Tag: infrastructure
-
CISA Releases Thorium: Open-Source Malware and Forensics Tool Now Public
The Cybersecurity and Infrastructure Security Agency (CISA) has made a significant contribution to the cybersecurity community by publicly releasing Thorium, a powerful open-source platform designed to revolutionize malware analysis and digital forensics operations. This announcement marks a major milestone in democratizing advanced cybersecurity tools for organizations worldwide. Partnership with Sandia National Laboratories CISA, in partnership…
-
SentinelLabs uncovers China’s hidden cyber-espionage arsenal
CSOonline that the most important pieces of new information gleaned from the findings are that “China’s contracting ecosystem forces many companies and individuals to collaborate on intrusions. This means many China-based Advanced Persistent Threats (APTs) may actually contain many different companies with many different clients.”The nation’s diverse private sector offensive ecosystem, he said, “supports a…
-
CISA open-sources Thorium platform for malware, forensic analysis
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) today announced the public availability of Thorium, an open-source platform for malware and forensic analysts across the government, public, and private sectors. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-open-sources-thorium-platform-for-malware-forensic-analysis/
-
The Kremlin’s Most Devious Hacking Group Is Using Russian ISPs to Plant Spyware
The FSB cyberespionage group known as Turla seems to have used its control of Russia’s network infrastructure to meddle with web traffic and trick diplomats into infecting their computers. First seen on wired.com Jump to article: www.wired.com/story/russia-fsb-turla-secret-blizzard-apolloshadow-isp-cyberespionage/
-
Singapore’s Strategic Approach to State-Linked APT Cyber Threats
Singapore’s recent disclosure of an ongoing cyberattack by the advanced persistent threat (APT) group UNC3886 on critical infrastructure highlights a deliberate strategy favoring technical attribution over overt political linkages. Coordinating Minister for National Security K. Shanmugam announced during the Cyber Security Agency’s (CSA) 10th anniversary event that the nation is contending with this highly sophisticated…
-
Dahua-Überwachungskameras mit Sicherheitslücken
Überwachungskameras sind ein nicht zu unterschätzendes Element der Angriffsoberfläche einer IT-Umgebung. Einerseits eignen sie sich für den Aufbau von Botnetzen, andererseits sind sie ein mögliches Einfallstor für Hacker, die sich Zugriff auf die IT-Infrastruktur von Unternehmen erschließen wollen. So sind beispielsweise Kameras chinesischer Hersteller, die an kritischen Infrastrukturen wie Bahnhöfen eingesetzt sind, ein potenzielles Risiko. Nun…
-
UNC2891 Breaches ATM Network via 4G Raspberry Pi, Tries CAKETAP Rootkit for Fraud
The financially motivated threat actor known as UNC2891 has been observed targeting Automatic Teller Machine (ATM) infrastructure using a 4G-equipped Raspberry Pi as part of a covert attack.The cyber-physical attack involved the adversary leveraging their physical access to install the Raspberry Pi device and have it connected directly to the same network switch as the…
-
Internet exchange points are ignored, vulnerable, and absent from infrastructure protection plans
Italian operator calls for lawmakers to wake up to the critical role played by peering First seen on theregister.com Jump to article: www.theregister.com/2025/07/31/ixp_resilience_call/
-
Applying Tenable’s Risk-based Vulnerability Management to the Australian Cyber Security Centre’s Essential Eight
Tags: ai, attack, breach, business, cloud, compliance, container, control, cvss, cyber, cybersecurity, data, data-breach, defense, endpoint, finance, firewall, framework, google, government, identity, incident response, infrastructure, intelligence, Internet, microsoft, mitigation, network, ransomware, risk, service, software, strategy, technology, threat, tool, update, vpn, vulnerability, vulnerability-management, windows, zero-dayLearn how Thales Cyber Services uses Tenable to help customers navigate the maturity levels of the Essential Eight, enabling vulnerability management and staying ahead of cyber threats. In today’s fast-moving digital world, cyber threats are more advanced and relentless than ever. A single security breach can mean financial loss, reputational damage and operational chaos. That’s…
-
Plankey nomination for CISA director advances to Senate floor
