CySecurity News - Latest Information Security and Hacking Incidents: Cyberhackers

AI AI Engineers Cyber Attacks CyberCrime Cyberhackers Cybersecurity CyberThreat Fake AI Microsoft

London Startup Allegedly Deceived Microsoft with Fake AI Engineers

There have now been serious allegations of fraud against London-based startup Builder.ai, once considered a disruptor of software development and valued at $1.5 billion. Builder.ai is now in bankruptcy. The company claims that its artificial intelligence-based platform will revolutionise app development. With the help of its AI-assisted platform, Natasha, the company claims that building software will be easier than ordering pizza.

The recent revelations, however, have revealed a starkly different reality: instead of employing cutting-edge AI technology, Builder.ai reportedly relies on hundreds of human developers in India, who manually execute customer requests while pretending to be AI-generated results.

Having made elaborate misrepresentations about this company, Microsoft and Qatar Investment Authority invested $445 million, led by the false idea that they were backed by a scalable, AI-based solution, which resulted in over $445 million in funding being raised. This scandal has sparked a wider conversation about transparency, ethics, and the hype-driven nature of the startup ecosystem, as well as raised serious concerns about due diligence in the AI investment landscape.

In 2016, Builder.ai, which was founded by entrepreneur Sachin Dev Duggal under the name Engineer.ai, was conceived with a mission to revolutionise app development. In the company's brand, the AI-powered, no-code platform was touted to be able to dramatically simplify the process of creating software applications by cutting down on the amount of code required.

Founded by a group of MIT engineers and researchers, Builder.ai quickly captured the attention of investors worldwide, as the company secured significant funding from high-profile companies including Microsoft, the Qatar Investment Authority, the International Finance Corporation (IFC), and SoftBank's DeepCore.

The company highlighted its proprietary artificial intelligence assistant, Natasha, as the technological breakthrough that could be used to build custom software without human intervention. This innovative approach was a central part of the company's value proposition. With the help of a compelling narrative, the startup secured more than $450 million in funding and achieved unicorn status with a peak valuation of $1.5 billion.

It was widely recognised in the early stages of the evolution of Builder.ai that it was a pioneering force that revolutionised software development, reducing the reliance on traditional engineering teams and democratizing software development. However, underneath the surface of the company's slick marketing campaigns and investor confidence lay a very different operational model—one which relied heavily on human engineers, rather than advanced artificial intelligence.

Building.ai's public image unravelled dramatically when its promotional promises diverged from its internal practices. It was inevitable that the dramatic collapse of Builder.ai, once regarded as a rising star in the global tech industry, would eventually lead to mounting scrutiny and a dramatic unravelling of its public image. This has revealed troubling undercurrents in the AI startup sector.

In its beginnings, Builder.ai was marketed as a groundbreaking platform for creating custom applications, but it also promised automation, scale, and cost savings, and was positioned as a revolutionary platform for developing custom applications. Natasha was the company's flagship artificial intelligence assistant, which was widely advertised as enabling it to develop software with no code. Yet internal testimonies, lawsuits, and investigation findings have painted a much more troubling picture since then.

According to its claims of integrating sophisticated artificial intelligence, Natasha was only used as a simple interface for collecting client requirements, whereas the actual development work was done by large engineering teams in India, despite Natasha's claims of sophisticated artificial intelligence integration. According to whistleblowers, including former executives, Builder.ai did not have any genuine AI infrastructure in place.

As it turns out, internal documentation indicates that applications are being marketed as “80% built by AI” when in fact their underlying tools are rudimentary at best, when they are actually built with artificial intelligence. Former CEO Robert Holdheim filed a $5 million lawsuit alleging wrongful termination after raising concerns about deceptive practices and investor misrepresentation in the company. Due to his case catalysing broader scrutiny, allegations of financial misconduct, as well as technological misrepresentations, were made, resulting in allegations of both.

After Sachin Dev Duggal had taken over as CEO in mid-2025, Manpreet Ratia took over as CEO, starting things off in a positive manner by stabilising operations. An independent financial audit was ordered under Ratia's leadership that revealed massive discrepancies between the reported revenue and the actual revenue.

Builder.ai claimed that it had generated more than $220 million in revenues for 2024, while the true figure was closer to $50 million. As a result, Viola Credit, a company's loan partner, quickly seized $37 million in the company's accounts and raised alarm among creditors and investors alike. A final-ditch measure was to release a press release acknowledging Builder.ai had been unable to sustain payroll or its global operations, with only $5 million remaining in restricted funds.

In the statement, it acknowledged that it had not been able to recover from its past decisions and historic challenges. Several bankruptcy filings were initiated across multiple jurisdictions within a short period of time, including India, the United Kingdom, and the United States. The result was the layoff of over 1,000 employees and the suspension of a variety of client projects.

The controversy exploded as new allegations were made about revenue roundtrips with Indian technology company VerSe, which was believed to be a strategy aimed at inflating financial performance and attracting new investors. Further, reports revealed that Builder.ai has defaulted on substantial payments to Amazon and Microsoft, owing approximately $85 million to Amazon and $30 million to Microsoft for unpaid cloud services.

As a result of these developments, a federal investigation has been launched, with authorities requesting access to the company's finances and client contracts as well. As a result of the Builder.ai scandal, a broader issue is at play in the tech sector — "AI washing", where startups exaggerate or misstate their artificial intelligence capabilities to get funding and market traction.

In an interview with Info-Tech Research Group, Principal Analyst Phil Brunkard summarised this crisis succinctly: "Many of these so-called AI companies scaled based on narrative rather than infrastructure." There is a growing concern among entrepreneurs, investors, and the entire technology industry that Builder.ai could be serving as a cautionary tale for investors, entrepreneurs, and the entire technology industry as regulatory bodies tighten scrutiny of AI marketing claims.

There have been concerns regarding the legitimacy of Builder.ai's artificial intelligence capabilities ever since a report published by The Wall Street Journal in 2019 raised questions about how heavily the company relies on human labour over artificial intelligence. It has been reported that, despite the company's marketing narrative emphasising automation and machine learning, the company's internal operations paint a different picture.

The article quotes former employees of Builder.ai saying that Builder.ai was a platform that was primarily engineering, and not AI-driven. This statement starkly contradicted the company's claim to be an AI-first, no-coding platform. Even though many investors and stakeholders ignored these early warnings, they hinted that there might be deeper structural inconsistencies with the startup's operations than what the initial warnings indicated.

When Manpreet Ratia took on the role of CEO of the company in February 2025, succeeding founder Sachin Dev Duggal, the extent to which the company's internal dysfunction was revealed. It became apparent to Ratia quickly that the company had been misreported and that data had been manipulated for years in order to increase its valuation and public image, despite the fact that it had been tasked with restoring investor confidence and operational transparency.

Following the revelations in this case, U.S. federal prosecutors immediately began an investigation into the company's business practices in response to the disclosures. Earlier this week, the authorities formally requested access to Builder.AI's financial records, internal communications, and its customer data. The request is part of a broader investigation looking into the possibility of fraud, deception of investors, and violations related to false descriptions of AI capabilities.

It should be noted that the failure of Builder.AI serves as an obvious sign that the investment and innovation ecosystems surrounding artificial intelligence need to be recalibrated urgently and sharply. Capital is continuing to flow into AI-powered ventures at a rapid pace, and stakeholders need to raise their standards in regards to due diligence, technical validation and governance oversight as a result.

It is important to temper investor enthusiasm for innovative startups by rigorously evaluating the company's technical capabilities beyond polished pitch decks and strategic storytelling. The case reinforces the importance of transparency and sustainability over short-term hype for founders, as well as the need for regulators to develop frameworks aimed at holding companies accountable if they make misleading claims in their product representations and financial disclosures.

