Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Threat Intelligence. Show all posts
Threat Intelligence
agentic AI AI Risk Management Cloud Governance Cyber defense Cyber Security Data Resilience Identity Protection SaaS security security automation Threat Intelligence

Balancing Rapid Innovation and Risk in the New Era of SaaS Security


 

The accelerating pace of technological innovation is leaving a growing number of organizations unwittingly exposing their organization to serious security risks as they expand their reliance on SaaS platforms and experiment with emerging agent-based AI algorithms in an effort to thrive in the age of digital disruption. Businesses are increasingly embracing cloud-based services to deliver enterprise software to their employees at breakneck speed. 

With this shift toward cloud-delivered services, it has become necessary for them to adopt new features at breakneck speed-often without pausing to implement, or even evaluate, the basic safeguards necessary to protect sensitive corporate information. There has been an unchecked acceleration of the pace of adoption of SaaS, creating a widening security gap that has renewed the urgent need for action from the Information Security community to those who are responsible for managing SaaS ecosystems. 

Despite the fact that frameworks such as the NIST Cybersecurity Framework (CSF) have served as a guide for InfoSec professionals for many years, many SaaS teams are only now beginning to use its rigorously defined functions—Govern, Identify, Protect, Detect, Respond, and Recover—particularly considering that NIST 2.0 emphasizes identity as the cornerstone of cyber defenses in a manner unparalleled to previous versions. 

Silverfort's identity-security approach is one of many new approaches emerging to help organizations meet these ever-evolving standards against this backdrop, allowing them to extend MFA to vulnerable systems, monitor lateral movements in real-time, and enforce adaptive controls more accurately. All of these developments are indicative of a critical moment for enterprises in which they need to balance relentless innovation with uncompromising security in a SaaS-driven, AI-driven world that is increasingly moving towards a SaaS-first model. 

The enterprise SaaS architecture is evolving into expansive, distributed ecosystems built on a multitenant infrastructure, microservices, and an ever-expanding web of open APIs, keeping up with the sheer scale and fluidity of modern operations is becoming increasingly difficult for traditional security models. 

The increasing complexity within an organization has led to enterprises focusing more on intelligent and autonomous security measures, making use of behavioral analytics, anomaly detection, and artificial intelligence-driven monitoring to identify threats much in advance of them becoming active. 

As opposed to conventional signature-based tools, advanced systems can detect subtle deviations from user behavior in real-time, neutralize risks that would otherwise remain undetected, and map user behavior in a way that will never be seen in the future. Innovators in the SaaS security space, such as HashRoot, are leading the way by integrating AI into the core of SaaS security workflows. 

A combination of predictive analytics and intelligent misconfiguration detection in HashRoot's AI Transformation Services can be used to improve aging infrastructures, enhance security postures, and construct proactive defense mechanisms that can keep up with the evolving threat landscape of 2025 and the unpredictable threats ahead of us. 

During the past two years, there has been a rapid growth in the adoption of artificial intelligence within enterprise software, which has drastically transformed the SaaS landscape at a rapid pace. According to new research, 99.7 percent of businesses rely on applications with AI capabilities built into them, which demonstrates how the technology is proven to boost efficiency and speed up decision-making for businesses. 

There is a growing awareness that the use of AI-enhanced SaaS tools is becoming increasingly common in the workplace, and that these systems have become increasingly integrated in every aspect of the work process. However, as organizations begin to grapple with the sweeping integration of AI into their businesses, a whole new set of risks emerge. 

As one of the most pressing concerns arises, a loss of control of sensitive information and intellectual property is a significant concern, raising complex concerns about confidentiality and governance, as well as long-term competitive exposure, as AI models often consume sensitive data and intellectual property. 

Meanwhile, the threat landscape is shifting as malicious actors are deploying sophisticated impersonator applications to mimic legitimate SaaS platforms in an attempt to trick users into granting them access to confidential corporate data through impersonation applications. It is even more challenging because AI-related vulnerabilities are traditionally identified and responded to manually—an approach which requires significant resources as well as slowing down the speed at which fast-evolving threats can be countered. 

Due to the growing reliance on cloud-based AI-driven software as a service, there has never been a greater need for automated, intelligent security mechanisms. It is also becoming increasingly apparent to CISOs and IT teams that disciplined SaaS configuration management is a critical priority. This is in line with CSF's Protect function under Platform Security, which has a strong alignment with the CSF's Protect function. In the recent past, organizations were forced to realize that they cannot rely solely on cloud vendors for secure operation. 

A significant share of cloud-related incidents can be traced back to preventable misconfigurations. Modern risk governance has become increasingly reliant on establishing clear configuration baselines and ensuring visibility across multiple platforms. While centralized tools can simplify oversight, there are no single solutions that can cover the full spectrum of configuration challenges. As a result of the recent development of multi-SaaS management systems, native platform controls and the judgment of skilled security professionals working within the defense-in-depth model, effective protection has become increasingly important. 

It is important to recognize that SaaS security is never static, so continuous monitoring is indispensable to protect against persistent threats such as authorized changes, accidental modifications, and gradual drifts from baseline security. It is becoming increasingly apparent that Agentic AI is playing a transformative role here. 

By detecting configuration drift at scale, correcting excessive permissions, and maintaining secure settings at a pace that humans alone can never match, it has begun to play a transformative role. In spite of this, configuration and identity controls are not all that it takes to secure an organization. Many organizations continue to rely on what is referred to as an “M&M security model” – a hardened outer shell with a soft, vulnerable center.

Once a valid user credential or API key is compromised, an attacker may be able to pass through perimeter defenses and access sensitive data without getting into the system. A strong SaaS data governance model based on the principles of identifying, protecting, and recovering critical information, including SaaS data governance, is essential to overcoming these challenges. This effort relies on accurate classification of data, which ensures that high-value assets are protected from unauthorised access, field level encryption, and adequate protection when they are copied into environments that are of lower security. 

There is now a critical role that automated data masking plays in preventing production data from being leaked into these environments, where security controls are often weak and third parties often have access to the data. In order to ensure compliance with evolving privacy regulations when personal information is used in testing, the same level of oversight is required as it is with production data. This evaluation must also be repeated periodically as policies and administrative practices change in the future. 

Within SaaS ecosystems, it is equally important to ensure that data is maintained in a manner that is both accurate and available. Although the NIST CSF emphasizes the need to implement a backup strategy that preserves data, allows precise recovery, and maintains uninterrupted operation, the service provider is responsible for maintaining the reliability of the underlying infrastructure. 

Modern SaaS environments require the ability to recover only the affected data without causing a lot of disruption, as opposed to traditional enterprise IT, which often relies on broad rollbacks to previous system states. It is crucial to maintain continuity in an enterprise-like environment by using granular resilience, especially because in order for agentic AI systems to function effectively and securely, they must have accurate, up-to-date information. 

Together, these measures demonstrate that safeguarding SaaS environments has evolved into a challenging multidimensional task - one that requires continuous coordination between technology teams, information security leaders, and risk committees in order to ensure that innovation can take place in a secure and scalable manner. 

Organizations are increasingly relying on cloud applications to conduct business, which means that SaaS risk management is becoming a significant challenge for security vendors hoping to meet the demands of enterprises. Businesses nowadays need more than simple discovery tools that identify which applications are being used to determine which application is being used. 

