Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyberattacks. Show all posts
SPN
AES Cryptographic Cryptographically Relevant Quantum Computer Cyber Encryption Cyber Security Cyberattacks CyberThreat Decryption Tool Global Encryption Hardware RSA SPN

Global Encryption at Risk as China Reportedly Advances Decryption Capabilities

 


It has been announced that researchers at Shanghai University have achieved a breakthrough in quantum computing that could have a profound impact on modern cryptographic systems. They achieved a significant leap in quantum computing. The team used a quantum annealing processor called D-Wave to successfully factor a 22-bit RSA number, a feat that has, until now, been beyond the practical capabilities of this particular class of quantum processor. 

There is no real-world value in a 22-bit key, but this milestone marks the beginning of the development of quantum algorithms and the improvement of hardware efficiency, even though it is relatively small and holds no real-world encryption value today. A growing vulnerability has been observed in classical encryption methods such as RSA, which are foundational to digital security across a wide range of financial systems, communication networks and government infrastructures. 

It is a great example of the accelerated pace at which the quantum arms race is occurring, and it reinforces the urgency around the creation of quantum-resistant cryptographic standards and the adoption of quantum-resistant protocols globally. 

As a result of quantum computing's progress, one of the greatest threats is that it has the potential to break widely used public key cryptographic algorithms, including Rivest-Shamir-Adleman (RSA), Diffie-Hellman, and even symmetric encryption standards, such as Advanced Encryption Standard (AES), very quickly and with ease.

Global digital security is built on the backbone of these encryption protocols, safeguarding everything from financial transactions and confidential communications to government and defense data, a safeguard that protects everything from financial transactions to confidential communications. As quantum computers become more advanced, this system might become obsolete if quantum computers become sufficiently advanced by dramatically reducing the time required to decrypt, posing a serious risk to privacy and infrastructure security. 

As a result of this threat looming over the world, major global powers have already refocused their strategic priorities. There is a widespread belief that nation-states that are financially and technologically able to develop quantum computing capabilities are actively engaged in a long-term offensive referred to as “harvest now, decrypt later”, which is the purpose of this offensive. 

Essentially, this tactic involves gathering enormous amounts of encrypted data today to decrypt that data in the future, when quantum computers reach a level of functionality that can break classical encryption. Even if the data has remained secure for now, its long-term confidentiality could be compromised. 

According to this strategy, there is a pressing need for quantum-resistant cryptographic standards to be developed and deployed urgently to provide a future-proof solution to sensitive data against the inevitable rise in quantum decryption capabilities that is inevitable. Despite the fact that 22-bit RSA keys are far from secure by contemporary standards, and they can be easily cracked by classical computer methods, this experiment marks the largest number of quantum annealing calculations to date, a process that is fundamentally different from the gate-based quantum systems that are most commonly discussed. 

It is important to note that this experiment is not related to Shor's algorithm, which has been thecentrer of theoretical discussions about breaking RSA encryption and uses gate-based quantum computers based on highly advanced technology. Instead, this experiment utilised quantum annealing, an algorithm that is specifically designed to solve a specific type of mathematical problem, such as factoring and optimisation, using quantum computing. 

The difference is very significant: whereas Shor's algorithm remains largely impractical at scale because of hardware limitations at the moment, D-Wave offers a solution to this dilemma by demonstrating how real-world factoring can be achieved on existing quantum hardware. Although it is limited to small key sizes, it does demonstrate the potential for real-world factoring on existing quantum hardware. This development has a lot of importance for the broader cryptographic security community. 

For decades, RSA encryption has provided online transactions, confidential communications, software integrity, and authentication systems with the necessary level of security. The RSA encryption is heavily dependent upon the computational difficulty of factorising large semiprime numbers. Classical computers have required a tremendous amount of time and resources to crack such encryption, which has kept the RSA encryption in business for decades to come.

In spite of the advances made by Wang and his team, it appears that even alternative quantum methods, beyond the widely discussed gate-based systems, may have tangible results for attacking these cryptographic barriers in the coming years. While it may be the case that quantum annealing is still at its infancy, the trajectory is still clearly in sight: quantum annealing is maturing, and as a result, the urgency for transitioning to post-quantum cryptographic standards becomes increasingly important.

A 22-bit RSA key does not have any real cryptographic value in today's digital landscape — where standard RSA keys usually exceed 2048 bits — but the successful factoring of such a key using quantum annealing represents a crucial step forward in quantum computing research. A demonstration, which is being organised by researchers in Shanghai, will not address the immediate practical threats that quantum attacks pose, but rather what it will reveal concerning quantum attack scalability in the future. 

A compelling proof-of-concept has been demonstrated here, illustrating that with refined techniques and optimisation, more significant encryption scenarios may soon come under attack. What makes this experiment so compelling is the technical efficiency reached by the research team as a result of their work. A team of researchers demonstrated that the current hardware limitations might actually be more flexible than previously thought by minimising the number of physical qubits required per variable, improving embeddings, and reducing noise through improved embeddings. 

By using quantum annealers—specialised quantum devices previously thought to be too limited for such tasks, this opens up the possibility to factor out larger key sizes. Additionally, there have been successful implementations of the quantum annealing approach for use with symmetric cryptography algorithms, including Substitution-Permutation Network (SPN) cyphers such as Present and Rectangle, which have proven to be highly effective. 

In the real world, lightweight cyphers are common in embedded systems as well as Internet of Things (IoT) devices, which makes this the first demonstration of a quantum processor that poses a credible threat to both asymmetric as well as symmetric encryption mechanisms simultaneously instead of only one or the other. 

There are far-reaching implications to the advancements that have been made as a result of this advancement, and they have not gone unnoticed by the world at large. In response to the accelerated pace of quantum developments, the US National Institute of Standards and Technology (NIST) published the first official post-quantum cryptography (PQC) standards in August of 2024. These standards were formalised under the FIPS 203, 204, and 205 codes. 

There is no doubt that this transition is backed by the adoption of the Hamming Quasi-Cyclic scheme by NIST, marking another milestone in the move toward a quantum-safe infrastructure, as it is based on lattice-based cryptography that is believed to be resistant to both current and emerging quantum attacks. This adoption further solidifies the transition into this field. There has also been a strong emphasis on the urgency of the issue from the White House in policy directives issued by the White House. 

A number of federal agencies have been instructed to begin phasing out vulnerable public key encryption protocols. The directive highlights the growing consensus that proactive mitigation is essential in light of the threat of "harvest now, decrypt later" strategies, where adversaries collect encrypted data today in anticipation of the possibility that future quantum technologies can be used to decrypt it. 

Increasing quantum breakthroughs are making it increasingly important to move to post-quantum cryptographic systems as soon as possible, as this is no longer a theoretical exercise but a necessity for the security of the world at large. While the 22-bit RSA key is very small when compared to the 2048-bit keys commonly used in contemporary cryptographic systems, the recent breakthrough by Shanghai researchers holds a great deal of significance both scientifically and technologically. 

Previously, quantum factoring was attempted with annealing-based systems, but had reached a plateau at 19-bit keys. This required a significant number of qubits per variable, which was rather excessive. By fine-tuning the local field and coupling coefficients within their Ising model, the researchers were able to overcome this barrier in their quantum setup. 

Through these optimisations, the noise reduction and factoring process was enhanced, and the factoring process was more consistent, which suggests that with further refinement, a higher level of complexity can be reached in the future with the RSA key size, according to independent experts who are aware of the possible implications. 

Despite not being involved in this study, Prabhjyot Kaur, an analyst at Everest Group who was not involved, has warned that advances in quantum computing could pose serious security threats to a wide range of industries. She underscored that cybersecurity professionals and policymakers alike are becoming increasingly conscious of the fact that theoretical risks are rapidly becoming operational realities in the field of cybersecurity. 

A significant majority of the concern surrounding quantum threats to encryption has traditionally focused on Shor's algorithm - a powerful quantum technique capable of factoring large numbers efficiently, but requiring a quantum computer based on gate-based quantum algorithms to be implemented. 

Though theoretically, these universal quantum machines are not without their limitations in hardware, such as the limited number of qubits, the limited coherence times, and the difficult correction of quantum errors. The quantum annealers from D-Wave, on the other hand, are much more mature, commercially accessible and do not have a universal function, but are considerably more mature than the ones from other companies. 

