Tag: news
Cyber (In)Securities – Issue 143
News Cybersecurity CEO accused of running malware on hospital PC blabs about it on LinkedInThe Register – Brandon Vigliarolo Cybersecurity experts issue response to Trump order targeting Chris Krebs, SentinelOneCyberscoop – Greg Otto Marks & Spencer breach linked to Scattered Spider ransomware attackBleepingComputer – Lawrence …
Cyber (In)Securities – Issue 138
Information Security News Disclosure Drama Clouds CrushFTP Vulnerability ExploitationDark Reading – Rob Wright CISA warns of Fast Flux DNS evasion used by cybercrime gangsBleepingComputer – Bill Toulas Google Quick Share Bug Bypasses Allow Zero-Click File TransferDark Reading – Tara Seals China-Linked Threat Group Exploits Ivanti …
Cyber (In)Securities – Issue 134
Information Security News
Judge blocks Elon Musk’s Doge from accessing social security records
The Guardian by Guardian Staff & Agencies
A federal judge has issued a restraining order preventing Elon Musk’s Department of Government Efficiency (Doge) from accessing Social Security Administration (SSA) records, citing privacy concerns and potential data misuse. The lawsuit, filed by advocacy groups, argues that Doge’s demand for non-anonymised data amounts to a fishing expedition, with risks of exposing sensitive personal information. Musk, appointed to cut government spending, has faced criticism for aggressive cost-cutting and mass layoffs, fuelling concerns over transparency, oversight, and the ethical handling of federal data.
Read more.
Ukraine Defense Sector Under Attack Via Dark Crystal RAT
Dark Reading by Kristina Beek
Ukraine’s defence sector is facing a new wave of cyberattacks deploying Dark Crystal RAT (DCRat), a powerful malware capable of remote access, data theft, and system manipulation. Threat actors are using phishing emails and malicious attachments to infiltrate defence networks, raising concerns over national security and battlefield intelligence leaks. This campaign underscores the increasing cyberwarfare threats targeting Ukraine’s military infrastructure, reinforcing the need for enhanced endpoint security, strict access controls, and real-time threat intelligence to mitigate state-sponsored attacks.
Read more.
RansomHub ransomware uses new Betruger ‘multi-function’ backdoor
BleepingComputer by Sergiu Gatlan
The RansomHub ransomware group has integrated Betruger, a newly discovered multi-function backdoor, to enhance stealth, persistence, and payload deployment. Betruger allows attackers to bypass security defenses, exfiltrate sensitive data, and execute ransomware operations with greater efficiency. This evolution in ransomware tactics highlights the growing sophistication of double-extortion techniques, where attackers encrypt data while also threatening public leaks. Organisations must prioritise endpoint security, network segmentation, and real-time monitoring to defend against these advanced ransomware threats.
Read more.
HellCat hackers go on a worldwide Jira hacking spree
BleepingComputer by Ionut Ilascu
The HellCat hacking group is actively targeting Jira servers worldwide, exploiting unpatched vulnerabilities to gain unauthorised access, steal sensitive data, and deploy malware. The attacks focus on exfiltrating corporate and government project management data, posing a severe risk to intellectual property and internal communications. Security researchers warn that many organisations have failed to apply critical updates, leaving them vulnerable. Experts recommend immediate patching, strong access controls, and continuous monitoring to prevent these intrusions and protect sensitive project data.
Read more.
Nation-state groups hit hundreds of organizations with Microsoft Windows zero-day
Cyberscoop by Matt Kapko
Nation-state hacking groups are actively exploiting a Microsoft Windows zero-day vulnerability, compromising hundreds of organisations across critical sectors. The flaw allows attackers to escalate privileges, gain persistent access, and deploy malware, making it a valuable tool for espionage and disruptive cyber operations. Security experts warn that affected organisations must apply available mitigations, enhance endpoint detection, and monitor for unusual activity to prevent exploitation. This campaign highlights the urgency of timely patching and proactive defence strategies against state-sponsored cyber threats.
Read more.
India Is Top Global Target for Hacktivists, Regional APTs
Dark Reading by Robert Lemos
India has become the top global target for hacktivists and regional APT groups, facing a surge in cyberattacks on critical infrastructure, financial institutions, and government networks. Motivations range from political activism to state-sponsored espionage, with attackers leveraging sophisticated malware, phishing campaigns, and zero-day exploits. The rise in threats highlights the urgent need for enhanced cyber defenses, cross-border intelligence sharing, and proactive threat-hunting to mitigate risks against India’s expanding digital economy and national security infrastructure. Read more.
