A new security analysis has revealed that nearly half of all network communications between Internet of Things (IoT) devices and traditional IT systems come from devices that pose serious cybersecurity risks.
The report, published by cybersecurity company Palo Alto Networks, analyzed data from over 27 million connected devices across various organizations. The findings show that 48.2 percent of these IoT-to-IT connections came from devices classified as high risk, while an additional 4 percent were labeled critical risk.
These figures underline a growing concern that many organizations are struggling to secure the rapidly expanding number of IoT devices on their networks. Experts noted that a large portion of these devices operate with outdated software, weak default settings, or insecure communication protocols, making them easy targets for cybercriminals.
Why It’s a Growing Threat
IoT devices, ranging from smart security cameras and sensors to industrial control systems are often connected to the same network as computers and servers used for daily business operations. This creates a problem: once a vulnerable IoT device is compromised, attackers can move deeper into the network, access sensitive data, and disrupt normal operations.
The study emphasized that the main cause behind such widespread exposure is poor network segmentation. Many organizations still run flat networks, where IoT devices and IT systems share the same environment without proper separation. This allows a hacker who infiltrates one device to move easily between systems and cause greater harm.
How Organizations Can Reduce Risk
Security professionals recommend several key actions for both small businesses and large enterprises to strengthen their defenses:
1. Separate Networks:
Keep IoT devices isolated from core IT infrastructure through proper network segmentation. This prevents threats in one area from spreading to another.
2. Adopt Zero Trust Principles:
Follow a security model that does not automatically trust any device or user. Each access request should be verified, and only the minimum level of access should be allowed.
3. Improve Device Visibility:
Maintain an accurate inventory of all devices connected to the network, including personal or unmanaged ones. This helps identify and secure weak points before they can be exploited.
4. Keep Systems Updated:
Regularly patch and update device firmware and software. Unpatched systems often contain known vulnerabilities that attackers can easily exploit.
5. Use Strong Endpoint Protection:
Deploy Endpoint Detection and Response (EDR) or Extended Detection and Response (XDR) tools across managed IT systems, and use monitoring solutions for IoT devices that cannot run these tools directly.
As organizations rely more on connected devices to improve efficiency, the attack surface grows wider. Without proper segmentation, monitoring, and consistent updates, one weak device can become an entry point for cyberattacks that threaten entire operations.
The report reinforces an important lesson: proactive network management is the foundation of cybersecurity. Ensuring visibility, limiting trust, and continuously updating systems can significantly reduce exposure to emerging IoT-based threats.
Earlier this year, the breach was against a famous U.S non-profit working in advocacy, that demonstrated advanced techniques and shared tools among Chinese cyber criminal gangs like APT41, Space Pirates, and Kelp.
They struck again in April with various malicious prompts checking both internal network breach and internet connectivity, particularly targeting a system at 192.0.0.88. Various tactics and protocols were used, showing both determination and technical adaptability to get particular internal resources.
Following the connectivity tests, the hackers used tools like netstat for network surveillance and made an automatic task via the Windows command-line tools.
This task ran a genuine MSBuild.exe app that processed an outbound.xml file to deploy code into csc.exe and connected it to a C2 server.
These steps hint towards automation (through scheduled tasks) and persistence via system-level privileges increasing the complexity of the compromise and potential damage.
The techniques and toolkit show traces of various Chinese espionage groups. The hackers weaponized genuine software elements. This is called DLL sideloading by abusing vetysafe.exe (a VipreAV component signed by Sunbelt Software, Inc.) to load a malicious payload called sbamres.dll.
This tactic was earlier found in campaigns lkmkedytl Earth Longzhi and Space Pirates, the former also known as APT41 subgroup.
Coincidentally, the same tactic was found in cases connected to Kelp, showing the intrusive tool-sharing tactics within Chinese APTs.
Google has launched a detailed investigation into a weeks-long security breach after discovering that a contractor with legitimate system privileges had been quietly collecting internal screenshots and confidential files tied to the Play Store ecosystem. The company uncovered the activity only after it had continued for several weeks, giving the individual enough time to gather sensitive technical data before being detected.
According to verified cybersecurity reports, the contractor managed to access information that explained the internal functioning of the Play Store, Google’s global marketplace serving billions of Android users. The files reportedly included documentation describing the structure of Play Store infrastructure, the technical guardrails that screen malicious apps, and the compliance systems designed to meet international data protection laws. The exposure of such material presents serious risks, as it could help malicious actors identify weaknesses in Google’s defense systems or replicate its internal processes to deceive automated security checks.
Upon discovery of the breach, Google initiated a forensic review to determine how much information was accessed and whether it was shared externally. The company has also reported the matter to law enforcement and begun a complete reassessment of its third-party access procedures. Internal sources indicate that Google is now tightening security for all contractor accounts by expanding multi-factor authentication requirements, deploying AI-based systems to detect suspicious activities such as repeated screenshot captures, and enforcing stricter segregation of roles and privileges. Additional measures include enhanced background checks for third-party employees who handle sensitive systems, as part of a larger overhaul of Google’s contractor risk management framework.