With its current generation of Advantage systems, D-Wave has been able to boast over 5,000 qubits and maintain an analogue quantum evolution process that is extremely stable at an ultra-low temperature of 15 millikelvin. There are limitations to quantum annealers, particularly in the form of exponential scaling costs, limiting their ability to crack only small moduli at present, but they also present a unique path to quantum-assisted cryptanalysis that is becoming increasingly viable as time goes by. 

By utilising a fundamentally different model of computation, annealers avoid many of the pitfalls associated with gate-based systems, including deep quantum circuits and high error rates, which are common in gate-based systems. In addition to demonstrating the versatility of quantum platforms, this divergence in approach also underscores how important it is for organisations to remain up to date and adaptive as multiple forms of quantum computing continue to evolve at the same time. 

The quantum era is steadily approaching, and as a result, organisations, governments, and security professionals must acknowledge the importance of cryptographic resilience as not only a theoretical concern but an urgent operational issue. There is no doubt that recent advances in quantum annealing, although they may be limited in their immediate threat, serve as a clear indication that quantum technology is progressing at a faster ra///-te than many had expected. 

The risk of enterprises and institutions not being able to afford to wait for large-scale quantum computers to become fully capable before implementing security transitions is too great to take. Rather than passively watching, companies and institutions must start by establishing a full understanding of the cryptographic assets they are deploying across their infrastructure in order to be able to make informed decisions about their cryptographic assets. 

It is also critical to adopt quantum-resistant algorithms, embrace crypto-agility, and participate in standards-based migration efforts if people hope to secure digital ecosystems for the long term. Moreover, continuous education is equally important to ensure that decision-makers remain informed about quantum developments as they develop to make timely and strategic security investments promptly. 

The disruptive potential of quantum computing presents undeniable risks, however it also presents a rare opportunity for modernizing foundational digital security practices. As people approach post-quantum cryptography, the digital future should be viewed not as one-time upgrade but as a transformation that integrates foresight, flexibility, and resilience, enabling us to become more resilient, resilient, and flexible. Taking proactive measures today will have a significant impact on whether people remain secure in the future.
Read more »
Scattered Spider
Cyber Bureau Cyberattacks CyberCrime Cybersecurity CyberThreat FBI FBI warning IT malware MGM Resorts Scattered Spider

FBI Urges Airlines to Prepare for Evolving Threat Scenarios

 


Federal investigators have warned that the cyberextortion collective known as Scattered Spider is steadily expanding its reach to cover airlines and their technology vendors, a fresh alarm that has just been sounded for the aviation sector. According to an FBI advisory, the syndicate, already infamous for having breached high-profile U.S. casinos, Fortune 500 companies, and government agencies, relies more on social engineering tactics than malicious software. 

As it masquerades as a legitimate employee or trusted contractor, its operatives communicate with help desk staff, request credentials to be reset, or convince agents to enrol rogue devices in multi-factor authentication. The carefully orchestrated deceptions enable privileged network access, resulting in data exfiltration and ransomware deployment by enabling the exploitation of malicious malware. 

In a statement published by the Bureau, it stressed that the threat "remains ongoing and rapidly evolving," and encouraged organisations to report intrusions as soon as possible, as well as reiterating its longstanding prohibition against paying ransom. A loosely organised, but extremely effective group of cybercriminals, dominated by English-speaking cybercriminals, many of whom are teenagers or young adults, is regarded by experts as Scattered Spider. 

Despite their age, the group has demonstrated a level of sophistication that rivals seasoned threat actors. The primary motive of these criminals appears to be financial gain, with most of their operations focused on stealing and extorting corporate data in the form of ransom payments and extortion. Once the attackers obtain access to sensitive data, they often exfiltrate it for ransom or resale it on the underground market, and in many instances, they use ransomware to further compel victims to cooperate. 

The distinctiveness of Scattered Spider from other cybercriminal groups lies in the way it uses social engineering tactics to gain an advantage in cybercrime. Instead of relying heavily on malware, the group utilises psychological manipulation to attack organisations' vulnerabilities. In order to pressure employees, particularly employees who work at the help desk, to surrender their access credentials or override security protocols, phishing campaigns, impersonation schemes, and even direct threats are often used. 

Some reports have indicated that attackers have used coercion or intimidation to access support staff in an attempt to expedite access to the system. As a result of the group's reliance on human engineering rather than technology tools, they have been able to bypass even the most advanced security measures, making them especially dangerous for large organisations that utilise distributed and outsourced IT support services. Their tactical changes reflect a calculated approach to breaching high-value targets swiftly, stealthily, with minimal resistance, and with speed. 

There was a stark public warning released by the Federal Bureau of Investigation on June 27, 2025, stating that the United States aviation industry is now firmly under threat from a wave of cyber-aggression that is escalating rapidly. It has been observed that, unlike traditional threats that involved physical attacks, these new threats come from highly skilled cybercriminals rather than hijackers. 

There is a cybercrime group known as Scattered Spider at the forefront of this escalating threat, widely regarded to be among the most sophisticated and dangerous actors in the digital threat landscape. The group, which was previously known for its high-impact breaches on major hospitality giants such as MGM Resorts and Caesars Entertainment, has now switched its attention to the aviation sector, signalling that the group has taken a key step in changing the way it targets the aviation sector. 

At a time when geopolitical instability worldwide is at its peak, this warning has an even greater urgency than ever. Having large-scale cyberattacks on airline infrastructure is no longer just a theoretical possibility—it has become a credible threat with serious implications for national security, economic stability, and public safety that cannot be ignored. 

A new generation of malware-driven operations, Scattered Spider, utilising advanced social engineering techniques for infiltration into networks, as opposed to traditional malware-based attacks. It has been reported that members of the group impersonate legitimate employees or contractors and make contact with internal help desks by creating convincing narratives that manipulate agents into bypassing multi-factor authentication protocols. 

Once they have entered a network, they usually move laterally with speed and precision to gain access to sensitive data and systems. Researchers from Google's Mandiant division have confirmed the group's advanced capabilities in the field of cybersecurity. According to the Chief Technology Officer of Mandiant, Charles Carmakal, Scattered Spider is adept at maintaining persistence within compromised systems, moving laterally, and elevating privileges as quickly as possible. 

It is common knowledge that a group of individuals capable of deploying ransomware within hours of first access to their computer systems are capable of doing so, thereby leaving very little time for detection and response. As a result of the FBI's warning, airlines and their vendors need to increase access controls, train their staff against social engineering, and report suspicious activity immediately. 

There has been some observation from cybersecurity experts that Scattered Spider has previously targeted a broad range of high-value sectors, such as finance, healthcare, retail, as well as the gaming industry, in the past. However, as the group appears to be shifting its focus to the aviation sector, a domain that possesses an extremely wide-open attack surface and is particularly vulnerable. 

It is important to note that the airline industry heavily relies on interconnected IT infrastructure as well as third-party service providers, which makes it extremely vulnerable to cascading effects in the case of a breach. A single compromised vendor, especially one with access to critical systems like maintenance platforms, reservation networks, or crew scheduling tools, might pose an immediate threat to multiple airline customers. 

It is the FBI's latest advisory, in which they emphasise the urgency and the evolving nature of this threat, encouraging airlines and their related vendors to reevaluate their security protocols internally and to strengthen them. Organisations are encouraged to strengthen their identity verification procedures, particularly when dealing with IT-related requests involving password resets, reconfiguring multi-factor authentication (MFA), or access permissions that are related to IT.

According to the Bureau, stricter controls should be implemented over privileged access, and staff members should be trained and made aware of social engineering tactics, as well as closely monitoring for unusual activity, such as attempts to log in from unfamiliar locations or devices that have not been previously associated with an account. The report of suspected intrusions must also be done quickly and efficiently. 

In addition to the FBI’s emphasis on early notification, law enforcement and intelligence agencies are able to trace malicious activity more effectively, which can limit the damage and prevent further compromise if it is caught in the first place. Scattered Spider has been involved in several previous operations in which not only has it stolen data, but it has also extorted money. It frequently threatens to release or encrypt sensitive data until ransom demands are met. 

