CySecurity News - Latest Information Security and Hacking Incidents: Cybersecurity

AI/ML vulnerabilities Artificial Intelligence Cybersecurity SQL Technology

How Security Teams Can Turn AI Into a Practical Advantage

Artificial intelligence is now built into many cybersecurity tools, yet its presence is often hidden. Systems that sort alerts, scan emails, highlight unusual activity, or prioritise vulnerabilities rely on machine learning beneath the surface. These features make work faster, but they rarely explain how their decisions are formed. This creates a challenge for security teams that must rely on the output while still bearing responsibility for the outcome.

Automated systems can recognise patterns, group events, and summarise information, but they cannot understand an organisation’s mission, risk appetite, or ethical guidelines. A model may present a result that is statistically correct yet disconnected from real operational context. This gap between automated reasoning and practical decision-making is why human oversight remains essential.

To manage this, many teams are starting to build or refine small AI-assisted workflows of their own. These lightweight tools do not replace commercial products. Instead, they give analysts a clearer view of how data is processed, what is considered risky, and why certain results appear. Custom workflows also allow professionals to decide what information the system should learn from and how its recommendations should be interpreted. This restores a degree of control in environments where AI often operates silently.

AI can also help remove friction in routine tasks. Analysts often lose time translating a simple question into complex SQL statements, regular expressions, or detailed log queries. AI-based utilities can convert plain language instructions into the correct technical commands, extract relevant logs, and organise the results. When repetitive translation work is reduced, investigators can focus on evaluating evidence and drawing meaningful conclusions.

However, using AI responsibly requires a basic level of technical fluency. Many AI-driven tools rely on Python for integration, automation, and data handling. What once felt intimidating is now more accessible because models can draft most of the code when given a clear instruction. Professionals still need enough understanding to read, adjust, and verify what the model generates. They also need awareness of how AI interprets instructions and where its logic might fail, especially when dealing with vague or incomplete information.

A practical starting point involves a few structured steps. Teams can begin by reviewing their existing tools to see where AI is already active and what decisions it is influencing. Treating AI outputs as suggestions rather than final answers helps reinforce accountability. Choosing one recurring task each week and experimenting with partial automation builds confidence and reduces workload over time. Developing a basic understanding of machine learning concepts makes it easier to anticipate errors and keep automated behaviours aligned with organisational priorities. Finally, engaging with professional communities exposes teams to shared tools, workflows, and insights that accelerate safe adoption.

As AI becomes more common, the goal is not to replace human expertise but to support it. Automated tools can process large datasets and reduce repetitive work, but they cannot interpret context, weigh consequences, or understand the nuance behind security decisions. Cybersecurity remains a field where judgment, experience, and critical thinking matter. When organisations use AI with intention and oversight, it becomes a powerful companion that strengthens investigative speed without compromising professional responsibility.

DOJ Disrupts Major Myanmar-Based Scam Targeting TickMill Users



 

Scam Networks

Crypto Scam Cyber Fraud Cybercrime Prevention Cybersecurity DOJ Action Financial crime Investment fraud Online Safety Scam Networks

DOJ Disrupts Major Myanmar-Based Scam Targeting TickMill Users

Taking action to demonstrate the United States' commitment to combating transnational cyber-fraud networks, the Department of Justice has announced a decisive seizure of tickmilleas.com, a domain allegedly used by a sophisticated cryptocurrency investment scam originating in Burma, as a decisive step to underscore its intensifying campaign against cyber-fraud networks.

Investigators have determined that the site, linked to the notorious Tai Chang scam compound, a hub favored by Burmese groups previously designated by the U.S Treasury for connections to Chinese organized crime and large-scale Southeast Asian scam operations, was intentionally crafted to lure foreign investors with fabricated promises of high returns, based on fabricated information provided to the investigators. A further manipulation took place to induce the victim to download fraudulent mobile applications that were part of the scheme's broader ecosystem.

Law enforcement authorities have already taken coordinated actions that led to the removal of malicious apps from major app stores and the eradication of more than 2,000 scam-related accounts across Meta platforms as a result of coordinated actions. A renewed global alert has also been issued by Interpol, warning that such criminal activities are rapidly on the rise due to the rapidly developing use of technology and, in some cases, trafficking of forced labor in order to sustain these criminal enterprises.

Using a counterfeit platform, the scammers deceived their victims into transferring their savings, and they usually presented fabricated dashboards that showed handsome, albeit fictional, gains from their investments, using the counterfeit platform.

A number of victims reported seeing supposed deposits that were entered by the criminals themselves, according to the FBI. This was done in order to create the appearance that the money would be in a good position and to encourage further contributions. Even though the domains were registered only in early November 2025, investigators have already identified multiple individuals who have been induced to contribute cryptocurrency to the scam in recent weeks.

Additionally, users were directed to download mobile applications which were alleged to be related to the platform through the website, prompting the FBI to alert both Google and Apple; some of the fraudulent apps have since been removed from the market. As the domain has been seized, visitors are met with an official law enforcement notice, eschewing what once looked like an impressive facade for an international fraud operation.

As the FBI San Diego Field Office continues its investigations, as well as the newly formed Scam Center Strike Force, it has been revealed that the seized domain was not an isolated fraud, but rather an extension of a scam infrastructure in Southeast Asia which is well-entrenched in the digital world. Tickmilleas.com, a website that sells pig meat and related products, was identified by authorities as having been built inside the Tai Chang compound in Burma, a fortified enclave located on the Thai-Myanmar border known for violent enforcement tactics, coerced labor, and large-scale "pig butchering" schemes.

Associated with the Democratic Karen Benevolent Army, this compound has become a central engine within a multibillion dollar fraud economy, which targets Americans through sophisticated cryptocurrency investment traps that are disguised as professional trading platforms operated by affiliates of the Democratic Karen Benevolent Army, as well as broader Chinese transnational crime syndicates.

In order to be convincing to the victims, the website which was taken down by U.S. officials was designed as a convincing imitation of the legitimate TickMill trading service. It was decorated with fake trading dashboards, staged deposits, and fraudulent mobile applications aimed at luring victims deeper into the con. The investigators noted that there was a high degree of trafficking among the individuals working for the scam, as they were forced to engage in scripted interactions that were meant to reassure victims and extract increasing amounts of money from them.

Despite the domain having been active for just a short time, federal agents were able to quickly map its infrastructure, identify the investors who had been deceived, and cut off the digital channels used for siphoning funds within minutes of its activeness. There had been three successful domain seizures linked to Tai Chang within the past few weeks, with the rapid intervention marking the third in the region—a sign that the U.S. efforts are becoming more aggressive, and the criminal networks operating around the region are experiencing a greater degree of disruption.

These operations are part of a broader criminal ecosystem known as pig butchering, which is a long-con scam in which perpetrators build trust with victims before stealing from them their savings. Officials from the U.S. estimate that these types of fraud schemes are draining approximately $9 to $10 billion from Americans every year, underscoring both their scale and sophistication in the way they are developed and executed.

However, the human cost of such fraud schemes goes far beyond financial loss. Human rights groups, investigators, and experts have all repeatedly gathered evidence that a substantial number of these scam centers' staff members are trafficking victims who have been coerced, threatened, and violently forced into participating. As a result of the expansion of scam compounds across parts of Southeast Asia, it is reportedly estimated that they account for a substantial share of the country's economic output as well.

According to the FBI's Internet Crime Complaint Center, there were more than 41,000 reports of cryptocurrency investment fraud in 2024, involving losses of over $5.8 billion, but investigators believe that the actual numbers don't even come close to the true damages, as many victims are too embarrassed or scared to come forward.

A growing number of cross-border fraud networks are being uncovered by U.S. authorities. Officials are warning the public to be vigilant against platforms that promise effortless returns or encourage the download of unfamiliar apps - tactics that have been repeatedly used in these types of schemes. Experts note that if early skepticism, independent verification, and prompt reporting are utilized, they can significantly reduce the reach of such criminal organizations.

Despite the fact that tickmilleas.com has been dismantled, investigators stress the importance of sustained international cooperation and ensuring that consumers remain informed in order to disrupt the larger ecosystem that provides the basis for these schemes to flourish.

