Recent Posts
Cyber (In)Securities – Issue 144
News Quantum computer threat spurring quiet overhaul of internet securityCyberscoop – Greg Otto Pro-Russia hacktivists bombard Dutch public orgs with DDoS attacksBleepingComputer – Bill Toulas Dems look to close the barn door after top DOGE dog has boltedThe Register – Brandon Vigliarolo Canadian Electric Utility …
Cyber (In)Securities – Issue 143
News
-
Cybersecurity CEO accused of running malware on hospital PC blabs about it on LinkedIn
The Register – Brandon Vigliarolo -
Cybersecurity experts issue response to Trump order targeting Chris Krebs, SentinelOne
Cyberscoop – Greg Otto -
Marks & Spencer breach linked to Scattered Spider ransomware attack
BleepingComputer – Lawrence Abrams -
House passes bill to study routers’ national security risks
Cyberscoop – Matt Braken -
Hitachi Vantara takes servers offline after Akira ransomware attack
BleepingComputer – Sergiu Gatlan -
Over 1,200 SAP NetWeaver servers vulnerable to actively exploited flaw
BleepingComputer – Bill Toulas -
Cybersecurity vendors are themselves under attack by hackers, SentinelOne says
Cyberscoop – Tim Starks -
VeriSource now says February data breach impacts 4 million people
BleepingComputer – Bill Toulas -
DragonForce expands ransomware model with white-label branding scheme
BleepingComputer – Ionut Ilascu -
WooCommerce admins targeted by fake security patches that hijack sites
BleepingComputer – Bill Toulas -
Amid CVE funding fumble, ‘we were mushrooms, kept in the dark,’ says board member
The Register – Jessica Lyons -
More Ivanti attacks may be on horizon, say experts who are seeing 9x surge in endpoint scans
The Register – Connor Jones -
Mobile provider MTN says cyberattack compromised customer data
BleepingComputer – Bill Toulas -
Vehicles Face 45% More Attacks, 4 Times More Hackers
Dark Reading – Nate Nelson -
Gig-Work Platforms at Risk for Data Breaches, Fraud, Account Takeovers
Dark Reading – Tatiana Walk-Morris -
All Major Gen-AI Models Vulnerable to ‘Policy Puppetry’ Prompt Injection Attack
SecurityWeek – Ionut Arghire -
Researchers Identify Rack::Static Vulnerability Enabling Data Breaches in Ruby Servers
The Hacker News – Ravie Lakshmanan -
Anthropic finds alarming ’emerging trends’ in Claude misuse report
ZDNet – Radhika Rajkumar -
Darcula adds AI to its DIY phishing kits to help would-be vampires bleed victims dry
The Register – Jessica Lyons -
‘SessionShark’ ToolKit Evades Microsoft Office 365 MFA
Dark Reading – Kristina Beek -
Assassin’s Creed maker faces GDPR complaint for forcing single-player gamers online
The Register – Brandon Vigliarolo -
Interlock ransomware claims DaVita attack, leaks stolen data
BleepingComputer – Bill Toulas -
Verizon DBIR Flags Major Patch Delays on VPNs, Edge Appliances
SecurityWeek – Ryan Naraine -
‘Warning sign’: Espionage driving APAC cyber surge
InnovationAus – Trish Everingham
Analysis
-
The Trouble with AI in Cybersecurity – Part 5: Ethics on Autopilot
PrivID (Substack) -
Mobile Applications: A Cesspool of Security Issues
Dark Reading – Robert Lemos -
M-Trends 2025: State-Sponsored IT Workers Emerge as Global Threat
Dark Reading – Kevin Townsend -
Inside the Verizon 2025 DBIR: Five Trends That Signal a Shift in the Cyber Threat Economy
SecurityWeek – Danelle Au -
Why NHIs Are Security’s Most Dangerous Blind Spot
The Hacker News -
Navigating Regulatory Shifts & AI Risks
Dark Reading – Arnaud Treps
CyAN Members: News
-
Comment instaurer une relation de confiance entre le DPO et le Hacker Éthique ?