Despite the fact that there is no evidence to suggest that flight safety has been directly affected, the nature of the intrusions has raised serious concerns. In light of the potential vulnerability of systems that process passenger information, crew assignments, and operational logistics, the risk for business continuity, and by extension, public trust, remains high. 

Aviation is now being called upon to act decisively in order to combat the threat of cybercriminal groups like Scattered Spider, which is not merely a back-office function but rather a core component of operational resilience. The airline IT departments, the helpdesk teams at the airlines, and third-party vendors must all implement robust identity verification processes as well as technical safeguards in order to combat the growing threat posed by cybercriminal groups like Scattered Spider. 

Among the most urgent priorities right now is strengthening the frontline defences at the level of the help desk, where attackers often exploit human error and the inexperience of employees. According to security experts, callback procedures should be established with only pre-approved internal contact numbers, callers should be required to verify a non-obvious “known secret” such as an internal training code, and a dual-approval policy should be implemented when performing sensitive actions such as resets of multi-factor authentication (MFA), especially when those accounts are privileged. 

Also, every identity enrollment should be logged and audited, with a Security Information and Event Management (SIEM) system able to trigger real-time alerts that flag suspicious behaviour. In addition, airlines are being advised to implement enhanced access controls immediately on a technical front. In combination with velocity rules, conditional access policies can be used to block login attempts and MFA enrollments from geographically improbable or high-risk locations. 

A just-in-time (JIT) privilege management process should replace static administrative access, limiting access to restricted areas of the system within limited time windows, sometimes just minutes, so that attack opportunities are reduced. Endpoint detection and response (EDR) tools must be deployed on virtual desktop environments and jump hosts so as to detect credential theft in real time. DNS-layer isolation will also provide a way for you to block outbound connections to attacker-controlled command-and-control (C2) servers, thereby preventing outbound connections from the attacker. 

There are five crucial pillars necessary to build an incident response plan tailored to aviation: identification, containment, eradication, recovery, and communication. It is essential to monitor the logs of identity providers continuously, 24 hours a day, 7 days a week, in order to detect suspicious activity early on. If an account is compromised, immediate containment measures should be triggered, including the disabling of affected accounts and the freezing of new MFA enrollments. 


In the eradication phase, compromised endpoints are reimaged and credentials are rotated in both on-premise and cloud-based identity management systems, and in the recovery phase, systems must be recovered from immutable, clean backups, and sensitive passenger data must be validated to ensure that the data is accurate. A crucial part of the process has to do with communication, which includes seamless coordination with regulatory organisations such as the Transportation Security Administration (TSA) and the Cybersecurity and Infrastructure Security Agency (CISA), as well as internal stakeholders inside and outside the organisation.

Additionally, third-party vendors, such as IT service providers, ground handlers, and catering contractors, must also be stepped up in terms of their security posture. These organisations are often exploited as entry points for island-hopping attacks, which must be taken into account. This risk can be reduced by aligning vendor identity verification protocols with those of the airlines they serve, reporting any suspicious activity related to MFA within four hours, and performing regular penetration tests, especially those that simulate social engineering attacks, in order to reduce this risk. 

Ultimately, the broader transportation sector must acknowledge that people are the weakest link in today’s threat landscape and not passwords. A zero-trust approach to help desk operations must be adopted, including scripted callbacks, rigorous identification verifications, and mandatory dual-approval processes. 

Managing coordinated threats can become increasingly challenging as ISACs (Information Sharing and Analysis Centres) play an important role in enabling rapid, industry-wide information sharing. As isolated organisations are often the first to fall victim, ISACs can play an essential role in protecting against coordinated threats. Furthermore, security budgets need to prioritise human-centred investments, such as training and resilient response procedures, rather than just the latest security technologies. 

Currently, the aviation industry faces a rapidly evolving landscape of cyber threats, particularly from adversaries as resourceful and determined as Scattered Spider. To counter these threats, both airlines and the broader ecosystem should adopt a proactive cybersecurity posture that is forward-looking. Security is no longer reactive. A proactive, intelligently driven defence must now take precedence, combining human vigilance, procedural discipline, and adaptive technology to ensure its effectiveness. 

In order to achieve this, organisations need to develop zero-trust architectures, foster a culture of security at every operational level, and integrate cybersecurity into every strategic decision they make. As a result, cross-sector cooperation should transcend compliance checklists and regulatory requirements, but instead evolve into a dynamic exchange of threat intelligence, defence tactics, and incident response insights that transcend compliance checklists and regulatory obligations. 

In the era of convergent digital and physical infrastructures, cyber complacency could lead to catastrophic outcomes that will undermine not only the continuity of operations but also public trust as well as national resilience. There is now an opportunity for aviation leaders to rethink cybersecurity as not just a technical issue, but as a strategic imperative integral to ensuring global air travel is safe, reliable, and profitable into the future.
Read more »
UAE Cybersecurity Council (CSC)
Cyberattacks CyberCrime Data Breach Data Hackers Health Records Patient Data UAE Cybersecurity Council (CSC)

Cyberattack in Dubai Compromises Patient Health Records

 


During the last few months, the UAE Cyber Security Council (CSC) has revealed that the UAE has seen a surge in cyberattacks that have been reported daily to the highest level of more than 200,000. Cyber threats of this magnitude and in such a coordinated manner are mostly directed at the nation's strategic sectors, such as government institutions, energy infrastructure, financial systems, and healthcare networks, which represent the nation's most important institutions.

Even though these attacks originate in at least 14 different foreign countries, they do not just attempt to compromise sensitive data, they also aim to disrupt critical infrastructure and disrupt national security in addition to compromising sensitive data. As a result of this growing threat landscape, the CSC has developed a comprehensive and proactive cybersecurity framework that utilises a wide range of cutting-edge global technologies, intelligence sharing protocols, and advanced threat mitigation mechanisms to combat this threat. 

As a result of identifying both the source and the perpetrators of these cyber intrusions, UAE authorities were able to swiftly implement countermeasures in order to neutralise threats before they were capable of inflicting widespread damage. A comprehensive defence strategy indicates the country’s unwavering commitment to safeguarding its digital sovereignty while protecting its essential assets in an era when cyber warfare is becoming more complex. 

The ongoing investigation into escalating cyber threats has led to alarming claims from Gunra, which claims to have stolen 450 million patient records from the American Hospital Dubai (AHD) as a result of the ransomware group's alleged theft. In light of this development, the cybersecurity landscape in the region has reached a turning point, as even the most technologically advanced healthcare institutions are vulnerable to increasingly sophisticated digital threats, even when they are technologically advanced. 

With a reputation for being one of the UAE's premier private healthcare providers since being founded in 1996, the American Hospital Dubai has become one of the UAE's premier private healthcare providers. An excellent facility located in Oud Metha that offers specialised care across 40 medical disciplines, including pioneering work in robotic surgery and minimally invasive surgery, the facility is well-known for its work in these fields. 

It is a trustworthy hub for both local and international patients, so the extent of the alleged breach is particularly devastating. A claim has been made by Gunra that he has exfiltrated 4 terabytes of highly sensitive data, which includes individual identifiers, financial information, and detailed clinical records, which are highly sensitive. 

The sheer magnitude of the alleged data breach raises serious questions about the confidentiality of patient data, the institutional oversight that governs the UAE's digital infrastructure, and how it complies with stringent data protection laws. When the breach is verified, it could have far-reaching implications on AHD, its operations, and reputation as well as on the broader healthcare sector's approach to cyber resilience and risk management in general. 

The emergence of Gunra as a new and aggressive threat actor in the context of global concerns over ransomware attacks is adding a new urgency to cybersecurity discussions, especially as ransomware attacks continue to increase in scale and sophistication. As a result of its first detection in April 2025, the Gunra ransomware group has rapidly established itself as one of the most disruptive groups in the cybercriminal landscape, according to Cyfirma, a threat intelligence firm. 

Based on the data collected by Cybernews' dark web monitoring platform, Ransomlooker, the group has claimed responsibility for attacks on 12 organisations across a variety of industries. The Gunra ransomware group seems to have taken a calculated approach, compared to other ransomware groups that choose to target high-value targets in sectors such as real estate, pharmaceuticals, and manufacturing, whereas other groups may choose to target low-value targets. 