Experts note that the incident arrives during a period of heightened regulatory attention on Google’s data protection and antitrust practices. The breach not only exposes potential security weaknesses but also raises broader concerns about insider threats, one of the most persistent and challenging issues in cybersecurity. Even companies that invest heavily in digital defenses remain vulnerable when authorized users intentionally misuse their access for personal gain or external collaboration.
The incident has also revived discussion about earlier insider threat cases at Google. In one of the most significant examples, a former software engineer was charged with stealing confidential files related to Google’s artificial intelligence systems between 2022 and 2023. Investigators revealed that he had transferred hundreds of internal documents to personal cloud accounts and even worked with external companies while still employed at Google. That case, which resulted in multiple charges of trade secret theft and economic espionage, underlined how intellectual property theft by insiders can evolve into major national security concerns.
For Google, the latest breach serves as another reminder that internal misuse, whether by employees or contractors remains a critical weak point. As the investigation continues, the company is expected to strengthen oversight across its global operations. Cybersecurity analysts emphasize that organizations managing large user platforms must combine strong technical barriers with vigilant monitoring of human behavior to prevent insider-led compromises before they escalate into large-scale risks.
The European Commission has accused Meta Platforms, the parent company of Facebook and Instagram, of violating the European Union’s Digital Services Act (DSA) by making it unnecessarily difficult for users to report illegal online content and challenge moderation decisions.
In its preliminary findings, the Commission said both platforms lack a user-friendly “Notice and Action” system — the mechanism that allows people to flag unlawful material such as child sexual abuse content or terrorist propaganda. Regulators noted that users face multiple steps and confusing options before they can file a report. The Commission also claimed that Meta’s interface relies on “dark patterns”, which are design features that subtly discourage users from completing certain actions, such as submitting reports.
According to the Commission, Meta’s appeal process also falls short of DSA requirements. The current system allegedly prevents users from adding explanations or submitting supporting evidence when disputing a moderation decision. This, the regulator said, limits users’ ability to express why they believe a decision was unfair and weakens the overall transparency of Meta’s content moderation practices.
The European Commission’s findings are not final, and Meta has the opportunity to respond before any enforcement action is taken. If the Commission confirms these violations, it could issue a non-compliance decision, which may result in penalties of up to 6 percent of Meta’s global annual revenue. The Commission may also impose recurring fines until the company aligns its operations with EU law.
Meta, in a public statement, said it “disagrees with any suggestion” that it breached the DSA. The company stated that it has already made several updates to comply with the law, including revisions to content reporting options, appeals procedures, and data access tools.
The European Commission also raised similar concerns about TikTok, saying that both companies have limited researchers’ access to public data on their platforms. The DSA requires large online platforms to provide sufficient data access so independent researchers can analyze potential harms — for example, whether minors are exposed to illegal or harmful content. The Commission’s review concluded that the data-access tools of Facebook, Instagram, and TikTok are burdensome and leave researchers with incomplete or unreliable datasets, which hinders academic and policy research.
TikTok responded that it has provided data to almost 1,000 research teams and remains committed to transparency. However, the company noted that the DSA’s data-sharing obligations sometimes conflict with the General Data Protection Regulation (GDPR), making it difficult to comply with both laws simultaneously. TikTok urged European regulators to offer clarity on how these two frameworks should be balanced.
Beyond Europe, the investigation may strain relations with the United States. American officials have previously criticized the EU for imposing regulatory burdens on U.S.-based tech firms. U.S. FTC Chairman Andrew Ferguson recently warned companies that censoring or modifying content to satisfy foreign governments could violate U.S. law. Former President Donald Trump has also expressed opposition to EU digital rules and even threatened tariffs against countries enforcing them.
For now, the Commission’s investigation continues. If confirmed, the case could set a major precedent for how global social media companies manage user safety, transparency, and accountability under Europe’s strict online governance laws.
A password is essentially a secret code you use to prove your identity online. But weak password habits are widespread. A CyberNews report revealed that 94% of 19 billion leaked passwords were reused, and many followed predictable patterns—think “123456,” names, cities, or popular brands.
When breaches occur, these passwords spread rapidly, leading to account takeovers, phishing scams, and identity theft. In fact, hackers often attempt to exploit leaked credentials within an hour of a breach.
Phishing attacks—where users are tricked into entering their passwords on fake websites—continue to rise, with more than 3 billion phishing emails sent daily worldwide.
Experts recommend creating unique, complex passwords or even memorable passphrases like “CrocApplePurseBike.” Associating it with a story can help you recall it easily.
Emerging around four years ago, passkeys use public-key cryptography, a process that creates two linked keys—one public and one private.
The public key is shared with the website.
The private key stays safely stored on your device.
When you log in, your device signs a unique challenge using the private key, confirming your identity without sending any password. To authorize this action, you’ll usually verify with your fingerprint or face ID, ensuring that only you can access your accounts.
Even if the public key is stolen, it’s useless without the private one—making passkeys inherently phishing-proof and more secure. Each passkey is also unique to the website, so it can’t be reused elsewhere.
Passkeys eliminate the need to remember passwords or type them manually. Since they’re tied to your device and require biometric approval, they’re both more convenient and more secure.
