Tag: infrastructure
-
Auditing MCP Server Access and Usage
6 min readRobust auditing is essential for secure MCP deployments, providing compliance evidence, forensic capabilities, and operational confidence for managing AI agents and context-aware systems at scale. The dynamic nature of MCP makes a lack of visibility dangerous, as attackers can exploit complex workflows and ephemeral infrastructure to hide malicious activity. First seen on securityboulevard.com…
-
Cybersecurity Awareness Month Is for Security Leaders, Too
Think you know all there is to know about cybersecurity? Guess again. Shadow AI is challenging security leaders with many of the same issues raised by other “shadow” technologies. Only this time, it’s evolving at breakneck speed. Key takeaways: The vast majority of organizations (89%) are either using AI or piloting it. Shadow AI lurks…
-
Auditing MCP Server Access and Usage
6 min readRobust auditing is essential for secure MCP deployments, providing compliance evidence, forensic capabilities, and operational confidence for managing AI agents and context-aware systems at scale. The dynamic nature of MCP makes a lack of visibility dangerous, as attackers can exploit complex workflows and ephemeral infrastructure to hide malicious activity. First seen on securityboulevard.com…
-
Google ‘Careers’ scam lands job seekers in credential traps
Tags: attack, authentication, breach, control, credentials, cybersecurity, defense, google, identity, infrastructure, jobs, login, mfa, monitoring, north-korea, phishing, scam, strategy, threat, trainingWhat must organizations must: Sublime observed a sophisticated backend infrastructure supporting the phishing operation. Rather than just relying on a static fake login page, the attackers used newly registered domains (like gappywave[.]com, gcareerspeople[.]com) and what appeared to be command-and-control (C2) servers such as satoshicommands[.]com to process stolen credentials.Additionally, the HTML and JavaScript of the fake…
-
Google ‘Careers’ scam lands job seekers in credential traps
Tags: attack, authentication, breach, control, credentials, cybersecurity, defense, google, identity, infrastructure, jobs, login, mfa, monitoring, north-korea, phishing, scam, strategy, threat, trainingWhat must organizations must: Sublime observed a sophisticated backend infrastructure supporting the phishing operation. Rather than just relying on a static fake login page, the attackers used newly registered domains (like gappywave[.]com, gcareerspeople[.]com) and what appeared to be command-and-control (C2) servers such as satoshicommands[.]com to process stolen credentials.Additionally, the HTML and JavaScript of the fake…
-
CAASM and EASM: Top 12 attack surface discovery and management tools
Tags: access, ai, api, attack, automation, blockchain, business, cloud, control, corporate, credentials, cyber, cybersecurity, dark-web, data, data-breach, detection, dns, endpoint, exploit, framework, guide, hacking, HIPAA, incident response, infrastructure, intelligence, Internet, leak, marketplace, microsoft, monitoring, network, open-source, PCI, risk, risk-assessment, service, soc, software, supply-chain, technology, threat, tool, update, vulnerabilityCAASM and EASM tools for attack surface discovery and management: Periodic scans of the network are no longer sufficient for maintaining a hardened attack surface. Continuous monitoring for new assets and configuration drift are critical to ensure the security of corporate resources and customer data.New assets need to be identified and incorporated into the monitoring…
-
Millions of Credentials Stolen Each Day by Stealer Malware
The cybercrime ecosystem surrounding stealer malware has reached unprecedented scale, with threat actors now processing millions of stolen credentials daily through sophisticated distribution networks. Security researchers have been monitoring these operations for nearly a year, revealing an alarming infrastructure that processes victim data at industrial volumes through platforms like Telegram, forums, and social media sites.…
-
New Salt Typhoon Attacks Leverage Zero-Days and DLL Sideloading
Salt Typhoon represents one of the most persistent and sophisticated cyber threats targeting global critical infrastructure today. Believed to be linked to state-sponsored actors from the People’s Republic of China, this advanced persistent threat group has executed a series of high-impact campaigns against telecommunications providers, energy networks, and government systems”, most notably across the United…
-
AWS Outage: Lessons Learned
What can we learn from the recent AWS outage, and how can we apply those lessons to our own infrastructure? What Happened? On October 20, 2025, AWS experienced a major disruption that rippled across the internet (and social media), affecting widely used services such as Zoom, Microsoft Teams, Slack, and Atlassian. The issue originated not…
-
AWS Outage: Lessons Learned
