Author: Staff Writer

Summary Points Attackers with physical access can exploit the YellowKey vulnerability to bypass BitLocker encryption by placing crafted files on USB or EFI, triggering unrestricted shell access during reboot. Successful exploitation allows the attacker to sidestep device encryption and access encrypted data with elevated privileges. Mitigation involves disabling auto-start of the FsTx utility in WinRE, switching to TPM+PIN mode, or requiring additional startup authentication, to prevent unauthorized access. The Threat, Attack Techniques, and Targets Microsoft revealed a new vulnerability called YellowKey, which affects certain Windows systems. The flaw allows attackers to bypass a security feature called BitLocker. The CVE number…

Summary Points Spyware and backdoor attacks in East Africa increased by up to 83% regionally, driven by AI-enhanced cybersecurity risks. The rising use of AI-driven tools has escalated the sophistication and frequency of cyber threats targeting regional networks. These evolving threats threaten critical infrastructure and data security, emphasizing the need for advanced AI-backed defense mechanisms. Threats, Techniques, and Targets Artificial Intelligence (AI) is now creating new cybersecurity risks in East Africa. Attackers are using AI tools to increase spyware and backdoor attacks. Spyware attacks have grown by 83 percent in Kenya and 53 percent across the region. Backdoor attacks, which…

Essential Insights GitHub confirmed a breach resulting from a compromised employee device infected through a malicious Visual Studio Code extension, impacting internal repositories but not public or customer data. The attacker, linked to threat actor TeamPCP, exfiltrated roughly 3,800 to 4,000 repositories and is offering stolen data for sale on underground markets. Immediate containment measures included removing the malicious extension, isolating the affected device, rotating secrets, and increasing log monitoring to prevent further access. GitHub is continuing investigation, validating secret rotations, analyzing logs, and will publish a detailed incident report, with no current evidence of customer data exposure. The Issue…

Summary Points A cyberattack on an online LMS, attributed to ShinyHunters, caused widespread disruptions in U.S. educational institutions, exposing vulnerabilities in cloud-based education systems. ShinyHunters, known for large-scale data breaches and extortion, often exfiltrates sensitive data to monetize through resale or targeted extortion campaigns, including aggressive threats and leak sites. The FBI warns that threat actors may escalate tactics with harassing messages, "swatting," and releasing stolen data, which can enable highly convincing spear-phishing attacks targeting students and staff. Authorities advise victims to avoid responding to extortion, verify all suspicious communications, report incidents to the FBI, and emphasize the urgent need…

Fast Facts A threat actor, TeamPCP, claims to have breached GitHub’s internal systems, exfiltrating around 4,000 private repositories and offering the data for sale over $50,000 on cybercrime forums. GitHub has confirmed an investigation into the unauthorized access, but currently reports no evidence of customer data outside its internal repositories being impacted. TeamPCP, known for major supply chain attacks including compromising security tools like Trivy and leaking its own malware source code on GitHub, lends credibility to their claims. The investigation remains ongoing, with GitHub not confirming the breach’s details or the method of entry, and promises to notify customers…

Summary Points Microsoft disrupted "Fox Tempest," a cybercriminal group that used stolen identities to obtain over 1,000 code-signing certificates, facilitating the distribution of malicious software and ransomware. The group operated a malware code-signing service, charging $5,000–$9,000 for signing malicious files, helping attackers bypass detection by trusted platforms like Microsoft Defender. The operation involved creating preconfigured virtual machines for uploading malware, which would then be signed and distributed to malicious actors, exemplifying a shift towards service-based cybercrime. This case highlights the evolving landscape of cybercrime, where illicit code-signing is sold as a scalable service to enhance malware distribution and evade detection,…

Fast Facts Secure Code Warrior has launched immersive training modules focused on securing Amazon Bedrock and addressing AI-specific vulnerabilities like prompt injection and excessive agency. Training emphasizes real-world remediation tailored to Bedrock’s infrastructure, closing gaps in enterprise AI security awareness beyond generic application security measures. Endorsement from OpenText underscores the training’s effectiveness in producing measurable security improvements, influencing enterprise procurement decisions. This initiative signals a broader shift towards AI-specific developer security education, highlighting the urgent need for organizations to update their security training to cover new AI threat classes and attack surfaces. Enhancing Developer Preparedness for AI Security Challenges Secure…

Fox Tempest is a cybercriminal group offering malware signing-as-a-service, enabling other actors to distribute malicious code signed with fraudulent, short-lived certificates to evade security measures. Their infrastructure involved creating over a thousand certificates and supporting operations across hundreds of Azure tenants, facilitating widespread malware deployment including ransomware like Rhysida. Disrupted by Microsoft in May 2026, Fox Tempest’s operations included a website and virtual machine environment that supplied signed files, tools, and certificates to paying cybercriminals, often using stolen identities. Microsoft’s defense recommendations include deploying threat detection tools, enabling security features like Safe Links and SmartScreen, maintaining tamper protections, and utilizing…

Essential Insights Despite evolving threats, fundamentals like visibility, patch management, and response plans remain crucial for cybersecurity resilience. Vulnerability exploitation increased by 31%, with many critical vulnerabilities going unpatched or only partially remediated, leading to longer resolution times. Threat actors leverage AI and large language models to enhance their attack methods, giving them a significant asymmetrical advantage. Effective vulnerability management prioritizes patching actively exploited or recent flaws, integrating automated tools and early detection strategies to stay ahead. Enterprises Face an Increasing Flood of Vulnerabilities Cybersecurity experts warn that organizations now confront a record-breaking number of vulnerabilities. The latest report highlights…

Top Highlights Attackers exploited vulnerabilities as the primary initial access method in over 31% of breaches, a significant increase from 20% the previous year, driven by the overwhelming volume of unpatched security flaws. Only 26% of critical vulnerabilities listed in CISA’s catalog were remediated by organizations in 2025, with the median patch time extending to 43 days, highlighting ongoing challenges in vulnerability management. Ransomware attacks surged, accounting for 48% of breaches—up from 44%—with victims increasingly refusing to pay ransom, and median payments decreasing to around $140,000. Despite some positive trends, such as declining ransom payments, the report notes a growing…