There is a growing expectation that platforms will be able to classify SaaS tools accurately, assess their security postures, and take into consideration the rapidly growing presence of artificial intelligence assistants, large language model-based applications, which are now able to operate independently across corporate environments, as well as the growing presence of AI assistants. A shift in SaaS intelligence has led to the need for enriched SaaS intelligence, an advanced level of insight that allows vendors to provide services that go beyond basic visibility. 

The ability to incorporate detailed application classification, function-level profiling, dynamic risk scoring, and the detection of shadow SaaS and unmanaged AI-driven services can provide security providers with a more comprehensive, relevant and accurate platform that will enable a more accurate assessment of an organization's risks. 

Vendors that are able to integrate enriched SaaS application insights into their architectures will be at an advantage in the future. Vendors that are able to do this will be able to gain a competitive edge as they begin to address the next generation of SaaS and AI-related risks. Businesses can close persistent blind spots by using enriched SaaS application insights into their architectures. 

In an increasingly artificial intelligence-enabled world, which will essentially become a machine learning-enabled future, it will be the ability of platforms to anticipate emerging vulnerabilities, rather than just responding to them, that will determine which platforms will remain trusted partners in safeguarding enterprise ecosystems in the future. 

A company's path forward will ultimately be shaped by its ability to embrace security as a strategic enabler rather than a roadblock to innovation. Using continuous monitoring, identity-centric controls, SaaS-enhanced intelligence, and AI-driven automation as a part of its operational fabric, enterprises are able to modernize at a speed without compromising trust or resilience in their organizations. 

It is imperative that companies that invest now, strengthening governance, enforcing data discipline, and demanding greater transparency from vendors, will have the greatest opportunity to take full advantage of SaaS and agentic AI, while also navigating the risks associated with an increasingly volatile digital future.
Read more »
Vulnerability Exploit
Clop Group Cybersecurity Breach Data Breach Enterprise security GlobalLogic Incident response Oracle Zero-Day Ransomware attack SQL Threat Intelligence Vulnerability Exploit

GlobalLogic Moves to Protect Workforce After Oracle-related Data Theft

 


A new disclosure that underscores the increasing sophistication of enterprise-level cyberattacks underscores the need to take proactive measures against them. GlobalLogic has begun notifying more than ten thousand of its current and former employees that their personal information was compromised as a result of a security breach connected to an Oracle E-Business Suite zero-day flaw. 

An engineering services firm headquartered in the United States, owned by Hitachi, announced the breach to regulators after determining that an unknown attacker exploited an unpatched vulnerability in the Oracle platform, the core platform used to manage finance, human resources, and operational processes at the company, so that sensitive data belonging to 10,000 employees was stolen. 

The Maine Attorney General's office reported to the Maine State Attorney General that attackers had infiltrated GlobalLogic's environment with an advanced SQL-injection chain mapped to MITRE techniques T1190 and T1040, deploying a persistent backdoor through an Oracle Forms vulnerability, obtaining extensive employee data, including identification, contact information, passport information, tax and salary data, and bank account numbers, as well as extensive employee records. 

The signs of compromise point to a coordinated data-extortion campaign in which privilege-escalation events were used to maintain prolonged access to data. Indicators like malicious IP ranges and rogue domains indicate that the attack was coordinated. In the aftermath of Oracle's security patches being released, GlobalLogic announced that an immediate investigation had been conducted, and the company is now urging the rapid implementation of vendor updates, enhanced logging, and temporary hardening measures in order to mitigate further risk. 

With Hitachi's acquisition of the company in 2021, it has now served more than 600 enterprise clients around the world, and the company has officially reported the breach to California and Maine regulators, who confirmed that more than 10,500 current and former employees' personal information was exposed in the attack. 

During GlobalLogic's investigation, it was discovered that the intrusion was a part of a larger campaign that was coordinated by the Clop ransomware group, which has been exploiting a zero-day flaw in Oracle's E-Business Suite since at least July in order to snare huge amounts of corporate information. There have been reports that several companies have been caught in this wave of attacks, and many are only aware of their compromise after they receive extortion emails from extortionists. Analysts are claiming that dozens of companies have been compromised.

It is reported by GlobalLogic that the company discovered the breach on October 9 but it was later discovered that the attackers gained access to the server on July 10, with the most recent malicious activity occurring on August 20 according to GlobalLogic's filings. Despite the fact that the incident was contained to the Oracle platform, the sheer amount of sensitive and high-level data stolen—from contact information to internal identifiers to passports to tax records to salary information to bank account numbers—does not make it easy for the severity of the attack to be noted. 

A spokesperson for the company said that they immediately activated their incident response protocols, notified the law enforcement, and consulted external forensic experts after the zero-day exploit was discovered (CVE-2025-61882) was discovered, and that Oracle's patch for the vulnerability (CVE-2025-61882) was applied once it was released. 

Security researchers later confirmed that Clop hacked numerous victims over a period of several months by exploiting multiple vulnerabilities within the same platform, demanding ransoms that often reached eight-figure sums. It has been reported that nearly 30 organizations are currently listed on Clop's website after a breach of their systems was discovered last week. If these organizations do not pay the restitution, they will face public exposure. The kind of information exposed in the GlobalLogic breach highlights how sophisticated the attackers were. 

According to the company's disclosure, the stolen data was representative of a wide range of personal information that is typically kept in human resources systems, such as names, home addresses, telephone numbers, addresses for emergency contacts, and identifiers for internal employees.

There were a variety of individuals whose exposure to cyber attacks was far more in-depth and involved email addresses, dates and countries of birth, nationalities, passports, tax and national identification numbers such as Social Security details, salary information, and full banking credentials for their online banking accounts. 

A ransomware group known as Clop has been associated with several high-profile Oracle EBS data theft operations, as well as adding major companies to its Tor-based leak site, including Harvard University, Envoy Air, and The Washington Post, whose stolen data is already available via torrent downloads from a number of sources. Despite the fact that GlobalLogic's information has not yet appeared on the leak portal, security analysts have said that the omission may be indicative of ongoing negotiations, or that a ransom has already been paid by the company. 

The company spokesperson refused to comment on whether any demands were being addressed, but confirmed Clop has publicly claimed responsibility for the breach. Now that the gang is being questioned more closely by the U.S. authorities after previously exploiting Accellion FTA, GoAnywhere MFT, Cleo, and MOVEit Transfer in mass-scale data breaches, they are under greater scrutiny than ever before. 

According to the State Department, there is a reward for intelligence that can be provided tying the group's operations to a foreign government worth up to $10 million. In light of this incident, industry officials are calling for improved patch management, proactive threat hunting, and tighter oversight of third-party platforms supporting critical business operations that are used by critical business units. 

According to GlobalLogic's analyst, the company's experience shows just how quickly a single vulnerability can lead to widespread damage when exploited by highly coordinated ransomware groups, particularly if the vulnerability has not yet been patched. 

Despite continuing to investigate Clop's broader campaign, experts urge organizations to adopt continuous monitoring, strengthen vendor risk controls, and prepare for the likelihood that they will be the victim of future zero day exploits in the following years, as the modern enterprise threat landscape is now characterized by zero-day threats.
Read more »
Threat Intelligence
ClickFix Cyber Security Malicious Campaign Social Engineering Threat Intelligence

ClickFix: The Silent Cyber Threat Tricking Families Worldwide

 

ClickFix has emerged as one of the most pervasive and dangerous cybersecurity threats in 2025, yet remains largely unknown to the average user and even many IT professionals. This social engineering technique manipulates users into executing malicious scripts—often just a single line of code—by tricking them with fake error messages, CAPTCHA prompts, or fraudulent browser update alerts.