Regulators are becoming increasingly aware of what is being called "AI washing" and are developing strategies to address it. Credibility in a sector built upon trust has become an essential cornerstone of long-term viability, and the collapse of Builder.ai illustrates that this is no longer just a case of a singular failure; rather, it has become a call to action in the tech industry to place substance above spectacle in the age of artificial intelligence.

Vanta Customer Data Exposed Due to Code Bug at Compliance Firm



 

Vanta

Bug Cyber Crime CyberCrime Cyberhackers Cybersecurity CyberThreat Cyde Bug data threat Datasecurity Vanta

Vanta Customer Data Exposed Due to Code Bug at Compliance Firm

It was discovered today that Vanta, one of the leading providers of compliance automation solutions, experienced a critical product malfunction that resulted in the accidental exposure of confidential customer data. The issue stemmed from a software bug introduced during a recent modification to the company's product code, which inadvertently enabled certain clients to access private information belonging to other customers on the platform.

There has been widespread concern regarding the robustness of the firm's internal safeguards in light of this incident, which reportedly affected hundreds of Vanta's enterprise users. Given its role in assisting businesses with managing and maintaining their own cybersecurity and compliance postures, this incident has raised questions over the firm's internal controls. In response, Vanta's internal teams began investigating the issue on May 26 and implemented containment measures immediately.

The company has confirmed that remediation efforts were fully completed by June 3. Despite this, the incident continues to prompt scrutiny from observers and affected customers regarding the failure of a platform designed to protect sensitive corporate data. The event has also raised concerns about the quality of Vanta's code review protocols, real-time monitoring systems, and overall risk management practices-especially with regard to the scalability of automation technologies in trusted environments.

According to a statement released by Vanta, there was no external attack or intrusion involved, and the incident did not constitute a breach. Rather, the data exposure resulted entirely from an internal product code error that inadvertently compromised data privacy. The company confirmed that the bug led to the unintended sharing of customer data across accounts, particularly within certain third-party integrations. Approximately 20% of the affected integrations were used to streamline compliance with security standards followed by clients.

Vanta, which automates security and compliance workflows for over 10,000 businesses globally, detected the anomaly through its internal monitoring systems on May 26. It launched an immediate investigation and moved quickly toward resolution. The full remediation process was completed by June 3. Jeremy Epling, Vanta's Chief Product Officer, stated that less than 4% of Vanta's customers were affected by the exposure.

All affected clients have been notified and informed of the details of the incident, along with the steps being taken to prevent similar occurrences in the future. Although the exact number of affected organizations has not been disclosed, the scope of the customer base suggests several hundred may have been impacted.

Even though this mid-level data exposure was not widespread, it is a notable incident considering Vanta's role in managing sensitive compliance-related data. It highlights the importance of rigorous safeguards when deploying code changes to live production environments.

To inform impacted clients that employee account data was inadvertently shared across customer environments, Vanta has begun direct outreach. The company explained that certain user data was mistakenly imported into unrelated Vanta instances, leading to accidental data exposure across some organizations.

This internally caused cross-contamination of data raises serious concerns about the reliability of centralized compliance platforms, even in the absence of malicious activity. It underscores that automation platforms, while helpful, can still introduce risk through unexpected internal changes.

For a company positioned as a leader in providing security and compliance services, this incident extends beyond a technical fault-it calls into question the foundation of trust on which such services are built. It also serves as a reminder that automated systems, while efficient, are not immune to the cascading consequences of a single faulty update.

This event highlights the need for organizations to evaluate their reliance on automated compliance systems and to adopt a proactive, layered approach to vendor risk management. While automation enhances efficiency and regulatory alignment, it must be supported by engineering diligence, transparent reporting, and continuous oversight of internal controls.

Businesses should demand greater accountability from service providers-requiring fail-safe mechanisms, rollback strategies, code audit procedures, and more. This incident serves as a key reminder for companies to maintain independent visibility into data flow, integration points, and vendor performance by conducting regular audits and contingency planning.

As the compliance landscape continues to evolve rapidly, trust must be earned not only through innovation and growth but also through demonstrated commitment to customer security, ethical responsibility, and long-term resilience.

Vanta has committed to publishing a full root cause analysis (RCA) by June 16.

ESXi Environment Infiltrated Through Malicious KeePass Installer



 

VMware

Bing Cobalt Strike Beacon CyberCrime Cyberhackers Cybersecurity CyberThreat Fraudlent KeePass malware malware installation VMware

ESXi Environment Infiltrated Through Malicious KeePass Installer

Research by cybersecurity researchers has revealed that threat actors have been using tampered versions of KeePass password manager software to break into enterprise networks for several months. Researchers have discovered that this campaign has been sophisticated and ongoing for several months. For more than eight months, attackers have been using trojanized applications to stealthily infiltrate organisations and present themselves as legitimate KeePass installers while encoding malicious code into them.

A deceptive installer serves as an entry point by which adversaries may gain access to internal systems, deploy Cobalt Strike beacons and harvest credentials, setting up large-scale ransomware attacks by using these deceptive installers as entry points. In this campaign, attackers have shown a particular interest in environments running VMware ESXi-one of the most widely used enterprise virtualisation platforms-indicating their strategic intention of targeting critical infrastructure environments.

After the attackers are able to gain access, they escalate their privileges, move across networks, and plant ransomware payloads to disrupt operations as well as compromise data to the maximum extent possible. In addition to ensuring persistent access, malware is also able to exfiltrate sensitive information, which severely undermines the security postures of organisations targeted for attacks.

KeePass was a rogue installer that was disguised in the appearance of a trustworthy software application, however, it underscored the increasing sophistication of cyber threats in the 21st century and the urgency of maintaining heightened security across enterprise systems. A comprehensive investigation by WithSecure's Threat Intelligence team, which had been engaged to analyse a ransomware attack that affected a corporate environment, led to the discovery of the campaign.

Upon closer examination, the team traced the intrusion back to a malicious version of KeePass that had been deceptively distributed via sponsored advertisements on Bing. These ads led unsuspecting users to fraudulent websites designed to mirror legitimate software download pages, thereby tricking them into downloading the compromised installer.

As the team investigated further, they found that the intrusion was linked to a malicious version of KeePass that had been misrepresenting itself as available through sponsored advertisements on Bing, leading unsuspecting users to fraudulent websites that mirrored legitimate software download pages, which tricked them into downloading the compromised installer by deceptively distributing it. Researchers have since discovered that the threat actors exploited KeePass's open-source nature by altering its original source code to craft a fully functional yet malicious version of the program, known as KeeLoader.

In spite of the fact that this trojanized version maintains all of the standard features of a real password manager, it is capable of operating without immediately raising suspicions about its legitimacy. There are, however, covert enhancements embedded within the application designed to serve the attackers' objectives, namely the deployment of a Cobalt Strike beacon that will serve as a means for delivering the attacker's objectives.

The tool enables remote control and data exfiltration, which can be done, for example, by exchanging the user's entire KeePass password database in cleartext with the use of remote command-and-control capabilities. As a result of the beacon, the attackers were able to extract this information, which provided a basis for the further infiltration of the network as well as, in the end, ransomware deployment. This tactic exemplifies the growing trend of leveraging trusted open-source software to deliver advanced persistent threats. According to industry experts, this incident emphasises the importance of many critical, multifaceted cybersecurity challenges.

It has been pointed out by Boris Cipot, Senior Security Engineer at Black Duck, that the campaign raises concerns on a number of fronts, ranging from the inherent risks that arise from open source software development to the growing problem of deceptive online advertising. Using a combination of open-source tools and legitimate ad platforms, Cipot explained that the attackers were able to execute a highly efficient and damaging ransomware campaign that exploited the public's trust in both of these tools. In their breach, the attackers the impact of their attack by targeting VMware ESXi servers, which are at the heart of many enterprise virtual environments.