By using a double-extortion strategy – a very common technique among advanced ransomware groups — this group not only encrypts victim data but also threatens to release the stolen information unless a ransom is paid; the stolen information is a public disclosure. Combined, these two layers of pressure greatly heighten the stakes for organisations in need, potentially compounding the damage beyond the initial breach and compounding it. Technically, Gunra is an alarmingly efficient malware once it enters a network. 

Once it has entered, it quickly encrypts critical files and adds a unique ".ENCRT" extension to each file. Upon entering the network, the malware then locks the victim out of their data and systems and leaves a ransom note in every affected folder. There are instructions provided in these notes for making a payment and reclaiming access, which often require significant sums of cryptocurrency. 

There appears to be no doubt that the primary motivation for this group is financial gain, but its rapidly evolving tactics and wide range of targets indicate an increasing threat to global digital infrastructure. It has been reported by the ransomware group that they intend to publicly release the exfiltrated data on June 8th, which significantly escalates the severity of the situation and leverages psychological pressure to compel victims to comply.

In the case of an important healthcare facility such as the American Hospital Dubai, whose job is to safeguard sensitive patient information and whose operating framework is tightly regulated, such an incident would have significant repercussions. Besides legal and financial penalties that could arise, there is also the possibility of a profound erosion of patient trust, reputational damage, and long-term disruption to patient services. 

In light of this incident, healthcare organisations, especially those that manage large amounts of confidential data in digital repositories, need to take a more aggressive cybersecurity posture that is more forward-looking and more aggressive. It is important for organisations to take steps to prevent cyber intrusions by deploying advanced threat detection systems, conducting frequent vulnerability assessments, conducting security audits, and training staff in order to minimise human error, which is often a key vector of cyber intrusions, in addition to basic security measures. 

Additionally, one must implement a robust, well-tested incident response framework that allows them to contain, recover, and communicate quickly in the event of a breach. In addition, the situation illustrates the rapidly changing threat landscape, in which cybercriminals are employing increasingly advanced and aggressive tactics to exploit systemic weaknesses in order to exploit them. Healthcare providers need to elevate their defences as these digital threats become increasingly complex and scaled. They need to invest in not only technology but also strategic foresight and organisational resilience so that they can endure and respond to cyberattacks in the future.

It is worth mentioning that while the American Hospital Dubai is dealing with the fallout of a potential massive data breach, a wave of similar cyber incidents has swept through other parts of the Middle East and Africa, demonstrating the increased globalisation and globalisation of the ransomware threat landscape. Throughout the Moroccan territory, cyberattacks targeting both public and private organisations have raised serious concerns about how resilient the digital infrastructures of the country are. 

The initial reports suggest that cybercriminals broke into the computer systems of the National Agency for Land Conservation, Cadastre, and Cartography (ANCFCC), claiming to have exfiltrated over four million documents from its systems. In the alleged compromised data, there is an accumulation of highly sensitive documents such as over 10,000 property certificates, passports and bank statements, as well as a variety of other personal information like a birth certificate, passport, and civil status information. 

It was further clarified by Morocco's General Directorate of Information Systems Security (DGSSI) that the ANCFCC had not been compromised. Upon further investigation, it was discovered that there had been no compromise of ANCFCC. Ultimately, it was discovered that the breach had been caused by an online platform known as tawtik. Ma, which was used by the National Council of Notaries. In order to contain the threat and initiate remediation steps, the platform was taken offline immediately to ensure a limited set of documents could be accessed.

The breach is the second significant cybersecurity incident that has occurred in Morocco in recent years. Recently, the National Social Security Fund (CNSS) suffered a major compromise that resulted in the theft of over 54,000 documents and the loss of nearly 2 million citizens' personal data. Cyber intrusions continue to occur in the public and private sectors, which indicates that both sectors are vulnerable to attacks. The list of victims is growing, as Best Profil, a prominent Moroccan human resources firm, has also been targeted in another attack. 

According to preliminary assessments, approximately 26 gigabytes of sensitive internal data were exfiltrated by the attackers, among other things. According to reports, the stolen data included sensitive HR and financial documents, employee contracts, and financial records. According to cybersecurity analysts, the data which was compromised may have been worth around $10 million. This underscores the high stakes involved in such breaches and the lucrative motivations behind cybercrime that drive cybercrime in the first place. 

In aggregate, these incidents emphasise how transnational cyberattacks have become increasingly common across sectors and borders, with an increasing frequency. A strong emphasis has been placed upon the need for nations and organisations - particularly those responsible for managing sensitive public data, to invest in advanced cybersecurity frameworks, to facilitate inter-agency collaboration, and to stay alert to evolving digital threats safeguard themselves. 

Increasingly, cybersecurity compliance plays a crucial role in addressing the threats to healthcare institutions in the Middle East and Africa as a result of the growing number of cyberattacks targeting those facilities. A hospital or medical service provider's responsibility to safeguard sensitive patient data, digital infrastructure, and life-saving technologies, along with adhering to rigorous cybersecurity regulations, is more than just a legal formality. 

It is an integral part of operating with integrity, maintaining patient trust, and ensuring long-term resilience. There are so many regulatory frameworks out there that offer a structured approach to risk management by requiring best practices in data protection, threat monitoring, and incident response, as well as implementing regulations based on the Abu Dhabi Healthcare Information and Cyber Security (ADHICS) standards. 

Amidst the rapid progress of digital transformation across the Middle East, the region continues to face enormous challenges when it comes to protecting healthcare and public infrastructures from the ever-increasing number of cyber threats, which include ransomware, phishing, and data breaches. As a critical defence mechanism, compliance initiatives provide an important means of reducing vulnerabilities, ensuring accountability, and ensuring continuity of care despite cyber disruptions by introducing standard safeguards. 

A robust phishing protection protocol, for example, mandated under many regional cybersecurity guidelines, can serve as a tool to counter one of the most prevalent entry points for threat actors, thereby safeguarding the institutional data and patient outcomes. By aligning their security frameworks with regulatory mandates such as ADHICS, healthcare organisations can significantly reduce the impact of cyber incidents by ensuring that their security frameworks are aligned with regulatory guidelines. 

Aside from preventing large-scale data breaches, mitigating medical service delays caused by system outages, and strengthening public confidence that healthcare providers are capable of protecting patient information, there are many other benefits. As well, well-regulated cybersecurity postures establish a reputation for reliability and digital responsibility, which are key attributes in an environment where healthcare is highly interconnected and highly threatened. Cybersecurity compliance is not a problem only in the Middle East. 

As cyber threats become increasingly sophisticated and broad in scope, other regions are also in need of the same regulatory models that emphasise proactive governance and multilayered security. It is crucial to develop strong, sector-specific cybersecurity policies in order not only to protect national health infrastructures but also to promote a culture of digital safety and resilience across the globe. As cyberattacks continue to increase in frequency and severity across the Middle East and Africa, cybersecurity compliance has become more important than ever before. 

As hospitals and medical service providers are responsible for the stewardship of sensitive patient data, digital infrastructure and life-saving technologies, it is important that they adhere to stringent cybersecurity regulations, as this is not just a legal requirement. There are so many regulatory frameworks out there that offer a structured approach to risk management by requiring best practices in data protection, threat monitoring, and incident response, as well as implementing regulations based on the Abu Dhabi Healthcare Information and Cyber Security (ADHICS) standards. 

Amidst the rapid progress of digital transformation across the Middle East, the region continues to face enormous challenges when it comes to protecting healthcare and public infrastructures from the ever-increasing number of cyber threats, which include ransomware, phishing, and data breaches. As a critical defence mechanism, compliance initiatives provide an important means of reducing vulnerabilities, ensuring accountability, and ensuring continuity of care despite cyber disruptions by introducing standard safeguards. 

Several regional cybersecurity guidelines, such as the one mandated by the Department of Homeland Security, mandate robust phishing protection protocols, which help to combat phishing attacks, and have proven to be one of the most common ways for threat actors to access institutional data, as well as patient results. 