WhatsApp patched zero-click flaw exploited in Paragon spyware attacks
BleepingComputer by Sergiu Gatlan
A critical zero-click vulnerability in WhatsApp was exploited in targeted spyware attacks linked to Paragon, a surveillance firm known for supplying spyware to governments. The flaw allowed attackers to infect devices without user interaction, exposing victims to surveillance and data theft. WhatsApp has since patched the issue, but the incident underscores growing concerns over commercial spyware abuse and the need for stronger security measures to prevent sophisticated exploits that threaten privacy and national security. Users are urged to keep apps updated to protect against emerging threats.
Read more.
New Arcane infostealer infects YouTube, Discord users via game cheats
BleepingComputer by Bill Toulas
Cybercriminals are spreading the Arcane infostealer via fake game cheats on YouTube and Discord, tricking users into downloading malware disguised as gaming tools. Once installed, Arcane steals login credentials, financial data, and personal information, posing serious risks to victims. The malware’s distribution method leverages the trust gamers place in community-shared content, making detection difficult. This campaign highlights the dangers of downloading unverified software and the need for stronger user awareness, platform moderation, and security controls to combat evolving infostealer threats.
Read more.
Leaked Black Basta Chats Suggest Russian Officials Aided Leader’s Escape from Armenia
The Hacker News by Ravie Lakshmanan
Leaked internal chats from Black Basta, a notorious ransomware group, suggest that Russian officials may have helped its leader evade capture in Armenia. The messages indicate high-level connections that allowed for safe passage out of the country, raising concerns about state-backed cybercriminal protection. If true, this reinforces fears that Russia is sheltering ransomware operators, complicating international efforts to combat cybercrime. The revelations highlight the urgent need for stronger global cooperation, sanctions, and law enforcement actions against cybercriminal networks operating with impunity.
Read more.
Six additional countries identified as suspected Paragon spyware customers
Cyberscoop by Tim Starks
Investigations have linked six more countries to the use of Paragon spyware, a powerful surveillance tool marketed for law enforcement but often abused for political espionage. While Paragon claims it restricts sales to trusted governments, reports suggest its spyware has been used to monitor dissidents, journalists, and activists. This growing list of suspected customers fuels concerns over the unchecked proliferation of commercial spyware, the lack of international regulations, and the ongoing threats to privacy, press freedom, and human rights in authoritarian-leaning states.
Read more.
Activist alerts ICC to spyware attack while sharing Libya torture victims’ details
The Guardian by Stephanie Kirchgaessner & Angela Giuffrida
A human rights activist reported being targeted by spyware while submitting evidence of Libyan torture victims to the International Criminal Court (ICC), raising alarm over the use of surveillance tools to obstruct justice. The attack, suspected to be politically motivated, highlights the weaponisation of spyware against activists, journalists, and legal professionals. This incident underscores the urgent need for stricter regulations on commercial spyware, international accountability for misuse, and stronger security measures to protect those working on human rights investigations from digital surveillance and intimidation.
Read more.
Ukrainian military targeted in new Signal spear-phishing attacks
BleepingComputer by Bill Toulas
A new spear-phishing campaign is targeting the Ukrainian military, using Signal messages to trick personnel into downloading malware. Attackers impersonate trusted sources, sending malicious links that, once opened, grant unauthorised access to sensitive data and communications. This tactic marks an evolution in cyber warfare, exploiting encrypted messaging platforms to bypass traditional security measures. The attack underscores the growing threat of nation-state cyber operations, highlighting the need for enhanced training, stronger authentication protocols, and continuous threat monitoring in military communications.
Read more.
ClearFake Infects 9,300 Sites, Uses Fake reCAPTCHA and Turnstile to Spread Info-Stealers
The Hacker News by Ravie Lakshmanan
A large-scale ClearFake campaign has infected 9,300 websites, using fake reCAPTCHA and Turnstile prompts to trick users into downloading info-stealing malware. These fraudulent verification screens appear legitimate but deliver malicious payloads that harvest credentials, financial data, and browser-stored information. The attack highlights the growing sophistication of social engineering tactics, reinforcing the need for stronger website security, user awareness, and advanced threat detection to combat malware campaigns that exploit trust in widely used authentication systems. Read more.