Germany’s Cyber Skills Shortage Leaves Companies Exposed to Record Cyberattacks



 

threats

Automation Cyber Security Cybersecurity Germany Recruitment Shortage threats

Germany’s Cyber Skills Shortage Leaves Companies Exposed to Record Cyberattacks

Germany faces a critical shortage of cybersecurity specialists amid a surge in cyberattacks that caused record damages of €202.4 billion in 2024, according to a study by Strategy&, a unit of PwC. The study found that nine out of 10 organizations surveyed reported a shortage of cybersecurity experts, a sharp increase from two-thirds in 2023.

Key institutions such as German air traffic control, the Federal Statistical Office, and the Society for Eastern European Studies were targeted by foreign cyberattacks, highlighting the nation’s digital vulnerability. Russia and China were specifically identified as significant cyber threats.

The overall damage to German organizations from cyber-related incidents in 2024 reached €267 billion, with cyberattacks themselves accounting for about €179 billion. Other forms of damage included theft of data, IT equipment, and various acts of espionage and sabotage. Despite the growing threat, the recruitment landscape for cybersecurity roles is bleak.

Only half of the public sector's job ads for cybersecurity specialists attracted more than 10 applicants, and a decline in applications has been noted. Over two-thirds of organizations reported that applicants either partially met or failed to meet the qualifications, with notable gaps in knowledge about cybersecurity standards and data protection.

The most acute shortage exists in critical roles such as risk management, where 57% of respondents identified major gaps in positions responsible for recognizing and responding to cyber threats. Financial constraints pose another barrier to hiring, especially in the public sector, where 78% cited budget issues as a reason for not filling positions, compared to 48% in the private sector.

Low pay contributes significantly to high staff turnover. Many experts in urgent demand in the public sector are moving to tech companies offering better salaries, exacerbating the problem. The study also revealed that only about 20% of organizations have strategically employed AI to alleviate staff shortages. Experts recommend using bonuses, allowances, outsourcing, and automation to retain talent and improve efficiency.

Without these interventions, the study warns that bottlenecks in security-critical roles will persist, potentially crippling the ability of institutions to operate and jeopardizing Germany’s overall digital resilience. Strengthening cyber expertise through targeted incentives and international recruitment is urgent to counter these growing challenges. This situation poses a serious risk to the country's cybersecurity defenses and operational readiness .

Mass Router Hijack Targets End-of-Life ASUS Devices



 

Threat actors

AiCloud Exploits ASUS Routers Cyber Attacks Cybersecurity Espionage Campaign Firmware Updates Global Botnet Network Security Router Vulnerabilities Threat actors

Mass Router Hijack Targets End-of-Life ASUS Devices

The research team has found an extensive cyber-espionage campaign known as Operation WrtHug, which has quietly infiltrated tens of thousands of ASUS routers across the globe, which is a sign that everyday network infrastructure is becoming increasingly vulnerable.

A seemingly routine home or small-office device that appears to be ordinary has been covertly repurposed to make up a sophisticated reconnaissance and relay network that has enabled threat actors to operate both anonymously and with great reach. There is a clear pattern in which consumer-grade routers are being strategically used for intelligence gathering, according to SecurityScorecard analysts, a trend that has been on the rise for several months now.

Security specialists warn of the risk of such compromises becoming an ongoing trend in which outdated or poorly secured home routers are rapidly becoming valuable assets for hostile operators seeking persistence, cover, and distributed access to targeted environments that is no longer isolated incidents. In the last six months, investigators have determined that the operation’s reach has been much wider than they initially thought.

As a result, over the past few months, nearly 50,000 unique IP addresses have responded to probing for compromised ASUS WRT routers. A chain of six unpatched vulnerabilities allowed the attackers to hijack these end of life or outdated devices and use them to develop a coordinated, globally distributed infrastructure by combining them with a series of unpatched vulnerabilities.

Taiwan was attributed to the majority of routers infected, and significant clusters of routers were detected across Southeast Asia, Russia, Central Europe, and the United States. As a detail, the researchers noted that there were no infections within China, a detail that implies that the infection originates in China, but the available evidence is still insufficient for conclusive evidence to indicate a Chinese operator may be responsible.

Moreover, the SecurityScorecard STRIKE team noticed that there were overlaps between the tactics and targeting patterns of Operation WrtHug, as well as the earlier AyySSHush campaign that was detected earlier by GreyNoise in May, suggesting that the campaign may be related to a much broader and well-organized effort to weaponize aging consumer networking products.

A further analysis reveals that the intrusions seem to be connected to a coordinated effort to exploit a series of well-known vulnerabilities present in end-of-life ASUS WRT routers. This gives attackers the ability to perform full control over devices that remain unpatched, even after the end of the device's useful lifespan.

According to the investigators, each of the compromised routers has the same distinctive self-signed TLS certificate, which is supposed to expire a century after April 2022, suggesting the operation was carried out by the same set of toolset or deployment strategy. A report from SecurityScorecard states that nearly all of the services using this certificate are linked to ASUS's AiCloud platform.

AiCloud is a proprietary feature that enables users to access their local storage over the internet and has become a convenient entry point for attackers who are leveraging n-day flaws to gain high-level access to hardware which is not supported. Researchers have noted parallels between this campaign and several China-linked ORBs and botnet ecosystems, despite its adherence to the classic profile of an Operational Relay Box network.

According to the researchers, the attackers are relying on a cluster of vulnerabilities that include CVE-2023-41345, CVE-2023-41346, CVE-2023-41347, CVE-2023-41348, CVE-2023-39780, CVE-2024-12912, and CVE-2025-2492. The AyySSHush botnet is one of the routers that have been exploited in the past.

A number of the infected IP addresses have been tagged with signs consistent with compromises made by both WrtHug and AyySSHush, which suggests that the two operations may be overlapping. However, researchers caution that any link between the two operations remains speculative and is solely based upon the exploitation of common vulnerabilities, rather than a confirmed coordination effort. According to security experts, the majority of infections that have been identified originate from Taiwan, with minor concentrations spreading throughout Southeast Asia, Russia, Central Europe, and the United States of America.

A lot of the targeted ASUS models appear to be among the most vulnerable to the campaign-including the 4G-AC55U, 4G-AC860U, DSL-AC68U, GT-AC5300, GT-AX11000, RT-AC1200HP, RT-AC1300GPLUS, and RT-AC1300UHP-many of them no longer receiving updates and can no longer be supported.

In the opinion of the STRIKE researchers, attackers are initiating their takeover by exploiting a high-impact command injection flaw along with several other known vulnerabilities to take control of the routers by converting them into operational relay boxes designed to conceal commands-and-control activities, so they can be integrated into these networks as a whole.

It is important to note, however, that the researchers do not confirm the network's full operational role. Instead, they emphasize that the underlying vulnerabilities make these devices exceptionally valuable to hackers. It has been recommended that users immediately update their routers to address all six exploited flaws.

Users of nonsupported routers, they warn, should either disable the remote access functions or retire them. Researchers noted that the attackers were not using undisclosed zero-day exploits, but rather a series of well-documented n-day vulnerabilities that are still unpatched on older ASUS WRT routers, providing a path to large-scale compromise that was possible without patching.

Through this weakness, multiple forms of intrusion were possible, including OS command injection, which tricks a device into executing unauthorized system-level instructions, as well as remote code execution, which allows for complete authentication bypass as well. Using ASUS's AiCloud remote access service as a point of entry, SecurityScorecard's STRIKE team found that the threat actors were constantly exploiting ASUS's exposure to the internet, allowing them to gain a foothold on vulnerable devices.

Once the routers were intruded into an extremely vast, global mesh network of hijacked systems once access had been secured. Research has identified over 50,000 unique IP addresses associated with compromised devices in the past six months alone. Based on analysis, analysts believe that the campaign's behavior resembles that of a covert network known as a Operational Relay Box, which involves repurposing everyday consumer devices as relays for espionage traffic, concealing the true source of espionage activity, and maintaining long-term persistence as a covert infrastructure model.

As far as ORB-style operations are concerned, China-aligned threat groups are frequently associated with them, and this observation is reinforced by the geographical footprint of the infected devices. Security Scorecard found that about 30% to 50% of the compromised routers were based in Taiwan. Moreover, other concentrations have been observed in the United States, Russia, Southeast Asia and parts of Europe as well.

