Parse notes
Sponsored
Governance, risk, and compliance (GRC) programs take more time and resources to manage than ever before. The answer? Tools that enable continuous compliance [4]—to take work off your plate and help you manage changes across your controls and vendors, so _you_ can focus on innovation.
The AWS CloudFormation phishing attack begins with fake AWS Support emails containing a "Launch Stack" button that redirects victims to the AWS CloudFormation console. Clicking it deploys a template that creates an IAM role with admin privileges and a trust policy for the attacker's account. The IAM Role ARN is sent to the attacker's API Gateway, resulting in complete account compromise through privilege escalation, resource creation, and data exfiltration, avoiding detection.
Chinese cyber espionage group UNC3886 has targeted Juniper Networks MX routers nearing end-of-life, using six TinyShell-based backdoors for file transfers, shell command execution, and log disabling. They exploit JunOS security by using legitimate credentials for privileged access and injecting malicious payloads into the memory of legitimate processes. Juniper Networks has addressed this vulnerability (CVE-2025-21590) in recent OS updates and advises organizations to upgrade their devices to the latest Juniper Malware Removal Tool versions.
OBSCURE#BAT malware tricks users with fake captchas and software downloads to evade detection and steal data. It hides in systems using rootkit technology, making it hard to detect. To stay safe, only download from trusted sources and use threat detection tools.
Symantec demonstrates how OpenAI's Operator agent could execute a basic cyberattack with minimal prompt engineering. The research highlights that while most LLM attacker use cases have been passive, AI-powered agents with web interaction capabilities present expanded opportunities for both legitimate users and potential attackers.
DeepSeek's R1 model can create malicious code with careful prompting despite its guardrails. Tenable researchers generated working keyloggers and basic ransomware after claiming educational purposes, though manual intervention was needed to fix bugs.
Zero trust architecture requires continuous verification of users and devices regardless of network location. A four-level maturity model helps organizations assess progress, though complete implementation faces challenges with SaaS, device verification, and legacy systems. Organizations should approach zero trust as an ongoing journey tailored to their risk profile rather than a checklist.
secureCodeBox is a Kubernetes-based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box.
CRADLE is an open-source web app that empowers Cyber Threat Intelligence (CTI) analysts by streamlining threat analysis with collaborative note-taking, visual mapping, and report generation.
Quasar is a modified version of the original Quasar RAT, now featuring HVNC, webcam support, and better remote desktop streaming, enhancing its remote administration and misuse potential.
Three stalkerware apps—Cocospy, Spyic, and Spyzie—stored victims' stolen data on Amazon Web Services. Although notified by February with specific bucket locations, Amazon hasn't removed the data due to procedural issues, claiming the notifications aren't formal abuse reports.
The UK government faces criticism as its appeal hearing against Apple over a 'backdoor' order will be held secretly on March 14. The Technical Capability Notice would force Apple to provide access to encrypted iCloud data of users worldwide. Several MPs demand the hearing be public, warning about global privacy risks and dangerous precedents for authoritarian regimes.
The Medusa ransomware targeted over 300 U.S. critical infrastructure organizations until February 2025, leading the FBI, CISA, and MS-ISAC to issue a joint advisory for network defenders. The ransomware developers recruited access brokers via cybercriminal forums and used techniques to evade detection, executing double extortion schemes that demanded payment for decrypting files and preventing data leaks.
New ransomware SuperBlack exploits two Fortinet vulnerabilities to breach firewalls and deploy itself.
Microsoft reinstated VSCode extensions after mistakenly flagging them as malicious due to obfuscated code, which led to the banning of publisher Mattia Astorino.
ScarCruft, linked to North Korea, used KoSpy spyware to target Korean and English users, disguising it as utility apps to gather SMS, calls, location, files, audio, and screenshots.