Author: Staff Writer

Top Highlights Mass Exodus: Approximately 1,000 employees have left CISA due to the Trump administration’s workforce purge, impacting the agency’s capacity to protect federal networks. Cybersecurity Division Impact: The Cybersecurity Division has suffered significant losses, dropping from around 1,100 to approximately 800 personnel, straining its operational effectiveness. Voluntary Departures: Over 600 employees departed in the latest round, leading to speculation about a possible Reduction in Force (RIF), though many positions have been vacated voluntarily. Leadership Changes: CISA is bracing for leadership shifts with the recent appointment of Deputy Director Madhu Gottumukkala and the upcoming confirmation of Sean Plankey as head,…

Essential Insights Threat Overview: Google identifies a financially motivated threat group named UNC6040, specializing in voice phishing (vishing) to access organizations’ Salesforce accounts for data theft and extortion. Deceptive Tactics: UNC6040 uses social engineering by impersonating IT support personnel, convincing employees to authorize a modified Salesforce Data Loader app that allows unauthorized access to sensitive information. Data Exfiltration and Lateral Movement: The attackers not only steal data from Salesforce but also move laterally within the victim’s network to target other platforms, with extortion attempts following months after initial breaches. Increased Targeting of IT Staff: The campaign highlights a growing trend…

Summary Points Vishing Campaign Targeting Salesforce: The threat actor UNC6040 is conducting a large-scale voice phishing attack, targeting Salesforce customers by impersonating IT support to gain unauthorized access to their accounts. Data Exfiltration and Extortion: By guiding victims to approve a malicious version of Salesforce’s Data Loader application, UNC6040 exfiltrates sensitive data for extortion, sometimes months post-intrusion. Social Engineering Tactics: All attacks rely on social engineering rather than exploiting Salesforce vulnerabilities, with UNC6040 specifically targeting sectors like education, hospitality, and retail across the Americas and Europe. Collaboration and Threat Links: The group shows links to other cybercriminal collectives, including claims…

Essential Insights Human Element Dominates Breaches: Nearly 70% of data breaches involve human factors, highlighting the vulnerability created by emotions and social engineering tactics. AI Enhances Both Attack and Defense: Criminals leverage AI for sophisticated scams and attacks, while defenders harness AI for more effective anomaly detection and simulations, creating a dynamic "cat and mouse" scenario. Emerging Threat of Deepfakes: Deepfakes represent a significant risk by enabling attackers to imitate individuals convincingly, challenging existing verification protocols and leading to greater potential for exploitation. Need for Continuous Vigilance: Organizations must prioritize awareness and robust verification processes (e.g., multi-factor interactions) to mitigate…

Quick Takeaways Backdoored Repositories: The investigation uncovered 141 backdoored GitHub repositories, primarily aimed at gaming cheaters and novice cybercriminals, with many repositories using a PreBuild event to stealthily download malware during compilation. Sakura RAT Analysis: Although initially seen as a sophisticated malware variant, Sakura RAT was rendered ineffective due to empty code forms and primarily acted as a lure, targeting users compiling the RAT instead of established businesses. Complex Infection Chains: The identified backdoors utilized convoluted infection chains involving multiple obfuscation techniques, downloading various payloads including infostealers and RATs, illustrating a sophisticated operational scale by the threat actor. Active Mitigation:…

Summary Points Security Breach Impact: Victoria’s Secret postponed its quarterly earnings due to a major security breach detected on May 24, which disrupted corporate operations and forced the company to shut down its U.S. shopping site for several days. Cyberattack Suspicions: While not explicitly confirmed, the incident is believed to resemble a ransomware attack, reflecting a growing trend of cyberattacks targeting retailers. Operational Disruptions: In addition to its website, some in-store services were affected, although most functions have since been restored. The company is still working to fully restore corporate systems. Preliminary Financial Outlook: Despite the breach, Victoria’s Secret anticipates…

With thousands of endpoints, cloud instances, remote users, and third-party integrations, securing the enterprise has become a massive target. Each change in the IT environment – whether driven by digital transformation, M&A activity, or routine system updates – creates new opportunities for adversaries to leverage. Yet, the network is the backbone of business operations. It must always be available to support production, collaboration, and growth. In this article, we’ll explore the specific challenges large enterprises face when validating their security posture and how leading security teams are evolving their testing strategies to match the scale, speed, and sophistication of large,…

Fast Facts Exposed Vulnerabilities: Approximately 35,000 solar power systems are exposed online, making them susceptible to potential remote attacks due to over 90 identified vulnerabilities, particularly among products from firms like Sungrow, Growatt, and SMA Solar Technology. Geographical Distribution: More than 75% of these internet-exposed devices are located in Europe, with a significant portion in Asia, reflecting global vulnerability in solar energy infrastructure. Device Types at Risk: The most commonly exposed devices include SMA Sunny Webbox (10,000 units), Fronius inverters (4,000), and others, highlighting specific products that need urgent security attention. Potential Threats: While not all exposed devices can be…

In today’s cyber landscape, advanced threat actors are exploiting the very fabric of our digital identity infrastructure. They’re not just breaking in; they’re taking over, compromising the identity providers of some of the world’s largest organizations with alarming ease. Once inside, these attackers move laterally, infiltrating cloud environments and exfiltrating sensitive data – all within a matter of days. It’s a chilling reality, and it’s happening right now. Join us for an exclusive webinar with Ian Ahl, SVP of P0 labs and former Head of Advanced Practices at Mandiant, as he pulls back the curtain on the tactics of these…

A new mobile malware tool that security vendors are tracking as “Crocodilus” is stealthily slithering onto Android devices around the world via fake banking apps, phony browser updates, and malicious ads promising fake rewards.ThreatFabric’s mobile threat intelligence team firm spotted Crocodilus in test campaigns in March and shortly after in live campaigns that mainly targeted Android users in Turkey. Since then, the malware has surfaced on devices in Poland, Spain, South America, and parts of Asia, signaling a sharp uptick in both its reach and sophistication.Updated FeaturesThe malware now has an updated feature set, which includes the ability to create…