Having stolen the credentials for KeePass, including administrative access to both hosts and service accounts, threat actors could compromise entire ESXi infrastructures without having to attack each virtual machine individually. As a result of this approach, a high level of technical sophistication and planning was demonstrated in order to cause widespread disruption across potentially hundreds of different systems in a single campaign.

Cipot emphasises one key lesson in his presentation: the organisation and users should not blindly trust any software promoted through online advertisements, nor should they assume that open-source software tools are necessarily safe, as it is advertised. A person who knows the importance of verifying the authenticity and integrity of software before deploying it to any development environment or on a personal computer has said that the importance of this cannot be overstated. Moreover, Rom Carmel, Co-Founder and CEO of Apono, also noted that the attack highlighted the fact that identity compromise is becoming a growing part of ransomware operations.

In addition to the KeePass compromise, there was a large repository of sensitive credentials, including admin credentials and API access keys, that were exposed to attackers. With this data at hand, attackers were able to rapidly advance from network to network, escalating privileges as quickly as possible, turning credential theft into the most powerful enabler of enterprise-wide compromise. According to Carmel, the example provided by this case proves the importance of securing identity and access management as the front-line defence against cyberattacks that exist today.

It was discovered by researchers that, as they investigated malicious websites distributing trojanized versions of KeePass password managers, there was a wider network of deceptive domains advertising other legitimate software products. In addition to the software impersonated, trusted applications such as WinSCP, a secure file transfer tool, and several popular cryptocurrency applications were also posed as legitimate software.

It was noteworthy that these applications were modified less aggressively than KeePass, however, they still posed an important threat. Instead of incorporating complex attack chains, the attackers delivered a well-known malware strain called Nitrogen Loader, which acts as a gateway for further malicious payloads to be distributed on compromised systems by using Nitrogen Loader as a malicious payload. In light of the recent discovery, it appears that the trojanized KeePass variant was likely to have been created and distributed by initial access brokers, a group of cybercriminals who specialise in penetrating corporate networks.

They are known to steal login credentials, harvest data, and identify exploitable entry points in enterprise networks, which are all ways of stealing sensitive information. It is then that they use the intrusion to monetise their intrusion by selling this access to other threat groups, primarily ransomware operators, on underground forums. One particular reason that this threat model is so dangerous is that it is indiscriminate in nature.

Malware distributors target a wide variety of victims, from individuals to large corporations, without applying any specific selection criteria in the way they select their victims. There is a meticulous sorting and selling process for all of the stolen data, which is varied from passwords and financial records, to personal information and social media credentials. Ransomware gangs, on the other hand, are typically interested in corporate network credentials, while scammers are interested in financial data and banking information.

Spammers may also attempt to exploit email, social networking, or gaming accounts by acquiring login credentials. A stealer malware distributor who employs an opportunistic business model is more likely to cast a wide net and embed their payload in virtually any type of software, so that they can distribute the malware to a wider audience. In addition to consumer-oriented applications, like games and file managers, it also offers professional tools for architects, accountants and information technology administrators.

The importance of implementing strict software verification practices, both for organisations and individuals, cannot be overstated. Every download tool, no matter how trustworthy it may seem, must be obtained from a trustworthy and verifiable source, regardless of the appearance of a given tool. As a result of the campaign with the help of WithSecure, the victim organisation's VMware ESXi servers – a critical component of the organisation's virtual infrastructure – were encrypted.

There was a significant impact of this malware distribution operation far beyond a single compromised installer, as reflected by the severity of the consequences resulting from this sophisticated and well-orchestrated operation. According to further analysis, a sprawling malicious infrastructure masquerading as a trusted financial service and software platform was revealed. It seems that the attackers used the domain aenys[.]com, which hosted a number of subdomains impersonating reputable organisations such as WinSCP, Phantom Wallet, PumpFun, Sallie Mae, Woodforest Bank, and DEX Screener.

Every subdomain was designed to deliver malware payloads or act as phishing portals designed to harvest sensitive user credentials from the targeted users. A careful, multi-pronged approach to compromise a wide range of targets is demonstrated by this level of detail and breadth. As a result of the analysis conducted by WithSecure, UNC4696, a threat group associated with operations previously involving Nitrogen Loader malware, has been identified as responsible for this activity.

Research suggests that campaigns involving Nitrogen Loader may have been linked to the deployment of BlackCat/AlphaPhy ransomware, a highly destructive and well-known threat actor known for attacking enterprise networks. The importance of cautious and deliberate software acquisition practices has been emphasised for many years by security experts, especially for security-critical applications such as password managers that require careful attention to detail.

Downloading software from official, verified sources is strongly recommended, and links provided through online advertisements should not be relied upon. It is important to note that a website may appear to be referencing the right URL or brand of a legitimate provider, but it might still be redirecting users to fake websites that are created by malicious actors. Having been shown repeatedly that advertising platforms are being exploited to circumvent content policies, it is vital that vigilance and source verification be maintained in order to avoid compromise.

In the cybersecurity landscape, there is still a persistent and evolving threat to be addressed because legitimate credentials are increasingly used in cyberattacks. It is widely known that Infostealers, which are specifically designed to harvest sensitive data and login information, serve as a gateway for more widespread breaches, including ransomware attacks.

Organisations must adopt a comprehensive security strategy that goes beyond the basics to reduce this risk. When it comes to preventing trojanized software, such as the malicious KeePass variant, strict controls must be enforced on the execution of applications that aren't trusted. Users can achieve this by implementing application allow lists to restrict software installations and make sure that trusted vendors or applications signed with verified digital certificates are allowed to install the software.

In the case of the KeePass attack, such a certificate-based policy could have effectively prevented the tampered version from getting into the system, since it had been signed with an unauthorised certificate. It is equally crucial to implement centralised monitoring and incident response mechanisms on all endpoints, whether they are desktops or servers, to detect and respond to incidents. Every endpoint in an organisation should be equipped with Endpoint Detection and Response (EDR) sensors.

By combining these tools with Security Information and Event Management (SIEM) or Extended Detection and Response (XDR) platforms, security teams can get a real-time view of network activity and detect, analyse, and respond to threats before they get too far. Furthermore, an organisation must cultivate a well-informed and security-conscious workforce.

Beyond learning about phishing scams, employees should be trained on how to recognise fake software, misleading advertisements, and other forms of social engineering that cybercriminals commonly employ. With Kaspersky's Automated Security Awareness Platform, organisations can support ongoing education efforts, helping them foster a culture of security that is proactive and resilient. With the proliferation of cyber attacks and the continual refining of attackers' methods, a proactive, layered defence approach, rooted in intelligent technology, policy, and education, is essential for enterprises to protect their systems against increasingly deceptive and damaging threats.

Child Abuse Detection Efforts Face Setbacks Due to End-to-End Encryption



 

Technology

AI Artificial Intelligence child abuse Cyberhackers CyberThreat End-to-End Encryption Online Safety Technology

Child Abuse Detection Efforts Face Setbacks Due to End-to-End Encryption

Technology has advanced dramatically in the last few decades, and data has been exchanged across devices, networks, and borders at a rapid pace. It is imperative to safeguard sensitive information today, as it has never been more important-or more complicated—than it is today. End-to-end encryption is among the most robust tools available for the purpose of safeguarding digital communication, and it ensures that data remains safe from its origin to its destination, regardless of where it was created.

