human Identities (NHIs): NHIs, including service and machine identities, are rapidly transforming cybersecurity strategies as they become essential to the digital infrastructure, enabling seamless interaction among systems. Security Confidence Gap Identified: Approximately 60% of cybersecurity professionals lack confidence in their organization’s ability to secure NHIs, revealing a critical gap in security measures amid their expanding presence. Governance Challenges: Managing NHIs poses unique challenges, such as credential security, visibility, and privilege management, necessitating sophisticated frameworks to prevent unauthorized access and maintain accountability. Urgent Need for Robust Security Frameworks: Organizations must implement comprehensive NHI management strategies, focusing…

Quick Takeaways ToddyCat, active since 2020, has escalated from stealing browser cookies to siphoning entire Outlook archives, targeting high-profile organizations. Recent operations (May-June 2024) utilize a PowerShell-based toolkit, “TomBerBill,” to operate from domain controllers under privileged accounts. The attack scope expanded to include Firefox browser data, alongside Chrome and Edge, using scheduled tasks and SMB connections to access user directories. The threat signifies a significant evolution in ToddyCat’s tactics, increasing its capability to extract sensitive organizational data. Key Challenge Recently, a cyber espionage group called ToddyCat has dramatically escalated its activities. Since 2020, they mainly stole browser cookies and credentials,…

Top Highlights Cyber threats are escalating with nearly 2,000 weekly attacks per organization in early 2025, driven by industrialized cybercrime, targeted social engineering, and rapid AI-enabled tactics. Leaders must adopt a core business resilience approach through “assume breach” strategies, robust identity controls, staff training, and incident response planning, positioning cybersecurity as a growth enabler. Dependency management and third-party oversight are crucial; organizations should ensure supply chain resilience and clear response plans for compromised partners. Cybersecurity requires translating technical risks into business language for board-level understanding, focusing on measurable outcomes such as faster detection, recovery, and sustaining revenue streams. Problem Explained…

Essential Insights ASUS released firmware updates to patch nine security vulnerabilities, including a critical authentication bypass flaw (CVE-2025-59366) in routers with AiCloud enabled. The vulnerability allows remote attackers to exploit a path traversal and OS command injection flaw, enabling unauthorized function execution without user interaction. To mitigate risks, users should immediately update their router firmware and disable internet-accessible services like remote access, port forwarding, and VPN. Previously, ASUS patched another critical flaw (CVE-2025-2492) exploited in the Operation WrtHug campaign, which hijacked devices globally and suspected to be used in Chinese hacking operations. Underlying Problem Recently, ASUS released a firmware update…

Fast Facts The RomCom malware family was delivered via SocGholish, a JavaScript loader exploiting compromised websites, marking the first observed use of SocGholish for RomCom distribution. The attack is attributed with medium-to-high confidence to Russia’s GRU Unit 29155, targeting entities with ties to Ukraine, using fake browser updates to trick users into installing malware. Threat actor RomCom employs spear-phishing and zero-day exploits to breach networks, deploying tools like the Mythic Agent and custom backdoors, primarily targeting Ukraine and NATO-related organizations. The attack chain is rapid, taking less than 30 minutes from infection to payload delivery, highlighting SocGholish’s widespread threat and…

Summary Points Cyber threat activity surged significantly in October, following a 28% increase in September, as threat actors accelerate operations ahead of peak holiday shopping season. The October spike aligns with the “golden quarter” (Black Friday, Cyber Monday, Christmas), bringing increased opportunities for cybercriminals. Industrial sectors remained the top targets, accounting for 28% of attacks, with consumer discretionary and healthcare also heavily impacted. NCC monitors leak sites associated with ransomware groups to track attacks, highlighting the intensifying cyber threat landscape during this period. The Issue The report highlights a notable increase in cyber attacks during the fall, especially in October,…

Quick Takeaways Dartmouth College confirmed a data breach via a zero-day attack on its Oracle E-Business Suite, resulting in the exfiltration of personal and financial data, including Social Security numbers. The Cl0p ransomware group claims responsibility, listing over 100 victims publicly, with more than half experiencing data leaks—Dartmouth disclosed 226 GB of stolen files. Besides Dartmouth, victims include Harvard University, Southern Illinois University, and Tulane University; some firms like Mazda and Canon have been targeted but reported no data leakage. The breach highlights ongoing cyber threats in academia and industry, with attackers leveraging zero-day vulnerabilities and ransomware to compromise sensitive…

Fast Facts Dartmouth College experienced a data breach from a zero-day Oracle EBS vulnerability exploited by the Clop gang, affecting at least 1,494 individuals’ personal data, including Social Security numbers and financial info. The breach is part of Clop’s larger extortion campaign targeting multiple organizations since August 2025, exploiting similar vulnerabilities with dozens of breaches reported. The incident aligns with increased cyberattack trends on Ivy League institutions, including voice phishing and internal system breaches at Harvard, Princeton, and UPenn. Clop, linked to major data thefts like MOVEit Transfer, continues to threaten organizations worldwide, with US authorities offering a $10 million…

Essential Insights Managing Non-Human Identities (NHIs) is crucial for securing cloud infrastructures across industries like healthcare, finance, and travel, where machine identities facilitate critical transactions and data protection. Effective NHI management requires lifecycle oversight—from discovery to decommissioning—to detect anomalies, ensure security, and reduce vulnerabilities in dynamic, ephemeral environments. Leveraging advanced technologies such as AI, ML, and blockchain can enhance real-time monitoring, automate processes, and provide secure, transparent management of machine identities. Building a security-first organizational culture through education, collaboration, and adoption of identity-centric and DevSecOps practices is essential for addressing complex NHI challenges and future-proofing cybersecurity defenses. Problem Explained The…