Author: Staff Writer

Quick Takeaways Flare, a threat exposure management (TEM) provider, raised $30M, bringing total funding to nearly $70M to enhance its cybersecurity offerings. The company’s platform utilizes AI, machine learning, and data science to gather intelligence from the web and dark web to prevent security incidents like ransomware and data breaches. New funding will support the development of its Identity Exposure Management (IEM) features and strategic acquisitions. Flare’s IEM integrates with Entra ID to validate leaked credentials, offering organizations greater visibility into digital exposures, as it aims to lead the evolving TEM market. Underlying Problem Today, Flare, a Montreal-based provider of…

Essential Insights Gootloader malware, after a 7-month hiatus, has resumed using SEO poisoning to promote fake websites offering legal documents, which download malicious JavaScript files to infect devices. The malware employs advanced evasion techniques, such as hiding filenames through manipulated web fonts that swap glyphs, making detection by security tools difficult. Attackers distribute malformed ZIP archives that extract malicious scripts differently depending on the extraction tool, complicating analysis and detection efforts. Gootloader now deploys the Supper SOCKS5 backdoor, enabling threat actors—linked to ransomware groups like Vanilla Tempest—to perform swift reconnaissance and network compromise, including domain controller access. The Issue After…

Top Highlights Over 50 organizations, mainly in the U.S., have fallen victim to attacks exploiting a critical vulnerability in Windows Server Update Service (CVE-2025-59287). The initial Microsoft security update failed to provide adequate protection, leading to an emergency patch released shortly after. Attackers, identified as UNC6512, are conducting reconnaissance and data exfiltration following initial access to compromised systems. The Cybersecurity and Infrastructure Security Agency has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging prompt application of Microsoft patches. Understanding the Threat Recent attacks exploiting a vulnerability in Windows Server Update Service (WSUS) have ensnared at least 50 organizations,…

Quick Takeaways European organizations face a 13% annual rise in ransomware attacks, with over 2,100 victims since January 2024, making Europe the second most targeted region globally. Threat actors are increasingly sophisticated, utilizing AI for phishing, automation, and real-time reconnaissance, and are targeting virtualized environments with Linux ransomware on VMware ESXi. The underground cybercrime ecosystem remains resilient, with forums providing access to malware-as-a-service, credentials, and tools, supported by trust mechanisms like escrow and reputation systems. The region’s attractiveness is driven by substantial financial incentives, regulatory leverage via GDPR, and geopolitical motives, with threat actors exploiting managed and unmanaged systems through…

Essential Insights Cybercriminals are now using AI to develop adaptable, real-time malware that can evade detection and dynamically modify scripts during attacks. Google identified five new AI-powered malware families (FRUITSHELL, PROMPTFLUX, PROMPTSTEAL, PROMPTLOCK, QUIETVAULT) showcasing capabilities like code hiding and on-demand attack creation. Notably, PROMPTFLUX and PROMPTSTEAL employ advanced AI techniques, such as self-rewriting code and automated data theft, highlighting growing sophistication in malicious AI use. These developments emphasize the need for advanced detection tools that go beyond static signatures, as threat actors increasingly leverage AI for offensive capabilities, including by nation-states. Underlying Problem Recently, Google reported a concerning evolution…

Fast Facts AI as a Priority: Nearly 40% of security professionals view AI-based security frameworks as essential for reducing cyber risks over the next three years, according to an AWS report. Current AI Adoption: Around one-third of organizations already utilize AI agents for tasks like identity management and threat monitoring, but interest in expanding AI use remains low among non-users. SOC Automation Growth: There’s a slight expected growth in automating security operations center (SOC) processes, with only a 3% increase anticipated over the next year. Cloud Migration Hesitance: Approximately 90% of respondents express major concerns about security risks hindering their…

Top Highlights Over 65% of connected assets in modern networks are non-traditional IT devices, including IoT, OT, and IoMT, with industries like financial services, healthcare, and oil/gas experiencing higher device diversity and security risks. IP cameras are the most common IoT asset, with 40% containing vulnerabilities and over 1,400 unique flaws identified, exemplifying significant exposure due to pervasive use and outdated firmware. Device diversity across industries leads to complex security challenges, as ecosystems include thousands of vendors, device functions, and operating system versions, often with weak configurations and unpatched vulnerabilities. To address these risks, Forescout introduced eyeSentry — a cloud-native,…

Quick Takeaways The cybercrime group Scattered Spider is highly organized and has recently targeted retailers, insurers, and airlines globally with successful attacks. The group’s tactics and strategies, referred to as their “playbook,” are being dissected to understand their methods and improve defenses. A significant vulnerability in organizations is the “help desk blind spot,” which attackers exploit to access sensitive systems. Practical strategies, including identity threat detection and mitigation, are crucial for organizations to reduce their risk exposure against such persistent threats. The Core Issue Recently, the cybercriminal group known as Scattered Spider has made headlines with a series of sophisticated…

Essential Insights Critical Vulnerability: Cisco IOS XE has a severe vulnerability (CVE-2023-20198) that is actively exploited to install the BadCandy implant, affecting thousands of devices globally. Widespread Exploitation: More than 15,000 devices remain compromised worldwide, with over 400 devices reported in Australia alone since July 2023. Active Threat Actors: State-linked and criminal hackers are behind the attacks, with ties to known groups such as Salt Typhoon, linked to China. Mitigation Warning: Although rebooting a compromised device can eliminate the infection, persistent attackers may still regain access through stolen credentials. Understanding the BadCandy Implant Threat Recent attacks on Cisco IOS XE…

Fast Facts Google’s Threat Intelligence Group identified emerging AI-powered malware like PromptLock, PromptFlux, FruitShell, PromptSteal, and QuietVault, demonstrating increasing use of AI to generate scripts, evade detection, and conduct data theft. Some malware, such as PromptFlux and FruitShell, are designed to be self-repairing or bypass static security measures using AI-driven code rewriting and obfuscation techniques. Threat actors are employing AI prompts for social engineering to circumvent security defenses, and the underground market for AI tools catering to malware development and phishing is rapidly maturing. Nation-states from China, Iran, and North Korea are leveraging AI platforms like Google’s Gemini for espionage…