The benefits of encryption are undeniable when it comes to maintaining privacy and preventing unauthorised access, however, the process of effectively implementing such encryption presents both a practical and ethical challenge for both public organisations as well as private organisations. Several law enforcement agencies and public safety agencies are also experiencing a shift in their capabilities due to the emergence of artificial intelligence (AI).

Artificial intelligence has access to technologies that support the solving of cases and improving operational efficiency to a much greater degree. AI has several benefits, including facial recognition, head detection, and intelligent evidence management systems. However, the increasing use of artificial intelligence also raises serious concerns about personal privacy, regulatory compliance, and possible data misuse.

A critical aspect of government and organisation adoption of these powerful technologies is striking a balance between harnessing the strengths of artificial intelligence and encryption while maintaining the commitment to public trust, privacy laws, and ethical standards. As a key pillar of modern data protection, end-to-end encryption (E2EE) has become a vital tool for safeguarding digital information. It ensures that only the intended sender and recipient can access the information being exchanged, providing a robust method of protecting digital communication.

It is highly effective for preventing unauthorised access to data by encrypting it at origin and decrypting it only at the destination, even by service providers or intermediaries who manage the data transfer infrastructure. By implementing this secure framework, information is protected from interception, manipulation, or surveillance during its transit, eliminating any potential for interception or manipulation.

A company that handles sensitive or confidential data, especially in the health, financial, or legal sectors, isn't just practising best practices when it comes to encrypting data in a secure manner. It is a strategic imperative that the company adopt this end-to-end encryption technology as soon as possible. By strengthening overall cybersecurity posture, cultivating client trust and ensuring regulatory compliance, these measures strengthen overall cybersecurity posture.

As the implementation of E2EE technologies has become increasingly important to complying with stringent data privacy laws like the Health Insurance Portability and Accountability Act (HIPAA) in the United States, and the General Data Protection Regulation (GDPR) in Europe, as well as other jurisdictional frameworks, it is increasingly important that the implementation of E2EE technologies is implemented.

Since cyber threats are on the rise and are both frequent and sophisticated, the implementation of end-to-end encryption is an effective way to safeguard against information exposure in this digital age. With it, businesses can confidently manage digital communication, giving stakeholders peace of mind that their personal and professional data is protected throughout the entire process. While end-to-end encryption is widely regarded as a vital tool for safeguarding digital privacy, its increasing adoption by law enforcement agencies as well as child protection agencies is posing significant challenges to these agencies.

There have been over 1 million attempts made by New Zealanders to access illegal online material over the past year alone, which range from child sexual abuse to extreme forms of explicit content like bestiality and necrophilia. During these efforts, 13 individuals were arrested for possessing, disseminating, or generating such content, according to the Department of Internal Affairs (DIA). The DIA has expressed concerns about the increasing difficulty in detecting and reacting to criminal activity that is being caused by encryption technologies.

As the name implies, end-to-end encryption restricts the level of access to message content to just the sender and recipient, thus preventing third parties from monitoring harmful exchanges, including regulatory authorities. Several of these concerns were also expressed by Eleanor Parkes, National Director of End Child Prostitution and Trafficking (ECPAT), who warned that the widespread use of encryption could make it possible for illegal material to circulate undetected.

Since digital platforms are increasingly focusing on privacy-enhanced technologies, striking a balance between individual rights and collective safety has become an issue not only for technical purposes but also for societal reasons It has never been more clearly recognised how important it is to ensure users' privacy on the Internet, and standard encryption remains a cornerstone for the protection of their personal information across a wide array of digital services.

In the banking industry, the healthcare industry, as well as private communications, encryption ensures the integrity and security of information that is being transmitted across networks. This form of technology is called end-to-end encryption (E2EE), which is a more advanced and more restrictive implementation of this technology. It enhances privacy while significantly restricting oversight at the same time. In contrast to traditional methods of encrypting information, E2EE allows only the sender and recipient of the message to access its content.

As the service provider operating the platform has no power to view or intercept communications, it appears that this is the perfect solution in theory. However, the absence of oversight mechanisms poses serious risks in practice, especially when it comes to the protection of children. Platforms may inadvertently be used as a safe haven for the sharing of illegal material, including images of child sexual abuse, if they do not provide built-in safeguards or the ability to monitor content. Despite this, there remains the troubling paradox: the same technology that is designed to protect users' privacy can also shield criminals from detection, thus creating a troubling paradox.

As digital platforms continue to place a high value on user privacy, it becomes increasingly important to explore balanced approaches that do not compromise the safety and well-being of vulnerable populations, especially children, that are also being safe. A robust Digital Child Exploitation Filtering System has been implemented by New Zealand's Department of Internal Affairs (DIA) to combat the spread of illegal child sexual abuse material online. This system has been designed to block access to websites that host content that contains child sexual abuse, even when they use end-to-end encryption as part of their encryption method.

Even though encrypted platforms do present inherent challenges, the system has proven to be an invaluable weapon in the fight against the exploitation of children online. In the last year alone, it enabled the execution of 60 search warrants and the seizure of 235 digital devices, which demonstrates how serious the issue is and how large it is. The DIA reports that investigators are increasingly encountering offenders with vast quantities of illegal material on their hands, which not only increases in quantity but also in intensity as they describe the harm they cause to society.

According to Eleanor Parkes, National Director of End Child Prostitution and Trafficking (ECPAT), the widespread adoption of encryption is indicative of the public's growing concern over digital security. Her statement, however, was based on a recent study which revealed an alarming reality that revealed a far more distressing reality than most people know. Parkes said that young people, who are often engaged in completely normal online interactions, are particularly vulnerable to exploitation in this changing digital environment since child abuse material is alarmingly prevalent far beyond what people might believe.

A prominent representative of the New Zealand government made a point of highlighting the fact that this is not an isolated or distant issue, but a deeply rooted problem that requires urgent attention and collective responsibility within the country as well as internationally. As technology continues to evolve at an exponential rate, it becomes increasingly important to be sure that, particularly in sensitive areas like child protection, both legally sound and responsible. As with all technological innovations, these tools must be implemented within a clearly defined legislative framework which prioritises privacy while enabling effective intervention within the context of an existing legislative framework.

To detect child sexual abuse material, safeguarding technologies should be used exclusively for that purpose, with the intent of identifying and eliminating content that is clearly harmful and unacceptable. Law enforcement agencies that rely on artificial intelligence-driven systems, such as biometric analysis and head recognition systems, need to follow strict legal frameworks to ensure compliance with complex legal frameworks. As the General Data Protection Regulation (GDPR) is established in the European Union, and the California Consumer Privacy Act (CCPA) is established in the United States, there is a clear understanding of how to handle, consent to, and disclose data.

The use of biometric data is also tightly regulated, as legislation such as Illinois' Biometric Information Privacy Act (BIPA) imposes very strict limitations on how this data can be used. Increasingly, AI governance policies are being developed at both the national and regional levels, reinforcing the importance of ethical, transparent, and accountable technology use. Noncompliance not only results in legal repercussions, but it also threatens to undermine public trust, which is essential for successfully integrating AI into public safety initiatives.

The future will require striking a delicate balance between innovation and regulation, ensuring that technology empowers protective efforts while protecting fundamental rights in the meantime. For all parties involved—policymakers, technology developers, law enforcement, as well as advocacy organisations—to address the complex interplay between safeguarding privacy and ensuring child protection, they must come together and develop innovative, forward-looking approaches. The importance of moving beyond the viewpoint of privacy and safety as opposing priorities must be underscored to foster innovations that learn from the past and build strong ethical protections into the core of their designs.

The steps that must be taken to ensure privacy-conscious technology is developed that can detect harmful content without compromising user confidentiality, that secure and transparent reporting channels are established within encrypted platforms, and that international cooperation is enhanced to combat exploitation effectively and respect data sovereignty at the same time. Further, industry transparency must be promoted through independent oversight and accountability mechanisms to maintain public trust and validate the integrity of these protective measures.