The attack exploits the natural human desire to fix technical problems, bypassing most endpoint protections and affecting Windows, macOS, and Linux systems. ClickFix campaign typically begin when a victim encounters a legitimate-looking message urging them to run a script or command, often on compromised or spoofed websites. 

Once executed, the script connects the victim’s device to a server controlled by attackers, allowing stealthy installation of malware such as credential stealers (e.g., Lumma Stealer, SnakeStealer), remote access trojans (RATs), ransomware, cryptominers, and even nation-state-aligned malware. The technique is highly effective because it leverages “living off the land” binaries, which are legitimate system tools, making detection difficult for security software.

ClickFix attacks have surged by over 500% in 2025, accounting for nearly 8% of all blocked attacks and ranking as the second most common attack vector after traditional phishing. Threat actors are now selling ClickFix builders to automate the creation of weaponized landing pages, further accelerating the spread of these attacks. Victims are often ordinary users, including families, who may lack the technical knowledge to distinguish legitimate error messages from malicious ones.

The real-world impact of ClickFix is extensive: it enables attackers to steal sensitive information, hijack browser sessions, install malicious extensions, and even execute ransomware attacks. Cybersecurity firms and agencies are urging users to exercise caution with prompts to run scripts and to verify the authenticity of error messages before taking any action. Proactive human risk management and user education are essential to mitigate the threat posed by ClickFix and similar social engineering tactics.
Read more »
Threat Intelligence
Cloud Security continuous monitoring Cyber Security Cybersecurity Endpoint Defense Incident response ransomware protection Risk Management SOC Operations Threat Intelligence

Continuous Incident Response Is Redefining Cybersecurity Strategy

 


With organizations now faced with relentless digital exposure, continuous security monitoring has become an operational necessity instead of a best practice, as organizations navigate an era where digital exposure is ubiquitous. In 2024, cyber-attacks will increase by nearly 30%, with the average enterprise having to deal with over 1,600 attempted intrusions a week, with the financial impact of a data breach regularly rising into six figures. 

Even so, the real crisis extends well beyond the rising level of threats. In the past, cybersecurity strategies relied on a familiar formula—detect quickly, respond promptly, recover quickly—but that cadence no longer suffices in an environment that is characterized by adversaries automating reconnaissance, exploiting cloud misconfiguration within minutes, and weaponizing legitimate tools so that they can move laterally far faster than human analysts are able to react. 

There has been a growing gap between what organizations can see and the ability to act as the result of successive waves of innovation, from EDR to XDR, as a result of which they have widened visibility across sprawling digital estates. The security operations center is already facing unprecedented complexity. Despite the fact that security operations teams juggle dozens of tools and struggle with floods of alerts that require manual validation, organisations are unable to act as quickly as they should. 

A recent accelerated disconnect between risk and security is transforming how security leaders understand risks and forcing them to face a difficult truth: visibility without speed is no longer an effective defence. When examining the threat patterns defining the year 2024, it becomes more apparent why this shift is necessary. According to security firms, attackers are increasingly using stealthy, fileless techniques to steal from their victims, with nearly four out of five detections categorised as malware-free today, with the majority of attacks classified as malware-free. 

As a result, ransomware activity has continued to climb steeply upward, rising by more than 80% on a year-over-year basis and striking small and midsized businesses the most disproportionately, accounting for approximately 70% of all recorded incidents. In recent years, phishing campaigns have become increasingly aggressive, with some vectors experiencing unprecedented spikes - some exceeding 1,200% - as adversaries use artificial intelligence to bypass human judgment. 

A number of SMBs remain structurally unprepared in spite of these pressures, with the majority acknowledging that they have become preferred targets, but three out of four of them continue to use informal or internally managed security measures. These risks are compounded by human error, which is responsible for an estimated 88% of reported cyber incidents. 

There have been staggering financial consequences as well; in the past five years alone, the UK has suffered losses of more than £44 billion, resulting in both immediate disruption and long-term revenue losses. Due to this, the industry’s definition of continuous cybersecurity is now much broader than periodic audits. 

It is necessary to maintain continuous threat monitoring, proactive vulnerability and exposure management, disciplined identity governance, sustained employee awareness programs, regularly tested incident response playbooks, and ongoing compliance monitoring—a posture which emphasizes continuous evaluation rather than reactive control as part of an operational strategy. Increasingly complex digital estates are creating unpredictable cyber risks, which are making continuous monitoring an essential part of modern defence strategies. 

Continuous monitoring is a real time monitoring system that scans systems, networks, and cloud environments in real time, in order to detect early signs of misconfiguration, compromise, or operational drift. In contrast to periodic checks which operate on a fixed schedule and leave long periods of exposure, continuous monitoring operates in real time. 

The approach outlined above aligns closely with the NIST guidance, which urges organizations to set up an adaptive monitoring strategy capable of ingesting a variety of data streams, analysing emerging vulnerabilities, and generating timely alerts for security teams to take action. Using continuous monitoring, organizations can discover latent weaknesses that are contributing to their overall cyber posture. 

Continuous monitoring reduces the frequency and severity of incidents, eases the burden on security personnel, and helps them meet increasing regulatory demands. Even so, maintaining such a level of vigilance remains a challenge, especially for small businesses that lack the resources, expertise, and tooling to operate around the clock in order to stay on top of their game. 

The majority of organizations therefore turn to external service providers in order to achieve the scalability and economic viability of continuous monitoring. Typically, effective continuous monitoring programs include four key components: a monitoring engine, analytics that can be used to identify anomalies and trends on a large scale, a dashboard that shows key risk indicators in real time, and an alerting system to ensure that emerging issues are quickly addressed by the appropriate staff. 

With the help of automation, security teams are now able to process a great deal of telemetry in a timely and accurate manner, replacing outdated or incomplete snapshots with live visibility into organisational risk, enabling them to respond successfully in a highly dynamic threat environment. 

Continuous monitoring can take on a variety of forms, depending on the asset in focus, including endpoint monitoring, network traffic analysis, application performance tracking, cloud and container observability, etc., all of which provide an important layer of protection against attacks as they spread across every aspect of the digital infrastructure. 

It has also been shown that the dissolution of traditional network perimeters is a key contributor to the push toward continuous response. In the current world of cloud-based workloads, SaaS-based ecosystems, and remote endpoints, security architectures mustwork as flexible and modular systems capable of correlating telemetrics between email, DNS, identity, network, and endpoint layers, without necessarily creating new silos within the architecture. 

Three operational priorities are usually emphasized by organizations moving in this direction: deep integration to keep unified visibility, automation to handle routine containment at machine speed and validation practices, such as breach simulations and posture tests, to ensure that defence systems behave as they should. It has become increasingly common for managed security services to adopt these principles, and this is why more organizations are adopting them.

909Protect, for instance, is an example of a product that provides rapid, coordinated containment across hybrid environments through the use of automated detection coupled with continuous human oversight. In such platforms, the signals from various security vectors are correlated, and they are layered on top of existing tools with behavioural analysis, posture assessment and identity safeguards in order to ensure that no critical alert goes unnoticed while still maintaining established investments. 