Sean Plankey’s nomination to direct the Cybersecurity and Infrastructure Security Agency advanced out of committee on Wednesday after languishing for several months, bringing him one step closer to confirmation. First seen on therecord.media Jump to article: therecord.media/plankey-advances-cisa-nomination
-
CISA Pledges to Release Salt Typhoon Report
Senator Declines to Lift Hold on Trump’s CISA Nominee Without Clear Timeline. The U.S. Cybersecurity and Infrastructure Security Agency plans to release a report on telecom vulnerabilities exploited in the Salt Typhoon cyberespionage campaign to help move along President Donald Trump’s nomination to lead the agency – but Sen. Ron Wyden still intends to delay…
-
Palo Alto kauft CyberArk
Tags: ceo, cloud, cybersecurity, cyersecurity, endpoint, firewall, google, governance, identity, infrastructure, network, risk, toolDer israelische Identity-Management-Anbieter CyberArk wird Teil von Palo Alto Networks. Mit der Übernahme des Identity-Management-Spezialisten CyberArk für rund 25 Milliarden Dollar geht Palo Alto Networks möglicherweise das größte Risiko seiner Geschichte ein. Faszinierend ist dieser Deal insbesondere deshalb, weil Palo Alto Networks über Jahre den Bereich Identity Management bewusst gemieden hat. Und das aus gutem…
-
Game changer: How AI simplifies implementation of Zero Trust security objectives
Tags: access, ai, api, automation, cloud, computing, cyber, data, detection, firewall, infrastructure, network, service, software, strategy, technology, threat, tool, vmware, vulnerability, zero-trust“You may think, oh that’s good enough,” Rajagopalan said. “I’ll protect my critical apps through Zero Trust and not worry about non-critical apps. But that ‘partial Zero Trust’ approach won’t work. Modern attackers identify less-secure environments and systems, enter through them, and then move laterally toward high value assets. True Zero Trust demands that every…
-
Palo Alto Networks to buy CyberArk for $25B as identity security takes center stage
The identity crisis driving this deal: Walk into any CISO’s office these days, and they’ll tell you the same story: hackers don’t need to break down the front door anymore. They just steal legitimate credentials and walk right in.”Today, most breaches originate not from malware or misconfigured ports but from stolen or misused credentials,” Tyagi…
-
Palo Alto Networks eyes $20B CyberArk deal as identity security takes center stage
The identity crisis driving this deal: Walk into any CISO’s office these days, and they’ll tell you the same story: hackers don’t need to break down the front door anymore. They just steal legitimate credentials and walk right in.”Today, most breaches originate not from malware or misconfigured ports but from stolen or misused credentials,” Tyagi…
-
Industry experts warn crypto infrastructure is ‘creaking’
A new report from experts at HSBC, Thales and InfoSec Global claims decades-old cryptographic systems are failing, putting businesses at risk from current vulnerabilities and the threat from quantum computing First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366628242/Industry-experts-warn-crypto-infrastructure-is-creaking
-
Hackers Exploit SAP Vulnerability to Breach Linux Systems and Deploy Auto-Color Malware
Threat actors have been observed exploiting a now-patched critical SAP NetWeaver flaw to deliver the Auto-Color backdoor in an attack targeting a U.S.-based chemicals company in April 2025.”Over the course of three days, a threat actor gained access to the customer’s network, attempted to download several suspicious files and communicated with malicious infrastructure linked to…
-
MCP”‘Sicherheit: Das Rückgrat von Agentic AI sichern
Tags: access, ai, api, authentication, ciso, credentials, cyberattack, cyersecurity, firewall, infrastructure, LLM, mfa, risk, toolIm Zuge von Agentic AI sollten sich CISOs mit MCP-Sicherheit auseinandersetzen. Das Model Context Protocol (MCP) wurde erst Ende 2024 vorgestellt, dennoch sind die technologischen Folgen in vielen Architekturen bereits deutlich spürbar. Damit Entwickler nicht jede Schnittstelle mühsam von Hand programmieren müssen, stellt MCP eine einheitliche ‘Sprache” für LL-Agenten bereit. Dadurch können sie Tools, Datenbanken und SaaS”‘Dienste…
-
Bitdefender-Informationen zur Blacksuit/Royal-Ransomwaregruppe
Auch Bitdefender war an den Ermittlungen gegen die Ransomware-Kriminellen von Blacksuite beteiligt. Zu der internationalen Checkmate-Aktion, die zu der Beschlagnahme und der Zerschlagung der technischen Infrastruktur der Blacksuit-Gruppe führte, liefert Bitdefender nun in einem Blog Informationen über die Verbreitung der Ransomware, die Opfertypologie und das technische Vorgehen der Angreifer. Zu den wichtigsten Inhalten des Bitdefender-Blogposts…