Regulatory frameworks and technological solutions should be adapted rapidly to safeguard vulnerable populations without sacrificing fundamental rights to keep pace with the rapid evolution of the digital landscape. As the world becomes increasingly interconnected, technology will only be able to fulfil its promise as a force for good if it is properly balanced, ethically robust, and proactive in its approach in terms of the protection of children and ensuring privacy rights for everyone.

Cybersecurity Agencies on High Alert as Attacks Spike After Pahalgam Incident



 

Pakistan Hacker

Cyber Attacks Cyber Crew Cyber Hacking Cyberhackers CyberThreat Dark Web Digitl war Hacktivist group India National Cyber Security Pahalgam Attack Pakistan Hacker

Cybersecurity Agencies on High Alert as Attacks Spike After Pahalgam Incident

A rising tension between India and Pakistan has resulted in an intensified digital war, whose hacktivist groups have launched coordinated cyber offensives targeting government systems and critical infrastructure as a result of increasing tensions between the two countries. The attacks, which are fueled by geopolitical conflict, have expanded beyond the immediate region.

A report suggests that hacktivist collectives from Asia, the Middle East, and North Africa (MENA) have united to disrupt the Indian cyber ecosystem, according to the report. There was a tragic incident on April 22, when armed terrorists shot a group of tourists in Pahalgam, the serene hill town in Kashmir administered by the Indian government, which was the trigger for this wave of activity.

According to researchers from NSFOCUS, there had been an immediate and significant surge in cyber activity, which shook the nation. In the aftermath of the attack, cyber activity on both sides of the border intensified. It appears that the initial wave of cyberattacks has stabilised, however, cybersecurity threats persist. India witnessed an increase of 500% in targeted cyber intrusions, and Pakistan faced a rise of 700%. It was reported recently that several Pakistani hacker groups have attempted to breach Indian websites as part of an ongoing digital aggression campaign.

The Indian cybersecurity agencies have responded robustly to these attempts, which have successfully detected and neutralised most of these threats, despite their efforts to undermine this. According to the reports, hacker collectives such as 'Cyber Group HOAX1337' and 'National Cyber Crew' have targeted websites belonging to the Army Public Schools in Jammu in the past.

In their attempt to deface the websites, the attackers mocked the victims of the Pahalgam terror attack, which was widely condemned as both distasteful and inflammatory. As a result of the rise in cyber hostilities, we have seen the importance of digital warfare in modern geopolitical conflicts grow. This highlights the need for enhanced cyber vigilance and cross-border security collaboration that must be enhanced.

The cyber threat landscape has intensified further since India launched Operation Sindoor in retaliation for a military operation targeting suspected terror camps across the border. It has been estimated that the launch of Operation Sindoor on May 7 has resulted in a sharp increase in malicious cyber activity as a result of these attacks, as reported by cybersecurity researchers at Radware and Cyble.

As a result of the coordinated attacks conducted by hacktivist groups from across the eastern hemisphere, a substantial surge in cyber attacks was recorded on that day alone, with dozens of hacktivist groups actively participating. The Indian government, already dealing with the aftermath of the Pahalgam terror attack, which took place on April 22, has become the primary target of these attacks. Several threats have been launched against Indian institutions by groups aligned with pro-Pakistan and Bangladeshi interests, as well as with groups aligned with pro-Bangladeshi interests.

Technisanct, a cybersecurity firm based in Kochi, released a report recently in which they noted that there has been a steady increase in offensive operations against government infrastructure, educational platforms, and public services. In various online forums and dark web communities, this wave of cyber aggression has been informally referred to as #OpIndia.

In many ways, the campaign resembles past hacktivist movements which targeted nations like Israel and the United States, usually motivated by ideological motives, but not necessarily sophisticated enough to threaten the nation's security. The current attacks, experts caution, however, demonstrate a coordinated approach to threats, where threat actors are using both denial-of-service DosS) and defacement attacks to spread propaganda and disrupt networks.

A sustained cyber battle has been waged between India and Pakistan, marked by both nationalist fervour and geopolitical tension as part of the India-Pakistan conflict, which has clearly evolved into a digital dimension of the conflict. Indian cybersecurity agencies must remain vigilant as they attempt to counter these persistent threats through proactive monitoring and rapid incident response, along with strengthened defensive protocols.

It was decided by Prime Minister Narendra Modi to convene a cabinet committee on security (CCS) on April 30, 2025, to assess the evolving security situation in Jammu and Kashmir amid rising tensions in the region. During the high-level meeting, which took place at the Prime Minister's official residence on Lok Kalyan Marg, members of the national security apparatus, including Rajnath Singh, Amit Shah, and S. Jaishankar, were present, as well as key national security officials.

In the discussion, Jaishankar discussed the recent wave of violence in the Kashmir Valley, concerns about cross-border security, and the threat of cyberattacks from hostile actors, as well as the threat of cyberterrorism. The Pakistani government has issued a provocative statement warning of a possible Indian military attack within a 24 to 36-hour window, which is similar to the one issued by Pakistan in a provocative statement.

According to what Islamabad called credible intelligence, New Delhi is preparing to launch retaliatory strikes. The allegations of Pakistan's involvement in the Pahalgam terror attack of April 22 are supposedly based on unsubstantiated accusations. There has been public criticism of India's fabrication of an offensive narrative by Pakistan's Federal Minister for Information, Attaullah Tarar, cautioning that any such move would result in serious consequences if followed.

It has been revealed that diplomatic and military signals have increased the level of tension in the existing volatile situation, with both sides locked in a tense standoff that spans both physical and virtual borders. There has been news that threat actors have attempted to deface the official website of Armoured Vehicle Nigam Ltd, which is another indication of the intensification of cyberhostility. It is a public sector company operated by the Ministry of Defence.

It was reported that the attackers defaced the website by showing images associated with Pakistan, including the national flag and images of the 'Al Khalid' battle tank, an act that was seen as both provocative and symbolic by officials. This development has spurred the Indian cybersecurity agencies and expert teams to increase their real-time monitoring of the digital landscape, as a result of which they are concentrating their efforts on identifying threats that have been linked to Pakistani state-sponsored or affiliated groups.

The authorities have confirmed that this increased surveillance is part of a greater effort to avert further attacks as well as neutralise any new threats that may arise. To counter the increasing wave of cyberattacks, a series of robust countermeasures is being put in place to strengthen the nation's digital security posture in response. For example, fortifying critical infrastructure, strengthening incident response protocols, and increasing online platform resilience across key industries are all examples of strengthening the nation's digital security posture.

There was no doubt that the authorities were concerned that these proactive actions were aimed at ensuring India's defence and civilian systems were protected as well as that India's digital frontline was prepared to repel and withstand future cyberattacks as well. It has become increasingly apparent that cyberwarfare has become a central theatre of geopolitical rivalry in the modern world as the contours of contemporary conflict continue to evolve.

Digital infrastructure, in the same way that physical borders play a crucial role in national security, has recently been heightened by several recent developments, and this serves as a reminder to all of us. Because of this, India needs to enhance its investments in advanced cybersecurity capabilities, establish strong public-private partnerships, and establish a comprehensive national cyber defence strategy that is both responsive and flexible.

To isolate and neutralise transnational cyber threat actors, it is not only necessary to implement technical fortification but also to conduct strategic diplomacy, share intelligence, and engage in international cooperation. It will be crucial to cultivate a culture of resilience, both at the institutional and individual levels, by cultivating cyber awareness.