There was also another distinctive technical signature that was shared by all of the infected routers, namely, a self-signed TLS certificate that had an unusually long valid period of 100 years, a sign that could be used by researchers to trace the campaign's infrastructure throughout multiple geographical locations.

Together, these characteristics align closely with the pattern of cyber-espionage activities linked to China—including its choice of targets, methods of exploitation, design of operations, and geographic distribution. An important finding of the investigation is the geographical imbalance in which infected devices were detected, which scientists say is difficult to dismiss as coincidental by the researchers.

According to analysts, one-third to one-half of all compromised routers identified in Operation WrtHug were traced back to IP addresses located in Taiwan - an overrepresentation that analysts argue is consistent with the long-standing intelligence priorities assigned to China-linked cyber operators, which is why this is an overrepresentation.

A further striking feature of this study is that there have been no infections within mainland China, apart from a handful detected in Hong Kong, thereby highlighting the possibility of a deliberate targeting effort by the attackers. The attackers also seemed to be very interested in Southeast Asia, where the number of infected devices is substantially higher than the global average.

In addition, researchers have noted striking tradecraft overlap between WrtHug and AyySSHush, another campaign outlined by GreyNoise earlier that aimed to use ASUS routers to conscript into a persistent botnet. The CVE-2023-39780 command injection vulnerability is used by both of these operations, raising the possibility that they could represent different phases of the same evolving campaign, separate efforts by the same threat actor, or parallel operations that are loosely coordinated.

It is still believed by analysts that WrtHug continues to be an independent campaign despite the fact that it carries the characteristics of a well-resourced adversary even though there is no conclusive evidence to prove it. It remains a fertile ground for such intrusions, despite the absence of conclusive evidence. Small office and home office routers are often installed only to be forgotten, especially as manufacturers discontinue support for them.

It has become increasingly common for end-of-life devices to be updated automatically, but they still function as usual, and there seems to be little reason for users to replace them despite the mounting security risks. Despite the persistent gap, authorities have been increasingly concerned. The FBI released a public advisory in May calling for users of SOHO routers to disable remote management features as a minimum requirement in order to reduce the chances of compromise by retiring unsupported models.

During the ongoing unfolding of Operation WrtHug, users' vigilance is becoming increasingly important as the security of global networks continues to become more dependent upon enterprise defenses, as well as the efforts of everyday users. As the findings indicate, households and small businesses need to abandon outdated hardware, implement timely patching, and limit their exposure to remote access services, which silently increase the attack surface of their networks.

The experts stress that proactive maintenance - once considered optional - has now become a vital component of preventing consumer devices from being used as a tool in geopolitical cyber operations. With the rise of international espionage fueling neglected routers today, even basic security hygiene has become a matter of national importance.

Continuous Incident Response Is Redefining Cybersecurity Strategy



 

Threat Intelligence

Cloud Security continuous monitoring Cyber Security Cybersecurity Endpoint Defense Incident response ransomware protection Risk Management SOC Operations Threat Intelligence

Continuous Incident Response Is Redefining Cybersecurity Strategy

With organizations now faced with relentless digital exposure, continuous security monitoring has become an operational necessity instead of a best practice, as organizations navigate an era where digital exposure is ubiquitous. In 2024, cyber-attacks will increase by nearly 30%, with the average enterprise having to deal with over 1,600 attempted intrusions a week, with the financial impact of a data breach regularly rising into six figures.

Even so, the real crisis extends well beyond the rising level of threats. In the past, cybersecurity strategies relied on a familiar formula—detect quickly, respond promptly, recover quickly—but that cadence no longer suffices in an environment that is characterized by adversaries automating reconnaissance, exploiting cloud misconfiguration within minutes, and weaponizing legitimate tools so that they can move laterally far faster than human analysts are able to react.

There has been a growing gap between what organizations can see and the ability to act as the result of successive waves of innovation, from EDR to XDR, as a result of which they have widened visibility across sprawling digital estates. The security operations center is already facing unprecedented complexity. Despite the fact that security operations teams juggle dozens of tools and struggle with floods of alerts that require manual validation, organisations are unable to act as quickly as they should.

A recent accelerated disconnect between risk and security is transforming how security leaders understand risks and forcing them to face a difficult truth: visibility without speed is no longer an effective defence. When examining the threat patterns defining the year 2024, it becomes more apparent why this shift is necessary. According to security firms, attackers are increasingly using stealthy, fileless techniques to steal from their victims, with nearly four out of five detections categorised as malware-free today, with the majority of attacks classified as malware-free.

As a result, ransomware activity has continued to climb steeply upward, rising by more than 80% on a year-over-year basis and striking small and midsized businesses the most disproportionately, accounting for approximately 70% of all recorded incidents. In recent years, phishing campaigns have become increasingly aggressive, with some vectors experiencing unprecedented spikes - some exceeding 1,200% - as adversaries use artificial intelligence to bypass human judgment.

A number of SMBs remain structurally unprepared in spite of these pressures, with the majority acknowledging that they have become preferred targets, but three out of four of them continue to use informal or internally managed security measures. These risks are compounded by human error, which is responsible for an estimated 88% of reported cyber incidents.

There have been staggering financial consequences as well; in the past five years alone, the UK has suffered losses of more than £44 billion, resulting in both immediate disruption and long-term revenue losses. Due to this, the industry’s definition of continuous cybersecurity is now much broader than periodic audits.

It is necessary to maintain continuous threat monitoring, proactive vulnerability and exposure management, disciplined identity governance, sustained employee awareness programs, regularly tested incident response playbooks, and ongoing compliance monitoring—a posture which emphasizes continuous evaluation rather than reactive control as part of an operational strategy. Increasingly complex digital estates are creating unpredictable cyber risks, which are making continuous monitoring an essential part of modern defence strategies.

Continuous monitoring is a real time monitoring system that scans systems, networks, and cloud environments in real time, in order to detect early signs of misconfiguration, compromise, or operational drift. In contrast to periodic checks which operate on a fixed schedule and leave long periods of exposure, continuous monitoring operates in real time.

The approach outlined above aligns closely with the NIST guidance, which urges organizations to set up an adaptive monitoring strategy capable of ingesting a variety of data streams, analysing emerging vulnerabilities, and generating timely alerts for security teams to take action. Using continuous monitoring, organizations can discover latent weaknesses that are contributing to their overall cyber posture.

Continuous monitoring reduces the frequency and severity of incidents, eases the burden on security personnel, and helps them meet increasing regulatory demands. Even so, maintaining such a level of vigilance remains a challenge, especially for small businesses that lack the resources, expertise, and tooling to operate around the clock in order to stay on top of their game.

The majority of organizations therefore turn to external service providers in order to achieve the scalability and economic viability of continuous monitoring. Typically, effective continuous monitoring programs include four key components: a monitoring engine, analytics that can be used to identify anomalies and trends on a large scale, a dashboard that shows key risk indicators in real time, and an alerting system to ensure that emerging issues are quickly addressed by the appropriate staff.

With the help of automation, security teams are now able to process a great deal of telemetry in a timely and accurate manner, replacing outdated or incomplete snapshots with live visibility into organisational risk, enabling them to respond successfully in a highly dynamic threat environment.

Continuous monitoring can take on a variety of forms, depending on the asset in focus, including endpoint monitoring, network traffic analysis, application performance tracking, cloud and container observability, etc., all of which provide an important layer of protection against attacks as they spread across every aspect of the digital infrastructure.

It has also been shown that the dissolution of traditional network perimeters is a key contributor to the push toward continuous response. In the current world of cloud-based workloads, SaaS-based ecosystems, and remote endpoints, security architectures mustwork as flexible and modular systems capable of correlating telemetrics between email, DNS, identity, network, and endpoint layers, without necessarily creating new silos within the architecture.

Three operational priorities are usually emphasized by organizations moving in this direction: deep integration to keep unified visibility, automation to handle routine containment at machine speed and validation practices, such as breach simulations and posture tests, to ensure that defence systems behave as they should. It has become increasingly common for managed security services to adopt these principles, and this is why more organizations are adopting them.

