Author: Staff Writer

Summary Points ‘Secure by design’ remains elusive in OT environments due to early architectural decisions—such as segmentation, remote access, and asset visibility—being fixed before deployment, making remediation costly and disruptive. Security is often deferred to later project phases, especially during procurement and operational entry, leading to vulnerabilities like unmanaged vendor access, missing logs, and configuration drift that are only identified during acceptance testing. Integrating security requirements into procurement, design reviews, and acceptance testing—through contractual obligations, verifying vendor capabilities, and rigorous FAT/SAT—can significantly reduce operational risks and mitigate vulnerabilities. Achieving a clean handover with comprehensive documentation, validated security controls, and operational…

Quick Takeaways A China-aligned group, UNK_MassTraction, is exploiting vulnerabilities in Roundcube mailservers at US and Canadian universities to steal credentials and deploy webshells and backdoors. The attack chain leverages cross-site scripting (CVE-2024-42009) to execute malicious JavaScript, exfiltrate data, and pivot into networks via webshells and the VShell backdoor. These actors are sophisticated, employing layered exploits, in-memory malware, and anti-forensic techniques to maintain persistence and evade detection, posing a significant espionage threat. The Threat, Techniques, and Targets Since May 2026, Proofpoint has been watching a threat group called UNK_MassTraction. This group is believed to be aligned with China. They mainly target…

Quick Takeaways Legacy MDR SLAs are outdated, designed for human-only response times, and do not reflect the rapid, AI-driven capabilities of modern security operations, risking delayed incident handling and increased damage. Common metrics such as MTTA, MTTD, MTTR, and MTTC are often conflated or exploited, with vendors gaming acknowledgment times to mask response and containment gaps, undermining true incident resolution. Rapid containment is critical; delays exponentially increase costs from tens of thousands to millions of dollars, making severity-tiered, AI-specific SLA benchmarks essential to effectively limit attacker dwell time and damage. SLA effectiveness hinges on enforceable penalties, measurable KPIs (accuracy, coverage,…

Fast Facts U.S. prosecutors linked hacker Peter Stokes to a 2025 retail break-in using a persistent Windows device ID tied to his online activity and locations. The attack involved manipulating help desk staff via phone, gaining control of admin accounts, and exfiltrating 77 GB of data, despite antivirus efforts. The case highlights how sophisticated identity verification is crucial, as attackers often hide behind VPNs and aliases, exploiting weak help desk protocols. Experts stress that arresting individual members like Stokes doesn’t significantly diminish the threat, which is driven by a loose collection of hacking groups operating globally. Technology’s Role in Tracking…

Essential Insights WhiteLock encrypts files using AES-256 and RSA-2048, appends the .Fbin extension, and forcibly terminates remote access tools like AnyDesk and TeamViewer to hinder response efforts. It communicates with external servers during encryption, which can be blocked but does not guarantee prevention; it also exfiltrates data and demands ransom via a Tor-based negotiation platform. WhiteLock creates ransom notes and changes desktop wallpapers to pressure victims, signifying system compromise and encrypting critical files while excluding essential OS and security files. Threat, Attack Techniques, and Targets WhiteLock ransomware encrypts key files on Windows systems and demands a ransom payment. It begins…

Fast Facts Threat actors use bogus Kakao login pages hosted on compromised legitimate websites to steal credentials by mimicking real sites and blending in with trusted domains. The phishing pages secretly transmit entered login data to external servers after encoding, making detection difficult and increasing the risk of account hijacking. Users are tricked by fake account transfer notifications that instill urgency, prompting credential entries on malicious sites, which can lead to personal data theft and account loss. Threat, Attack Techniques, and Targets Recently, threat actors have sent fake Kakao account transfer emails. These emails look like official messages but are…

Top Highlights A report links the FortiBleed credential theft campaign to the Lynx and INC Ransomware groups, revealing stolen Fortinet firewall credentials were used in ransomware intrusions, with an operator connected to both groups’ negotiation panels. The operation has expanded into a structured access brokerage involving about 20 operators, with over 400 organizations compromised, resulting in at least 12 ransomware incidents encrypting hundreds of endpoints. The attackers heavily utilize AI tools for vulnerability research, tool development, and attack automation, with evidence of exploiting a zero-day in Nextcloud and targeting small to mid-sized enterprises primarily in Latin America and Asia-Pacific. Operational…

Essential Insights The NewsJunkie operation generated nearly two billion invalid CTV bid requests daily by spoofing device, app, and IP details, exploiting gaps in JavaScript-less CTV environments. Attackers used server-side spoofing and routing through residential IPs to mimic genuine household devices, evading origin-based detection. The scheme demonstrates that sophisticated ad fraud can blend seamlessly into legitimate supply chains, highlighting the need for full supply chain visibility to prevent such threats. Threat, Techniques, and Targets HUMAN Security’s Satori team uncovered a threat called NewsJunkie. It disrupted a complex scheme targeting connected TV (CTV) advertising. The attackers used different techniques to create…

Top Highlights The Gentlemen ransomware employs advanced self-propagation, abusing trusted Windows administrative tools to spread across networks and weaken security measures before encryption begins. It targets organizations across diverse sectors globally using techniques like disabling security tools, deleting shadow copies, and stopping critical services to hinder recovery efforts. The malware uses a sophisticated hybrid encryption scheme and doubles extortion threats, emphasizing the importance of resilient backups and secure identity management. Defense strategies must go beyond initial prevention, focusing on limiting lateral movement, testing recovery resilience, and controlling privileged access to prevent widespread damage. Underlying Problem The story details the emergence…

Essential Insights The percentage of malicious objects blocked on ICS computers has decreased to 19.6% in Q1 2026, indicating a decline in overall attack activity, but targeted threats like spyware (3.73%) and malicious scripts (6.56%) remain prevalent. Biometric systems, with a 26.4% threat blocking rate, are highly vulnerable due to extensive internet and email usage, making them prime targets for spyware, malicious scripts, and AutoCAD malware. Threat sources such as internet threats (7.88%) and email-based attacks (2.59%) continue to pose significant risks, with cybercriminals increasing activity through denylisted internet resources and malicious documents, particularly in regions like Southeast Asia and…