With the increasingly contested digital frontier, India must remain proactive, unified, and forward-thinking at all times if it is to ensure that it is secured, sovereign, and fully “digitally self-reliant” as the threat of hybrid threats rises.

Cobb County Suffers Alleged Data Breach by Russian Hackers



 

Russian Hackers

Cobb County Cyberattacks CyberCrime Cyberhackers Cybersecurity CyberThreat Data Breach Ransomware Russian Hackers

Cobb County Suffers Alleged Data Breach by Russian Hackers

The recent cyber attacks against local governments have been concerning, with Cobb County in Georgia being targeted in March 2025 by a sophisticated ransomware attack. In an attempt to gain an edge over their competitors, the cybercriminals known as Qilin have claimed responsibility for a breach that resulted in the theft of approximately 150 gigabytes of sensitive data, totalling more than 400,000 files, and the unauthorised access to them.

An autopsy photograph, Social Security number, driver's license photo, and confidential internal government documents are among the materials that have been compromised. Public sector cybersecurity has been under increased scrutiny since this incident occurred, as officials attempt to assess the extent of the damage and prevent further exposures.

Cobb County School District has been informed that there has been an intrusion into the network and is currently collaborating with multiple cybersecurity partners to investigate the incident. This intrusion is considered a serious incident and is currently under active investigation. It has been reported that both the Georgia Emergency Management Agency and the Department of Homeland Security have been notified about the breach.

Throughout the investigation, the school system has advised all employees not to use desktop computers, and certain network processes are expected to be temporarily disrupted for the next few days as a precautionary measure, however, school operations are still expected to proceed as scheduled, despite these technical challenges.

It is anticipated that Advanced Placement (AP) testing will begin on Monday, May 5, and that the state Milestones Testing will be administered as scheduled on Tuesday. As of right now, there has been no indication that any personal informatio,- including information concerning students and employees, has been compromised, since the school remains operational and has not been affected by the breach. In addition, there is no indication that any personal information has been compromised.

The school system, however, is currently conducting a comprehensive investigation to assess the full scope and impact of the unauthorised access. At approximately 7:00 p.m. on Friday, the school system first discovered abnormal network activity. In line with established cybersecurity protocols, the IT department and its external security partners responded rapidly to the intrusion by shutting down affected systems, containing it, and identifying its source as soon as possible.

While the district's internal network remains restricted in the interim for forensic review to continue, and to ensure the security of critical systems is maintained, access is restricted to the district's internal network. As a result of the investigation, the school district has assured parents, staff, and community members that the district maintains close communication with federal, state, and local authorities. As more details come in, the district will provide regular updates to parents, staff, and the community.

A ransomware attack on Cobb County is still being investigated, with officials still trying to figure out the extent of the breach and identify individuals who might have been affected by the attack. Even though it is still unclear what type of data has been compromised, preliminary reports indicate that three county employees have been confirmed to have been compromised.

To combat this situation, the county has agreed to offer impacted residents access to credit monitoring services as well as identity theft protection services as a precautionary measure. Several online systems, including court records, jail databases, and Wi-Fi services, were closed down as a result of the cyberattack that was first discovered on March 21, prompting county officials to act immediately. It appears that these systems have gradually been restored over the last few days, and that full functionality is reported to have been restored as of March 27.

County officials have been cautious in disclosing specific details regarding the nature of the compromise throughout this period. They had until recently not confirmed whether ransom demands had been involved in the incident. It has been announced that Cobb County Communications Director Ross Cavitt addressed concerns about the server outages during a press conference held during the outages by stating that once all servers have been securely reconnected, residents will not experience any disruptions in accessing data or services.

As for whether the incident has been labelled as a ransomware attack, he refused to provide any further information on it. The Marietta Daily Journal has not been able to conduct an interview with county officials, which includes chairwoman Lisa Cupid and other members of staff, citing the sensitivity of the ongoing investigation as the reason for not doing so. During a recent email message that was released by the Cobb County Communications Department, it was made clear that it would be premature to comment publicly on this matter while the investigation is still underway.

In the meantime, Commissioner Keli Gambrill expressed confidence in the county's response, pointing out that staff members are performing well under challenging circumstances, despite the situation. Cybersecurity expert Allan Hudson confirmed in the aftermath of the ransomware attack that 16 files that were stolen from the data had already been published online by the attackers as a result of the ransomware attack in an apparent attempt to demonstrate how serious the breach was.

There were at least three autopsy photographs that were exposed, along with sensitive personal identification documents such as driver's licenses and social security cards that were also revealed. Several additional records released by the county seem to be about private citizens, incarcerated individuals, as well as government employees, which raises serious security and privacy concerns for many individuals.

Authorities at Cobb County reported to the public in April that ten individuals had been formally informed that their data had been compromised as a result of the breach. Hudson, however, emphasised that the extent of the breach is likely to be much wider than that, warning that anyone who has had an interaction with Cobb County government services in the past several years is at risk of experiencing a breach. He recommended that residents take immediate precautions to reduce their risk of identity theft by freezing their credit, updating their passwords, and enabling two-factor authentication across all of their online accounts. Several county officials reiterated their position against negotiating with cybercriminals in an official statement.

Even though there may be difficult choices to make, the county refuses to support or enable criminal enterprises, even if faced with difficult choices. While this may not be comforting to those affected, standing firm sends the clear message that bad actors won't benefit from this crime at any cost." Despite the growing concern that the ransomware group known as Qilin may continue to release sensitive information, this firm position comes at the same time that there are increasing concerns about this group's continued release of sensitive information.

Hudson described the group as highly aggressive and warned that more information could leak soon. Cobb County continues to encourage residents to monitor financial accounts and report any suspicious activity by staying vigilant. The county is assisting those impacted by the cyberattack, including credit monitoring and identity theft protection services, as part of the county's ongoing mitigation efforts. In light of the ongoing investigation into the ransomware attack on Cobb County, the incident has served as a stark reminder of the growing threats that public institutions face as a result of cyberattacks.

Among the many implications of the breach, not only did it expose vulnerabilities in government systems, but it also made it clear that the implications for citizens whose personal data may be compromised could be far-reaching. As a significant amount of sensitive information has already been released, it is evident that there is an urgent need for heightened digital security at every level of local government.

The authorities are working closely with cybersecurity experts and federal agencies to contain the situation and prevent further compromise. Despite the initial steps taken by officials to offer identity protection and credit monitoring services, it will likely be the effectiveness and swiftness with which mitigation efforts are initiated that will determine the long-term impact of this breach. Cobb County residents who have used Cobb County services in the past should be encouraged to take proactive measures to protect their personal information by doing so.

It is important to ensure that users' financial accounts are monitored, that multifactor authentication is enabled, and that their credit profile is frozen where needed. Especially when such cyberattacks are perpetrated by persistent and organised groups such as Qilin, it highlights how important awareness and resilience are at the community level. As a result of this incident, the world, as well as government entities, industrial entities, and individuals, will be called upon to re-evaluate their approach to digital security, especially in a world where we are increasingly interconnected.

Co-op Hack Triggers Widespread Scam Risk for Consumers



 

Ransom

Co-op Cyber Attacks Cyber Triggers CyberCrime Cyberhackers Cyberscams CyberThreat NCSC Ransom

Co-op Hack Triggers Widespread Scam Risk for Consumers

Several cyberattacks on major British retailers including Marks & Spencer, the Co-op Group, and others have been attributed to social engineering, the practice of deceiving internal support teams by impersonating legitimate employees to deceive internal support teams. It has been reported that the attackers contacted the companies' IT help desks and posed convincingly as employees seeking immediate assistance.