Cybersecurity Advisors Network -
CyAN Global Vice President Kim Chandler McDonald judges Australian Space Awards
Space Connect -
Michael do Rozario Named Finalist for Lawyers Weekly Partner of the Year Awards 2025
Lawyers Weekly
🗓️ Upcoming CyAN (and CyAN Partner) Global Events:
🎉 Celebration
CyAN 10th Anniversary
(Details TBA)
🌐 Online
CyAN Q2 Call (APAC + Gulf)
June 11 – 12:00 GST / 16:00 SGT / 18:00 AEST
🌐 Online
CyAN Q2 Call (EMEA + Americas)
June 11 – 20:00 GST / 18:00 CET / 17:00 UTC / 12:00 EDT
Welcome New Member – Norman King from Australia
Please welcome our newest member from Australia, Norman King! Norman has 25+ years of experience working as a technology professional. As CTO, he has been part of the leadership team at iPartners since the company began operations in 2017. He has overseen the development of …
Cyber (In)Securities – Issue 142
News
-
Ransomware Gangs Innovate With New Affiliate Models
Dark Reading – Alexander Culafi -
FBI: US lost record $16.6 billion to cybercrime in 2024
BleepingComputer – Sergiu Gatlan -
Attackers hit security device defects hard in 2024
Cyberscoop – Matt Kapko -
Ripple NPM supply chain attack hunts for private keys
The Register – Connor Jones -
DPRK Hackers Steal $137M from TRON Users in Single-Day Phishing Attack
The Hacker News – Ravie Lakshmanan -
Blue Shield of California leaked health data of 4.7 million members to Google
BleepingComputer – Bill Toulas -
‘Cookie Bite’ Entra ID Attack Exposes Microsoft 365
Dark Reading – Elizabeth Montalbano -
RIP, Google Privacy Sandbox
The Register – Thomas Claburn -
Microsoft Purges Millions of Cloud Tenants in Wake of Storm-0558
Dark Reading – Jai Vijayan -
Millions of SK Telecom customers are potentially at risk following USIM data compromise
Security Affairs – Pierluigi Paganini -
Fog ransomware channels Musk with demands for work recaps or a trillion bucks
The Register – Connor Jones -
Docker Malware Exploits Teneo Web3 Node to Earn Crypto via Fake Heartbeat Signals
The Hacker News – Ravie Lakshmanan -
Ripple’s recommended XRP library xrpl.js hacked to steal wallets
BleepingComputer – Lawrence Abrams -
DeepSeek Breach Opens Floodgates to Dark Web
Dark Reading – Emma Zaballos -
SuperCard X Android Malware Enables Contactless ATM and PoS Fraud via NFC Relay Attacks
The Hacker News – Ravie Lakshmanan -
Billion-dollar cyberscam industry spreading globally, warns UN
itNews -
Researchers warn of critical flaw found in Erlang OTP SSH
Cybersecurity Dive – David Jones -
The FBI Can’t Find ‘Missing’ Records of Its Hacking Tools
404 Media – Joseph Cox -
Microsoft rated this bug as low exploitability. Miscreants weaponized it in just 8 days
The Register – Iain Thomson -
Multiple top CISA officials behind ‘Secure by Design’ resign
Cyberscoop – Derek B. Johnson -
North Korean Cryptocurrency Thieves Caught Hijacking Zoom ‘Remote Control’ Feature
SecurityWeek – Ryan Naraine -
Phishers abuse Google OAuth to spoof Google in DKIM replay attack
BleepingComputer – Ionut Ilascu -
Countries Shore Up Their Digital Defenses as Global Tensions Raise the Threat of Cyberwarfare
SecurityWeek / Associated Press -
Hackers Abuse Russian Bulletproof Host Proton66 for Global Attacks and Malware Delivery
The Hacker News – Ravie Lakshmanan -
FOG Ransomware Spread by Cybercriminals Claiming Ties to DOGE
Trend Micro – Nathaniel Morales & Sarah Pearl Camiling -
APT29 Deploys GRAPELOADER Malware Targeting European Diplomats Through Wine-Tasting Lures
The Hacker News – Ravie Lakshmanan -
New Android malware steals your credit cards for NFC relay attacks
BleepingComputer – Bill Toulas -
Rogue npm Packages Mimic Telegram Bot API to Plant SSH Backdoors on Linux Systems
The Hacker News – Ravie Lakshmanan -
Hacking US crosswalks to talk like Zuck is as easy as 1234
The Register – Iain Thomson
Analysis