909Protect, for instance, is an example of a product that provides rapid, coordinated containment across hybrid environments through the use of automated detection coupled with continuous human oversight. In such platforms, the signals from various security vectors are correlated, and they are layered on top of existing tools with behavioural analysis, posture assessment and identity safeguards in order to ensure that no critical alert goes unnoticed while still maintaining established investments.

In addition to this shift, there is a realignment among the industry as a whole toward systems that are built to be available continuously rather than undergoing episodic interventions. Cybersecurity has gone through countless “next generation” labels, but only those approaches which fundamentally alter the behavior of operations tend to endure, according to veteran analysts in the field. In addressing this underlying failure point, continuous incident response fits perfectly into this trajectory.

Organizations are rarely breached because they have no data, but rather because they do not act on it quickly enough or cohesively. As analysts argue, the path forward will be determined by the ability to combine automation, analytics, and human expertise into a single adaptive workflow that can be used in an organization's entirety.

There is no doubt that the organizations that are most likely to be able to withstand emerging threats in the foreseeable future will be those that approach security as a living, constantly changing system that is not only based on the visible, but also on the ability of the organization to detect, contain, and recover in real time from any threats as they arise.

In the end, the shift toward continuous incident response is a sign that cybersecurity resilience is more than just about speed anymore, but about endurance as well. Investing in unified visibility, disciplined automation, as well as persistent validation will not only ensure that the path from detection to containment is shortened, but that the operations remain stable over the longer term as well.

The advantage will go to those who treat security as an evolving ecosystem—one that is continually refined, coordinated across teams and committed to responding in a continuity similar to the attacks used by adversaries.

Sweden Confirms Power Grid Breach Amid Growing Ransomware Concerns



 

Svenska Kraftnät

Critical Infrastructure Cyber Threats Cybersecurity Data Breach Everest Ransomware Network Protection Power Grid Security Ransomware attack Svenska Kraftnät

Sweden Confirms Power Grid Breach Amid Growing Ransomware Concerns

Swedish power grid operator, Suderland, has confirmed it is investigating a security incident related to a potential ransomware attack aimed at decrypting sensitive data as part of its ongoing cybersecurity investigation, a revelation that has stirred alarm across Europe's critical infrastructure community.

It has been revealed by Svenska kraftnät, the state-owned company in charge of ensuring the nation's electricity transmission networks, that a criminal group has threatened to release what it claims to be hundreds of gigabytes of internal data allegedly stolen from the organization's computer system in order to sell it to the public. It appears, based on initial findings, that the breach occurred solely through a limited external file transfer platform, and officials stressed that the electricity supply and core grid of Sweden have not been affected.

In spite of this, the revelation has raised alarm about the threat to critical energy infrastructure from cyber extortion, which has increased as authorities continue to figure out exactly how extensive and damaging the cyber extortion attack has been. A breach which took place on October 26, 2025, reverberated throughout the cybersecurity landscape across Europe, highlighting the fragility of digital defences protecting critical infrastructure for the first time.

In response to claims made by the notorious Everest ransomware group, Sweden's government-owned electricity transmission company, which plays a crucial role in the stability of the country's power grid, confirmed a data compromise had been confirmed by Svenska kraftnät. In spite of the fact that the full scope of the intrusion is still being investigated, early indications suggest that the attackers may have obtained or exfiltrated sensitive internal data as part of the intrusion.

It has been reported that the Everest group, notorious for coordinated extortion campaigns and sophisticated methods of network infiltration, has publicly accepted responsibility, increasing scrutiny of both national and international cybersecurity authorities. Such attacks on critical national infrastructure (CNI), according to experts, have far-reaching consequences, threatening both operational continuity as well as economic stability and public confidence, among others.

It has rekindled the need to strengthen cyber resilience frameworks, to collaborate on threat intelligence, and to increase vigilance across essential service providers to prevent similar disruptions in the future. Despite the intrusion, officials have assured that the nation's power transmission and supply operations remain fully operational, with no signs that mission-critical infrastructure will be affected by the intrusion.

The extent to which the organisation has been compromised is still being investigated while securing affected systems and assessing the nature of the leaked information. In spite of the fact that it is still uncertain to what extent the breach has affected the organisation, early reports suggest that around 280 gigabytes of internal data may have been stolen. An established cybercrime group known as Everest has claimed responsibility for the recent attack on Svenska Kraftnät, and they have listed Svenska Kraftnät among their victims on a Tor-based data leak website, which was launched in late 2020.

A notorious group for extortion and cyberattacks, the group has been previously linked to high-profile incidents such as Collins Aerospace's cyberattack, which disrupted operations at several European airports as a result. Despite the increasing boldness of ransomware actors to attack key entities of national infrastructure, the latest claim against Sweden's key power operator is a clear indication of what is happening.

In the process of investigating the incident, Svenska kraftnät continues to maintain close coordination with law enforcement and cybersecurity agencies to identify the perpetrators and mitigate further risks. Despite the fact that this incident has been isolated, it is nonetheless an indication of the escalating cyber threat landscape affecting critical infrastructure providers, where even isolated system failures can pose significant risks to national stability and public confidence.

Svenska kraftnät has confirmed to the media that Cem Göcgoren, Head of Information Security at Svenska kraftnät, is leading a comprehensive forensic investigation to determine the nature and extent of the data compromised during the cyberattack, as well as to assess the level of damage that has been caused. It has been determined that the breach of security did not affect Sweden's transmission or distribution systems, with officials reassuring that the country's electricity systems should continue to operate uninterrupted during the investigation.

The aforementioned distinction highlights that the attackers probably targeted administrative or corporate data, not the systems responsible for managing real-time power flo,whichat are responsible for preventing potential disruptions from occurring, which is a critical factor in preventing potentially severe damagSvenska kraftnät must informrms the national law enforcement authorities of the intrusion immediately after it discovers the intrusion and coordinates with the appropriate government agencies to safeguard the infrastructure and cybersecurity of the network.

As a result of the swift escalation, power grid operators are becoming increasingly regarded as prime targets by ransomware groups, given the strategic and economic leverage they hold. There is a known ransomware gang, Everest, that has claimed responsibility for the attack. This group is notorious for its "double extortion" tactics, in which they encrypt the data of victims while simultaneously threatening to publish the stolen files in the absence of the ransom payment.

According to cybersecurity experts, this incident has served to underscore the importance of vigilant security governance within critical infrastructure sectors. In terms of countermeasures, it is recommended that robust incident response protocols be activated, as well as users be isolated from compromised systems, and detailed forensic assessments be conducted in order to identify vulnerabilities exploited during the breach.

The strengthening of the defenders through multi-factor authentication, network segmentation, and the disciplined management of patches is of utmost importance at this time, especially as ransomware operators target flaws in enterprise software products such as VMware vCenter and Ivanti software with increasing frequency. Furthermore, keeping immutable offline backups, making employees aware of phishing and social engineering threats, and leveraging real-time threat intelligence can all help to strengthen resilience against similar attacks in the future.

Thus, the Svenska kraftnät breach serves both as a warning and a lesson in the ongoing fight against the cyberattacks of modern societies, both in the sense that they serve as a warning and a lesson. In the energy sector, the incident serves as a defining reminder that cybersecurity is no longer only a technical issue, but is also a matter of national resilience. With ransomware actors becoming more sophisticated and audacious, power grid operators have to take a proactive approach and move from reactive defence to predictive intelligence - by adopting continuous monitoring and zero-trust architectures, as well as collaborating with multiple agencies to strengthen digital ecosystems.

Aside from immediate containment efforts, it will be essential to invest in cybersecurity training, international alliances for information sharing, and next-generation defence technologies to prevent future cyber threats. While alarming, the Svenska kraftnät breach presents a unique opportunity for governments and industries alike to strengthen their digital trust and operational stability by using this breach.

Unsecured Corporate Data Found Freely Accessible Through Simple Searches



 

Privacy

AI governance AI Security Corporate Data Breach Cybersecurity Data protection Digital Risk ethical AI Information Security Privacy

Unsecured Corporate Data Found Freely Accessible Through Simple Searches

An era when artificial intelligence (AI) is rapidly becoming the backbone of modern business innovation is presenting a striking gap between awareness and action in a way that has been largely overlooked. In a recent study conducted by Sapio Research, it has been reported that while most organisations in Europe acknowledge the growing risks associated with AI adoption, only a small number have taken concrete steps towards reducing them.