Using trust and urgency as a basis, they were able to persuade help desk employees to reset passwords for internal accounts, giving them unauthorised access to sensitive corporate information. Using this technique, attackers could potentially gain access to sensitive data, internal communications, and systems that may be used to further exploit or steal data, as it bypasses traditional technical safeguards.

Once inside the networks, the attackers could potentially gain access to confidential data, internal communications, and systems that could be used for further exploitation. According to the UK's National Cyber Security Centre (NCSC), in light of these developments, all organisations should conduct a thorough review of their authentication procedures for help desks.

As social engineering attacks are becoming increasingly sophisticated and difficult to detect, NCSC stresses the importance of implementing strict identity verification methods and training employees to recognise such techniques to prevent them from occurring in the future. Approximately 2,000 grocery outlets are operated by the Co-operative Group, along with 800 funeral homes and legal and financial services, in addition to offering food and beverage services.

It has been confirmed that precautionary measures have been taken to protect the company's digital infrastructure. These included temporarily suspending certain internal systems that are used by retail operations and the legal department for their operations. A number of the organisation's systems have been affected, including the platform used to monitor stock levels.

A source familiar with the matter has indicated that unresolved disruptions may result in localised supply issues, which could lead to product shortages on store shelves if not handled promptly. It was also announced that some employees' access to certain digital tools was restricted in response to the breach, so that remote work capabilities would be limited starting Wednesday. As a result of these internal disruptions, the Co-op has said that its retail stores, including those which provide rapid delivery services and funeral care branches, will remain open and operational normally despite these disruptions.

According to the National Cyber Security Centre (NCSC), it has acknowledged its involvement in the incident and is actively supporting the Co-operative Group as they investigate it. In addition, it is believed that the company is working closely with Marks & Spencer to assess the scope and nature of an incident that occurred in a separate but similarly timed manner, with efforts underway to determine whether there is any connection between the two breaches.

As a matter of fact, the attack on two major retailers in close succession is unlikely to be a coincidence, according to Marijus Briedis, Chief Technology Officer of Nord Security. It suggests that there has been some coordination between both retailers or perhaps even a shared vulnerability.

According to the Co-operative Group, although its back-office operations and customer service call centres have suffered disruption, the company's network of 2,000 grocery stores and 800 funeral homes across the UK remains fully functional and continues to serve its customers without interruption, despite these disruptions.

When the cybercriminal group Scattered Spider first gained prominence in September 2023, it was after successfully infiltrating Caesars Entertainment and MGM Resorts International, an attack which, reportedly, forced Caesars to pay a ransom of $15 million. Recently, the group has been operating in the UK, and they seem to have changed their approach to attacking IT personnel by using sophisticated social engineering tactics rather than technical exploits.

It has been reported that one of the suspects, Scottish national Tyler Buchanan, has been extradited to the United States from Spain, where he has been charged with attempting to compromise several corporate networks. As a result of Buchanan and his network's involvement in numerous complex and multistage cyber intrusions, U.S. prosecutors are emphasising the growing threat cybercrime poses to society.

Despite Marks & Spencer's continued efforts to restore its digital systems, and as the Co-op assesses the full extent to which customer data might be exposed by the incidents, critical cybersecurity vulnerabilities have been revealed in enterprise cybersecurity protocols. It has become increasingly important for organisations to prioritise layered, adaptive security frameworks that go beyond traditional defences to combat threats from attackers exploiting human behaviour over system weaknesses.

It is ultimately clear that in a digital-first economy, the presence of cyber threats must be built into every aspect of the organisation, and to do so, organisations must embed cybersecurity into every aspect of their business. It remains a fact that human factors are the most exploited vulnerability, and without constant vigilance and robust incident response plans, even industry leaders are vulnerable. As M&S continues to deal with major problems caused by a cyber attack attributed to the hacking collective Scatter Spider, the problems have emerged.

In light of the M&S incident, the Co-op did not comment on whether the extra checks it had conducted resulted in the detection of attempted attacks on its systems. However, it did inform staff of the importance of protecting our systems, mentioning the recent issues surrounding M&S and the cyber-attack they have experienced in the past few weeks. As part of its commitment to reducing costs and preventing shoplifting, the company announced that technology would play an important role in reducing costs and preventing shoplifting.

The Co-op's grocery stores are currently introducing new technologies such as electronic shelf edge pricing to reduce labour hours, as well as expanding fast-track online grocery delivery services. Morrisons has been at the centre of cyberattacks in the last couple of years. In the run-up to Christmas last year, the retailer suffered from an incident at its tech supplier Blue Yonder that caused the retailer to become extremely vulnerable to cyber threats.

As recently as 2023, WH Smith was attacked by cyber criminals who illegally accessed their company information, including the personal details of current and former employees. This occurred less than a year after a cyber-attack on WH Smith's Funky Pigeon site forced the store to stop accepting orders for about a week following a cyber-attack. As a result of the recent cyber attacks on leading UK retailers, such as Marks & Spencer and the Co-operative, there is now an urgent and escalating challenge facing the UK: cybercrime is becoming a more prevalent threat in an increasingly digital retail environment.

In addition to enhancing customer experience, retailers are increasingly embracing advanced technologies to increase efficiency, reduce operational costs, and improve efficiency, but they also increase their exposure to cyber risks, particularly those originating from human manipulation and procedural errors. It is important to note that in a complex ecosystem where automation, remote access systems, and third-party technology partnerships are converging, a single vulnerability can compromise entire networks, resulting in a complex ecosystem.

It is important for cybersecurity tnot to be viewed simply as a technical function but rather as an integral part of every layer of an organisation's operations. Managing these threats requires organisations to use a holistic approach - issuing regular training to staff on social engineering awareness, setting up thorough verification processes, and auditing access control systems regularly - to mitigate such threats.

In order to avoid reactive measures, the implementation of zero-trust frameworks, the cooperation with cybersecurity experts, and continual incident simulation exercises must become standard practice instead of reactive ones. For businesses to keep up with the pace of cybercriminals, as they often operate across borders using coordinated tactics, they must also evolve. In addition, boards and leadership teams are responsible for cybersecurity resilience by ensuring that adequate investments, governance, and crisis management plans have been established.

Additionally, regulatory bodies and industry alliances should make an effort to establish unified standards and collaboratively share threat intelligence, particularly in sectors regarded as high risk. It is not an isolated incident; the recent breaches are a sign of a broader pattern that reveals a systemic vulnerability in the retail supply chain as a whole. The digital age has made it increasingly difficult to ignore cybersecurity when it comes to businesses that depend on trust, reputation, and uninterrupted service crucial element of long-term survival and customer trust.

Data Security Alert as Novel Exfiltration Method Emerges



 

Cyberhackers Cybersecurity CyberThreat Data Breach Data Loss Global Security Telegram WhatsApp

Data Security Alert as Novel Exfiltration Method Emerges

Global cybersecurity experts are raising serious concerns over the newly identified cyber threat known as Data Splicing Attacks, which poses a significant threat to thousands of businesses worldwide. It seems that even the most advanced Data Loss Prevention (DLP) tools that are currently being used are unable to stop the sophisticated data exfiltration technique.

A user can manipulate sensitive information directly within the browser, enabling the attacker to split, encrypt or encode it into smaller fragments that will remain undetected by conventional security measures because they can manipulate data directly within the browser. By fragmenting the data pieces, they circumvent the detection logic of both Endpoint Protection Platforms (EPP) and network-based tools, only to be reassembled seamlessly outside the network environment in which they were found.

As a further contributing factor to the threat, malicious actors are using alternatives to standard communication protocols, such as grpc and Webrtc, and commonly used encrypted messaging platforms, such as WhatsApp and Telegram, as a means of exfiltrating data. As a result of these channels, attackers can obscure their activities and evade traditional SSL inspection mechanisms, making it much more difficult to detect and respond to them.