Scareware Combined With Phishing in Attacks Targeting macOS Users
SecurityWeek by Ionut Arghire
Cybercriminals are combining scareware and phishing tactics to target macOS users, using fake security alerts to trick victims into installing malware or revealing credentials. These attacks rely on social engineering, displaying fraudulent pop-ups that claim the system is infected, leading users to click malicious links or download rogue software. The campaign highlights the growing sophistication of macOS-targeted threats, emphasising the need for user awareness, strong endpoint protection, and cautious interaction with unexpected security warnings to prevent falling victim to these scams.
Read more.
Hackers Exploit Severe PHP Flaw to Deploy Quasar RAT and XMRig Miners
The Hacker News by Ravie Lakshmanan
A critical PHP vulnerability is being actively exploited to deploy Quasar RAT and XMRig cryptocurrency miners, allowing attackers to take control of infected systems. The flaw enables remote code execution, giving hackers a backdoor to steal data, spy on users, and hijack computing resources for cryptomining. The attack highlights the ongoing risks of unpatched software and the need for immediate updates, stronger access controls, and continuous monitoring to prevent cybercriminals from leveraging PHP-based exploits for espionage and financial gain.
Read more.
Cybersecurity Experts Are Sounding the Alarm on DOGE
TIME by Andrew R. Chow
Security experts are raising concerns over DOGE’s expanding role in financial transactions, warning that its lack of regulatory oversight and growing use in illicit activities make it a prime target for cybercriminals. The cryptocurrency’s popularity has surged, but its decentralised nature and weak security measures expose users to scams, fraud, and laundering operations. Experts emphasise the urgent need for stricter compliance frameworks, enhanced monitoring tools, and user education to prevent DOGE from becoming a haven for cybercrime while ensuring financial security in the evolving crypto landscape.
Read more.
Rules File Backdoor: AI Code Editors Exploited For Silent Supply Chain Attacks
Security Affairs by Pierluigi Paganini
Attackers are exploiting AI-powered code editors to inject stealthy backdoors into software supply chains, leveraging manipulated rules files to introduce malicious code without detection. These silent intrusions bypass traditional security tools, allowing attackers to compromise development environments, steal credentials, and inject vulnerabilities into widely used software. The rise of AI-assisted coding highlights the urgent need for strict code validation, continuous monitoring, and enhanced security in software development pipelines to prevent exploitation and ensure supply chain integrity.
Read more.
Critical Fortinet Vulnerability Draws Fresh Attention
Dark Reading by Jai Vijayan
A critical vulnerability in Fortinet products is drawing renewed concern as attackers increasingly exploit it to gain unauthorised access to corporate networks. This flaw allows remote code execution, enabling cybercriminals to steal data, deploy malware, and move laterally within compromised environments. Security experts warn that many organisations have yet to patch affected systems, leaving them vulnerable to exploitation. This incident reinforces the urgent need for timely patching, robust access controls, and continuous monitoring to prevent cybercriminals from leveraging known security gaps for large-scale intrusions.
Read more.
California Cryobank, the Largest US Sperm Bank, Disclosed a Data Breach
Security Affairs by Pierluigi Paganini
California Cryobank, the largest sperm bank in the U.S., has disclosed a data breach, exposing sensitive client and donor information. The breach raises concerns over privacy, medical data security, and potential identity theft, as fertility clinics and healthcare-related organisations become increasingly targeted by cybercriminals. While the full scope of the breach is still under investigation, the incident underscores the need for stronger data protection in the healthcare sector, emphasising encryption, access controls, and stricter cybersecurity measures to safeguard personal medical records from exploitation.
Read more.
AI Cloud Adoption Is Rife With Cyber Mistakes
Dark Reading by Elizabeth Montalbano
Organisations rushing to adopt AI-powered cloud services are making critical security missteps, exposing sensitive data to cyber threats. Poor access controls, misconfigured APIs, and a lack of encryption have left AI cloud environments vulnerable to breaches and unauthorised access. Security experts warn that over-reliance on automation without robust governance, compliance, and risk assessment increases exposure to cyberattacks. To mitigate these risks, companies must implement strict data protection policies, continuous monitoring, and AI-specific security frameworks to safeguard their cloud-based AI operations.