-
Chaos RaaS Emerges After BlackSuit Takedown, Demanding $300K from U.S. Victims
A newly emerged ransomware-as-a-service (RaaS) gang called Chaos is likely made up of former members of the BlackSuit crew, as the latter’s dark web infrastructure has been the subject of a law enforcement seizure.Chaos, which sprang forth in February 2025, is the latest entrant in the ransomware landscape to conduct big-game hunting and double extortion…
-
New Risk Index Helps Organizations Tackle Cloud Security Chaos
Enterprises can use the IaC Risk Index to identify vulnerable cloud resources in their infrastructure-as-code environment which are not managed or governed. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/risk-index-tackle-cloud-security-chaos
-
CISA Warns of Exploited Critical Vulnerabilities in Cisco Identity Services Engine
Tags: cisa, cisco, cybersecurity, exploit, flaw, hacker, identity, infrastructure, service, vulnerabilityHackers are actively exploiting two critical flaws in Cisco Identity Services Engine, said the US Cybersecurity and Infrastructure Security Agency First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisa-kev-cisco-ise/
-
CISA Adds Cisco ISE and PaperCut Vulnerabilities to Known Exploited Vulnerabilities Catalog
Tags: cisa, cisco, cybersecurity, exploit, flaw, identity, infrastructure, kev, remote-code-execution, service, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert, adding three high-impact vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. These include two unauthenticated remote code execution flaws in Cisco Identity Services Engine (ISE) and one cross-site request forgery (CSRF) vulnerability affecting PaperCut NG/MF software. First seen on thecyberexpress.com Jump to…
-
PyPI Alerts Developers to New Phishing Attack Using Fake PyPI Site
Python developers are being warned about a sophisticated phishing campaign targeting users of the Python Package Index (PyPI) through fraudulent emails and a deceptive clone of the official repository website. While PyPI’s infrastructure remains secure, attackers are exploiting developer trust by impersonating the legitimate service to harvest user credentials. Attack Details and Methodology The phishing…
-
Ermittler stoppen Erpresser-Software von Blacksuit/Royal
Die Angreifer verschlüsseln Daten nicht nur, sondern stehlen diese vorher.Fast 200 Opfer und ein Millionenschaden: Internationalen Ermittlern ist ein Schlag gegen weltweit agierende cyberkriminelle Erpresser gelungen. Die technische Infrastruktur der Gruppierung Blacksuit/Royal sei identifiziert und beschlagnahmt worden, teilte das Landeskriminalamt (LKA) Niedersachsen mit. Durch das Abschalten der Server wurden demnach die Kommunikation, die Verbreitung der…
-
Nach Flugausfällen sprechen Hacker und Kreml von Angriff
Im Kreml spricht man von alarmierenden Nachrichten.In Moskau sind nach einem mutmaßlichen Angriff proukrainischer Hackergruppen Dutzende Flüge ausgefallen. Die staatliche russische Fluggesellschaft Aeroflot sprach zunächst von etwa 60 gestrichenen Flügen am Airport Scheremetjewo und gab eine Störung in ihren IT-Systemen als Grund dafür an. Experten des Unternehmens arbeiteten daran, die Arbeit der Server wiederherzustellen, um…
-
CISA Issues Alert on PaperCut RCE Vulnerability Under Active Exploitation
Tags: cisa, cve, cyber, cybersecurity, exploit, infrastructure, kev, rce, remote-code-execution, risk, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) has added a critical PaperCut vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, warning organizations of active exploitation attempts targeting the widely-used print management software. The vulnerability, tracked as CVE-2023-2533, represents a significant security risk that could allow attackers to execute arbitrary code on affected systems. Critical Vulnerability…
-
CISA Issues Alert on Cisco Identity Services Engine Flaw Exploited in Active Attacks
Tags: attack, cisa, cisco, cyber, cybersecurity, exploit, flaw, identity, infrastructure, injection, kev, risk, service, threat, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical security alert regarding severe vulnerabilities in Cisco’s Identity Services Engine (ISE) that are being actively exploited by threat actors. The agency added two critical injection vulnerabilities to its Known Exploited Vulnerabilities Catalog on July 28, 2025, signaling immediate risks to organizations using the affected…