By aligning their security frameworks with regulatory mandates such as ADHICS, healthcare institutions can minimise the impact of cyber incidents significantly. Aside from preventing large-scale data breaches, mitigating medical service delays caused by system outages, and strengthening public confidence that healthcare providers are capable of protecting patient information, there are many other benefits. 

As well, well-regulated cybersecurity postures establish a reputation for reliability and digital responsibility, which are key attributes in an environment where healthcare is highly interconnected and highly threatened. There is a growing urgency regarding cybersecurity compliance in other parts of the world, and not just in the Middle East.

Increasing cyber threats in scope and sophistication globally have made it necessary for other regions to adopt similar regulatory models emphasising proactive governance and multi-layered defences as the threat grows. A strong,sector-specific cybersecurity policy that is sector-specific is crucial not only to safeguard national health infrastructures but also to promote a culture of digital security and resilience throughout the entire world. 

Cyberattacks are becoming increasingly targeted, persistent, and damaging, especially against healthcare systems, which makes it imperative to implement robust, proactive cybersecurity measures. Recent incidents in Middle Eastern and African countries have exposed the vulnerabilities in the digital infrastructure, as well as a widespread underestimation of the threat of ofcybercrimee at the institutional level that is occurring in these regions.

Cybersecurity cannot be treated as a technical afterthought anymore; it has to be woven into the very fabric of business strategy and executive decision-making by organisations. A comprehensive, multilayered approach is needed to respond to this shift, including the use of cutting-edge technologies such as artificial intelligence-driven threat intelligence, robust governance models, risk assessments carried out by third parties, and simulation-based incident response planning systems. 

By empowering employees at all levels of the organisation through continuous education and accountability, cyber resilience can also be built, and security becomes a shared organizational responsibility, which will make cybersecurity a shared organisational responsibility. At the same time, regulators need to come up with agile, enforceable frameworks that evolve in line with changing threats. 

For cybercrime syndicates to continue to thrive, stronger cross-border collaboration, sector-specific mandates, and strict compliance oversight are essential measures to counteract their increasing influence. As a result of a hyperconnected world, being able to anticipate, withstand, and recover from cyber incidents is more than simply a competitive advantage; it is a necessary component of maintaining trust, continuity, and national security in an increasingly interconnected world.
Read more »
Ticketmaster
Cyberattacks CyberCrime Cybersecurity CyberThreat data threat Stolen Customer Data Ticketmaster

Stolen Customer Data from Ticketmaster Incident Resurfaces Online

 


Ticketmaster, one of the most prominent ticketing companies in the world, suffered a high-profile cyber-attack in May 2024 that affected the entire digital infrastructure of the company. The incident resulted in the unauthorised exposure of vast amounts of customer data, including personal information and payment details, placing millions of people at risk of harm. There was no doubt that security experts had linked the breach to ShinyHunters, a notorious hacker group known for its involvement in several large-scale data breaches, as well as ransomware attacks. 

Initial investigations suggest that the attackers may have exploited vulnerabilities in cloud-based systems, which reflects the increasing trend for cybercriminals to target third-party platforms and storage systems. Public and regulatory scrutiny has increased as a result of the breach, drawing attention to the increasing frequency and sophistication of cyberattacks on major consumer-facing platforms. 

Ticketmaster's breach serves as a stark warning of the vulnerabilities still present in today's cloud-based digital landscape, as forensic analysis continues and containment efforts are made. This emphasises the need for comprehensive cybersecurity practices and proactive risk mitigation strategies, which are imperative to the success of businesses. As the cybersecurity community went into the weekend, renewed concerns erupted over the claims of a relatively new threat actor operating under the name Arkana Security, which raised alarming concerns. 

Ticketmaster data that was claimed to have just been stolen by a group known as extortion-focused group was reportedly listed on its dark web leak site for sale at over 569 gigabytes, which they claim was newly stolen data. This post, accompanied by screenshots showing internal file directories and database structures, immediately sparked speculation that another large-scale attack had compromised the systems of one of the world's most prominent ticketing platforms, as shown in the screenshots. 

It has been revealed that this misinformation campaign was a deliberate act of misinformation that led to the operation being uncovered. It turns out that cyber analysts have confirmed what initial fears of the public were that the data which is being circulated is not the result of a fresh compromise, but rather is a repackaged version of the same set of data which was exfiltrated during the large-scale attacks of 2024 Snowflake based on credentials.

Previously, these breaches were connected to the notorious ShinyHunters hacking group, which was known for orchestrating numerous coordinated attacks across multiple organisations by utilising weak or poorly managed cloud access credentials to re-activate and monetise previously leaked material.

By misleading potential buyers and reigniting public concern, Arkana Security appears to be trying to revive and monetise previously leaked material. Moreover, this development confirms that public data breaches certainly have a long-tail impact. This also supports the argument that cyber extortion groups are increasingly relying on disinformation and rebranding to prolong the shelf life of stolen assets, thereby making public the fact that data breaches are having a long-tail impact. 

As part of an official statement released by Ticketmaster, it was confirmed that an unauthorised user had accessed a cloud database hosted by a third-party data services provider in an attempt to gain access to it. According to the document submitted to the Maine Attorney General's office, the incident is described as an external system breach, which is explicitly defined as a hacking incident. Following their investigations into Ticketmaster's data, cybersecurity experts determined that Snowflake, a cloud-based data warehouse company that was hosting the data at the time of the intrusion, was the third-party provider responsible for hosting the data. 

The attackers, according to analysts, obtained access by using stolen Snowflake account credentials, which allowed them to access the Ticketmaster database laterally through the platform. These findings suggest that Snowflake's environment may have been compromised; however, Snowflake firmly denied that any platform-level vulnerabilities or misconfigurations led to the breach, asserting that the breach was not due to any weaknesses within its infrastructure. 

Ticketmaster suffered widespread damage from the incident that went well beyond the technical compromise, causing widespread damage across a wide range of aspects of its operations. Financial Repercussions Although the company has not released a public accounting of the financial impact, similar high-profile breaches in the past have shown that significant losses could result. Equifax's 2017 breach, which involved hundreds of millions of users, resulted in a historic $575 million settlement that was the result of similar legal proceedings and regulatory scrutiny, especially given the size and sensitivity of the breached data. 

As a comparison to Equifax's 2017 breach, Ticketmaster's costs could be comparable. Reputational Harm. With Ticketmaster's brand reputation being damaged by this breach, Ticketmaster suffered substantial damage to its brand image. In the aftermath of that breach, the media began to focus on it, sparking a public debate about how such a dominant player in the digital entertainment ecosystem could be so vulnerable. Legal Consequences. 

It was the affected consumers who initiated the class action lawsuit against Ticketmaster and Live Nation Entertainment Inc. after the breach occurred. There is a lawsuit claiming that Ticketmaster did not adopt and implement adequate cybersecurity measures, thereby not fulfilling its duty to protect customer information. According to legal experts, this case could set a precedent in cloud-related breaches involving third-party providers in which responsibility can be given to third parties. Employee Impact.

The breach has not been discussed in public by any Ticketmaster employees, but indirect indicators provide insight into internal sentiment. According to Glassdoor, with over a thousand reviews, the company holds an average rating of 3.9 out of 5, with 83% of employees indicating that they would recommend it to their friends if they were able to find out what was going on. Customer Fallout. In today's interconnected digital environment, where cyberattacks have a wide range of impacts, this multifaceted fallout illustrates just how widespread the consequences of a cyberattack are, where a single breach can impact users, employees, legal entities, and even public trust as a whole. 

As the Ticketmaster breach has grown in importance over the past several years, it has been connected to a wave of coordinated cyberattacks connected with the Snowflake credential compromise incident, which occurred in 2024. As a result of the series of intrusions, a wide range of high-profile organisations, including Santander, AT&T, Neiman Marcus, Advance Auto Parts, Pure Storage, Cylance, and even the Los Angeles Unified School District, were all affected.

There was a well-known cybercriminal organisation called ShinyHunters at the centre of these attacks, a well-known cybercriminal organisation with a long history of obtaining and utilising stolen data to make money for its own. In the investigation that followed, it was discovered that Snowflake, one of the most popular cloud data warehousing services available, was compromised with the credentials used to launch these attacks. 