In addition to this shift, there is a realignment among the industry as a whole toward systems that are built to be available continuously rather than undergoing episodic interventions. Cybersecurity has gone through countless “next generation” labels, but only those approaches which fundamentally alter the behavior of operations tend to endure, according to veteran analysts in the field. In addressing this underlying failure point, continuous incident response fits perfectly into this trajectory. 

Organizations are rarely breached because they have no data, but rather because they do not act on it quickly enough or cohesively. As analysts argue, the path forward will be determined by the ability to combine automation, analytics, and human expertise into a single adaptive workflow that can be used in an organization's entirety. 

There is no doubt that the organizations that are most likely to be able to withstand emerging threats in the foreseeable future will be those that approach security as a living, constantly changing system that is not only based on the visible, but also on the ability of the organization to detect, contain, and recover in real time from any threats as they arise. 

In the end, the shift toward continuous incident response is a sign that cybersecurity resilience is more than just about speed anymore, but about endurance as well. Investing in unified visibility, disciplined automation, as well as persistent validation will not only ensure that the path from detection to containment is shortened, but that the operations remain stable over the longer term as well.

The advantage will go to those who treat security as an evolving ecosystem—one that is continually refined, coordinated across teams and committed to responding in a continuity similar to the attacks used by adversaries.
Read more »
Zero Trust
Credential Stuffing Cybersecurity Breach Data Leak Digital Risk Malware Logs Password Security Privacy Stolen Credentials Threat Intelligence Zero Trust

Digital Security Threat Escalates with Exposure of 1.3 Billion Passwords


 

One of the starkest reminders of just how easily and widely digital risks can spread is the discovery of an extensive cache of exposed credentials, underscoring the persistent dangers associated with password reuse and the many breaches that go unnoticed by the public. Having recently clarified the false claims of a large-scale Gmail compromise in the wake of Google’s recent clarification, the cybersecurity community is once again faced with vast, attention-grabbing figures which are likely to create another round of confusion. 

Approximately 2 billion emails were included in the newly discovered dataset, along with 1.3 billion unique passwords that were found in the dataset, and 625 million of them were not previously reported to the public breach repository. It has been emphasised that Troy Hunt, the founder of Have I Been Pwned, should not use sensationalism when discussing this discovery, as he stresses the importance of the disclosure. 

It is important to note that Hunt noted that he dislikes hyperbolic news headlines about data breaches, but he stressed that in this case, it does not require exaggeration since the data speaks for itself. Initially, the Synthient dataset was interpreted as a breach of Gmail before it was clarified to reveal that it was actually a comprehensive collection gathered from stealer logs and multiple past breaches spanning over 32 million unique email domains, and that it was a comprehensive collection. 

There's no wonder why Gmail appears more often than other email providers, as it is the world's largest email service provider. The collection, rather than a single event, represents a very extensive collection of compromised email and password pairs, which is exactly the kind of material that is used to generate credential-stuffing attacks, where criminals use recycled passwords to automate attempts to access their banking, shopping, and other online accounts. 

In addition to highlighting the dangers associated with unpublicized or smaller breaches, this new discovery also underscores the danger that even high-profile breaches can pose when billions of exposed credentials are quietly redirected to attackers. This newly discovered cache is not simply the result of a single hack, but is the result of a massive aggregation of credentials gathered from earlier attacks, as well as malware information thieves' logs, which makes credential-based attacks much more effective.

A threat actor who exploits reused passwords will have the ability to move laterally between personal and corporate services, often turning a compromised login into an entry point into an increasingly extensive network. A growing number organisations are still dependent on password-only authentication, which poses a high risk to businesses due to the fact that exposed credentials make it much easier for attackers to target business systems, cloud platforms, and administrative accounts more effectively. 

The experts emphasised the importance of adopting stronger access controls as soon as possible, including the generation of unique passwords by trusted managers, the implementation of universal two-factor authentication, and internal checks to identify credentials which have been reused or have previously been compromised. 

For attackers to be able to weaponise these massive datasets, enterprises must also enforce zero-trust principles, implement least-privilege access, and deploy automated defences against credential-stuffing attempts. When a single email account is compromised, it can easily cascade into financial, cloud or corporate security breaches as email serves as the central hub for recovering accounts and accessing linked services. 

Since billions of credentials are being circulated, it is clear that both individuals and businesses need to take a proactive approach to authentication, modernise security architecture, and treat every login as if it were a potential entry point for attackers. This dataset is also notable for its sheer magnitude, representing the largest collection of data Have I Been Pwned has ever taken on, nearly triple the volume of its previous collection.

As compiled by Synthient, a cybercriminal threat intelligence initiative run by a college student, the collection is drawn from numerous sources where stolen credentials are frequently published by cybercriminals. There are two highly volatile types of compromised data in this program: stealer logs gathered from malware on infected computers and large credential-stuffing lists compiled from earlier breaches, which are then combined, repackaged and traded repeatedly over the underground networks. 

In order to process the material, HIBP had to use its Azure SQL Hyperscale environment at full capacity for almost two weeks, running 80 processing cores at full capacity. The integration effort was extremely challenging, as Troy Hunt described it as requiring extensive database optimisation to integrate the new records into a repository containing more than 15 billion credentials while maintaining uninterrupted service for millions of people every day.

In the current era of billions of credential pairs being circulated freely between attackers, researchers are warning that passwords alone do not provide much protection any more than they once did. One of the most striking results of this study was that of HIBP’s 5.9 million subscribers, or those who actively monitor their exposure, nearly 2.9 million appeared in the latest compilation of HIBP credentials. This underscores the widespread impact of credential-stuffing troves. The consequences are especially severe for the healthcare industry. 

As IBM's 2025 Cost of a Data Breach Report indicates, the average financial impact of a healthcare breach has increased to $7.42 million, and a successful credential attack on a medical employee may allow threat actors to access electronic health records, patient information, and systems containing protected health information with consequences that go far beyond financial loss and may have negative economic consequences as well.

There is a growing concern about the threat of credential exposure outpacing traditional security measures, so this study serves as a decisive reminder to modernise digital defences before attackers exploit these growing vulnerabilities. Organisations should be pushing for passwordless authentication, continuous monitoring, and adaptive risk-based access, while individuals should take a proactive approach to maintaining their credentials as an essential rather than an optional task. 

Ultimately, one thing is clear: in a world where billions of credentials circulate unchecked, the key to resilience is to anticipate breaches by strengthening the architecture, optimising the authentication process and maintaining security awareness instead of reacting to them after a breach takes place.
Read more »
Threat Intelligence
Cybercrime Ecosystem Cybersecurity Threats Data Breach European Cybersecurity Malware As A Service Network Security ransomware attacks State-Sponsored Attacks Threat Intelligence

Europe struggles with record-breaking spike in ransomware attacks

 


Europe is increasingly being targeted by ransomware groups, driving attacks to unprecedented levels as criminal operations become more industrialised and sophisticated. Threat actors have established themselves in this region as a prime hunting ground, and are now relying on a growing ecosystem of underground marketplaces that sell everything from Malware-as-a-Service subscriptions to stolen network access and turnkey phishing kits to Malware-as-a-Service subscriptions. 