Read more.
UK cybersecurity agency warns over risk of quantum hackers
The Guardian by Dan Milmo
The UK’s cybersecurity agency has issued a warning about the growing threat of quantum-enabled cyberattacks, urging organisations to prepare for the future impact of post-quantum cryptography. As quantum computing advances, existing encryption standards risk becoming obsolete, allowing attackers to decrypt sensitive data at unprecedented speeds. The agency stresses the need for early adoption of quantum-resistant encryption, proactive risk assessments, and collaboration between governments and industry leaders to ensure digital security remains resilient in the face of emerging quantum threats.
Read more.
Europol warns of AI-driven crime threats
itNews
Europol has raised concerns about the increasing use of AI in cybercrime, warning that criminals are leveraging AI-powered tools for more sophisticated phishing, fraud, and deepfake-based scams. The agency highlights that AI is being used to automate attacks, create highly convincing fake identities, and bypass traditional security measures, making cyber threats harder to detect. Europol urges governments, businesses, and law enforcement to develop AI-resistant security measures, enhance digital forensics, and adopt stricter regulations to prevent AI from becoming a tool for large-scale cybercrime.
Read more.
Hundreds of ‘malicious’ Google Play-hosted apps bypassed Android 13 Security ‘with ease’
itNews / Bitdefender
Security researchers have uncovered hundreds of malicious apps on Google Play that successfully bypassed Android 13’s security features, exposing users to malware, spyware, and data theft. The apps exploited loopholes in permission handling and accessibility features, allowing them to steal credentials, track user activity, and install additional payloads. This discovery underscores ongoing concerns about Google Play’s vetting process and the need for stronger app security policies, regular audits, and user vigilance to prevent malware from infiltrating mobile ecosystems.
Read more.
Microsoft Exchange Online outage affects Outlook web users
BleepingComputer by Sergiu Gatlan
A widespread Microsoft Exchange Online outage has disrupted Outlook Web Access, leaving users unable to send or receive emails. The issue, affecting businesses and individuals globally, has raised concerns about service reliability and redundancy in cloud-based email infrastructure. Microsoft has acknowledged the problem and is working on a resolution, but the disruption highlights the risks of over-reliance on a single provider. Organisations are advised to implement backup communication plans and review business continuity strategies to mitigate the impact of future cloud service outages.
Read more.
Home Affairs explores secure service edge
itNews by Eleanor Dickinson
The Australian Department of Home Affairs is evaluating Secure Service Edge (SSE) solutions to enhance network security, cloud access, and data protection. SSE combines zero-trust principles, secure web gateways, and cloud security measures to improve visibility and control over sensitive information. This move aligns with efforts to modernise cybersecurity frameworks and reduce reliance on legacy infrastructure, ensuring government agencies can safeguard critical data while maintaining seamless and secure access to cloud-based services. The evaluation underscores the growing need for adaptive security solutions in government operations.
Read more.
CISA urges fired probationary workers to respond after federal judge grants order
Cybersecurity Dive by David Jones
CISA is urging former probationary employees to respond after a federal judge ruled in their favor, granting an order that may allow them to reclaim their positions. The ruling follows allegations that these employees were wrongfully terminated, raising concerns about hiring practices and workforce protections in federal cybersecurity roles. While CISA has not disclosed full details, the case underscores broader issues around job stability, due process, and talent retention in critical security agencies. Affected workers are encouraged to take action promptly to explore reinstatement options.
Read more.
Chinese Hackers Target European Diplomats with Malware
ISMG Data Breach Today by Prajeet Nair
A Chinese state-sponsored hacking group is targeting European diplomats with custom malware, aiming to conduct espionage and extract sensitive information. The attackers use phishing emails and compromised websites to deliver malware that provides persistent access to infected systems, enabling long-term surveillance. Security experts warn that government agencies and international organisations must strengthen defenses, implement zero-trust policies, and enhance threat intelligence sharing to counter nation-state cyber threats and prevent diplomatic data breaches. Read more.
RansomHub using FakeUpdates scheme to attack government sector
Cybersecurity Dive by Rob Wright
The RansomHub ransomware group is leveraging the FakeUpdates (SocGholish) malware to infiltrate government networks, disguising malicious payloads as legitimate software updates. Once installed, the malware enables data theft, system encryption, and extortion, forcing agencies to either pay ransoms or risk major operational disruptions. The campaign highlights the growing use of social engineering in ransomware attacks, reinforcing the need for strict software update policies, advanced threat detection, and employee training to prevent falling victim to deceptive update schemes.