What can we learn from the recent AWS outage, and how can we apply those lessons to our own infrastructure? What Happened? On October 20, 2025, AWS experienced a major disruption that rippled across the internet (and social media), affecting widely used services such as Zoom, Microsoft Teams, Slack, and Atlassian. The issue originated not…
-
Dead-Drop Resolvers: Malware’s Quiet Rendezvous and Why Adaptive Defense Matters
At this weekend’s BSides NYC, Dr. Jonathan Fuller, CISO of the U.S. Military Academy at West Point, delivered an extremely clear talk on how modern malware hides its command-and-control (C2) infrastructure through dead-drop resolvers. Fuller, who co-authored Georgia Tech’s VADER project, described how adversaries increasingly use public platforms-GitHub, Dropbox, Pastebin, even blockchain transactions-as-covert meeting points…
-
The Many Shapes of Identity: Inside IAM 360, Issue 3
Tags: access, ai, business, cloud, communications, compliance, container, cybersecurity, data, deep-fake, encryption, guide, iam, identity, infrastructure, intelligence, microsoft, passkey, password, risk, software, strategy, technology, threatThe Many Shapes of Identity: Inside IAM 360, Issue 3 josh.pearson@t“¦ Tue, 10/21/2025 – 17:27 The new issue of IAM 360 is here! In this issue, we take on a theme that shows how identity never stands still, reshaping how we live and work as it evolves. We call it Form Factor. Why Form Factor?…
-
Self-propagating worm found in marketplaces for Visual Studio Code extensions
Tags: access, application-security, attack, backdoor, backup, best-practice, blockchain, breach, ciso, control, credentials, crime, crypto, cyber, data, data-breach, endpoint, framework, github, gitlab, google, government, identity, incident response, infrastructure, intelligence, least-privilege, login, malicious, malware, marketplace, network, open-source, resilience, risk, sans, security-incident, software, supply-chain, threat, tool, update, wormMarketplaces targeted: The Koi Security report is the latest in a series of warnings that threat actors are increasingly targeting VS Code marketplaces in supply chain attacks. Last week, Koi Security exposed a threat actor dubbed TigerJack spreading malicious extensions. And researchers at Wiz just published research showing the widespread abuse of the OpenVSX and…
-
CISA Flags Highly Exploitable Windows SMB Flaw
Tags: attack, cisa, cybersecurity, exploit, flaw, infrastructure, microsoft, mitigation, network, ntlm, windowsNTLM Reflection Attack Strikes Again. A three-month old flaw in a network protocol for file sharing used by Microsoft is under active exploitation, warns the U.S. Cybersecurity and Infrastructure Security Agency. The flaw’s exploitation bypasses mitigations Microsoft has built over the years to prevent NTLM reflection attacks. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/cisa-flags-highly-exploitable-windows-smb-flaw-a-29778
-
Oracle E-Business Suite Vulnerability Exploited In Ransomware Attacks
Tags: attack, business, cisa, cybersecurity, exploit, infrastructure, oracle, ransomware, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that a vulnerability impacting Oracle E-Business Suite customers has seen exploitation in ransomware attacks. First seen on crn.com Jump to article: www.crn.com/news/security/2025/cisa-oracle-e-business-suite-vulnerability-exploited-in-ransomware-attacks
-
AffAction Fights Back Against Sophisticated Scrapers with DataDome and Wins
Discover how AffAction, managing over 6,000 domains, drastically reduced scraping attacks and stabilized its infrastructure with DataDome. Real-time bot protection freed up their CTO’s time and ensured consistent uptime. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/10/affaction-fights-back-against-sophisticated-scrapers-with-datadome-and-wins/
-
DataDome Secures MCP Infrastructure, Establishes Trust for Agentic AI
First to help customers see, govern and grow agentic commerce via MCP interactions. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/10/datadome-secures-mcp-infrastructure-establishes-trust-for-agentic-ai/
-
The Unkillable Threat: How Attackers Turned Blockchain Into Bulletproof Malware Infrastructure
The blockchain was supposed to revolutionize trust. Instead, it’s revolutionizing cybercrime. Every foundational principle that makes blockchain technology secure”, decentralization, immutability, global accessibility”, has been systematically inverted by sophisticated threat actors into the most resilient malware delivery system ever created. Welcome to the era of EtherHiding, where malicious code lives forever on public ledgers, protected…
-
U.S. CISA adds Oracle, Windows, Kentico, and Apple flaws to its Known Exploited Vulnerabilities catalog