New findings from CrowdStrike's 2025 European Threat Landscape Report reveal that nearly 22 per cent of all ransomware and extortion incidents that occurred globally this year have involved European organisations. Accordingly, European organizations are more likely than those in Asia-Pacific to be targeted by cybercriminals than those in North America, placing them second only to North America. 

According to these statistics, there is a troubling shift affecting Europe's public and private networks. An increasing threat model is being used by cybercriminals on the continent that makes it easier, cheaper, and quicker to attack their victims. This leaves thousands of victims of attacks increasingly sophisticated and financially motivated across the continent. 

Throughout CrowdStrike's latest analysis, a clear picture emerges of just how heavily Europeans have been affected by ransomware and extortion attacks, with the continent managing to absorb over 22% of all global extortion and ransomware attacks. As stated in the report, the UK, Germany, France, Italy, and Spain are the most frequently targeted nations. It also notes that dedicated leak sites linked to European victims have increased by nearly 13% on an annual basis, a trend driven by groups such as Scattered Spider, a group that has shortened its attack-to-deployment window to a mere 24 hours from when the attack started. 

According to the study, companies in the manufacturing, professional services, technology, industrial, engineering and retail industries are still the most heavily pursued sectors, as prominent gangs such as Akira, LockBit, RansomHub, INC, Lynx, and Sinobi continue to dominate the landscape, making big game hunting tactics, aimed at high-value enterprises, remain prevalent and have intensified throughout the continent as well. 

It has been suggested in the study that because of the wide and lucrative corporate base of Europe, the complex regulatory and legal structure, and the geopolitical motivations of some threat actors, the region is a target for well-funded e-crime operations that are well-resourced. State-aligned threat activity continues to add an element of volatility to the already troubled cyber landscape of Europe.

In the past two years, Russian operators have intensified their operations against Ukraine, combining credential phishing with intelligence gathering and disrupting attacks targeted at the power grid, the government, the military, the energy grid, the telecommunications grid, the utility grid, and so forth. The North Koreans have, at the same time, expanded their reach to Europe, attacking defence, diplomatic, and financial institutions in operations that fuse classic espionage with cryptocurrency theft to finance their strategic projects. 

Moreover, Chinese state-sponsored actors have been extorting valuable intellectual property from industries across eleven nations by exploiting cloud environments and software supply chains to siphon intellectual property from the nation that enables them to expand their footprint. 

A number of these operations have demonstrated a sustained commitment to biotechnology and healthcare, while Vixen Panda is now considered one of the most persistent threats to European government and defence organisations, emphasising the degree to which state-backed intrusion campaigns are increasing the region's risk of infection.

There has been a dramatic acceleration in the speed at which ransomware attacks are being carried out in Europe, with CrowdStrike noting that groups such as Scattered Spider have reduced their ransomware deployment cycles to unprecedented levels, which has driven up the levels of infection. Through the group's efforts, the time between an initial intrusion and full encryption has been reduced from 35.5 hours in 2024 to roughly 24 hours by mid-2025, meaning that defenders are likely to have fewer chances to detect or contain intrusions. 

Despite being actively under investigation by law enforcement agencies, eCrime actors based in Western countries, like the United States and the United Kingdom, are developing resilient criminal networks despite active scrutiny by law enforcement. The arrest of four individuals recently by the National Crime Agency in connection with attacks on major retailers, as well as the rearrest of the four individuals for involvement in a breach at Transport for London, underscores the persistence of these groups despite coordinated enforcement efforts. 

In addition to this rapid operational tempo, cybercrime has also been transformed into a commodity-driven industry as a result of a thriving underground economy. The Russian- and English-speaking forums, together with encrypted messaging platforms, offer threat actors the opportunity to exchange access to tools, access points, and operational support with the efficiency of commercial storefronts. 

A total of 260 initial access brokers were seen by investigators during the review period, advertising entry points into more than 1,400 European organizations during the review period. This effectively outsourced the initial stages of a breach to outside sources. Through subscription or affiliate models of malware-as-a-service, companies can offer ready-made loaders, stealers, and financial malware as a service, further lowering the barrier to entry. 

It has been noted that even after major disruptions by law enforcement, including the seizure of prominent forums, many operators have continued to trade without interruption, thanks to safe-haven jurisdictions and established networks of trustworthiness. Aside from eCrime, the report highlights an increasingly complex threat environment caused by state-sponsored actors such as Russia, China, North Korea and Iran. 

Russian actors are concentrating their efforts on Ukraine, committing credential-phishing attacks, obtaining intelligence, and undertaking destructive activities targeting the military, government, energy, telecommunications, and utility sectors, and simultaneously conducting extensive espionage across NATO member countries.

For the purpose of providing plausible deniability, groups tied to Moscow have conducted extensive phishing campaigns, set up hundreds of spoofed domains, and even recruited "throwaway agents" through Telegram to carry out sabotage operations. As Iranian groups continued to conduct hack-and-leak, phishing, and DDoS attacks, often masking state intent behind hacktivist personas, their hack-and-leak campaigns branched into the UK, Germany, and the Netherlands, and they stepped up their efforts. 

With these converging nation-state operations, European institutions have been put under increased strategic pressure, adding an element of geopolitical complexity to an already overloaded cyber-defence environment. It is clear from the findings that for Europe to navigate this escalating threat landscape, a more unified and forward-leaning security posture is urgently needed. According to experts, traditional perimeter defences and slow incident response models are no longer adequate to deal with actors operating at an industrial speed, due to the rapid pace of technology. 

Companies need to share regional intelligence, invest in continuous monitoring, and adopt AI-driven detection capabilities in order to narrow the attackers' widening advantage. Keeping up with the innovation and sophistication of criminal and state-backed adversaries is a difficult task for any organisation, but for organisations that fail to modernise their defences, they run the risk of being left defenceless in an increasingly unforgiving digital battlefield.
Read more »
Threat Intelligence
AI Phishing Threats Cyber Awareness Cybercrime Prevention cybersecurity trends Data protection Digital Deception email security Online Safety Technology Threat Intelligence

AI Tools Make Phishing Attacks Harder to Detect, Survey Warns


 

Despite the ever-evolving landscape of cyber threats, the phishing method remains the leading avenue for data breaches in the years to come. However, in 2025, the phishing method has undergone a dangerous transformation. 

What used to be a crude attempt to deceive has now evolved into an extremely sophisticated operation backed by artificial intelligence, transforming once into an espionage. Traditionally, malicious actors are using poorly worded, grammatically incorrect, and inaccurate messages to spread their malicious messages; now, however, they are deploying systems based on generative AI, such as GPT-4 and its successors, to craft emails that are eerily authentic, contextually aware, and meticulously tailored to each target.

Cybercriminals are increasingly using artificial intelligence to orchestrate highly targeted phishing campaigns, creating communications that look like legitimate correspondence with near-perfect precision, which has been sounded alarming by the U.S. Federal Bureau of Investigation. According to FBI Special Agent Robert Tripp, these tactics can result in a devastating financial loss, a damaged reputation, or even a compromise of sensitive data. 

By the end of 2024, the rise of artificial intelligence-driven phishing had become no longer just another subtle trend, but a real reality that no one could deny. According to cybersecurity analysts, phishing activity has increased by 1,265 percent over the last three years, as a direct result of the adoption of generative AI tools. In their view, traditional email filters and security protocols, which were once effective against conventional scams, are increasingly being outmanoeuvred by AI-enhanced deceptions. 