Read more.
Meta vows to curtail false content, deepfakes ahead of Australian election
itNews
With Australia’s upcoming elections, Meta has pledged to crack down on false content and deepfakes, aiming to curb misinformation and election interference. The company is enhancing detection tools, working with fact-checkers, and increasing transparency measures to prevent AI-generated disinformation from influencing voters. However, critics argue that enforcement remains inconsistent and that stronger regulatory oversight is needed. The initiative underscores the growing role of AI in disinformation campaigns and the ongoing struggle between tech platforms, governments, and election security experts to protect democratic processes.
Read more.
Curious tale of two HR tech unicorns, alleged espionage, and claims of a spy hiding in a bathroom
The Register by Thomas Claburn
A bizarre corporate espionage saga has emerged between two rival HR tech unicorns, involving allegations of trade secret theft, covert surveillance, and even a spy hiding in a bathroom to gather intelligence. The case, now unfolding in legal battles, underscores the high-stakes nature of data security in competitive industries. Beyond the headline-grabbing drama, the incident highlights the growing risks of insider threats, corporate espionage, and cybersecurity failures, reinforcing the need for robust access controls, employee monitoring policies, and strict data protection measures in high-growth tech firms.
Read more.
ANALYSIS
Through the Lens of Music: What Cybersecurity Can Learn From Joni Mitchell
SecurityWeek by Joshua Goldfarb
Cybersecurity, like music, thrives on balance, improvisation, and adaptability—lessons that Joni Mitchell’s approach to song writing can teach security professionals. Just as Mitchell defied conventions by using unconventional tunings and evolving styles, cybersecurity must embrace flexibility, creativity, and a proactive mindset to counter evolving threats. The article explores how risk management, defence strategies, and security innovation benefit from a holistic approach, reinforcing that effective cybersecurity is both an art and a science, requiring intuition, structure, and the ability to adapt to an unpredictable landscape.
Read more.
5 Identity Threat Detection & Response Must-Haves for Super SaaS Security
The Hacker News
As identity-based attacks surge, security experts highlight five critical components of effective Identity Threat Detection & Response (ITDR) for SaaS environments. These include continuous identity monitoring, behavioural analytics, adaptive authentication, automated response mechanisms, and strong integration with existing security frameworks. With attackers increasingly targeting identity as the weakest link, organisations must prioritise identity-centric security strategies to prevent unauthorised access, account takeovers, and data breaches in cloud-based applications.
Read more.
Why Cybersecurity Needs More Business-Minded Leaders
Dark Reading by Victoria Dimmick
Cybersecurity is no longer just a technical challenge—it’s a business imperative. Experts argue that CISOs and security leaders must adopt a business mindset, aligning security strategies with organisational goals, risk management, and financial impact. Too often, cybersecurity is seen as a cost centre rather than a driver of trust, resilience, and competitive advantage. To bridge this gap, security leaders must improve communication with executives, translate technical risks into business language, and integrate cybersecurity into overall corporate strategy to ensure long-term success.
Read more.
How Governments and Businesses in Canada and the EU Can Reduce Dependence on U.S.-Controlled Cloud Infrastructure
PrivID (Substack)
With concerns over data sovereignty and regulatory control, governments and businesses in Canada and the EU are exploring ways to reduce reliance on U.S.-controlled cloud infrastructure. Current cloud dependencies expose sensitive data to foreign surveillance laws and jurisdictional risks, prompting calls for localised, sovereign cloud solutions. Experts emphasise the need for investment in regional cloud providers, stricter data residency policies, and regulatory frameworks that ensure compliance with privacy laws while maintaining competitive access to cloud-based innovation.
Read more.
Zhou Shuai: A Hacker’s Road to APT27
Natto Thoughts by the Natto Team (Substack)
The story of Zhou Shuai, an infamous hacker linked to APT27, offers an inside look into the rise of one of the most notorious Chinese cyber espionage groups. Zhou’s journey from small-time attacks to orchestrating large-scale campaigns targeting global industries and governments highlights the increasing sophistication of state-backed cyber operations. This analysis explores the tactics, techniques, and procedures (TTPs) used by APT27, emphasising the need for organisations to implement advanced threat detection, improved intelligence-sharing, and a more aggressive approach to identifying and defending against these persistent threats.