An important shift in the threat landscape has taken place with the introduction of Data Splicing Attacks, which require immediate attention from both enterprises and cybersecurity professionals. Data exfiltration, a growing concern within the cybersecurity industry, refers to the act of transferring, stealing, or removing a specific amount of data from a computer, server, or mobile phone without authorisation.

Several methods can be used to perform this type of cyberattack, including a variety of cyberattacks such as data leakage, data theft, and information extrusion. The kind of security breach posed by this type of company poses a serious threat to the company, since it can result in significant financial losses, disruptions to operations, and irreparable damage to their reputation. This lack of adequate safeguarding of sensitive information under such threats emphasises the importance of developing effective data protection strategies.

There are two primary means by which data can be exfiltrated from an organisation's network: external attacks and insider threats. Cybercriminals infiltrate an organisation's network by deploying malware that targets connected devices, which can be the result of a cybercriminal attack. A compromised device can serve as a gateway to broader network exploitation once compromised.

Some types of malware are designed to spread across corporate networks in search of and extracting confidential information, while others remain dormant for extended periods, eschewing detection and quietly collecting, exfiltrating, and exchanging data in small, incremental amounts as it grows. As well as insider threats, internal threats can be equally dangerous in stealing data.

A malicious insider, such as a disgruntled employee, may be responsible for the theft of proprietary data, often transferring it to private email accounts or external cloud storage services for personal gain. Furthermore, employees may inadvertently expose sensitive information to external parties due to negligent behaviour, resulting in the disclosure of sensitive information to outside parties.

The insider-related incidents that take place at a company underscore the importance of robust monitoring, employee training, and data loss prevention (DLP) to safeguard the company's assets from outside threats. As a rule, there are many ways in which data exfiltration can be executed, usually by exploiting technological vulnerabilities, poor security practices, or human error in order to carry out the exfiltration.

When threat actors attempt to steal sensitive data from corporate environments, they use sophisticated methods without raising suspicion or setting off security alarms, to do so covertly. For organisations that wish to improve their security posture and reduce the risk of data loss, they must understand the most common tactics used in data exfiltration.

Infiltrating a system using malware is one of the most prevalent methods, as it is malicious software that is intentionally installed to compromise it. When malware is installed, it can scan a device for valuable data like customer records, financial data, or intellectual property, and send that information to an external server controlled by the attacker, which makes the process stealthy, as malware is often designed to mask its activity to evade detection by a company.

Data exfiltration is often accompanied by trojans, keyloggers, and ransomware, each of which is capable of operating undetected within a corporate network for extended periods. A similar method, phishing, relies on social engineering to trick users into revealing their login information or downloading malicious files. A cybercriminal can trick employees into granting them access to internal systems by craftily crafting convincing emails or creating false login pages.

When attackers gain access to a network, they can easily move across the network laterally and gain access to sensitive information. Phishing attacks are particularly dangerous because they rely heavily on human error to exploit human error, bypassing even the most sophisticated technological safeguards. The insider threat represents a challenging aspect of an organisation.

It can involve malicious insiders, such as employees or contractors, who deliberately leak or sell confidential information for monetary, strategic, or personal gain. As an example, insiders can also compromise data security unintentionally by mishandling sensitive data, sending information to incorrect recipients, or using insecure devices, without realising it. No matter what the intent of an insider threat is, it can be very difficult to detect and prevent it, especially when organisations do not have comprehensive monitoring and security controls in place.

Lastly, network misconfigurations are a great source of entry for attackers that requires little effort. When an internal system is compromised, it can be exploited by an attacker to gain unauthorised access by exploiting vulnerabilities such as poorly configured firewalls, exposed ports, and unsecured APIS. Once the attacker is inside, he or she can navigate the network by bypassing the traditional security mechanisms to locate and steal valuable information.

Often, these misconfigurations don't become apparent until a breach has already occurred, so it is very important to conduct continuous security audits and vulnerability assessments. In order to safeguard critical information assets better, organizations must understand these methods so that they may be able to anticipate threats and implement targeted countermeasures. Increasingly, web browsers have become an integral part of workplace productivity, creating a significant threat surface for data leaks.

As more than 60% of enterprise data is now stored on cloud-based platforms and is accessed primarily through browsers, ensuring browser-level security has become an extremely important concern. However, many existing security solutions have fallen short in addressing this challenge as recent research has revealed. It is very hard for proxy-based protections incorporated into enterprise browsers to identify sophisticated threats because they lack visibility.

Nevertheless, these solutions are not capable of understanding user interactions, monitoring changes to the Document Object Model (DOM), or accessing deeper browser context, which makes them easily exploitable to attackers. The traditional Data Loss Prevention (DLP) systems on endpoints are also not without limitations. As a result of their dependence on browser-exposed APIs, they are unable to determine the identity of the user, track browser extensions, or control the flow of encrypted content in the browser.

The constraints are creating a blind spot, which is increasingly being exploited by insider threats and advanced persistent attacks as a result of these constraints. It is especially problematic that these attacks are so adaptable; adversaries can develop new variants with very little coding effort, which will further widen the gap between modern threats and outdated security infrastructure, as well as allowing adversaries to build new variants that bypass existing defences.

A new toolkit developed specifically for reproducing the mechanics of these emerging data splicing attacks has been developed by researchers to address this growing concern. The tool has been developed to respond to this growing concern. It is designed for security teams, red teams, and vendors to test and evaluate their current defences in a realistic threat environment rigorously to determine whether their current defences are adequate.

It is the objective of Angry Magpie to help companies discover hidden vulnerabilities by simulating advanced browser-based attack vectors in order to evaluate how resilient their DLP strategies are. It is becoming increasingly apparent that enterprises need a paradigm shift in their approach to browser security, emphasizing proactive assessment and continuous adaptation in order to deal with rapidly changing cyber threats in the future.

As data splicing attacks have become increasingly prevalent and current security solutions have become increasingly limited, enterprise cybersecurity is at a critical inflexion point. As browser-based work environments become the norm and cloud dependency becomes more prevalent, traditional Data Loss Prevention strategies need to evolve both in scope and sophistication, as well as in scale. As organisations, we need to move away from legacy solutions that do not offer visibility, context, or adaptability that are necessary for detecting and mitigating modern data exfiltration techniques.

For cybersecurity professionals to remain competitive in the future, they must adopt a proactive and threat-informed defence strategy that includes continuous monitoring, advanced browser security controls, and regular stress testing of their systems through tools such as Angry Magpie. By taking this approach, organisations can identify and close vulnerabilities before they become exploitable, as well as ensure that there is a culture of security awareness throughout the workforce to minimise human error and insider threats.

Security infrastructures must keep up with the rapidly growing threats and innovations in cyberspace as well to maintain a competitive advantage. Businesses need to acknowledge and commit to modern, dynamic defence mechanisms to increase their resilience and ensure the integrity of their most valuable digital assets is better protected as a result of emerging threats.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

Report Abuse

About Me

Showing result(s) for

Popular Posts

Pages

London Startup Allegedly Deceived Microsoft with Fake AI Engineers

Vanta Customer Data Exposed Due to Code Bug at Compliance Firm

ESXi Environment Infiltrated Through Malicious KeePass Installer

Child Abuse Detection Efforts Face Setbacks Due to End-to-End Encryption

Cybersecurity Agencies on High Alert as Attacks Spike After Pahalgam Incident

Cobb County Suffers Alleged Data Breach by Russian Hackers

Co-op Hack Triggers Widespread Scam Risk for Consumers

Data Security Alert as Novel Exfiltration Method Emerges

Footer About

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

About Me

Showing result(s) for

Popular Posts

Pages

Menu Item