Once these credentials had been acquired, they could be used to access cloud environments and exfiltrate large volumes of sensitive corporate data from unprotected or poorly monitored endpoints, which had been exploited by infostealer malware. Several ransoms were demanded from victims for the theft of their confidential information, forcing them to choose between paying ransoms or revealing their private information to the public. A high-profile and widely extorted entity was Ticketmaster out of all those that had been affected.

There was unauthorised access gained by the attackers to databases that contained personal user information as well as ticketing records, which were listed on underground forums shortly after being accessed by the attackers. Ticketmaster took action to rectify the situation in late May 2024, and by data protection regulations, they notified affected customers of the breach. 

In order to increase pressure and maximise attention, the attackers published what they alleged to be "print-at-home" tickets, which allegedly included tickets associated with Taylor Swift concerts. This was a move that was clearly intended to arouse public interest and exert reputational pressure upon the attackers. In spite of Arkana Security, a relatively new group in the cyber extortion space, later surfacing with claims that it had fresh data from Ticketmaster, forensic analysis quickly uncovered inconsistencies despite the claim. 

In the file names and metadata, Arkana made reference to earlier leaks associated with ShinyHunters, suggesting that they repackaged and attempted to resell previously stolen data under the guise of a new breach, which is a sign that Arkana was trying to resell stolen data. The exact nature of Arkana’s involvement remains unclear. As far as I know, there is no way to tell whether the group acquired the data by purchasing it previously, whether they are acting as intermediaries for ShinyHunters, or if they are acting as part of the original threat operation, using a new alias. 

Whatever the role of the cybercriminals involved in the situation is, they remain a persistent and ever-evolving threat to the cyber community because they constantly recycle stolen information in order to reap the rewards of their efforts. Additionally, this reflects a broader trend where cybercriminals thrive on misinformation, duplication of data, and psychological manipulations aimed at both potential victims as well as buyers. 

In light of the Ticketmaster incident as well as the broader Snowflake-linked cyberattacks, it is imperative that organizations reevaluate their security posture concerning their cloud-based ecosystems and third-party services integrations in light of the Ticketmaster incident. It is important to realise that even industry giants are susceptible to persistent and well-planned cyber attacks, which have been demonstrated by this breach. 

As threat actors become more proficient at repackaging stolen data, leveraging digital supply chains to intensify extortion, and utilising misinformation to intensify extortion, businesses have to go beyond reactive containment as they become more agile. There is no longer a need for optional measures such as continuous credential hygiene, endpoint hardening, zero-trust architectures, and transparent vendor risk management; they have now become fundamental to security. 

Additionally, all companies must have a strategy in place to respond to cyber crises that ensures clear communication with stakeholders, timely disclosure of incidents, and legal preparedness. It's no secret that cybersecurity is changing very quickly. Only organisations that treat cybersecurity as a dynamic, business-critical function - and not as a checkbox - will be able to withstand attacks in the future.
Read more »
Zero-day Vulnerability and Exploits
Critical security flaw Cyberattacks CyberCrime Cybersecurity CyberThreat FortiGate Fortinet Bugs Qilin Ransomware VPN Zero-day Vulnerability and Exploits

Qilin Ransomware Actors Take Advantage of Newly Discovered Fortinet Bugs

 


The recently observed increase in ransomware activity linked to the Qilin group has sparked alarms throughout the cybersecurity industry. As a result of these sophisticated Ransomware-as-a-Service (RaaS) operations operating under multiple aliases, including Phantom Mantis and Agenda, Fortinet's recent critical vulnerability disclosures have made it possible for this operation to actively exploit two critical Fortinet vulnerabilities. 

Operators of Qilin can exploit these flaws in order to gain unauthorised access to targeted networks and to run malicious code on them, sometimes without any detection by the targeted network. Qilin is stepping up its tactics by exploiting these Fortinet vulnerabilities, signalling a shift in strategy to target enterprise security infrastructure deployed throughout the world. Consequently, organisations from a variety of sectors — ranging from healthcare and finance to government and critical infrastructure — have now become targets of an expanding global threat campaign. 

According to researchers at the company, the group's ability to weaponise newly discovered vulnerabilities so quickly demonstrates both the group's technical sophistication as well as the importance of adopting a proactive, vulnerability-focused security posture as a result of their rapid growth. As the trend of ransomware groups exploiting zero-day or newly patched vulnerabilities to bypass perimeter defences and gain persistent access is growing, this wave of attacks underscores the trend. 

There is no doubt that Qilin's campaign not only proves how effective it is to exploit trusted security platforms like Fortinet, but it also illustrates a more general evolution in the ransomware ecosystem, in which ransomware groups are constantly scaling and refining their methods to maximise their impact and reach within the ecosystem. 

With various aliases — including Phantom Mantis and Agenda — the Qilin ransomware group has increased the level of malicious activity they are able to conduct by exploiting critical Fortinet security vulnerabilities. It has been shown that these exploits provide attackers with the ability to bypass authentication controls, deploy malicious payloads remotely, and compromise targeted networks with alarming ease. 

It is important to note that since Qilin first emerged in August 2022 as a Ransomware-as-a-Service provider (RaaS), the company has been growing rapidly. The company has rolled out sophisticated ransomware toolkits to affiliate actors and is expanding into many different areas. Over 310 organisations around the world have been linked to Qilin breaches, spanning a range of sectors that include the media, healthcare, manufacturing, and government services sectors. 

Court Services Victoria in Australia, Yangfeng, Lee Enterprises, and Synnovis are a few of the most notable victims of the cyberattack. Several companies have been affected by the attack, and the group has demonstrated a high level of operational maturity and the capability to adapt tactics quickly by exploiting newly discovered vulnerabilities in widely used enterprise infrastructure systems. 

Experts consider Qilin's aggressive campaign to be a part of a broader trend in which RaaS actors are increasingly targeting foundational security platforms in order to extort high-value ransoms and maximise disruption. Several threat actors are actively exploiting two highly critical vulnerabilities in Fortinet's network security products, identified as CVE-2024-55591 and CVE-2024-21762, in the latest wave of Qilin ransomware activity. 

Neither of these vulnerabilities is classified as critical, but they do allow remote attackers to bypass authentication mechanisms and execute arbitrary code on compromised systems, allowing them to take complete control of the system. Although there are many cybercriminal groups that have exploited these vulnerabilities in the past, Qilin's use of them underscores that unpatched Fortinet devices are still an entry point into enterprise environments that criminal groups can exploit. 

Although these vulnerabilities have been disclosed publicly and patches have been released, thousands of Fortinet appliances remain vulnerable, which poses a significant risk to a significant number of organisations. IT administrators and security teams must prioritise patch management and hardening of systems at the earliest opportunity in order to prevent vulnerabilities from occurring in the future. 

According to a Fortinet expert, organisations utilising its products should immediately assess their infrastructure for signs of compromise and apply the latest firmware updates or temporary mitigation measures according to the vendor's recommendations. It is important for organisations relying on Fortinet products to address these vulnerabilities immediately, as failure to do so could result in devastating ransomware attacks, data breaches, and prolonged disruptions to operations. 

As the Qilin ransomware group emerged in August 2022 under the alias Phantom Mantis and Agenda, it has steadily increased its presence on the cyber threat landscape, steadily increasing its presence. In addition to operating as a Ransomware-as-a-Service (RaaS) provider, Qilin claims that it has compromised more than 310 organisations in a variety of different industries. 

This company’s most recent campaign reflects a highly targeted and technologically advanced approach, mainly focusing on exploiting known vulnerabilities within Fortinet’s FortiGate appliances, such as CVE-2024-21762 and CVE-2024-55591, found in Fortinet’s security appliances. This vulnerability can act as a critical attack vector, allowing threat actors to breach security controls, penetrate network perimeters, and launch widespread ransomware deployments within the affected environment as a result of these flaws. 

There is one aspect that sets Qilin apart from other ransomware groups: Rather than relying primarily on phishing or brute force methods, its strategic focus is on exploiting vulnerabilities in core enterprise infrastructure. Especially in the ability for the group to identify and exploit architectural weaknesses within widely deployed network security solutions, this evolving threat model exemplifies a high level of sophistication among the group members. 

