Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Tribal Health Clinics in California Report Patient Data Exposure

  Patients receiving care at several tribal healthcare clinics in California have been warned that a cyber incident led to the exposure of b...

All the recent news you need to know
Zero Trust Security
authentication failure authorization systems cloud outages cloud resilience Cyber Security Identity Security Zero Trust Security

Why Cloud Outages Turn Identity Systems into a Critical Business Risk

 

Recent large-scale cloud outages have become increasingly visible. Incidents involving major providers like AWS, Azure, and Cloudflare have disrupted vast portions of the internet, knocking critical websites and services offline. Because so many digital platforms are interconnected, these failures often cascade, stopping applications and workflows that organizations depend on daily.

For everyday users, the impact usually feels like a temporary annoyance—difficulty ordering food, streaming shows, or accessing online tools. For enterprises, the consequences are far more damaging. If an airline’s reservation platform goes down, every minute of downtime can mean lost bookings, revenue leakage, reputational harm, and operational chaos.

These events make it clear that cloud failures go well beyond compute and networking issues. One of the most vulnerable—and business-critical—areas affected is identity. When authentication or authorization systems fail, the problem is no longer simple downtime; it becomes a fundamental operational and security crisis.

Cloud Infrastructure as a Shared Failure Point

Cloud providers are not identity platforms themselves, but modern identity architectures rely heavily on cloud-hosted infrastructure and shared services. Even if an identity provider remains technically operational, disruptions elsewhere in the stack can break identity flows entirely.
  • Organizations commonly depend on the cloud for essential identity components such as:
  • Databases storing directory and user attribute information
  • Policy and authorization data stores
  • Load balancers, control planes, and DNS services
Because these elements are shared, a failure in any one of them can completely block authentication or authorization—even when the identity service appears healthy. This creates a concealed single point of failure that many teams only become aware of during an outage.

Identity as the Universal Gatekeeper

Authentication and authorization are not limited to login screens. They continuously control access for users, applications, APIs, and services. Modern Zero Trust architectures are built on the principle of “never trust, always verify,” and that verification is entirely dependent on identity system availability.

This applies equally to people and machines. Applications authenticate repeatedly, APIs validate every request, and services constantly request tokens to communicate with each other. When identity systems are unavailable, entire digital ecosystems grind to a halt.

As a result, identity-related outages pose a direct threat to business continuity. They warrant the highest level of incident response, supported by proactive monitoring across all dependent systems. Treating identity downtime as a secondary technical issue significantly underestimates its business impact.

Modern authentication goes far beyond checking a username and password—or even a passkey, as passwordless adoption grows. A single login attempt often initiates a sophisticated chain of backend operations.

Typically, identity systems must:
  • Retrieve user attributes from directories or databases
  • Maintain session state
  • Generate access tokens with specific scopes, claims, and attributes
  • Enforce fine-grained authorization through policy engines
Authorization decisions may occur both when tokens are issued and later, when APIs are accessed. In many architectures, APIs must also authenticate themselves before calling downstream services.

Each step relies on underlying infrastructure components such as datastores, policy engines, token services, and external integrations. If any part of this chain fails, access can be completely blocked—impacting users, applications, and critical business processes.

Why High Availability Alone Falls Short

High availability is essential, but on its own it is often insufficient for identity systems. Traditional designs usually rely on regional redundancy, with a primary deployment backed up by a secondary region. When one region fails, traffic shifts to the other.

This strategy offers limited protection when outages affect shared or global services. If multiple regions depend on the same control plane, DNS service, or managed database, a regional failover does little to improve resilience. In such cases, both primary and backup systems can fail simultaneously.

The result is an identity architecture that looks robust in theory but collapses during widespread cloud or platform-level disruptions.

True resilience requires intentional design. For identity systems, this may involve reducing reliance on a single provider or failure domain through multi-cloud deployments or carefully managed on-premises options that remain reachable during cloud degradation.

Planning for partial failure is equally important. Completely denying access during outages causes maximum business disruption. Allowing constrained access—using cached attributes, precomputed authorization decisions, or limited functionality—can significantly reduce operational and reputational damage.

Not all identity data demands identical availability guarantees. Some attributes or authorization sources may tolerate lower resilience, as long as those decisions are made deliberately and aligned with business risk.