Artificial intelligence-generated phishing has been elevated to become the most dominant email-borne threat of 2025, eclipsing even ransomware and insider risks because of its sophistication and scale. There is no doubt that organisations throughout the world are facing a fundamental change in how digital defence works, which means that complacency is not an option. 

Artificial intelligence has fundamentally altered the anatomy of phishing, transforming it from a scattershot strategy to an alarmingly precise and comprehensive threat. According to experts, adversaries now exploit artificial intelligence to amplify their scale, sophistication, and success rates by utilising AI, rather than just automating attacks.

As AI has enabled criminals to create messages that mimic human tone, context, and intent, the line between legitimate communication and deception is increasingly blurred. The cybersecurity analyst emphasises that to survive in this evolving world, security teams and decision-makers need to maintain constant vigilance, urging them to include AI-awareness in workforce training and defensive strategies. This new threat is manifested in the increased frequency of polymorphic phishing attacks. It is becoming increasingly difficult for users to detect phishing emails due to their enhanced AI automation capabilities. 

By automating the process of creating phishing emails, attackers are able to generate thousands of variants, each with slight changes to the subject line, sender details, or message structure. In the year 2024, according to recent research, 76 per cent of phishing attacks had at least one polymorphic trait, and more than half of them originated from compromised accounts, and about a quarter relied on fraudulent domains. 

Acanto alters URLs in real time and resends modified messages in real time if initial attempts fail to stimulate engagement, making such attacks even more complicated. AI-enhanced schemes can be extremely adaptable, which makes traditional security filters and static defences insufficient when they are compared to these schemes. Thus, organisations must evolve their security countermeasures to keep up with this rapidly evolving threat landscape. 

An alarming reality has been revealed in a recent global survey: the majority of individuals are still having difficulty distinguishing between phishing attempts generated by artificial intelligence and genuine messages.

According to a study by the Centre for Human Development, only 46 per cent of respondents correctly recognised a simulated phishing email crafted by artificial intelligence. The remaining 54 per cent either assumed it was real or acknowledged uncertainty about it, emphasising the effectiveness of artificial intelligence in impersonating legitimate communications now. 

Several age groups showed relatively consistent levels of awareness, with Gen Z (45%), millennials (47%), Generation X (46%) and baby boomers (46%) performing almost identically. In this era of artificial intelligence (AI) enhanced social engineering, it is crucial to note that no generation is more susceptible to being deceived than the others. 

While most of the participants acknowledged that artificial intelligence has become a tool for deceiving users online, the study demonstrated that awareness is not enough to prevent compromise, since the study found that awareness alone cannot prevent compromise. The same group was presented with a legitimate, human-written corporate email, and only 30 per cent of them correctly identified it as authentic. This is a sign that digital trust is slipping and that people are relying on instinct rather than factual evidence. 

The study was conducted by Talker Research as part of the Global State of Authentication Survey for Yubico, conducted on behalf of Yubico. During Cybersecurity Awareness Month this October, Talker Research collected insights from users throughout the U.S., the U.K., Australia, India, Japan, Singapore, France, Germany, and Sweden in order to gather insights from users across those regions. 

As a result of the findings, it is clear that users are vulnerable to increasingly artificial intelligence-driven threats. A survey conducted by the National Institute for Health found that nearly four in ten people (44%) had interacted with phishing messages within the past year by clicking links or opening attachments, and 1 per cent had done so within the past week. 

The younger generations seem to be more susceptible to phishing content, with Gen Z (62%) and millennials (51%) reporting significantly higher levels of engagement than the Gen X generation (33%) or the baby boom generation (23%). It continues to be email that is the most prevalent attack vector, accounting for 51 per cent of incidents, followed by text messages (27%) and social media messages (20%). 

There was a lot of discussion as to why people fell victim to these messages, with many citing their convincing nature and their similarities to genuine corporate correspondence, demonstrating that even the most technologically advanced individuals struggle to keep up with the sophistication of artificial intelligence-driven deception.

Although AI-driven scams are becoming increasingly sophisticated, cybersecurity experts point out that families do not have to give up on protecting themselves. It is important to take some simple, proactive actions to prevent risk from occurring. Experts advise that if any unexpected or alarming messages are received, you should pause before responding and verify the source by calling back from a trusted number, rather than the number you receive in the communication. 

Family "safe words" can also help confirm authenticity during times of emergency and help prevent emotional manipulation when needed. In addition, individuals can be more aware of red flags, such as urgent demands for action, pressure to share personal information, or inconsistencies in tone and detail, in order to identify deception better. 

Additionally, businesses must be aware of emerging threats like deepfakes, which are often indicated by subtle signs like mismatched audio, unnatural facial movements, or inconsistent visual details. Technology can play a crucial role in ensuring that digital security is well-maintained as well as fortified. 

It is a fact that Bitdefender offers a comprehensive approach to family protection by detecting and blocking fraudulent content before it gets to users by using a multi-layered security suite. Through email scam detection, malicious link filtering, and artificial intelligence-driven tools like Bitdefender Scamio and Link Checker, the platform is able to protect users across a broad range of channels, all of which are used by scammers. 

It is for mobile users, especially users of Android phones, that Bitdefender has integrated a number of call-blocking features within its application. These capabilities provide an additional layer of defence against attacks such as robocalls and impersonation schemes, which are frequently used by fraudsters targeting American homes. 

In Bitdefender's family plans, users have the chance to secure all their devices under a unified umbrella, combining privacy, identity monitoring, and scam prevention into a seamless, easily manageable solution in a seamless manner. As people move into an era where digital deception has become increasingly human-like, effective security is about much more than just blocking malware. 

It's about preserving trust across all interactions, no matter what. In the future, as artificial intelligence continues to influence phishing, it will become increasingly difficult for people to distinguish between the deception of phishing and its own authenticity of the phishing, which will require a shift from reactive defence to proactive digital resilience. 

The experts stress that not only advanced technology, but also a culture of continuous awareness, is needed to fight AI-driven social engineering. Employees need to be educated regularly about security issues that mirror real-world situations, so they can become more aware of potential phishing attacks before they click on them. As well, individuals should utilise multi-factor authentication, password managers and verified communication channels to safeguard both personal and professional information. 

On a broader level, government, cybersecurity vendors, and digital platforms must collaborate in order to create a shared framework that allows them to identify and report AI-enhanced scams as soon as they occur in order to prevent them from spreading.

Even though AI has certainly enhanced the arsenal of cybercriminals, it has also demonstrated the ability of AI to strengthen defence systems—such as adaptive threat intelligence, behavioural analytics, and automated response systems—as well. People must remain vigilant, educated, and innovative in this new digital battleground. 

There is no doubt that the challenge people face is to seize the potential of AI not to deceive people, but to protect them instead-and to leverage the power of digital trust to make our security systems of tomorrow even more powerful.
Read more »
zero Day vulnerability
Cyber Security Firewall Scanning GlobalProtect GreyNoise Network Security Palo Alto Networks PAN OS Threat Intelligence zero Day vulnerability

Spike in Login Portal Scans Puts Palo Alto Networks on Alert


 

The Palo Alto Networks login portals have seen a dramatic surge in suspicious scanning activity over the past month, a development that has caught the attention of the cybersecurity community. Evidence suggests that threat actors are trying to coordinate reconnaissance efforts aimed at the Palo Alto Networks login portals. 