Read more.
Sovereign digital infrastructure. Will Australia seize the moment?
InnovationAus by Rupert Taylor-Price
As digital sovereignty becomes a growing concern, Australia faces a critical decision—should it invest in nationally controlled digital infrastructure or continue relying on foreign technology providers? With increasing risks from geopolitical tensions, data privacy laws, and supply chain vulnerabilities, experts argue that developing sovereign cloud solutions, local data centres, and secure communication networks is essential for economic security and resilience. However, achieving this requires strong policy frameworks, public-private collaboration, and significant investment to reduce dependence on global tech giants while maintaining competitiveness.
Read more.
The EU General Data Protection Regulation: A Commentary (2nd edition)
Oxford University Press Edited by Christopher Kuner, Lee A. Bygrave, Christopher Docksey
The second edition of the EU General Data Protection Regulation (GDPR) commentary provides an in-depth analysis of the regulation’s evolving impact on privacy, compliance, and data protection frameworks. As enforcement actions increase and global companies adjust to stricter regulations, the book examines legal interpretations, case studies, and ongoing challenges faced by businesses operating under GDPR. With data privacy laws influencing policies worldwide, this edition offers valuable insights for lawmakers, compliance officers, and security professionals navigating the complexities of modern data protection.
Read more.
CyAN Members: Op Eds, Articles, etc:
Navigating Uncharted Waters: The EU’s Digital Markets Act and Its Impact on Security
By Kim Chandler McDonald
In this article, Kim explores the far-reaching implications of the EU’s Digital Markets Act (DMA) on cybersecurity, highlighting how the legislation aims to curb monopolistic practices, enhance digital competition, and introduce stricter security standards for major tech platforms. While the DMA promotes data privacy and transparency, it also raises questions about enforcement, compliance burdens, and unintended security risks. Kim emphasises the need for businesses to adapt, regulators to stay vigilant, and cybersecurity leaders to anticipate both challenges and opportunities as the EU reshapes the digital landscape.
Read more.
“What happens to Heroes?” EPISODE #2: The Unsung Heroes of the digital world
By Didier Annet
In his latest ‘episode,’ Didier shines a light on the often-overlooked cybersecurity professionals who work tirelessly behind the scenes to defend systems, data, and digital infrastructure. While cyber threats make headlines, those who prevent breaches, mitigate attacks, and secure critical assets rarely get recognition. This piece explores the mental and emotional toll of frontline defenders, the lack of visibility for their contributions, and the need for stronger industry support, acknowledgment, and resilience strategies to ensure these unsung heroes remain motivated and protected in an increasingly hostile digital world. Without greater recognition and investment in their well-being, burnout and attrition threaten to weaken the very defenses organizations rely on. As cyber threats grow more sophisticated, ensuring the people behind the screens are valued and supported is just as critical as strengthening the technology itself.
Read more.
Securing the Future: Innovative Cybersecurity for Agentic AI
RSA Conference Blog by Shantanu Bhattacharya
In this exploration of cybersecurity’s next frontier, Shantanu examines the risks and safeguards needed for Agentic AI—a new class of AI systems capable of autonomous decision-making and adaptive learning. As these models become more independent, traditional security frameworks struggle to keep pace. Shantanu highlights the need for proactive threat modelling, robust governance, and ethical safeguards to ensure these systems remain secure, accountable, and resistant to adversarial manipulation, reinforcing that cybersecurity must evolve alongside AI innovation. Without rigorous oversight, Agentic AI could introduce unpredictable security risks, from data poisoning to unauthorised decision-making that impacts critical systems. By embedding cybersecurity into AI’s foundation, organizations can harness its potential while mitigating the unintended consequences of unchecked autonomy.
Read more.
CyAN Members: NEWS
Don’t miss CyAN Global VP Kim Chandler McDonald on Risky Women Radio!
Risky Women Radio
In the captivating ‘Risk and Compliance Against Technology-Facilitated Domestic Violence’ episode, Kim shares her journey from theatre to becoming the co-founder and CEO of 3 Steps Data—and our VP! She delves into her advocacy for proactive compliance and robust risk strategies to protect vulnerable users, democratising technology, and combating technology-facilitated domestic violence. Kim also underscores the critical role of end-to-end encryption in ensuring data security and privacy. Alongside, she regales with tales from interviewing global leaders to her adventurous stint as an emergency forest firefighter!
