German broadcaster DW reports that hackers could access millions of solar panels responsible for hundreds of GW of electricity output via remote cloud-based services. Although the vendors have denied detecting any malicious access, attackers exploiting such vulnerabilities could lead to widespread blackouts in the European power grid. The EU is introducing regulations to enhance cybersecurity and protect critical infrastructure from cyberattacks.
Microsoft has named four individuals against whom it is taking legal action for abusing Azure OpenAI services to create harmful content. Members of the Storm-2139 APT group exploited exposed customer credentials scraped from public sources to unlawfully access accounts with certain generative AI services. Upon publication of the report, the cybercriminals doxed Microsoft's counsel of record, and some suspected cybercriminals sent emails to the counsel.
QR Phishing, or "quishing," is rising as scammers use these to steal personal information, install malware, or redirect to malicious websites. Criminals trick unsuspecting users by placing fake QR codes over legitimate ones or sending malicious QR codes via email or text. To stay safe, users should verify QR codes in public places, preview URLs before scanning, and be cautious with unsolicited QR codes.
Microsoft reports their customers face 600 million attacks daily from cybercriminals and nation-state actors. Despite Microsoft 365 apps sharing a common authentication layer, each app within the suite presents unique security challenges. Analysis by Obsidian Security reveals 70% of integrations are inactive, yet many retain privileged access—a key vector in the Midnight Blizzard breach.
Threat intelligence firm Kela has identified a new ransomware group that started as recently as late 2024. The group offers classic ransomware, data ransom, and access monetization services with different profit sharing agreements for each. So far, Anubis has claimed responsibility for 3 hacks and lists a fourth as “New - Top secret.”
Researchers from Modat discovered 49K exposed Access Management Systems that were not correctly configured for secure authentication. Anyone could view unencrypted employee data such as names, email addresses, phone numbers, biometrics, photos, work schedules, and access logs. In some cases, Modat could even edit employee records, add fake employees, change access credentials, restrict access to legitimate employees, and grant access to malicious actors.
UK water supplier Southern Water disclosed in its financial report that a Black Basta ransomware attack from February 2024 cost the company roughly £4.5M. Leaked chat logs from the Black Basta ransomware gang show that the company offered to pay £750K after the attackers demanded $3.5M. Representatives from the company refused to clarify whether they paid the ransomware gang.
Claude 3.7 Sonnet generated a CRUD application with notably secure code but still with a potential denial-of-service vulnerability in the email validation regex, which uses greedy quantifiers that could lead to exponential processing time. Despite this issue, Claude 3.7 Sonnet outperformed previous models and competitors that generated code with XSS vulnerabilities.
Sendbird improved AWS security by utilizing a holistic cloud security model, transitioning to SSO with Okta, managing access requests for EC2 and databases, and setting up SIEM for cloud security. They also focused on secure container management and plan to continue enhancing security measures for their evolving infrastructure.
Researchers from AdaLogics experimented with using their Fuzz Introspector tool along with an LLM to generate fuzz testing harnesses. The fuzzing workflow that they created takes a project link and function name and uses Fuzz Inspector to extract the necessary data for the LLM. This data is then converted into a prompt that is sent to the LLM and then the LLM's output is extracted and manually verified for correctness.
Drata partnered with Wakefield Research to survey 300 U.S. IT and security professionals for the new State of GRC 2025 report [12]. The data shows that GRC programs, traditionally viewed as cost centers, are now increasingly being seen as revenue drivers. AI is poised to deliver further transformation in compliance. Read the full report →
keycred is a tool for managing KeyCredentialLinks and certificate key pairs in Active Directory environments. It supports various authentication mechanisms and strict compliance with rules for validated writes.
Archipelo aims to improve software security and compliance by tracking the Software Development Lifecycle (SDLC) and tracking AI usage during the process.
In this post, PAN's Unit42 analyzes a sophisticated backdoor named Squidoor targeting Windows and Linux systems. The suspected Chinese threat actors exploited vulnerabilities in IIS servers to deploy web shells for persistent access and lateral movement. Squidoor allows attackers to maintain access, execute commands, and communicate stealthily with their operators across different networks using the Outlook API or tunnels over ICMP or DNS.
2025.02.28·
unit42.paloaltonetworks.com·10 min read·TLDR InfoSec
Amnesty International discovered that Serbian authorities covertly infected phones during police interviews using Cellebrite tools and a newly found spyware called NoviSpy. The spyware allowed for extensive surveillance, leading to Cellebrite suspending its services in Serbia and calls for independent investigations and safeguards against misuse of digital technologies.
The Department of Health and Human Services has fined Warby Parker $1.5M for HIPAA failures. The fines are levied due to a 2018 data breach in which data of 200K customers was stolen as well as two other smaller data breaches in 2020 and 2022. According to the HHS' Office of Civil Rights as of September 2024, Warby Parker still had not conducted an assessment of potential risks and vulnerabilities or taken appropriate steps to improve their security posture.
The U.S. Army soldier who admitted to leaking officials' phone records had researched countries without U.S. extradition and if hacking could be treason.
The FBI reported that North Korean hackers stole $1.5 billion from Bybit exchange on February 21 - the hackers are rapidly laundering the cryptocurrency.
One of Australia's largest fertility service providers, Genea, has reported a breach in which attackers stole 940.7GB of data. Gather attackers obtained access through a Citrix server and then obtained access to the company's primary file server, DC, backup program, and BabySentry patient management system. The breached data includes full names, email addresses, phone numbers, dates of birth, emergency contacts, next of kin data, health insurance numbers, and medical history.