A new report from cybersecurity intelligence firm GreyNoise revealed that Palo Alto Networks' GlobalProtect and PAN-OS interfaces saw an increase in scanning volumes of over 500%, which marks a sharp departure from the usual pattern for such scanning. In the last week of October, the firm recorded more than 1,285 unique IP addresses attempting to probe these systems - a sharp rise from the typical daily average of fewer than 200 that occurs on a regular basis. 

Approximately 80% of this activity was attributed to IP addresses in the United States, with additional clusters originating from IP addresses in the United Kingdom, the Netherlands, Canada, and Russia. Moreover, separate TLS fingerprints indicated that there were organised scanning clusters that were heavily oriented towards United States targets as well as Pakistani targets. 

A GreyNoise analyst classifies 91% of the observed IP addresses as suspicious, while the remaining 7% are suspected to be malicious, indicating this may represent an early phase of targeted reconnaissance or exploitation attempts against Palo Alto Networks' infrastructure that is widely deployed. 

A GreyNoise analysis revealed that a large portion of the scanning traffic originated from U.S. IP addresses, with smaller but noteworthy clusters originating from the United Kingdom, the Netherlands, Canada, and Russia, indicating the traffic originated primarily from the United States. Using TLS fingerprints, research identified distinct activity clusters – targeting foand cusing o and focusing on Pakistani systems, focusing, overlapping fingerprints, suggesting infrastructure or coordination. 

Ninety per cent of the IP addresses involved in the campaign were deemed suspicious, while another seven per cent were flagged as malicious by the firm. It has been observed that most scanning activity has been directed towards emulated Palo Alto Networks profiles, including GlobalProtect and PAN-OS, indicating that the probes were likely to be intentional and are the product of open-source scanning tools or attackers who are conducting reconnaissance efforts to identify vulnerable Palo Alto devices. 

According to GreyNoise, heightened scanning activity can often be detected before zero-day or zero-n-day vulnerabilities are exploited, acting as a warning to potential offensive operations well in advance. A similar pattern was observed earlier this year, as a spike in Cisco ASA scans followed shortly thereafter by the disclosure and exploitation of a critical zero-day vulnerability in that product line, which was a warning of potential offensive operations. 

Although the timing and scale of the current Palo Alto scans are cause for concern, researchers have clarified that the available evidence suggests a weak correlation with any known or emerging exploit activity at this point in the Palo Alto network ecosystem. Palo Alto Networks' GlobalProtect platform is the core of its next-generation firewall ecosystem, allowing organisations to implement consistent policies for threat prevention and security across remote endpoints, regardless of whether or not the endpoints are connected to a virtual network. 

GlobalProtect portals are critical management tools that enable administrators to customize VPN settings, distribute security agents, and oversee endpoint connectivity within enterprise networks by allowing them to configure VPN settings, distribute security agents, and manage endpoint connectivity. Due to its function and visibility on the Internet, the portal is considered a high-value target for attackers looking to access sensitive data. 

According to experts, firewalls, VPNs, and other edge-facing technologies are among the most attractive security tools for attackers because they act as gateways between internal corporate environments and the open internet as a whole. These systems, by necessity, are available online to support remote operations, but are inadvertently exposing themselves to extensive reconnaissance and scanning efforts as a result. 

A few weeks earlier, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a warning indicating that Palo Alto Networks would be actively exploited if it were to exploit a zero-day authentication bypass vulnerability in the company's PAN-OS software. This has increased Palo Alto Networks' appeal to cyber adversaries. As with other cyber threats, similar trends have been observed across the entire industry. 

For example, Cisco Talos disclosed last year that two zero-day flaws in Cisco firewall appliances were exploited by a state-backed threat actor to conduct an espionage campaign coordinated with Cisco. These risks highlight the persistence of the threats vendors are facing when it comes to edge security infrastructure vendors.

Among experts in the field of cybersecurity, it is very important to recognise that recent spikes in scanning activity targeting Palo Alto Networks' PAN-OS GlobalProtect gateways highlight a long-standing principle of cybersecurity: there is always a vulnerability in software. According to Boris Cipot, Senior Security Engineer at Black Duck, no matter how sophisticated a piece of software is, security vulnerabilities will inevitably arise at some point, whether due to programming oversight or the introduction of vulnerabilities by third-party open-source components. 

According to him, the real test is not whether a vulnerability exists but how swiftly the affected vendor releases a fix and how quickly the users apply the fix. The Palo Alto Networks spokesperson told me that while most Palo Alto Networks customers have probably patched their systems in response to recent advisories, attackers continue to hunt for devices that are not patched or poorly maintained, hoping that they can exploit those that are not well secured. 

Among Cipot's recommendations are to perform timely patching, follow vendor-recommended mitigations when patches are not available, and restrict management interfaces to trusted internal networks, which, he says, is also one of the most fundamental practices. 

The report also recommends that organisations use continuous log monitoring, conduct regular security audits, and analyse open-source components to identify vulnerabilities as early as possible in the lifecycle. A Salt Security director, Eric Schwake, who is responsible for cybersecurity strategy, expressed the concerns of these people by pointing out that the pattern of scans, which span nearly 24,000 unique IP addresses, demonstrates the persistence of threat actors in attempting to gain unauthorised access to data. 

While perimeter security, such as firewalls and VPNs, is still crucial, it should not be viewed as impenetrable, according to Schwake. As a result, he recommended organisations adopt a multi-layered security approach integrating API security governance, robust authentication mechanisms, and behavioural threat detection in order to detect abnormal login attempts as well as other malicious activities immediately in real time, as opposed to just relying on a single approach. 

Also, it was recommended that users be trained in user awareness, and multifactor authentication (MFA) should be enforced in order to reduce the risk of credential compromise and strengthen the overall cyber resilience of organisations. A GreyNoise security research team has noted unusual scanning activity directed at Palo Alto Networks’ PAN-OS GlobalProtect gateways for a number of years. 

In April 2025, the cybersecurity intelligence firm spotted another wave of suspicious login probes, resulting in Palo Alto Networks advising its customers to make sure that their systems are running the latest software versions and to apply all patches available to them. There are several patterns in GreyNoise’s Early Warning Signals report from July 2025 that support the company’s renewed warning. Among those patterns are large-scale spikes in malicious scanning, brute-force attempts, or exploit probing, which often follow a new CVE being disclosed within six weeks of the spike in those activities.

A similar pattern appeared to occur in early September 2025 when GreyNoise detected an increase in suspicious network scans targeting Cisco Adaptive Security Appliance (ASA) devices - traced back to late August. A total of 25,100 IP addresses were involved in the initial wave, primarily located in Brazil, Argentina, and the United States, with most originating from Brazil. 

Researchers at Palo Alto Networks have discovered what appears to be an alarming rise in the number of scanning sessions available on the Internet targeting a critical flaw in the software Palo Alto Networks GlobalProtect, identified as CVE-2024-3400. There is a high-severity vulnerability that affects one of the most widely deployed enterprise firewall solutions, allowing the creation of arbitrary files that can be weaponised in order to execute root privilege-based commands on the operating system.