Based on insights from 800 consumers and 375 finance decision-makers across the UK, Germany, France, and the Netherlands, the Finance Pulse 2024 report highlights a surprising paradox: 93 per cent of companies are aware that artificial intelligence poses a risk, yet only half have developed formal policies to regulate its responsible use.

There was a significant number of respondents who expressed concern about data security (43%), followed closely by a concern about accountability, transparency, and the lack specialised skills to ensure a safe implementation (both of which reached 29%). In spite of this increased awareness, only 46% of companies currently maintain formal guidelines for the use of artificial intelligence in the workplace, and even fewer—48%—impose restrictions on the type of data that employees are permitted to feed into the systems.

It has also been noted that just 38% of companies have implemented strict access controls to safeguard sensitive information. Speaking on the findings of this study, Andrew White, CEO and Co-Founder of Sapio Research, commented that even though artificial intelligence remains a high priority for investment across Europe, its rapid integration has left many employers confused about the use of this technology internally and ill-equipped to put in place the necessary governance frameworks.

It was found, in a recent investigation by cybersecurity consulting firm PromptArmor, that there had been a troubling lapse in digital security practices linked to the use of artificial intelligence-powered platforms. According to the firm's researchers, 22 widely used artificial intelligence applications—including Claude, Perplexity, and Vercel V0-had been examined by the firm's researchers, and highly confidential corporate information had been exposed on the internet by way of chatbot interfaces.

There was an interesting collection of data found in the report, including access tokens for Amazon Web Services (AWS), internal court documents, Oracle salary reports that were explicitly marked as confidential, as well as a memo describing a venture capital firm's investment objectives. As detailed by PCMag, these researchers confirmed that anyone could easily access such sensitive material by entering a simple search query - "site:claude.ai + internal use only" - into any standard search engine, underscoring the fact that the use of unprotected AI integrations in the workplace is becoming a dangerous and unpredictable source of corporate data theft.

A number of security researchers have long been investigating the vulnerabilities in popular AI chatbots. Recent findings have further strengthened the fragility of the technology's security posture. A vulnerability in ChatGPT has been resolved by OpenAI since August, which could have allowed threat actors to exploit a weakness in ChatGPT that could have allowed them to extract the users' email addresses through manipulation.

In the same vein, experts at the Black Hat cybersecurity conference demonstrated how hackers could create malicious prompts within Google Calendar invitations by leveraging Google Gemini. Although Google resolved the issue before the conference, similar weaknesses were later found to exist in other AI platforms, such as Microsoft’s Copilot and Salesforce’s Einstein, even though they had been fixed by Google before the conference began.

Microsoft and Salesforce both issued patches in the middle of September, months after researchers reported the flaws in June. It is particularly noteworthy that these discoveries were made by ethical researchers rather than malicious hackers, which underscores the importance of responsible disclosure in safeguarding the integrity of artificial intelligence ecosystems.

It is evident that, in addition to the security flaws of artificial intelligence, its operational shortcomings have begun to negatively impact organisations financially and reputationally. "AI hallucinations," or the phenomenon in which generative systems produce false or fabricated information with convincing accuracy, is one of the most concerning aspects of artificial intelligence. This type of incident has already had significant consequences for the lawyer involved, who was penalised for submitting a legal brief that was filled with over 20 fictitious court references produced by an artificial intelligence program.

Deloitte also had to refund the Australian government six figures after submitting an artificial intelligence-assisted report that contained fabricated sources and inaccurate data. This highlighted the dangers of unchecked reliance on artificial intelligence for content generation and highlighted the risk associated with that. As a result of these issues, Stanford University’s Social Media Lab has coined the term “workslop” to describe AI-generated content that appears polished yet is lacking in substance.

In the United States, 40% of full-time office employees reported that they encountered such material regularly, according to a study conducted. In my opinion, this trend demonstrates a growing disconnect between the supposed benefits of automation and the real efficiency can bring. When employees are spending hours correcting, rewriting, and verifying AI-generated material, the alleged benefits quickly fade away.

Although what may begin as a convenience may turn out to be a liability, it can reduce production quality, drain resources, and in severe cases, expose companies to compliance violations and regulatory scrutiny. It is a fact that, as artificial intelligence continues to grow and integrate deeply into the digital and corporate ecosystems, it is bringing along with it a multitude of ethical and privacy challenges.

In the wake of increasing reliance on AI-driven systems, long-standing concerns about unauthorised data collection, opaque processing practices, and algorithmic bias have been magnified, which has contributed to eroding public trust in technology. There is still the threat of unauthorised data usage on the part of many AI platforms, as they quietly collect and analyse user information without explicit consent or full transparency. Consequently, the threat of unauthorised data usage remains a serious concern.

It is very common for individuals to be manipulated, profiled, and, in severe cases, to become the victims of identity theft as a result of this covert information extraction. Experts emphasise organisations must strengthen regulatory compliance by creating clear opt-in mechanisms, comprehensive deletion protocols, and transparent privacy disclosures that enable users to regain control of their personal information.

In addition to these alarming concerns, biometric data has also been identified as a very important component of personal security, as it is the most intimate and immutable form of information a person has. Once compromised, biometric identifiers are unable to be replaced, making them prime targets for cybercriminals to exploit once they have been compromised.

If such information is misused, whether through unauthorised surveillance or large-scale breaches, then it not only poses a greater risk of identity fraud but also raises profound questions regarding ethical and human rights issues. As a consequence of biometric leaks from public databases, citizens have been left vulnerable to long-term consequences that go beyond financial damage, because these systems remain fragile.

There is also the issue of covert data collection methods embedded in AI systems, which allow them to harvest user information quietly without adequate disclosure, such as browser fingerprinting, behaviour tracking, and hidden cookies. utilising silent surveillance, companies risk losing user trust and being subject to potential regulatory penalties if they fail to comply with tightening data protection laws, such as GDPR. Microsoft and Salesforce both issued patches in the middle of September, months after researchers reported the flaws in June.

It is particularly noteworthy that these discoveries were made by ethical researchers rather than malicious hackers, which underscores the importance of responsible disclosure in safeguarding the integrity of artificial intelligence ecosystems. It is evident that, in addition to the security flaws of artificial intelligence, its operational shortcomings have begun to negatively impact organisations financially and reputationally.

"AI hallucinations," or the phenomenon in which generative systems produce false or fabricated information with convincing accuracy, is one of the most concerning aspects of artificial intelligence. This type of incident has already had significant consequences for the lawyer involved, who was penalised for submitting a legal brief that was filled with over 20 fictitious court references produced by an artificial intelligence program.

Deloitte also had to refund the Australian government six figures after submitting an artificial intelligence-assisted report that contained fabricated sources and inaccurate data. This highlighted the dangers of unchecked reliance on artificial intelligence for content generation, highlighted the risk associated with that. As a result of these issues, Stanford University’s Social Media Lab has coined the term “workslop” to describe AI-generated content that appears polished yet is lacking in substance.

When employees are spending hours correcting, rewriting, and verifying AI-generated material, the alleged benefits quickly fade away. Although what may begin as a convenience may turn out to be a liability, it can reduce production quality, drain resources, and in severe cases, expose companies to compliance violations and regulatory scrutiny.

It is a fact that, as artificial intelligence continues to grow and integrate deeply into the digital and corporate ecosystems, it is bringing along with it a multitude of ethical and privacy challenges. In the wake of increasing reliance on AI-driven systems, long-standing concerns about unauthorised data collection, opaque processing practices, and algorithmic bias have been magnified, which has contributed to eroding public trust in technology.

There is still the threat of unauthorised data usage on the part of many AI platforms, as they quietly collect and analyse user information without explicit consent or full transparency. Consequently, the threat of unauthorised data usage remains a serious concern. It is very common for individuals to be manipulated, profiled, and, in severe cases, to become the victims of identity theft as a result of this covert information extraction.