Ultimately, identity platforms must be built to fail gracefully. Infrastructure outages are unavoidable; access control should degrade in a controlled, predictable manner rather than collapse entirely.
Read more »
Ransomware
AI Black Basta Black Basta Ransomware Cloud Cyber Crime Data Ransomware

Federal Agencies Worldwide Hunt for Black Basta Ransomware Leader


International operation to catch Ransomware leader 

International law enforcement agencies have increased their search for individuals linked to the Black Basta ransomware campaign. Agencies confirmed that the suspected leader of the Russia-based Ransomware-as-a-service (RaaS) group has been put in the EU’s and Interpol’s Most Wanted list and Red Notice respectively. German and Ukrainian officials have found two more suspects working from Ukraine. 

As per the notice, German Federal Criminal Police (BKA) and Ukrainian National Police collaborated to find members of a global hacking group linked with Russia. 

About the operation 

The agencies found two Ukrainians who had specific roles in the criminal structure of Black Basta Ransomware. Officials named the gang’s alleged organizer as Oleg Evgenievich Nefedov from Russia. He is wanted internationally. German law enforcement agencies are after him because of “extortion in an especially serious case, formation and leadership of a criminal organization, and other criminal offenses.”

According to German prosecutors, Nefedov was the ringleader and primary decision-maker of the group that created and oversaw the Black Basta ransomware. under several aliases, such as tramp, tr, AA, Kurva, Washingt0n, and S.Jimmi. He is thought to have created and established the malware known as Black Basta. 

The Ukrainian National Police described how the German BKA collaborated with domestic cyber police officers and investigators from the Main Investigative Department, guided by the Office of the Prosecutor General's Cyber Department, to interfere with the group's operations.

The suspects

Two individuals operating in Ukraine were found to be carrying out technical tasks necessary for ransomware attacks as part of the international investigation. Investigators claim that these people were experts at creating ransomware campaigns and breaking into secured systems. They used specialized software to extract passwords from business computer systems, operating as so-called "hash crackers." 

Following the acquisition of employee credentials, the suspects allegedly increased their control over corporate environments, raised the privileges of hacked accounts, and gained unauthorized access to internal company networks.

Authorities claimed that after gaining access, malware intended to encrypt files was installed, sensitive data was stolen, and vital systems were compromised. The suspects' homes in the Ivano-Frankivsk and Lviv regions were searched with permission from the court. Digital storage devices and cryptocurrency assets were among the evidence of illicit activity that police confiscated during these operations.

Read more »
Technology
AI AI Assistant Artificial Intelligence Threats DockerDash Technology

Researchers Disclose Patched Flaw in Docker AI Assistant that Enabled Code Execution


Researchers have disclosed details of a previously fixed security flaw in Ask Gordon, an artificial intelligence assistant integrated into Docker Desktop and the Docker command-line interface, that could have been exploited to execute code and steal sensitive data. The vulnerability, dubbed DockerDash by cybersecurity firm Noma Labs, was patched by Docker in November 2025 with the release of version 4.50.0. 

“In DockerDash, a single malicious metadata label in a Docker image can be used to compromise your Docker environment through a simple three-stage attack,” said Sasi Levi, security research lead at Noma Labs, in a report shared with The Hacker News. “Every stage happens with zero validation, taking advantage of current agents and MCP Gateway architecture.” 

According to the researchers, the flaw allowed Ask Gordon to treat unverified container metadata as executable instructions. When combined with Docker’s Model Context Protocol gateway, this behavior could lead to remote code execution on cloud and command-line systems, or data exfiltration on desktop installations. 

The issue stems from what Noma described as a breakdown in contextual trust. Ask Gordon reads metadata from Docker images, including LABEL fields, without distinguishing between descriptive information and embedded instructions. These instructions can then be forwarded to the MCP Gateway, which executes them using trusted tools without additional checks. “MCP Gateway cannot distinguish between informational metadata and a pre-authorized, runnable internal instruction,” Levi said. 

“By embedding malicious instructions in these metadata fields, an attacker can hijack the AI’s reasoning process.” In a hypothetical attack, a malicious actor could publish a Docker image containing weaponized metadata labels. When a user queries Ask Gordon about the image, the assistant parses the labels, forwards them to the MCP Gateway, and triggers tool execution with the user’s Docker privileges.  
Researchers said the same weakness could be used for data exfiltration on Docker Desktop, allowing attackers to gather details about installed tools, container configurations, mounted directories, and network setups, despite the assistant’s read-only permissions. Docker version 4.50.0 also addressed a separate prompt injection flaw previously identified by Pillar Security, which could have enabled attackers to manipulate Docker Hub metadata to extract sensitive information. 