Socket has discovered a malicious Python package called automslc that pirates music from the Deezer streaming service via hardcoded credentials. The automslc package utilized user supplies credentials to login to Deezer or hardcoded credentials and stores downloaded files locally. Socket reported that the package has been downloaded over 100K times.
Two security researchers reported the ‘Material Theme - Free' and ‘Material Theme Icons - Free' to Microsoft because they seemed malicious. BleepingComputer found a heavily obfuscated release-notes.js file that upon partial deobfuscation makes reference to usernames and passwords in several places. The author of the themes denies any malicious intent and states that a dependency may have been compromised but that Microsoft should have alerted them instead of removing the package.
This blog post, from Google's Security team, discusses the urgent need to eliminate memory safety vulnerabilities in software to enhance security and trust in technology. The authors propose a standardization framework to promote the widespread adoption of memory-safe practices and tools in the software industry. Google is actively involved in advocating for memory safety standards, developing potential standards with partners, and prioritizing memory-safe languages to reduce vulnerabilities and enhance security in its products and services.
This post discusses brute force, dictionary, and rainbow table attacks to crack passwords. To defend against these techniques, users should choose strong, unique passwords and enable multi-factor authentication. Tools like Specops Policy provide an extra layer of protection by continuously scanning Active Directory against a database of over 4 billion breached passwords.
This blog post explains the role of a SOC Analyst, which involves monitoring and responding to cybersecurity threats within organizations. Their progression requires technical skills with SIEM tools and security systems.
Marco Ivaldi of HN Security has released new tools in Rust for reverse engineering and vulnerability research in IDA Pro that leverage the IDA SDK and Binarly's idalib Rust bindings for a faster user experience. These tools, which include rhabdomancer and haruspex, help locate potentially insecure API calls and extract pseudo-code for analysis, enhancing the efficiency of vulnerability research efforts. The availability of idalib opens up opportunities for developers to create standalone analysis tools in Rust, expanding the capabilities of IDA Pro in security research.
EclipseRecon is a powerful and stealthy web reconnaissance tool designed to uncover hidden vulnerabilities, subdomains, and intricate site structures that may otherwise remain in the dark.
The Linux Foundation's Open Source Security Foundation (OpenSSF) released a security baseline for open source projects to improve their security and trustworthiness. This checklist outlines best practices to reduce vulnerabilities and enhance project security levels. Developers are encouraged to meet at least level 1 requirements, with larger projects advised to aim for level 3.
The UK government asking Apple to create a backdoor in iCloud could put everyone's data at risk. This could perhaps be a coordinated effort with other “Five Eyes” countries of the United States, Canada, Australia, and New Zealand: the rich English-language-speaking spying club. Everyone can help with privacy and support companies like Apple not buckle down by enabling the Advanced Protection feature as well as being proactively involved in the policy front.
This blog post highlights some of the challenges that AI brings to the SecOps field as well as some opportunities that it brings to defenders. Attackers can utilize AI to aid in social engineering research and crafting spear phishing emails or craft deepfakes as well as aid in developing malware. Defenders can incorporate AI Agents in their threat hunting workflows.
Microsoft released the Windows 11 KB5052093 update with 33 fixes and improvements for common issues like SSH problems, File Explorer bugs, and audio volume glitches.
Deputy Homeland Security nominee Troy Edgar has endorsed the dismantling of CISA's Cyber Safety Review Board, claiming the agency needed "reining in” as it had overstepped its boundaries by getting too involved in election interference investigations.
Trust centers turn your security programs from a cost center to a revenue enabler. Get the low-down on launching and operationalizing your trust center in this guide by Safebase [4], packed full of insider tips from leading security teams [4]:
DISA Global Solutions, which provides drug and alcohol testing and background checks to more than 55K enterprises, has disclosed a data breach that impacts 3.3M individuals. DISA reported that in April 2024, it discovered that an attacker had been present in its network for over two months and procured information from its systems. The stolen data includes individuals' SSNs, financial account information, and government-issued documents, but DISA also stated that it could not determine the specific data procured.
Detroit Public Broadcasting notified 1,694 individuals about a data breach in August 2024. The breached data includes names, SSNs, passwords and usernames, medical info, addresses, employer ID numbers, and driver's license numbers. The Qlin ransomware gang claimed responsibility for the attack. Detroit PBS has not confirmed whether the filing implied a ransomware attack.
Southern Water reportedly offered the Black Basta ransomware gang $750,000 following a January 2024 cyberattack, down from the initial $3.5 million demand. The information emerged from leaked internal Black Basta chats. While the utility company avoided confirming the payment, chat logs suggest the ransom was paid for approximately 750GB of stolen data.
Pricing models impact security and software engineering teams differently. Security vendors tend to extract more value due to higher barriers to entry and limited ability for security teams to build their own tools. The pricing dynamic in the security industry hinders innovation and affordability, especially for smaller companies and startups.
This blog dives into how to harden Nginx deployments with essential configuration options that boost monitoring capabilities, enhance performance metrics, and reinforce security posture.
The ProjectDiscovery team decided to experiment with utilizing AI to generate nuclei templates from CVEs. The team utilized cvemap to identify CVEs that had a publicly available POC but did not already have a nuclei template and then built TemplateMan to aid in adding non-functional enhancements to the generated templates. They noted issues in parsing technical details out of unstructured Medium and other blog posts as well as issues with authenticated vulnerabilities and data quality. The ProjectDiscovery team has created a new repository to store the AI-generated templates and has also added the capability to build nuclei templates with AI to their online template editor.