By exploiting such vulnerabilities, attackers are able to gain complete control over affected devices, potentially resulting in the theft of sensitive data, the compromise of critical network functions, and even the disruption of critical network functions. In the last few weeks, analysts have noticed a significant increase in the probing attempts of this exploit, suggesting that threat actors have been actively incorporating it into their attack arsenals. 

The fact that GlobalProtect serves as a gateway to the internet in many corporate environments increases the risks associated with the flaw, which is remote and unauthenticated. A surge of malicious reconnaissance, according to analysts, could be the precursor to coordinated intrusion campaigns. This makes it imperative that organizations implement security patches as soon as possible, enforce access restrictions, and strengthen monitoring mechanisms across all perimeter defenses, as well as implement security patches as soon as possible.

Only weeks after the discovery of one of the exploitable zero-day vulnerabilities in its ASA products (CVE-2025-20333), Cisco confirmed that the other zero-day vulnerability in the same product (CVE-2025-2020362) was actively exploited, enabling advanced malware strains such as RayInitiator and LINE VIPER to be deployed in real-world attacks. 

In accordance with the data supplied by the Shadowserver Foundation, over 45,000 Cisco ASA and Firepower Threat Defence instances in the world, including more than 20,000 in the United States, remain susceptible to these vulnerabilities. It is evident that organisations reliant on perimeter security technologies face escalating threats and are faced with an ongoing challenge of timely patch adoption, as well as the escalating risks associated with them. 

This latest surge in scanning activity serves as yet another reminder that cyber threats are constantly evolving, and that is why maintaining vigilance, visibility, and velocity is so crucial in terms of defence against them. As reconnaissance efforts become more sophisticated and automated, organisations have to take more proactive steps - both in terms of integrating threat intelligence, continuously monitoring, and managing attack surfaces in order to remain effective. 

This cannot be done solely through vendor patches. It is imperative to combine endpoint hardening, strict access controls, timely updates, and intelligence anomaly detection based on behavioural analytics in order to strengthen network resilience today. It is also important for security teams to minimise the exposure of interfaces, and wherever possible, to shield them behind zero-trust architectures that validate every connection attempt with a zero-trust strategy. 

The use of regular penetration testing, as well as active participation in information-sharing communities, can make it much easier to detect early warning signs before adversaries gain traction. The attackers are ultimately playing the long game, as can be seen by the recurring campaigns against Palo Alto Networks and Cisco infrastructure – scanning for vulnerabilities, waiting for them to emerge, and then attacking when they become complacent. Defenders' edge lies, therefore, in staying informed, staying updated, and staying ahead of the curve: staying informed and staying updated.
Read more »
Threat Intelligence
Cyber Attacks Division NATO Russia-Ukraine War Threat Intelligence

NATO Rift Widens Over Response to Russian Cyber Threats

 

NATO is confronting significant internal divisions on how to handle the intensifying wave of Russian cyberattacks, which expose rifts in alliance strategy and threaten the alliance’s coherence and overall deterrence posture. 

As Russia increasingly targets NATO states’ critical infrastructure, governmental functions, and even military networks, debate has raged within the alliance as to how forcefully to respond, and under what terms, to hostile state-sponsored cyber activities.

Deepening divisions 

A core challenge for NATO is divergent national approaches to what constitutes an act of cyber aggression warranting collective response. Some member states—particularly those along Russia’s borders in the Baltics, as well as Poland—are calling for robust measures, including invoking Article 4 (consultative action in response to threats), and even considering proportional offensive cyber operations against Russian state targets. 

These nations see repeated Russian provocations, from cyber to airspace incursions, as clear tests of alliance resolve that demand a stiff and highly visible response.

However, other countries, such as France and Germany, worry about the risks of escalation and advocate a more cautious, defensive posture, preferring extensive evidence gathering, attribution efforts, and diplomatic engagement before considering retaliatory action. 

They argue frequent consultations or aggressive stances could water down NATO’s deterrent signal or trigger dangerous unintended escalation. This split produces tactical uncertainty and delays, potentially emboldening adversaries and hampering a unified alliance front.

Policy stalemate and its consequences

These diverging approaches are mirrored in ongoing arguments about when and how to use NATO’s cyber capabilities offensively versus limiting the alliance to defensive postures or coordinated resilience initiatives. 

While some strategists press for disruptive cyber operations or overt information warfare campaigns targeting Russia, consensus is lacking due to legal concerns, worries about thresholds for collective defense, and varying levels of national cyber capacity and risk appetite.

Strategic implications

Analysts warn that Russia’s overt cyber and hybrid threats are, in part, designed to exploit and widen these strategic rifts, stymying meaningful joint response and putting both NATO's credibility and European security at risk. Persistent internal divisions leave NATO vulnerable, raising pressure for the alliance to develop a clearer, more decisive policy on cyber deterrence and response.
Read more »
Threat Intelligence
Business Security Cl0p Cyber Security Google Mandiant Ransom Threat Intelligence

Google Warns of Cl0p Extortion Campaign Against Oracle E-Business Users

 

Google Mandiant and the Google Threat Intelligence Group are tracking a suspected extortion campaign by the Cl0p ransomware group targeting executives with claims of stealing Oracle E-Business Suite data. 

The hackers have demanded ransoms reaching up to $50 million, with cybersecurity firm Halcyon reporting multiple seven and eight-figure ransom demands in recent days. The group claims to have breached Oracle's E-Business Suite, which manages core operations including financial, supply chain, and customer relationship management functions.

Modus operandi 

The attackers reportedly hacked user emails and exploited Oracle E-Business Suite's default password reset functionality to steal valid credentials. This technique bypassed single sign-on protections due to the lack of multi-factor authentication on local Oracle accounts. At least one company has confirmed that data from their Oracle systems was stolen, according to sources familiar with the matter. The hackers provided proof of compromise to victims, including screenshots and file trees.

This activity began on or before September 29, 2025, though Mandiant experts remain in early investigation stages and have not yet substantiated all claims made by the group. Charles Carmakal, Mandiant's CTO, described the operation as a high-volume email campaign launched from hundreds of compromised accounts. Initial analysis confirms at least one compromised account previously associated with FIN11, a long-running financially motivated threat group known for deploying ransomware and engaging in extortion.

Threat actor background 

Since August 2020, FIN11 has targeted organizations across multiple industries including defense, energy, finance, healthcare, legal, pharmaceutical, telecommunications, technology, and transportation. The group is believed to operate from Commonwealth of Independent States countries, with Russian-language file metadata found in their malware code. In 2020, Mandiant observed FIN11 hackers using spear-phishing messages to distribute a malware downloader called FRIENDSPEAK.

An email address in the extortion notes ties to a Cl0p affiliate and includes Cl0p site contacts, though Google lacks definitive proof to confirm the attackers' claims. The malicious emails contain contact information verified as publicly listed on the Cl0p data leak site, strongly suggesting association with Cl0p and leveraging their brand recognition. Cl0p has launched major attacks in recent years exploiting zero-day flaws in popular software including Accellion, SolarWinds, Fortra GoAnywhere, and MOVEit.

Security recommendations

Oracle confirmed the investigation on October 3, 2025, stating that attacks potentially relate to critical vulnerabilities disclosed in their July 2025 Critical Patch Update. The company strongly encouraged customers to review the July update and patch their systems for protection. Mandiant researchers recommend investigating environments for indicators of compromise associated with Cl0p operations.
Read more »
Subscribe to: Comments (Atom)