This blog explores how intelligence analysts can distinguish objective victimology from subjective threat actor motivations when reporting on “targeted” sectors. Analysts can ensure consistent, data-driven threat assessments by leveraging standardized industry classifications (ISIC, NACE, and NAICS) and linking tactical evidence to strategic assertions in Synapse. Storm queries help validate that strategic conclusions about targeting are backed by concrete, observable evidence.
Hunt & Hackett details its end-to-end YubiKey FIDO2 rollout for Microsoft Entra ID, using phased conditional access enforcement to mandate phishing-resistant hardware authentication for specific users and actions. Its approach includes automated Temporary Access Pass (TAP) provisioning for onboarding and fallback, access packages for exceptions, and robust monitoring of breakglass accounts. Key lessons include session token control and cross-platform testing prior to full enforcement.
Prompt injection attacks in VS Code's Copilot Chat could allow malicious actors to leak data or execute code by embedding crafted prompts in GitHub issues. GitHub responded with security improvements like enhanced confirmation flows, tool execution restrictions, and sandboxed environments. The post also recommends Workspace Trust and containerization as defenses, emphasizing the need for ongoing protection as LLM threats evolve.
Three years after the Optus breach exposed millions of customer records, Intruder's [13] research team went hunting for the same broken API authorization flaws. They found:
Azure AppHunter is an open-source PowerShell tool designed for security researchers, red teamers, and defenders. It identifies excessive or risky permissions granted to Azure Service Principals, helping teams uncover misconfigurations and enforce least privilege.
EntraRoleReaper audits Entra ID users' role assignments by comparing them to actual operations performed over a selected time period. The tool supports least privilege reviews and helps reduce unnecessary role sprawl in Microsoft Entra ID environments.
AntiDebug is a terminal-based tool for testing x86_64 Windows anti-debugging techniques. It provides a hands-on environment for analyzing and understanding various methods malware may use to detect or evade debuggers.
Phishing campaigns are now embedding AI prompt injection commands within emails to manipulate automated analysis tools while simultaneously targeting users with credential harvesting tactics. These hidden prompts instruct AI models to enter reasoning loops rather than flag malicious content, increasing the risk of delayed detection or false negatives in SOC workflows. This dual-track approach highlights attackers' growing awareness of AI-based defenses and their efforts to bypass both human and machine detection systems.
This guide breaks down Docker in plain terms: containers package code with dependencies to avoid the “works on my machine” problem. It covers key concepts like `Dockerfile` “recipes,” `docker build` commands for creating layered images, registries for storing images, and `docker run` for execution. Containers offer faster, more consistent, isolated, and efficient environments for running applications across systems.
This article outlines a strategic approach to security by identifying and protecting your organization's “crown jewels,” the most critical assets, systems, or people. These may include intellectual property, CI/CD pipelines, backup infrastructure, or key personnel. Instead of reacting to specific attacker tactics, the approach emphasizes understanding attacker intent and designing layered defenses around the assets most likely to be targeted. The process is recursive, expanding protections outward from the crown jewel.
AWS experts offer a guide to choosing cloud security tools. Explore how to integrate third-party tools into your AWS stack for threat protection. Read the guide now [21] to find the best security solutions for your AWS environment.
Federal authorities charged Oregon resident Ethan Foltz with operating the Rapper Bot DDoS network, which controlled 95,000 infected devices and launched over 370,000 attacks in just four months.
A cyberattack on Aspire Rural Health in Michigan exposed the personal and healthcare data of nearly 140,000 patients, including Social Security numbers and medical records.
Many organizations solve software installation problems by handing out local admin rights. This generally “works” in terms of getting software installed, at the cost of creating a massive security threat.
Attackers are using the Japanese hiragana character 'ん' (n) in phishing domains to impersonate Booking.com, creating URLs that appear legitimate but redirect victims to credential-stealing sites. The campaign exploits how the character renders similarly to the Latin 'n' in many fonts, making malicious domains harder to detect. Users should verify URLs carefully and avoid clicking links in unsolicited emails claiming to be from Booking.com.
Over 300 entities were infected by SHAMOS, a variant of the Atomic macOS Stealer (AMOS), through malvertising campaigns between June and August. The malware steals passwords stored in Keychain, browser data, cryptocurrency wallets, and other sensitive information from infected macOS systems. The campaign used malicious advertisements to distribute the stealer, targeting Mac users with fake software downloads.
CPAP Medical Supplies, a company that serves mainly military personnel, suffered a hack between December 13 and 21 that exposed over 90,000 individuals' sensitive data. The breach created risks of identity and medical fraud. Affected customers have been offered monitoring services. CPAP Medical Supplies has stressed that there has been no evidence of misuse so far.
Attackers embed base64-encoded Bash commands in RAR filenames that run automatically during directory listing with unsafe patterns like eval "echo $f" or for f in *. The attack downloads loaders specific to architecture that fetch XOR-encrypted VShell backdoor payloads, decrypts them in memory, and executes as fake kernel threads such as [kworker/0:2] to evade detection. This method bypasses defenses because antivirus doesn't scan filenames, the malware doesn't touch disk after decryption, and execution happens via common shell operations without needing executable permissions.
This post walks through how to set up a CI/CD pipeline using Terraform and GitHub Actions to manage Okta resources. The pipeline is configured to use AWS for remote state storage and storing the secrets for accessing Okta.
Anthropic's Claude platform has introduced AI-powered code security reviews, which can make detecting common vulnerabilities easier and more integrated for developers. While these tools provide helpful automation for identifying issues like SQL injection and authentication flaws, they are not foolproof and miss complex bugs. Human expertise, comprehensive security practices, and additional testing are still necessary to achieve safe and secure application development in the fast-evolving landscape of AI-assisted coding.