It appears that this group is attempting to exploit the authentication and session management vulnerabilities of FortiGate systems to establish unauthorised access to networks, as well as maintain persistence within these compromised networks. It is clear from the methodical exploitation that the attackers have a deep understanding of enterprise defence mechanisms and are demonstrating a shift away from ransomware tactics to compromise infrastructure. 

Such attacks pose substantial risks. By infiltrating the first line of defence, which is normally a security infrastructure, Qilin's operations effectively neutralise conventional defence layers, enabling internal systems to be compromised and exposed to data exfiltration through lateral movement. There are a number of consequences for organisations that have been affected by this ransomware attack, including severe operational disruption, the loss of sensitive data, the violation of regulations, as well as long-term reputational damage. 

Because of this, organisations are required to reassess their vulnerability management strategies, to ensure timely patching of known vulnerabilities, as well as adopt a more proactive security posture to mitigate the threat that advanced ransomware actors like Qilin are posing to their organisations. This latest ransomware campaign from Qilin exploits vulnerabilities that have a troubling history within the security community, particularly CVE-2024-55591 and CVE-2024-21762. CVE-2024-55591, for example, had been exploited as a zero-day vulnerability as early as November 2024 by several threat actors who used it as a zero-day exploit.

It is worth mentioning that the Mora_001 ransomware operator used the vulnerability to deliver the SuperBlack ransomware strain, which is linked by Forescout researchers to the notorious LockBit cybercrime syndicate. By recurring abuse of Fortinet vulnerabilities, we can see how these flaws continue to be appealing to a wide variety of threat actors, from criminal gangs to state-sponsored espionage groups.

Fortinet patched the second vulnerability in early February of 2025, CVE-2024-21762. Upon discovering the threat this vulnerability posed, the U.S Cybersecurity and Infrastructure Security Agency (CISA) swiftly added it to its Known Exploited Vulnerabilities (KEV) catalogue and instructed federal agencies to secure all affected FortiOS and FortiProxy devices by the end of February. However, despite these warnings, widespread vulnerability persisted. 

By the middle of March, the Shadowserver Foundation reported nearly 150,000 devices across the globe remained unpatched and vulnerable. This underscores a critical gap in patch adoption and risk mitigation within corporations. Fortinet's network security products have been a frequent target of exploitation over the years, and they have served as the first point of entry for both cyber-espionage campaigns and financial ransomware attacks over the years. 

It has been revealed recently by Fortinet that in a separate incident earlier this year, Chinese state-sponsored threat group Volt Typhoon exploited two old SSL VPN vulnerabilities (CVEs 2020-22475 and 2022-2997) to deploy a custom remote access trojan, dubbed Coathanger, within the Dutch Ministry of Defense's military network, exploitation two older SSL VPN vulnerabilities. As a result of these repeated and high-impact incidents, the threat pattern is consistently one of Fortinet devices being targeted due to their widespread deployment and their vital role in enterprise network security in enterprises. 

In order to expand their reach and refine their tactics, ransomware groups such as Qilin will likely continue to focus on exploiting foundational security infrastructure such as Fortinet firewalls and VPNs, so it is likely that they will continue to use this technique. Taking into account these developments, it is becoming increasingly apparent that organisations need to put security first, prioritising continuous vulnerability assessment, timely patching, and a robust incident response strategy in order to be able to protect themselves against the increasing sophistication and persistence of threat actors operating in the digital era. 

There has been a noticeable shift in Qilin's operational strategy, according to threat intelligence firm PRODAFT, which has been characterised by a shift to partially automated attacks on FortiGate firewalls that are not patched. It appears that the campaign is influenced by Spanish-speaking regions, but the tactics employed remain largely opportunistic, utilising vulnerable devices regardless of their location, despite the fact that there is a distinct geographic bias toward these regions. 

A key exploit technique identified, CVE-2024-55591, has been linked to the deployment of the SuperBlack ransomware variant, which is closely linked with the LockBit cybercriminal ecosystem, as well as with the deployment of the SuperBlack ransomware. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued urgent patching instructions in February 2025 to patch nearly 150,000 devices vulnerable to the second critical flaw, CVE-2024-21762. 

Even though widespread awareness of this flaw is widespread, nearly 150,000 devices are still vulnerable. Although these devices are still unpatched, this symptom of security lapses that continue to be exploited by ransomware operators illustrates a critical security vulnerability that is still prevalent. Because of their widespread use in enterprise environments, Fortinet appliances remain a high value target, and organizations must act decisively and immediately to minimize those risks in order to reduce them. 

In order to maintain a secure environment, security teams should take a proactive approach and apply security patches as soon as they are released and ensure that FortiGate and FortiProxy appliances are strictly monitored. Among the measures that we should take are the deployment of intrusion detection and prevention systems, the analysis of real-time logs for suspicious behaviour, and the segmentation of high-value assets within networks to prevent lateral movement. 

A defence-in-depth strategy must also be implemented with endpoint protection, segmentation of the network, integration of threat intelligence, and regular audits of security practices in order to boost resilience against increasingly automated and targeted ransomware attacks. With the increasing complexity and scale of cyberattacks, it is becoming increasingly important for organisations to maintain continuous visibility and control of their security infrastructure, so as to protect their organisational integrity. It is no longer optional.

As a result of the escalating threat landscape and the calculated use of core enterprise infrastructure by the Qilin ransomware group, organisations need to move beyond reactive cybersecurity practices and develop a forward-looking security posture. Organisations must keep vigilance on new vulnerabilities to minimise the speed and precision with which threat actors exploit them. Continuous vulnerability intelligence, rigorous patch lifecycle management, and real-time system integrity monitoring are essential to combating these threats.

Organisations need to integrate threat-aware defence mechanisms that account for both technical weakness and adversarial behaviour—merely deploying security solutions is no longer enough. By investing in automated detection systems, segmenting critical assets, multifactor authentication, and creating secure configuration baselines, we can significantly reduce the attack surface. 

Furthermore, establishing a culture of cybersecurity readiness—through continuous workforce training, tabletop exercises, and simulations of an incident response scenario—ensures that when preventative measures do not work, we are resilient. A growing number of ransomware attacks, especially those such as Qilin, which exploit security technologies themselves, are becoming increasingly complex and scaled up, so securing the digital perimeter should become an executive-level priority that is supported by adequate resources, measurable accountability, and executive commitment.
Read more »
Software
agentic AI AI API Artifical Intelligence Cyber Security Cyberattacks CyberThreat Data collection LLM RAG Software

The Strategic Imperatives of Agentic AI Security


 

In terms of cybersecurity, agentic artificial intelligence is emerging as a transformative force that is fundamentally transforming the way digital threats are perceived and handled. It is important to note that, unlike conventional artificial intelligence systems that typically operate within predefined parameters, agentic AI systems can make autonomous decisions by interacting dynamically with digital tools, complex environments, other AI agents, and even sensitive data sets. 

There is a new paradigm emerging in which AI is not only supporting decision-making but also initiating and executing actions independently in pursuit of achieving its objective in this shift. As the evolution of cybersecurity brings with it significant opportunities for innovation, such as automated threat detection, intelligent incident response, and adaptive defence strategies, it also poses some of the most challenging challenges. 

As much as agentic AI is powerful for defenders, the same capabilities can be exploited by adversaries as well. If autonomous agents are compromised or misaligned with their targets, they can act at scale in a very fast and unpredictable manner, making traditional defence mechanisms inadequate. As organisations increasingly implement agentic AI into their operations, enterprises must adopt a dual-security posture. 

They need to take advantage of the strengths of agentic AI to enhance their security frameworks, but also prepare for the threats posed by it. There is a need to strategically rethink cybersecurity principles as they relate to robust oversight, alignment protocols, and adaptive resilience mechanisms to ensure that the autonomy of AI agents is paired with the sophistication of controls that go with it. Providing security for agentic systems has become more than just a technical requirement in this new era of AI-driven autonomy. 

It is a strategic imperative as well. In the development lifecycle of Agentic AI, several interdependent phases are required to ensure that the system is not only intelligent and autonomous but also aligned with organisational goals and operational needs. Using this structured progression, agents can be made more effective, reliable, and ethically sound across a wide variety of use cases. 