“The DockerDash vulnerability underscores the need to treat AI supply chain risk as a current core threat,” Levi said. “Trusted input sources can be used to hide malicious payloads that manipulate an AI’s execution path.”
Read more »
Malware attacks
Cyber Attacks CyberSecurity Ransomware Attacks Finance Sector financial attack malicious PDF files Malware attacks

PDFSider Malware Used in Fortune 100 Finance Ransomware Attack

 

A Fortune 100 finance company was targeted by ransomware actors using a new Windows malware strain called PDFSider, built to quietly deliver malicious code during intrusions. Rather than relying on brute force, the attackers used social engineering, posing as IT support staff and convincing employees to launch Microsoft Quick Assist, enabling remote access. Resecurity researchers identified the malware during incident response, describing it as a stealth backdoor engineered to avoid detection while maintaining long-term control, with traits typically associated with advanced, high-skill intrusion activity. 

Resecurity previously told BleepingComputer that PDFSider had appeared in attacks connected to Qilin ransomware, but researchers emphasize it is not limited to a single group. Their threat hunting indicates the backdoor is now actively used by multiple ransomware operators as a delivery mechanism for follow-on payloads, suggesting it is spreading across criminal ecosystems rather than remaining a niche tool. 

The infection chain begins with spearphishing emails containing a ZIP archive. Inside is a legitimate, digitally signed executable for PDF24 Creator, developed by Miron Geek Software GmbH, paired with a malicious DLL named cryptbase.dll. Since the application expects that DLL, it loads the attacker’s version instead. This technique, known as DLL side-loading, allows the malicious code to execute under the cover of a trusted program, helping it evade security controls that focus on the signed executable rather than the substituted library.  
In some cases, attackers increase the likelihood of execution using decoy documents crafted to appear relevant to targets. One example involved a file claiming authorship from a Chinese government entity. Once launched, the malicious DLL inherits the same privileges as the legitimate executable that loaded it, increasing the attacker’s ability to operate within the system. 

Resecurity notes that while the EXE remains validly signed, attackers exploited weaknesses in the PDF24 software to load the malware and bypass EDR tools more effectively. The firm also warns that AI-assisted coding is making it easier for cybercriminals to identify and exploit vulnerable software at scale. After execution, PDFSider runs primarily in memory to reduce disk traces, using anonymous pipes to issue commands through CMD. 

Each infected device is assigned a unique identifier, system details are collected, and the data is exfiltrated to an attacker-controlled VPS through DNS traffic on port 53. For command-and-control security, PDFSider uses Botan 3.0.0 and encrypts communications with AES-256-GCM, decrypting inbound data only in memory to limit its footprint. It also applies AEAD authentication in GCM mode, a cryptographic approach commonly seen in stealthy remote shell backdoors designed for targeted operations. 

The malware includes anti-analysis checks such as RAM size validation and debugger detection, terminating early when it suspects sandboxing. Based on its behavior and design, Resecurity assesses PDFSider as closer to espionage-grade tradecraft than typical financially motivated ransomware tooling, built to quietly preserve covert access, execute remote commands flexibly, and keep communications protected.
Read more »
Windows DoS
Iconics SCADA Mitsubishi Electric OT security Vulnerabilities and Exploits Windows DoS

Iconics SCADA Flaw Enables Privileged File Abuse and Windows DoS

 

A newly disclosed flaw in Mitsubishi Electric’s Iconics Suite SCADA platform, tracked as CVE-2025-0921, exposes critical industrial environments to denial-of-service attacks by abusing privileged file system operations in Windows-based engineering workstations. Rated with a CVSS score of 6.5, the vulnerability affects GENESIS64 deployments on Microsoft Windows versions 10.97.2 and earlier and could be combined with other weaknesses to corrupt essential system binaries and halt operations.

Researchers from Unit 42 discovered CVE-2025-0921 during an assessment of Iconics Suite, following an earlier set of five vulnerabilities they reported in versions 10.97.3 and below that enabled privilege escalation and system disruption. The latest bug resides in the way multiple Iconics services perform file system operations with elevated privileges, creating an opportunity for attackers with local, non‑admin access to direct these operations toward sensitive files. In industrial sectors such as automotive, energy and manufacturing, where Iconics SCADA is used to monitor and control processes, such misuse could severely impact system integrity and availability.

The core issue is a privileged file system operations vulnerability centered on the Pager Agent component of AlarmWorX64 MMX, which handles custom alerting via SMS and other pager protocols. Administrators configure SMS alerts using the PagerCfg.exe utility, including the path for an SMSLogFile where every SMS operation is logged. Under normal circumstances, the configuration file storing this path, IcoSetup64.ini in C:\ProgramData\ICONICS, should not be writable by standard users; however, when the legacy GenBroker32 component is installed, a previously documented flaw, CVE-2024-7587, grants any user full read-write access to this directory.