Experts emphasise that thatorganisationss must strengthen regulatory compliance by creating clear opt-in mechanisms, comprehensive deletion protocols, and transparent privacy disclosures that enable users to regain control of their personal information. In addition to these alarming concerns, biometric data has also been identified as a very important component of personal security, as it is the most intimate and immutable form of information a person has.

Once compromised, biometric identifiers are unable to be replaced, making them prime targets for cybercriminals to exploit once they have been compromised. If such information is misused, whether through unauthorised surveillance or large-scale breaches, then it not oonly posesa greater risk of identity fraud but also raises profound questions regarding ethical and human rights issues.

As a consequence of biometric leaks from public databases, citizens have been left vulnerable to long-term consequences that go beyond financial damage, because these systems remain fragile. There is also the issue of covert data collection methods embedded in AI systems, which allow them to harvest user information quietly without adequate disclosure, such as browser fingerprinting behaviourr tracking, and hidden cookies.

utilising silent surveillance, companies risk losing user trust and being subject to potential regulatory penalties if they fail to comply with tightening data protection laws, such as GDPR. Furthermore, the challenges extend further than privacy, further exposing the vulnerability of AI itself to ethical abuse. Algorithmic bias is becoming one of the most significant obstacles to fairness and accountability, with numerous examples having been shown to, be in f ,act contributing to discrimination, no matter how skewed the dataset.

There are many examples of these biases in the real world - from hiring tools that unintentionally favour certain demographics to predictive policing systems which target marginalised communities disproportionately. In order to address these issues, we must maintain an ethical approach to AI development that is anchored in transparency, accountability, and inclusive governance to ensure technology enhances human progress while not compromising fundamental freedoms.

In the age of artificial intelligence, it is imperative tthat hatorganisationss strike a balance between innovation and responsibility, as AI redefines the digital frontier. As we move forward, not only will we need to strengthen technical infrastructure, but we will also need to shift the culture toward ethics, transparency, and continual oversight to achieve this.

Investing in a secure AI infrastructure, educating employees about responsible usage, and adopting frameworks that emphasise privacy and accountability are all important for businesses to succeed in today's market. As an enterprise, if security and ethics are incorporated into the foundation of AI strategies rather than treated as a side note, today's vulnerabilities can be turned into tomorrow's competitive advantage – driving intelligent and trustworthy advancement.

Attackers Exploit Critical Windows Server Update Services Flaw After Microsoft’s Patch Fails



 

WSUS exploit

CVE-2025-59287 Cybersecurity Microsoft patch failure Vulnerabilities and Exploits Windows Server Update Services vulnerability WSUS exploit

Attackers Exploit Critical Windows Server Update Services Flaw After Microsoft’s Patch Fails

Cybersecurity researchers have warned that attackers are actively exploiting a severe vulnerability in Windows Server Update Services (WSUS), even after Microsoft’s recent patch failed to fully fix the issue. The flaw, tracked as CVE-2025-59287, impacts WSUS versions dating back to 2012.

Microsoft rolled out an emergency out-of-band security update for the vulnerability on Thursday, following earlier attempts to address it. Despite this, several cybersecurity firms reported active exploitation by Friday. However, Microsoft has not yet officially confirmed these attacks.

This situation highlights how quickly both cyber defenders and adversaries respond to newly disclosed flaws. Within hours of Microsoft’s emergency patch release, researchers observed proof-of-concept exploits and live attacks targeting vulnerable servers.

“This vulnerability shows how simple and trivial exploitation is once an attack script is publicly available,” said John Hammond, principal security researcher at Huntress, in an interview with CyberScoop. “It’s always an attack of opportunity — just kind of spray-and-pray, and see whatever access a criminal can get their hands on.”

The Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, urging organizations to apply the latest patch and adhere to Microsoft’s mitigation steps.

A Microsoft spokesperson confirmed the re-release of the patch, explaining: “We re-released this CVE after identifying that the initial update did not fully mitigate the issue. Customers who have installed the latest updates are already protected.” Microsoft did not specify when or how it discovered that the previous patch was insufficient.

According to Shadowserver, over 2,800 instances of WSUS with open ports (8530 and 8531) are exposed to the internet — a necessary condition for exploitation. Approximately 28% of these vulnerable systems are located in the United States.

“Exploitation of this flaw is indiscriminate,” warned Ben Harris, founder and CEO of watchTowr. “If an unpatched Windows Server Update Services instance is online, at this stage it has likely already been compromised. This isn’t limited to low-risk environments — some of the affected entities are exactly the types of targets attackers prioritize.”

Huntress has observed five active attack cases linked to CVE-2025-59287. Hammond explained that these incidents mostly involve reconnaissance activities — such as environment mapping and data exfiltration — with no severe damage observed so far. However, he cautioned that WSUS operates with high-level privileges, meaning successful exploitation could fully compromise the affected server.

The risk, Hammond added, could escalate into supply chain attacks, where adversaries push malicious updates to connected systems. “Some potential supply-chain shenanigans just opening the door with this opportunity,” he said.

Experts from Palo Alto Networks’ Unit 42 echoed the concern. “By compromising this single server, an attacker can take over the entire patch distribution system,” said Justin Moore, senior manager of threat intel research at Unit 42. “With no authentication, they can gain system-level control and execute a devastating internal supply chain attack. They can push malware to every workstation and server in the organization, all disguised as a legitimate Microsoft update. This turns the trusted service into a weapon of mass distribution.”

Security researchers continue to emphasize that WSUS should never be exposed to the public internet, as attackers cannot exploit the flaw in instances that restrict external access.

Microsoft deprecated WSUS in September, stating that while it will still receive security support, it is no longer under active development or set to gain new features.

iOS 26 Update Erases Key Forensic Log, Hindering Spyware Detection on iPhones



 

Vulnerabilities

Apple Apple vulnerabilities Cybersecurity Vulnerabilities

iOS 26 Update Erases Key Forensic Log, Hindering Spyware Detection on iPhones

Researchers have raised concerns that Apple’s latest software release, iOS 26, quietly removes a crucial forensic tool used to detect infections from sophisticated spyware such as Pegasus and Predator. The change affects a system file known as shutdown.log, a part of Apple’s Sysdiagnose tool that for years has helped security experts trace evidence of digital compromise.

Investigators at cybersecurity firm iVerify discovered that the log, which previously recorded every instance of an iPhone being powered off and on, is now automatically overwritten each time the device reboots. Earlier versions of iOS appended new entries to the file, preserving a timeline of shutdown events that often contained small traces of malware activity.

These traces had previously been key in confirming spyware attacks on devices belonging to journalists, activists, and public officials. In 2021, forensic analysts revealed that Pegasus, a surveillance tool developed by the Israeli company NSO Group, left recognizable patterns within the shutdown.log, which became instrumental in public investigations into digital espionage.

After these findings, Pegasus operators began deleting the file to hide their activity, but even those deletions became a clue for analysts, as an abnormally clean log often pointed to tampering.

The iOS 26 update now clears this record automatically, effectively erasing any historical evidence of infection after a single reboot.

iVerify researchers said the change may have been introduced to improve performance or reduce unnecessary data storage, but its timing has raised alarms among those tracking spyware use, which has expanded beyond activists to include business leaders and celebrities.

The update complicates ongoing efforts to investigate and confirm past infections, particularly on devices that may have been compromised months or years ago. Analysts studying Predator, another spyware tool linked to the surveillance firm Cytrox, have reported similar behavior within shutdown.log.

With Apple yet to comment, experts recommend that high-risk users save a Sysdiagnose report before updating to preserve existing logs. They also advise delaying installation until the company provides clarity or releases a patch. The loss of historical shutdown data, researchers warn, could make identifying spyware on iPhones significantly harder at a time when digital surveillance threats continue to grow globally.

Stop Using Public Wi-Fi: Critical Security Risks Explained



 

Security

Cybersecurity Hacking Privacy Public Wifi Security

Stop Using Public Wi-Fi: Critical Security Risks Explained

Public Wi-Fi networks, commonly found in coffee shops and public spaces, are increasingly used by remote workers and mobile device users seeking internet access outside the home or office. While convenient, these networks pose significant security risks that are often misunderstood.