However, the technology isn’t yet universal. Compatibility issues between platforms like Apple and Microsoft have slowed adoption, though these gaps are closing as newer devices and systems improve integration.
From a cybersecurity perspective, passkeys are clearly the superior option—they’re stronger, resistant to phishing, and easy to use. But widespread adoption will take time. Many websites still rely on traditional passwords, and transitioning millions of users will be a long process.
Until then, maintaining good password hygiene remains essential: use unique passwords for every account, enable multi-factor authentication, and change any reused credentials immediately.
Chennai, India — In a paradigm-shifting judgment that reshapes how India’s legal system views digital assets, the Madras High Court has ruled that cryptocurrencies qualify as property under Indian law. The verdict, delivered by Justice N. Anand Venkatesh, establishes that while cryptocurrencies cannot be considered legal tender, they are nonetheless assets capable of ownership, transfer, and legal protection.
Investor’s Petition Leads to Legal Precedent
The case began when an investor approached the court after her 3,532.30 XRP tokens, valued at around ₹1.98 lakh, were frozen by the cryptocurrency exchange WazirX following a major cyberattack in July 2024.
The breach targeted Ethereum and ERC-20 tokens, resulting in an estimated loss of $230 million (approximately ₹1,900 crore) and prompted the platform to impose a blanket freeze on user accounts.
The petitioner argued that her XRP holdings were unrelated to the hacked tokens and should not be subject to the same restrictions. She sought relief under Section 9 of the Arbitration and Conciliation Act, 1996, requesting that Zanmai Labs Pvt. Ltd., the Indian operator of WazirX, be restrained from redistributing or reallocating her digital assets during the ongoing restructuring process.
Zanmai Labs contended that its Singapore-based parent company, Zettai Pte Ltd, was undergoing a court-supervised restructuring that required all users to share losses collectively. However, the High Court rejected this defense, observing that the petitioner’s assets were distinct from the ERC-20 tokens involved in the hack.
Justice Venkatesh ruled that the exchange could not impose collective loss-sharing on unrelated digital assets, noting that “the tokens affected by the cyberattack were ERC-20 coins, which are entirely different from the petitioner’s XRP holdings.”
Court’s Stance: Cryptocurrency as Property
In his judgment, Justice Venkatesh explained that although cryptocurrencies are intangible and do not function as physical goods or official currency, they meet the legal definition of property.
He stated that these assets “can be enjoyed, possessed, and even held in trust,” reinforcing their capability of ownership and protection under law.
To support this interpretation, the court referred to Section 2(47A) of the Income Tax Act, which classifies cryptocurrencies as Virtual Digital Assets (VDAs). This legal category recognizes digital tokens as taxable and transferable assets, strengthening the basis for treating them as property under Indian statutes.
Jurisdiction and Legal Authority
Addressing the question of jurisdiction, the High Court noted that Indian courts have the authority to protect assets located within the country, even if international proceedings are underway. Justice Venkatesh cited the Supreme Court’s 2021 ruling in PASL Wind Solutions v. GE Power Conversion India, which affirmed that Indian courts retain the right to intervene in matters involving domestic assets despite foreign arbitration.
Since the petitioner’s crypto transactions were initiated in Chennai and linked to an Indian bank account, the Madras High Court asserted complete jurisdiction to hear the dispute.
Beyond resolving the individual case, Justice Venkatesh emphasized the urgent need for robust regulatory and governance frameworks for India’s cryptocurrency ecosystem.
The judgment recommended several safeguards to protect users and maintain market integrity, including:
• Independent audits of cryptocurrency exchanges,
• Segregation of customer funds from company finances, and
• Stronger KYC (Know Your Customer) and AML (Anti-Money Laundering) compliance mechanisms.
The court underlined that as India transitions toward a Web3-driven economy, accountability, transparency, and investor protection must remain central to digital asset governance.
Impact on India’s Crypto Industry
Legal and financial experts view the judgment as a turning point in India’s treatment of digital assets.
By recognizing cryptocurrencies as property, the ruling gives investors a clearer legal foundation for ownership rights and judicial remedies in case of disputes. It also urges exchanges to improve corporate governance and adopt transparent practices when managing customer funds.
“This verdict brings long-needed clarity,” said a corporate lawyer specializing in digital finance. “It does not make crypto legal tender, but it ensures that investors’ holdings are legally recognized as assets, something the Indian market has lacked.”
The decision is expected to influence future policy discussions surrounding the Digital India Act and the government’s Virtual Digital Asset Taxation framework, both of which are likely to define how crypto businesses and investors operate in the country.
A Legally Secure Digital Future
By aligning India’s legal reasoning with international trends, the Madras High Court has placed the judiciary at the forefront of global crypto jurisprudence. Similar to rulings in the UK, Singapore, and the United States, this decision formally acknowledges that cryptocurrencies hold measurable economic value and are capable of legal protection.
While the ruling does not alter the Reserve Bank of India’s stance that cryptocurrencies are not legal currency, it does mark a decisive step toward legal maturity in digital asset regulation.
It signals a future where blockchain-based assets will coexist within a structured legal framework, allowing innovation and investor protection to advance together.