-
The Foundations of a Resilient Cyber Workforce
Dark Reading – Mohan Loo -
Nation-State Threats Put SMBs in Their Sights
Dark Reading – Robert Lemos -
Why AI Cyber Defences Are Lagging Behind the Offence
PrivID (Substack) -
Can Cybersecurity Weather the Current Economic Chaos
Dark Reading – Robert Lemos -
Bot Traffic Surpasses Humans Online—Driven by AI and Criminal Innovation
SecurityWeek – Kevin Townsend -
5 Reasons Device Management Isn’t Device Trust
The Hacker News
CyAN Members
-
The Elephant in the Server Room: Why Nation-State Hackers Love Small Businesses
CyAN Global VP – Kim Chandler McDonald -
CyAN’s Position on Germany’s 2025 Coalition Agreement
CyAN Position Paper -
Fortune 500 CEOs on Cybersecurity (2019–2024)
CyAN Member – Nick Kelly -
La Liga: Blocking of Cloudflare IPs in Spain
CyAN Communications Director – John Salomon
-
CyAN Members Lead 11th International TPRM Virtual Summit
International TPRM Alliance – Featuring CyAN Board Member Bharat Raigangar and Member Yedhu Krishna Menon
🗓️ Upcoming CyAN (and CyAN Partner) Global Events:
🎉 Celebration
CyAN 10th Anniversary
(Details TBA)
🌐 Online
CyAN Q2 Call (APAC + Gulf)
June 11 – 12:00 GST / 16:00 SGT / 18:00 AEST
🌐 Online
CyAN Q2 Call (EMEA + Americas)
June 11 – 20:00 GST / 18:00 CET / 17:00 UTC / 12:00 EDT
🐘 The Elephant in the Server Room: Why Nation-State Hackers Love Small Businesses
You’d think nation-state cyber attackers would be too busy targeting military secrets, critical infrastructure, or global financial systems to bother with your local optometrist, small engineering firm, or boutique consultancy. But you’d be wrong. As Rob Lemos in his recent Dark Reading article “Nation-State Threats …
Cyber (In)Securities – Issue 141
News
- Former cyber official targeted by Trump quits company over move
NBC News – Kevin Collier - MITRE’s CVE program given last-minute reprieve
itNews – Raphael Satter - Whistle Blower: Russian Breach of US Data Through DOGE
Narativ – Zev Shalev - Midnight Blizzard deploys GrapeLoader malware
BleepingComputer – Bill Toulas - 4chan taken down following major hack
BleepingComputer – Sergiu Gatlan - China places NSA operatives on wanted list
Cyberscoop – Tim Starks - RansomHouse Ransomware: What You Need To Know
Fortra – Graham Cluley - Wine-Inspired Phishing Targets EU Diplomats
Dark Reading – Elizabeth Montalbano - Chinese group uses open-source tools
Cyberscoop – Derek B. Johnson - Apache Roller Flaw enables persistent access
Security Affairs – Pierluigi Paganini - Chinese Hackers Use SNOWLIGHT on Linux
The Hacker News – Ravie Lakshmanan - 2.6M impacted in Landmark/Young breaches
SecurityWeek – Ionut Arghire - UNC5174 Leveraging Open Source for Espionage
Dark Reading – Alexander Culafi - DOGE may have exposed sensitive labor data
NPR – Jenna McLaughlin - Conduent confirms client data stolen
BleepingComputer – Lawrence Abrams - Firm buys hacker forum accounts
BleepingComputer – Bill Toulas - Cyber Congressman demands CISA answers
The Register – Jessica Lyons - Gladinet vulnerabilities exploited
SecurityWeek – Ryan Naraine - Chinese APTs exploit EDR blind spots
Dark Reading – Becky Bracken - Cyber risks in aviation sector
Cybersecurity Dive – David Jones - Phishing uses real-time email validation
The Hacker News – Ravie Lakshmanan
- SSL/TLS cert lifespan shrinking
BleepingComputer – Bill Toulas - Malicious NPM packages target PayPal
Security Affairs – Pierluigi Paganini - Roblox poses risks to children
The Guardian – Libby Brooks & Jedidajah Otte - Fortinet Zero-Day Enables Remote Code Execution
Dark Reading – Kristina Beek - Hertz data breach confirmed
itNews - NIST Updates Privacy Framework
NIST - China accuses US of cyberattacks
itNews – Laurie Chen - China using ships to target undersea cables
The Guardian – Angela Dewan - US private prison firm fuels surveillance