This article explains why tech experts caution against the casual use of public Wi-Fi, emphasizing that such networks can be notably unsafe, especially when unsecured. The distinction between secure and unsecured networks is critical: secure networks require authentication steps like passwords, account creation, or agreeing to terms of service.

These measures typically offer additional layers of protection for users. In contrast, unsecured networks allow anyone to connect without authorization, lacking essential cybersecurity safeguards. According to experts from Executech, unsecured networks do not incorporate protective measures to prevent unauthorized access and malicious activities, leaving users vulnerable to cyberattacks.

When connecting to unsecured public Wi-Fi, data transmitted between a device and the network can be intercepted by attackers who may exploit weaknesses in the infrastructure. Cybercriminals often target these networks to access sensitive information stored or shared on connected devices. Individuals should be wary about what activities they perform on such connections, as the risk of unauthorized access and data theft is high.

Security experts advise users to avoid performing sensitive tasks, such as accessing bank accounts, entering financial details for online shopping, or opening confidential emails, when on public Wi-Fi. Personal and family information, especially involving children, should also be kept off devices used on public networks to mitigate the risk of exposure.

For those who absolutely must use public Wi-Fi—for emergencies or workplace requirements—layering protections is recommended. Downloading a reputable VPN can help encrypt data traffic, establishing a secure tunnel between the user’s device and the internet and reducing some risk.

Ultimately, the safest approach is to avoid public Wi-Fi altogether when possible, relying on personal routers or trusted connections instead. All public Wi-Fi networks are susceptible to hacking attempts, regardless of perceived safety. By following the suggested precautions and maintaining awareness of potential risks, users can better protect their sensitive information and minimize security threats when forced to use public Wi-Fi networks.

Passkeys vs Passwords: Why Passkeys Are the Future of Secure Logins



 

phishing

Biometrics Cyber Security Cybersecurity Online Security Passkeys Password password protection Passwords phishing

Passkeys vs Passwords: Why Passkeys Are the Future of Secure Logins

Passwords have long served as the keys to our digital world—granting access to everything from social media to banking apps. Yet, like physical keys, they can easily be lost, copied, or stolen. As cyber threats evolve, new alternatives such as passkeys are stepping in to offer stronger, simpler, and safer ways to log in.

Why passwords remain risky

A password is essentially a secret code you use to prove your identity online. But weak password habits are widespread. A CyberNews report revealed that 94% of 19 billion leaked passwords were reused, and many followed predictable patterns—think “123456,” names, cities, or popular brands.

When breaches occur, these passwords spread rapidly, leading to account takeovers, phishing scams, and identity theft. In fact, hackers often attempt to exploit leaked credentials within an hour of a breach.

Phishing attacks—where users are tricked into entering their passwords on fake websites—continue to rise, with more than 3 billion phishing emails sent daily worldwide.

Experts recommend creating unique, complex passwords or even memorable passphrases like “CrocApplePurseBike.” Associating it with a story can help you recall it easily.

Enter passkeys: a new way to log in

Emerging around four years ago, passkeys use public-key cryptography, a process that creates two linked keys—one public and one private.

The public key is shared with the website.
The private key stays safely stored on your device.

When you log in, your device signs a unique challenge using the private key, confirming your identity without sending any password. To authorize this action, you’ll usually verify with your fingerprint or face ID, ensuring that only you can access your accounts.

Even if the public key is stolen, it’s useless without the private one—making passkeys inherently phishing-proof and more secure. Each passkey is also unique to the website, so it can’t be reused elsewhere.

Why passkeys are better

Passkeys eliminate the need to remember passwords or type them manually. Since they’re tied to your device and require biometric approval, they’re both more convenient and more secure.

However, the technology isn’t yet universal. Compatibility issues between platforms like Apple and Microsoft have slowed adoption, though these gaps are closing as newer devices and systems improve integration.

The road ahead

From a cybersecurity perspective, passkeys are clearly the superior option—they’re stronger, resistant to phishing, and easy to use. But widespread adoption will take time. Many websites still rely on traditional passwords, and transitioning millions of users will be a long process.

Until then, maintaining good password hygiene remains essential: use unique passwords for every account, enable multi-factor authentication, and change any reused credentials immediately.

The Growing Role of Cybersecurity in Protecting Nations



 

National Security

Artificial Intelligence Threats Cyber Defense Strategy Cyber Diplomacy Cyber Security Cybercrime Prevention Cybersecurity Data protection Digital Resilience Global Cyber Governance National Security

The Growing Role of Cybersecurity in Protecting Nations

It is becoming increasingly complex and volatile for nations to cope with the threat landscape facing them in an age when the boundaries between the digital and physical worlds are rapidly dissolving. Cyberattacks have evolved from isolated incidents of data theft to powerful instruments capable of undermining economies, destabilising governments and endangering the lives of civilians.

It is no secret that the accelerating development of technologies, particularly generative artificial intelligence, has added an additional dimension to the problem at hand. A technology that was once hailed as a revolution in innovation and defence, GenAI has now turned into a double-edged sword.

It has armed malicious actors with the capability of automating large-scale attacks, crafting convincing phishing scams, generating convincing deepfakes, and developing adaptive malware that is capable of sneaking past conventional defences, thereby giving them an edge over conventional adversaries.

Defenders are facing a growing set of mounting pressures as adversaries become increasingly sophisticated. There is an estimated global cybersecurity talent gap of between 2.8 and 4.8 million unfilled positions, putting nearly 70% of organisations at risk. Meanwhile, regulatory requirements, fragile supply chains, and an ever-increasing digital attack surface have compounded vulnerabilities across a broad range of industries.

Geopolitics has added to the tensions against this backdrop, exacerbated by the ever-increasing threat of cybercrime. There is no longer much difference between espionage, sabotage, and warfare when it comes to state-sponsored cyber operations, which have transformed cyberspace into a crucial battleground for national power.

It has been evident in recent weeks that digital offensives can now lead to the destruction of real-world infrastructure—undermining public trust, disrupting critical systems, and redefining the very concept of national security—as they have been used to attack Ukraine's infrastructure as well as campaigns aimed at crippling essential services around the globe.

In India, there is an ambitious goal to develop a $1 trillion digital economy by the year 2025, and cybersecurity has quietly emerged as a key component of that transformation. In order to support the nation's digital expansion—which covers financial, commerce, healthcare, and governance—a fragile yet vital foundation of trust is being built on a foundation of cybersecurity, which has now become the scaffolding for this expansion.

It has become more important than ever for enterprises to be capable of anticipating, detecting, and neutralising threats, as artificial intelligence, cloud computing, and data-driven systems are increasingly integrated into their operations. This ability is critical not only to their resilience but also to their long-term competitiveness. In addition to the increasing use of digital technologies, the complexity of safeguarding interconnected ecosystems has increased as well.

During October's Cybersecurity Awareness Month 2025, a renewed focus has been placed on strengthening artificial intelligence-powered defences as well as encouraging collective security measures. As a senior director at Acuity Knowledge Partners, Sameer Goyal stated that India's financial and digital sectors are increasingly operating within an always-on, API-driven environment defined by instant payments, open platforms, and expanding integrations with third-party services—factors that inevitably widen the attack surface for hackers. He argued that security was not an optional provision; it was fundamental.

Taking note of the rise in sophisticated threats such as account takeovers, API abuse, ransomware, and deepfake fraud, he indicated that security is not optional. According to him, the primary challenge of a company is to protect its customers' trust while still providing frictionless digital experiences. According to Goyal, forward-thinking organisations are focusing on three key strategic pillars to ensure their digital experiences are frictionless: adopting zero-trust architectures, leveraging artificial intelligence for threat detection, and incorporating secure-by-design principles into development processes.

Despite this caution, he warned that technology alone cannot guarantee security. For true cyber readiness, employees should be well-informed, well-practised and well-rehearsed in incident response playbooks, as well as participate in proactive red-team and purple-team simulations. “Trust is our currency in today’s digital age,” he said. “By combining zero-trust frameworks with artificial intelligence-driven analytics, cybersecurity has become much more than compliance — it is becoming a crucial element of competitiveness.”