Unit 42 showed how an attacker could chain CVE-2025-0921 with CVE-2024-7587 to achieve a reliable denial-of-service condition on Windows. A local attacker first inspects IcoSetup64.ini to learn the SMSLogFile path, then creates a symbolic link from that log file to a critical binary, such as the cng.sys driver used by Microsoft’s Cryptography API: Next Generation. When an administrator later sends a test SMS or an alert fires automatically, the Pager Agent writes log data through the symbolic link into C:\Windows\System32\cng.sys, corrupting the driver so that the operating system fails to boot and becomes stuck in repair mode on reboot.

Even without the GenBroker32 installer misconfiguration, the researchers warn that CVE-2025-0921 remains dangerous if an attacker can make the log file path writable through other errors, alternative bugs or social engineering that changes permissions. They stress that privileged file system behaviors in OT environments are often underestimated, despite their potential to cause total system outages. Mitsubishi Electric has released an advisory and workarounds that address this and the previously reported issues, while Palo Alto Networks recommends hardening OT engineering workstations, segmenting SCADA systems with next-generation firewalls and leveraging OT security tools to detect and limit exploitation attempts.
Read more »
Zero Trust Identity
Cyber Security Cybersecurity Risk Management Enterprise Identity Management IAM Security Identity Control Plane Identity Dark Matter Identity First Security Identity Observability Zero Trust Identity

Orchid Security Debuts Continuous Identity Observability Platform


 

Over the past two decades, organizations have steadily expanded their identity security portfolios, layering IAM, IGA, and PAM to deploy access control at scale. However, identity-driven breaches continue to grow in both frequency and impact despite this sustained investment.

It has been argued that the failure of this system is not the result of weak policy design or inadequate standards, but rather of the widening gap between how the identity system is governed on paper and how access actually works in reality. 

Currently, enterprise environments contain a large number of unmanaged identity artifacts, including local system accounts, legacy authentication mechanisms, orphaned service principals, embedded API keys, and application-specific entitlements, that are inaccessible to centralized controls or cannot be accessed. 

These factors constitute Identity Dark Matter, an attack surface that adversaries increasingly exploit to bypass SSO, sidestep MFA, move laterally across systems, and escalate privileges without triggering conventional identity alerts. As a result of this work, Identity Dark Matter is not merely viewed as a risk category, but as a structural defect in existing identity architectures as a whole.

The new identity control plane proposes a method of reconciling intended access policies with effective, real-world authorization by correlating runtime telemetry with contextual identity signals and automating remediation across managed and unmanaged identities. 

Amidst this shift toward identity-centered security models, Orchid Security has been formally recognized as a Cool Vendor by Gartner in its 2025 report on Cool Vendors in Identity-First Security, highlighting its growing significance in redefining enterprise identity infrastructure.

Orchid has been recognized as one of a select group of vendors that address real-time security exposure and threat mitigation in increasingly perimeterless environments while maintaining compatibility with existing IAM infrastructures. As cloud adoption and API-driven architectures increase, network-bound security models become obsolete, elevating identity as the primary control plane for modern security architectures, according to Gartner's analysis.

Orchid is positioned as an innovative identity infrastructure provider by utilizing artificial intelligence and machine learning analytics to continuously correlate identity data, identify coverage gaps that are often overlooked during traditional IAM deployments and onboardings, and provide comprehensive observability across the application ecosystems. 

Moreover, Gartner reports that Orchid's emphasis on orchestration and fabric-level visibility enables enterprises to enhance their security posture while simultaneously supporting automated operations, positioning the platform as a unique solution capable of ensuring identity risk compliance across diverse and evolving enterprise environments with precision, scalability, and compliance. 

The traditional identity platforms are mainly designed around static configuration data and predefined policy models, which allows them to be implemented in a very limited number of domains, however their effectiveness is usually limited to well-governed, human-centric identities. 

When applied to the realities of modern enterprise environments, where custom applications are being developed, legacy authentication mechanisms are being used, credentials are embedded, non-human identity is still prevalent, and access paths do not bypass centralized identity providers, these approaches fall short. In consequence, security teams are often forced to conduct reactive analysis, reconstructing identity behavior retrospectively during audits or investigations conducted as a result of these incidents. 

It is inherently unsustainable at scale, as it relies on inference instead of continuous visibility into the utilization of identities within applications and services. To address this structural gap, Orchid Security has developed an identity observability model that aligns with the real-world security operations environment. A four-stage platform consists of four stages: discovery, analysis, orchestration, and auditing. 