Security teams are always busy, and it’s hard to find time and space for training. TryHackMe makes training easy (and fun) with exciting browser-based exercises [11], hyper-realistic simulations, and hands-on labs all designed to maximize challenge and engagement while building real skills. “I’m personally a massive fan of
The RRE Burp extension automates detecting Recursive Request Exploits by tracing API call chains from protected resources to find unauthenticated upstream APIs exploitable to bypass access controls. It uses Shannon entropy analysis (default threshold 3.0) to identify valuable backend tokens and parameters, then traces requests to find low-trust inputs that produce these high-value outputs. Demonstrated at DEF CON 33, it scales to find vulnerabilities across streaming services ("Streamageddon"), revealing how API chain flaws can bypass paywalls.
Unit 42's three-tier attribution framework tracks threats from activity clusters to named threat actors, requiring rigorous evidence like Diamond Model mapping and Admiralty System scoring for source reliability (A-F) and credibility (1-6). It mandates six-month observation, multiple sources, and TTP analysis before tier promotion, preventing premature attribution and enabling focused tracking. Default scores apply to common artifacts, with analyst adjustments and review board validation.
2025.08.25·
unit42.paloaltonetworks.com·16 min read·TLDR InfoSec
Raven is a modern, efficient, lightweight subdomain enumeration tool for security researchers and penetration testers. Built in Go, it offers a robust and user-friendly experience for discovering subdomains of a target domain. Raven has advanced features to minimize false positives and optimize performance.
Physicists from Hebrew University and Los Alamos Labs developed quantum encryption using imperfect quantum dot light sources, outperforming traditional laser-based systems by extending secure transmission distances by over 3 dB. The breakthrough employs a truncated decoy state and heralded purification protocols to filter multi-photon emissions in real time, removing the need for perfect single-photon sources for 40 years. Room-temperature tests showed the approach works with existing equipment, making quantum-secure communication more practical and affordable.
A former developer for an Ohio company was sentenced to four years for deploying malicious code and a kill switch that caused global outages after he lost access. His actions cost the company hundreds of thousands, highlighting the threat of insider sabotage.
Security researchers found that Google Gemini-powered tools can be deceived by hidden prompts embedded in images, exploiting image scaling for prompt injection. This trick can cause AI to leak data or act out of bounds. Google says it's not a default vulnerability, but experts urge stronger AI system defenses and user previews.
DaVita, a kidney dialysis provider, confirmed that a ransomware attack exposed personal and health information of 2,689,826 individuals, as reported to the Department of Health's Office for Civil Rights.
Attackers breached Orange Belgium's IT systems in July, stealing personal data of 850,000 customers, including names, phone numbers, SIM card numbers, PUK codes, and tariff plans. The company detected the breach at the end of July and confirmed that passwords, emails, and financial information were not compromised. Orange Belgium identified the threat group responsible, but hasn't disclosed its identity. The company confirmed this was unrelated to China's Salt Typhoon attacks targeting telecoms worldwide.
Apple has patched CVE-2025-43300, a zero-day exploit in the ImageIO framework that causes memory corruption via malicious images. It affected iOS 18.6.2, iPadOS 18.6.2/17.7.10, and macOS Ventura 13.7.8, Sonoma 14.7.8, and Sequoia 15.6.1. This is Apple's seventh zero-day patch in 2025.
TPG Telecom's subsidiary iiNet suffered a data breach due to a stolen employee login, exposing the data of around 280,000 customers. The exposed information includes emails, phone numbers, addresses, and some setup passwords. The breach was contained, and affected customers are being notified.
Russian hackers probably sabotaged a Norwegian dam in April by remotely opening valves for four hours. Poland also reported a thwarted cyberattack that could have cut water to a major city. These attacks, linked to groups like Z-Pentest Alliance, show water facilities as vulnerable targets that could lead to bigger threats. Water utilities should boost cybersecurity with more funding, consulting, or free resources like the DEF CON Franklin project.
FreeVPN.One, a popular VPN Chrome extension, secretly takes screenshots of users' browsing—including sensitive info—and uploads them to the developer's servers without consent. Despite claiming to protect privacy, it abuses permissions, uses encryption to evade detection, and provides misleading explanations, exposing security flaws in Chrome extensions.
As AI browsers like Comet take over online tasks, they're dangerously vulnerable to scams and prompt injections, sometimes making purchases or clicking harmful links without user awareness. Traditional fraud techniques and new AI-targeted tricks can easily fool agentic AI, making users pay the price. Security must be built into AI browsers from the ground up, not treated as an afterthought, to protect users in this new era of automated scamming.
Chalk captures metadata at build time and can add a small 'chalk mark' (metadata) to any artifacts so that they can be identified in production. It can also extract chalk marks and collect additional metadata about the operating environment during this process.
Microsoft's Copilot AI allowed users to access files in M365 without leaving audit log records, creating potential security and compliance risks. This was reported to Microsoft, which quietly fixed the issue but chose not to notify customers or issue a formal security alert. Any organization using Copilot before August 18 may have incomplete audit logs and might be unaware of what happened.
Two ethical hackers accessed a North Korean state hacker's computer for months and uncovered evidence of cyberespionage and theft. They leaked their findings to support cyber defense and expose government-backed hacking activities, hoping their action would inspire more transparency and accountability in global cybersecurity.
Security questionnaires are a standard part of the security review process that can often be tedious, time-consuming, and mechanical for vendors' teams. Instead of buying a tool to handle this process, vendors can either build their own RAG or use Claude/ChatGPT. To use Claude/ChatGPT, prepare a folder with the relevant documents that would be included in a Trust Center, as well as some previously manually completed questionnaires.