Among the things that make cybersecurity an exceptionally intricate domain of diplomacy are its deep entanglement with nearly every dimension of international relations-economics, military, and human rights, to name a few. As a result of the interconnectedness of our society, data movement across borders has become as crucial to global commerce as capital and goods moving across borders. It is no longer just tariffs and market access that are at the centre of trade disputes.

It is also about the issues of data localisation, encryption standards, and technology transfer policies that matter the most. While the General Data Protection Regulation (GDPR) sets an international standard for data protection, it has also become a focal point in a number of ongoing debates regarding digital sovereignty and cross-border data governance that have been ongoing for some time.

As far as defence and security are concerned, geopolitical stakes are of equal importance to those of air, land, and sea. Since NATO officially recognised cyberspace in 2016—as a distinct operational domain comparable with the other three domains—allies have expanded their collective security frameworks to include cyber defence. To ensure a rapid collective response to cyber incidents, nations share threat intelligence, conduct simulation exercises, and harmonise their policies in coordination with one another.

The alliance still faces a dilemma which is very sensitive and unresolved to the point where determining the threshold at which a cyberattack would qualify as an act of aggression enough to trigger Article 5, which is the cornerstone of NATO's commitment to mutual defence. Cybersecurity has become inextricable from concerns about human rights and democracy as well, in addition to commerce and defence.

In recent years, authoritarian states have increasingly abused digital tools for spying on dissidents, manipulating public discourse, and undermining democratic institutions abroad. As a consequence of these actions, the global community has been forced to examine issues of accountability and ethical technology use. The diplomatic community struggles with the establishment of international norms for responsible behaviour in cyberspace while it must navigate profound disagreements over internet governance, censorship, and the delicate balancing act between national security and individuals' privacy through the process of developing ethical norms.

There is no doubt that the tensions around cybersecurity have emerged over time from merely being a technical issue to becoming one of the most consequential arenas in modern diplomacy-shaping not only international stability, but also the very principles that underpin global cooperation. Global cybersecurity leaders are facing an age of uncertainty in the face of a raging tide of digital threats to economies and societies around the world.

Almost six in ten executives, according to the Global Cybersecurity Outlook 2025, feel that cybersecurity risks have intensified over the past year, with almost 60 per cent of them admitting that geopolitical tensions are directly influencing their defence strategies in the near future. According to the survey, one in three CEOs is most concerned about cyber espionage, data theft, and intellectual property loss, and another 45 per cent are concerned about disruption to their business operations.

Even though cybersecurity has increasingly become a central component of corporate and national strategy, these findings underscore a broader truth: cybersecurity is no longer just for IT departments anymore. Experts point out that the threat landscape has become increasingly complex over the past few years, but generative artificial intelligence offers both a challenge and an opportunity as well.

Several threat actors have learned to weaponise artificial intelligence so they can craft realistic deepfakes, automate phishing campaigns, and develop adaptive malware, but defenders are also utilising the same technology to enhance their resilience. The advent of AI-enabled security systems has revolutionised the way organisations anticipate and react to threats by analysing anomalies in real time, automating response cycles, and simulating complex attack vectors.

It is important to note, however, that progress remains uneven, with large corporations and developed economies being able to deploy cutting-edge artificial intelligence defences, but smaller businesses and public institutions continue to suffer from outdated infrastructure and a lack of talented workers, which makes global cybersecurity preparedness a growing concern. However, several nations are taking proactive steps toward closing this gap.

An example is the United Arab Emirates, which embraces cybersecurity not just as a technology imperative but also as a societal responsibility. A National Cybersecurity Strategy for the UAE was unveiled in early 2025. It is based on five pillars — governance, protection, innovation, capacity building, and partnerships. It is structured around five core pillars. It was also a result of these efforts that the UAE Cybersecurity Council, in partnership with the Tawazun Council and Lockheed Martin, established a Cybersecurity Centre of Excellence, which would develop domestic expertise and align national capabilities with global standards.

As a result of its innovative Public-Private-People model, which combines school curricula with nationwide drill and strengthens coordination between government and private sector, the country can further embed cybersecurity awareness across society. As a result of this approach, a more general realisation is taking shape globally: cybersecurity should be enshrined in the fabric of national governance, not as a secondary item but as a fundamental aspect of national governance. If cyber resilience is to be reframed as a core component of national security, sustained investment in infrastructure, talent, and innovation is needed, as well as rigorous oversight at the board and policy levels.

The plan calls for the establishment of red-team exercises, stress testing, and cross-border intelligence sharing to prevent local incidents from spiralling into systemic crises. The collective action taken by these institutions marks an important shift in global security thinking, a shift that recognises that an economy's vitality and geopolitical stability are inseparable from the resilience of a nation's digital infrastructure.

In the era of global diplomacy, cybersecurity has grown to be a key component, but it is much more than just an administrative adjustment or a passing policy trend. In this sense, it indicates the acknowledgement that all of the world's security, economic stability, and individual rights are inextricably intertwined within the fabric of the internet and cyberspace that we live in today.

Considering the sophistication and borderless nature of threats in today's world, the field of cyber diplomacy is becoming more and more important as a defining arena of global engagement as a result. As much as traditional forms of military and economic statecraft play a significant role in shaping global stability, the ability to foster cooperation, set shared norms, and resolve digital conflicts holds as much weight.

In the international community, the central question facing it is no longer whether the concept of cybersecurity deserves to be included in diplomatic dialogue, but rather how effectively global institutions can implement this recognition into tangible results in the future. To maintain peace in an era where the next global conflict could start with just one line of malicious code, it is becoming imperative to establish frameworks for responsible behaviour, enhance transparency, and strengthen crisis communications mechanisms.

Quite frankly, the stakes are simply too high, as if they were not already high enough. Considering how easily a cyberattack can disrupt power grids, paralyse transportation systems, or compromise electoral integrity, diplomacy in the digital sphere has become crucial to the protection of international order, especially in a world where cyberattacks are a daily occurrence.

The cybersecurity diplomacy sector is now a cornerstone of 21st-century governance – vital to safeguarding the interests of not only national governments, but also the broader ideals of peace, prosperity, and freedom that are at the foundation of globalisation. During these times of technological change and geopolitical uncertainty, the reality of cyber security is undeniable — it is no longer a specialized field but rather a shared global responsibility that requires all nations, corporations, and individuals to embrace a mindset in which digital trust is seen as an investment in long-term prosperity, and cyber resilience is seen as a crucial part of enhancing long-term security.

The building of this future will not only require advanced technologies but also collaboration between governments, industries, and academia to develop skilled professionals, standardise security frameworks, and create a transparent approach to threat intelligence exchange. For the digital order to remain secure and stable, it will be imperative to raise public awareness, develop ethical technology, and create stronger cross-border partnerships.

Those countries that are able to embrace cybersecurity in governance, innovation, and education right now will define the next generation of global leaders. There will come a point in the future when the strength of digital economies will not depend merely on their innovation, but on the depth of the protection they provide, for the interconnected world ahead will demand a currency of security that will represent progress in the long run.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

Report Abuse

About Me

Footer About

Labels

Showing result(s) for

Popular Posts

Pages

How Security Teams Can Turn AI Into a Practical Advantage

DOJ Disrupts Major Myanmar-Based Scam Targeting TickMill Users

Germany’s Cyber Skills Shortage Leaves Companies Exposed to Record Cyberattacks

Mass Router Hijack Targets End-of-Life ASUS Devices

Continuous Incident Response Is Redefining Cybersecurity Strategy

Sweden Confirms Power Grid Breach Amid Growing Ransomware Concerns

Unsecured Corporate Data Found Freely Accessible Through Simple Searches

Attackers Exploit Critical Windows Server Update Services Flaw After Microsoft’s Patch Fails

iOS 26 Update Erases Key Forensic Log, Hindering Spyware Detection on iPhones

Stop Using Public Wi-Fi: Critical Security Risks Explained

Passkeys vs Passwords: Why Passkeys Are the Future of Secure Logins

Why passwords remain risky

Enter passkeys: a new way to log in

Why passkeys are better

The road ahead

The Growing Role of Cybersecurity in Protecting Nations

Footer About

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

About Me

Footer About

Labels

Showing result(s) for

Popular Posts

Pages

Menu Item

Why passwords remain risky

Enter passkeys: a new way to log in

Why passkeys are better

The road ahead