The first critical phase in any software development process is called Problem Definition and Requirement Analysis. This lays the foundation for all subsequent efforts in software development. In this phase, organisations need to be able to articulate a clear and strategic understanding of the problem space that the artificial intelligence agent will be used to solve. 

As well as setting clear business objectives, defining the specific tasks that the agent is required to perform, and assessing operational constraints like infrastructure availability, regulatory obligations, and ethical obligations, it is imperative for organisations to define clear business objectives. As a result of a thorough requirements analysis, the system design is streamlined, scope creep is minimised, and costly revisions can be avoided during the later stages of the deployment. 

Additionally, this phase helps stakeholders align the AI agent's technical capabilities with real-world needs, enabling it to deliver measurable results. It is arguably one of the most crucial components of the lifecycle to begin with the Data Collection and Preparation phase, which is arguably the most vital. A system's intelligence is directly affected by the quality and comprehensiveness of the data it is trained on, regardless of which type of agentic AI it is. 

It has utilised a variety of internal and trusted external sources to collect relevant datasets for this stage. These datasets are meticulously cleaned, indexed, and transformed in order to ensure that they are consistent and usable. As a further measure of model robustness, advanced preprocessing techniques are employed, such as augmentation, normalisation, and class balancing to reduce bias, es and mitigate model failures. 

In order for an AI agent to function effectively across a variety of circumstances and edge cases, a high-quality, representative dataset needs to be created as soon as possible. These three phases together make up the backbone of the development of an agentic AI system, ensuring that it is based on real business needs and is backed up by data that is dependable, ethical, and actionable. Organisations that invest in thorough upfront analysis and meticulous data preparation have a significantly greater chance of deploying agentic AI solutions that are scalable, secure, and aligned with long-term strategic goals, when compared to those organisations that spend less. 

It is important to note that the risks that a systemic AI system poses are more than technical failures; they are deeply systemic in nature. Agentic AI is not a passive system that executes rules; it is an active system that makes decisions, takes action and adapts as it learns from its mistakes. Although dynamic autonomy is powerful, it also introduces a degree of complexity and unpredictability, which makes failures harder to detect until significant damage has been sustained.

The agentic AI systems differ from traditional software systems in the sense that they operate independently and can evolve their behaviour over time as they become more and more complex. OWASP's Top Ten for LLM Applications (2025) highlights how agents can be manipulated into misusing tools or storing deceptive information that can be detrimental to the users' security. If not rigorously monitored, this very feature can turn out to be a source of danger.

It is possible that corrupted data penetrates a person's memory in such situations, so that future decisions will be influenced by falsehoods. In time, these errors may compound, leading to cascading hallucinations in which the system repeatedly generates credible but inaccurate outputs, reinforcing and validating each other, making it increasingly challenging for the deception to be detected. 

Furthermore, agentic systems are also susceptible to more traditional forms of exploitation, such as privilege escalation, in which an agent may impersonate a user or gain access to restricted functions without permission. As far as the extreme scenarios go, agents may even override their constraints by intentionally or unintentionally pursuing goals that do not align with the user's or organisation's goals. Taking advantage of deceptive behaviours is a challenging task, not only ethically but also operationally. Additionally, resource exhaustion is another pressing concern. 

Agents can be overloaded by excessive queues of tasks, which can exhaust memory, computing bandwidth, or third-party API quotas, whether through accident or malicious attacks. When these problems occur, not only do they degrade performance, but they also can result in critical system failures, particularly when they arise in a real-time environment. Moreover, the situation is even worse when agents are deployed on lightweight frameworks, such as lightweight or experimental multi-agent control platforms (MCPs), which may not have the essential features like logging, user authentication, or third-party validation mechanisms, as the situation can be even worse. 

When security teams are faced with such a situation, tracking decision paths or identifying the root cause of failures becomes increasingly difficult or impossible, leaving them blind to their own internal behaviour as well as external threats. A systemic vulnerability in agentic artificial intelligence must be considered a core design consideration rather than a peripheral concern, as it continues to integrate into high-stakes environments. 

It is essential, not only for safety to be ensured, but also to build the long-term trust needed to enable enterprise adoption, that agents act in a transparent, traceable, and ethical manner. Several core functions give agentic AI systems the agency that enables them to make autonomous decisions, behave adaptively, and pursue long-term goals. These functions are the foundation of their agency. The essence of agentic intelligence is the autonomy of agents, which means that they operate without being constantly overseen by humans. 

They perceive their environment with data streams or sensors, evaluate contextual factors, and execute actions that are in keeping with the predefined objectives of these systems. There are a number of examples in which autonomous warehouse robots adjust their path in real time without requiring human input, demonstrating both situational awareness and self-regulation. The agentic AI system differs from reactive AI systems, which are designed to respond to isolated prompts, since they are designed to pursue complex, sometimes long-term goals without the need for human intervention. 

As a result of explicit or non-explicit instructions or reward systems, these agents can break down high-level tasks, such as organising a travel itinerary, into actionable subgoals that are dynamically adjusted according to the new information available. In order for the agent to formulate step-by-step strategies, planner-executor architectures and techniques such as chain-of-thought prompting or ReAct are used by the agent to formulate strategies. 

In order to optimise outcomes, these plans may use graph-based search algorithms or simulate multiple future scenarios to achieve optimal results. Moreover, reasoning further enhances a user's ability to assess alternatives, weigh tradeoffs, and apply logical inferences to them. Large language models are also used as reasoning engines, allowing tasks to be broken down and multiple-step problem-solving to be supported. The final feature of memory is the ability to provide continuity. 

Using previous interactions, results, and context-often through vector databases-agents can refine their behavior over time by learning from their previous experiences and avoiding unnecessary or unnecessary actions. An agentic AI system must be secured more thoroughly than incremental changes to existing security protocols. Rather, it requires a complete rethink of its operational and governance models. A system capable of autonomous decision-making and adaptive behaviour must be treated as an enterprise entity of its own to be considered in a competitive market. 

There is a need for rigorous scrutiny, continuous validation, and enforceable safeguards in place throughout the lifecycle of any influential digital actor, including AI agents. In order to achieve a robust security posture, it is essential to control non-human identities. As part of this process, strong authentication mechanisms must be implemented, along with behavioural profiling and anomaly detection, to identify and neutralise attempts to impersonate or spoof before damage occurs. 

As a concept, identity cannot stay static in dynamic systems, since it must change according to the behaviour and role of the agent in the environment. The importance of securing retrieval-augmented generation (RAG) systems at the source cannot be overstated. As part of this strategy, organisations need to enforce rigorous access policies over knowledge repositories, examine embedding spaces for adversarial interference, and continually evaluate the effectiveness of similarity matching methods to avoid data leaks or model manipulations that are not intended. 

The use of automated red teaming is essential to identifying emerging threats, not just before deployment, but constantly in order to mitigate them. It involves adversarial testing and stress simulations that are designed to expose behavioural anomalies, misalignments with the intended goals, and configuration weaknesses in real-time. Further, it is imperative that comprehensive governance frameworks be established in order to ensure the success of generative and agentic AI. 

As a part of this process, the agent behaviour must be codified in enforceable policies, runtime oversight must be enabled, and detailed, tamper-evident logs must be maintained for auditing and tracking lifecycles. The shift towards agentic AI is more than just a technological evolution. The shift represents a profound change in the way decisions are made, delegated, and monitored in the future. A rapid adoption of these systems often exceeds the ability of traditional security infrastructures to adapt in a way that is not fully understood by them.

Without meaningful oversight, clearly defined responsibilities, and strict controls, AI agents could inadvertently or maliciously exacerbate risk, rather than delivering what they promise. In response to these trends, organisations need to ensure that agents operate within well-defined boundaries, under continuous observation, and aligned with organisational intent, as well as being held to the same standards as human decision-makers. 

There are enormous benefits associated with agentic AI, but there are also huge risks associated with it. Moreover, these systems should not just be intelligent; they should also be trustworthy, transparent, and their rules should be as precise and robust as those they help enforce to be truly transformative.
Read more »
Subscribe to: Posts (Atom)