Tags: apple, cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, oracle, update, vulnerability, windowsU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Oracle, Windows, Kentico, and Apple flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Oracle, Windows, Kentico, and Apple flaws to its Known Exploited Vulnerabilities (KEV) catalog. Oracle recently released an emergency patch to address an information disclosure flaw, tracked as CVE-2025-61884 (CVSS…
-
CISA Warns of Actively Exploited Windows SMB Vulnerability
Tags: cisa, cve, cyber, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, threat, vulnerability, windowsThe Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Microsoft Windows Server Message Block (SMB) vulnerability to its Known Exploited Vulnerabilities catalog, warning that threat actors are actively exploiting the security flaw in the wild. The vulnerability, tracked as CVE-2025-33073, affects the Windows SMB Client and could allow attackers to escalate privileges on…
-
Pakistani Cyber Actors Impersonating ‘NIC eEmail Services’ to Target Indian Government
Tags: attack, credentials, cyber, email, government, group, india, infrastructure, phishing, service, spear-phishing, threatPakistan-based advanced persistent threat group APT36, also known as TransparentTribe, is actively targeting Indian government entities with a sophisticated spear-phishing campaign using email lures themed as “NIC eEmail Services.” This campaign leverages lookalike domains and weaponized infrastructure to steal credentials and enable long-term espionage. The attack begins with email messages that convincingly mimic official notifications…
-
Mikrosegmentierung in Zero-Trust-Umgebungen die Integration von richtliniengesteuerten Zugriffen
Die kürzlich veröffentlichte Leitlinie der CISA (Cybersecurity and Infrastructure Security Agency), »Mikrosegmentierung in Zero Trust Teil 1: Einführung und Planung«, bestätigt, dass Mikrosegmentierung eine grundlegende Voraussetzung für Zero Trust ist [1]. Anstatt die Mikrosegmentierung für eine fortgeschrittene Phase von Zero-Trust-Initiativen aufzuheben, können und sollten Unternehmen die granulare Segmentierung als Kernbaustein der Zero-Trust-Architektur priorisieren. Der… First…
-
Mikrosegmentierung in Zero-Trust-Umgebungen die Integration von richtliniengesteuerten Zugriffen
Die kürzlich veröffentlichte Leitlinie der CISA (Cybersecurity and Infrastructure Security Agency), »Mikrosegmentierung in Zero Trust Teil 1: Einführung und Planung«, bestätigt, dass Mikrosegmentierung eine grundlegende Voraussetzung für Zero Trust ist [1]. Anstatt die Mikrosegmentierung für eine fortgeschrittene Phase von Zero-Trust-Initiativen aufzuheben, können und sollten Unternehmen die granulare Segmentierung als Kernbaustein der Zero-Trust-Architektur priorisieren. Der… First…
-
US NSA alleged to have launched a cyber attack on a Chinese agency
Tags: access, attack, authentication, breach, china, ciso, cloud, communications, control, country, cyber, cybersecurity, defense, finance, hacker, infrastructure, international, login, malicious, mfa, monitoring, network, RedTeam, resilience, sans, service, spy, supply-chain, technology“NSA does not confirm nor deny allegations in the media regarding its operations. Our core focus is countering foreign malign activities persistently targeting American interests, and we will continue to defend against adversaries wishing to threaten us.”The Chinese post says the country “shattered the US cyber attack plot of stealing secrets and infiltration and sabotage,…
-
US NSA alleged to have launched a cyber attack on a Chinese agency
Tags: access, attack, authentication, breach, china, ciso, cloud, communications, control, country, cyber, cybersecurity, defense, finance, hacker, infrastructure, international, login, malicious, mfa, monitoring, network, RedTeam, resilience, sans, service, spy, supply-chain, technology“NSA does not confirm nor deny allegations in the media regarding its operations. Our core focus is countering foreign malign activities persistently targeting American interests, and we will continue to defend against adversaries wishing to threaten us.”The Chinese post says the country “shattered the US cyber attack plot of stealing secrets and infiltration and sabotage,…
-
CISA Warns of Active Exploitation of Critical Windows SMB Flaw CVE-2025-33073
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding the active exploitation of a high-severity Windows vulnerability, tracked as CVE-2025-33073. This flaw, rooted in the Server Message Block (SMB) protocol, enables attackers to escalate privileges to SYSTEM level on vulnerable Windows devices, potentially granting full control over affected systems. First seen…
-
CISA Warns of Active Exploitation of Critical Windows SMB Flaw CVE-2025-33073
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding the active exploitation of a high-severity Windows vulnerability, tracked as CVE-2025-33073. This flaw, rooted in the Server Message Block (SMB) protocol, enables attackers to escalate privileges to SYSTEM level on vulnerable Windows devices, potentially granting full control over affected systems. First seen…