The platform begins by identifying how identities are used inside applications in a direct manner, followed by an audit. With Orchid's lightweight instrumentation, we examine both managed and unmanaged environments at a high level in regards to authentication methods, authorization logic and credential handling. The goal of this process is to produce a comprehensive, runtime-driven inventory of applications, services, identity types, authentication flows, and embedded credentials that enables us to create an accurate baseline of identity activity. 

By correlating identities, applications, and access paths, Orchid analyzes identity behavior in context, identifying material risk indicators such as shared or hardcoded credentials, orphaned service accounts, privileged access outside the realm of Identity and Access Controls, as well as drift between desired policy and effective access. 


Identity-centric defense has evolved in alignment with Gartner's assessment that the accelerated adoption of digital transformation, cloud computing, remote work, API-driven architectures, and API-driven architectures have fundamentally undermined perimeter-based security, requiring the adoption of identity-first security as an integral part of enterprise protection.

With the advent of artificial intelligence and large language models within this emerging paradigm for identity and access management, a more dynamic and context-aware approach is now possible, capable of identifying systemic blind spots, latent exposure, and misconfigurations that are normally missed by static, rule-based systems. This technology enables stronger security outcomes while reducing operational friction through automation by continuously analyzing identity flows and enforcing policy according to real-time context. 

The orchestration-centric identity infrastructure offered by Orchid Security reflects this shift by extending beyond traditional IAM limitations associated with manual application onboarding and partial visibility of managed systems that have already been deployed. 

By enabling continuous evaluation of identity behavior, contextual gap analysis, and risk-based remediation enforced through automated orchestration, the platform provides a more comprehensive approach to identity governance than static roles and fragmented insights. In addition to providing consistent governance across distributed environments, Orchid aligns identity operations with business objectives as well as security objectives by embedding observability and intelligence directly into the identity fabric. 


Through continuous discovery, analysis and evaluation of enterprise applications at runtime, the platform supports evidence-driven prioritization by analyzing authentication and authorization paths and comparing them to regulatory requirements and established cybersecurity frameworks. 

In addition to augmenting native controls, the remediation process is simplified by integrating with existing Identity and Access Management systems, often without requiring custom development. It is through this approach that Orchid assists organizations in addressing the increasing presence of unmanaged identity exposure, commonly known as identity dark matter. 

In addition to reducing systemic risk, improving compliance posture, and reducing operational overhead, Orchid has already deployed its platform across Fortune 500 and Global 2000 enterprises, supporting Orchid's role in operationalizing identity-first security. It has been proven that adopting Orchid's platform yields measurable improvements in governance and accountability, in addition to incremental security improvements. 

By providing a detailed understanding of application-level identity usage, the platform reduces exposure caused by unmanaged access paths and helps security teams prepare for audits in a more timely and confident manner. The identification risk is no longer inferred or distributed between fragmented tools, but rather clearly attributed and supported by verifiable, runtime-derived evidence. 

In complex enterprise environments, it is imperative for organizations to shift from assumption-driven decision-making to evidence-based control, reinforcing the core objective of identity-first security. Increasingly, identity is fragmenting beyond traditional control points and centralized directories, making continuous, application-aware governance increasingly important. 

Providing persistent identity observability across modern application ecosystems, Orchid Security addresses this challenge by enabling organizations to discover identity usage, assess risk in context, coordinate remediation, and maintain audit-ready evidence through continuous, application-aware governance. 

There is no doubt that the operating model reflects the actual ways in which contemporary enterprise environments function, where access is dynamic, distributed, and deeply embedded within the logic of the applications. As a result of his leadership's experience in both advanced AI research and large-scale security engineering, the company has designed its identity infrastructure using practical knowledge from companies like Google DeepMind and Square, who are now part of Block. 

The rapid adoption of artificial intelligence throughout enterprise and adversarial domains has also raised the stakes for identity security, as threat actors increasingly automate reconnaissance, exploitation, and lateral movements. An Identity Control Plane, Orchid offers its platform as a means to converge managed and unmanaged identities into an authoritative view derived directly from application developers. 

The benefits of this approach include not only strengthening enterprise security postures, but also creating new opportunities for global systems integrators and managed service providers. As a result, they are able to provide additional value-added services such as continuous application security assessment, identity governance, audit readiness, incident response, and identity risk management. 

Using Orchid, organizations can accelerate the onboarding of applications, prioritize remediation according to observed risk, and monitor compliance continuously, thereby enabling the development of a new level of identity governance that minimizes organizational risk, lowers operating costs, and allows for consistent control of both human and machine identities in increasingly AI-driven organizations.
Read more »
Subscribe to: Comments (Atom)

Featured