Middle East Eye - ResolverRAT phishing targets healthcare
The Hacker News – Ravie Lakshmanan - Unknown Storm: Stealthiest hackers uncovered
Wired - Hacktivism likely state-sponsored
The Register – Jessica Lyons - AI hallucinated code dependencies
BleepingComputer – Bill Toulas - Microsoft recalls Recall feature
The Register – Iain Thomson - Lab breach exposes 1.6M records
Security Affairs – Pierluigi Paganini - Paper Werewolf spreads via USB
Dark Reading – Kristina Beek - Meta loses DEI group support
The Guardian – Adria R Walker - Third-party fraud leads cyber claims
Dark Reading – Robert Lemos - Western Sydney Uni breach
BleepingComputer – Bill Toulas - Trump attacks SentinelOne
InnovationAus – Raphael Satter - China admits Volt Typhoon cyberattacks
SecurityWeek – Eduard Kovacs
Analysis
- DOGE’s tech takeover threatens the safety and stability of our critical data
MIT Technology Review - Are We Prioritizing the Wrong Security Metrics?
Dark Reading – Swati Babbar - Businesses bleed $100m a year due to cybersecurity failures, study shows
IBS Intelligence – Gloria Methri
- Cybersecurity in the AI Era: Evolve Faster Than the Threats or Get Left Behind
The Hacker News - 5 warning signs that your phone’s been hacked – and how to fight back
ZDNet – Lance Whitney - AI-Driven Disinformation Campaigns: The Digital Fog of War
PrivID (Substack)
CyAN Op-Eds & Articles
CyAN Spotlights & Insights
- Highlights from this week’s cybersecurity research by evisec – CRD #20
CyAN Member and evisec CEO Henry Röigas
- Online Safety for Kids and Teens – Biweekly Brief
CyAN Member and Vyanams Strategies Founder Vaishnavi J
CyAN Member News
• Congratulations to CyAN Member Fatema Fardan, who has spent the past six months as a mentor with the QODWA program, initiated by the CFA Society Bahrain! We at CyAN are massive supporters of mentorship programs within the industry, knowing that they not only build professional confidence and capability, but also create lasting networks of support and inspiration. Fatema’s contribution to the next generation of cybersecurity and finance professionals reflects the heart of what makes our community so special—sharing knowledge, lifting others, and leading by example. Well done, Fatema! 👏💙
• Huge congrats to CyAN Member Will Rivera for representing MyOwn Image at two standout events on public service and responsible tech. On March 27, he spoke at Hartwick College’s Gender & Public Service event, honouring Judith “Judy” Day’s legacy. Then on April 5, he joined All Tech Is Human and NYIT to spotlight MyOwn Image’s advocacy against tech-facilitated violence. From campus panels to national policy—Will is leading with purpose. 👏💙
• CyAN thrives because of the incredible talent, leadership, and dedication of our members, and we are proud to see them shaping the future of cybersecurity on a global stage! 🚀💙
• CyAN Board Member Bharat Raigangar has been particularly busy recently! April 9–11 found him in Lisbon speaking at the Third Party and Supply Chain Cyber Security Summit (SCCS), and this week, while in NYC, he caught up with fellow CyAN members Gilles Chevillon and Vaishnavi J!
🗓️ Upcoming CyAN (and CyAN Partner) Global Events:
🎉 Celebration
CyAN 10th Anniversary
(Details TBA)
🌐 Online
CyAN Q2 Call (APAC + Gulf)
June 11 – 12:00 GST / 16:00 SGT / 18:00 AEST
🌐 Online
CyAN Q2 Call (EMEA + Americas)
June 11 – 20:00 GST / 18:00 CET / 17:00 UTC / 12:00 EDT
No Time for Antics with Semantics: Why CVEs Are Cybersecurity’s Lifeline
The cybersecurity world runs on shared language. We don’t often talk about it in those terms—but that’s exactly what the CVE (Common Vulnerabilities and Exposures) system is. A global taxonomy of flaws. A universal index of weakness. The quiet backbone that lets defenders coordinate responses …