Read more.
The first-ever CyAN APAC Community Call brought together 10 members for an intimate and insightful discussion. John Salomon and Saba Bagheri shared mentorship experiences and what mentees need most. Saba also invited Fatema to join the March “Women in Cyber” feature. The group proposed a webinar: “Seeking a Job in Cybersecurity? The Questionable Value of Certifications.” A warm, engaging call overall!
CyAN thrives because of the incredible talent, leadership, and dedication of our members, and we are proud to see them shaping the future of cybersecurity on a global stage! 🚀💙
Upcoming CyAN (and CyAN Partner) Global Events:
- Trust & Safety Forum at Forum INCYBER Europe (FIC), Lille, France: April 1–2 Read more
- Supply Chain Cyber Security Summit (SCCS), Lisbon, Portugal: April 9–11 Read more
- GITEX AFRICA, Marrakesh, Morocco: April 14–16 Read more
- GITEX ASIA, Singapore (Marina Bay Sands): April 23–25 Read more
- GISEC, Dubai World Trade Centre, UAE: May 6–8 Read more
- The Cyber Outstanding Security Performance Awards (Cyber OSPAs), London, UK: May 8 Read more
- CSG Awards 2025, Dubai: May 7 Read more
- World AI Technology Expo, Dubai, UAE: May 14–15 Read more
- CyAN 10th Anniversary Celebrations!
- GITEX Europe Messe, Berlin, Germany: May 21–23 Read more
- MaTeCC, Rabat, Morocco (The third annual North Africa cybersecurity event, hosted by CyAN partner École High-Tech): June 7–9, 2025 Read more
- CyAN Q2 Community Call (APAC and the Gulf): June 11, 12:00 GST / 16:00 SGT / 18:00 AEST
- CyAN Q2 Community Call (EMEA and the Americas): June 11, 20:00 GST / 18:00 CET / 17:00 UTC / 12:00 EDT
Cyber (In)Securities – Issue 130
Information Security News House Passes Bill Requiring Federal Contractors to Implement Vulnerability Disclosure Policies SecurityWeek by Eduard KovacsThe U.S. House of Representatives has recently passed a bill that mandates federal contractors to establish vulnerability disclosure policies. This legislative move aims to strengthen the security of …
Cyber (In)Securities – Issue 128
Information Security News 89% of Enterprise GenAI Usage Is Invisible to Organizations, Exposing Critical Security Risks The Hacker NewsA new report reveals that a staggering 89% of generative AI usage within enterprises remains undetected, exposing organisations to severe security risks. This covert AI activity can …
Cyber (In)Securities – Issue 127
Flaw found in stalkerware apps, exposing millions of people. Here’s how to find out if your phone is being spied upon
Bitdefender by Graham Cluley
A significant security flaw discovered in stalkerware apps has exposed millions to potential spying, significantly compromising user privacy. This vulnerability allows unauthorised access to personal data, raising serious concerns about the safety and security of individuals who may be unknowingly monitored. The issue highlights the urgent need for users to check their devices for signs of stalkerware, which may include unusual battery drain or data usage. Experts recommend regular security checks, the installation of reputable anti-stalkerware tools, and staying informed about ways to protect personal digital spaces from such invasive software.
Exploits for unpatched Parallels Desktop flaw give root on Macs
BleepingComputer by Bill Toulas
An unpatched vulnerability in Parallels Desktop for Mac allows attackers to gain root access, posing severe risks to users by potentially compromising system integrity and personal data. This exploit enables unauthorised users to bypass security mechanisms, manipulate systems, and access confidential information, illustrating the critical importance of regular software updates and vigilant security practices. Mac users are urged to apply all available security patches to mitigate this risk. The situation underscores the necessity of proactive cybersecurity measures and the dangers of operating systems without the latest security defenses.
DeepSeek’s ByteDance Data-Sharing Raises Fresh Security Concerns
Dark Reading by Elizabeth Montalbano
Recent reports have raised significant security concerns over DeepSeek, a subsidiary of ByteDance, and its data-sharing practices, which may compromise user privacy. The scrutiny comes amidst allegations that the company shares user data in ways that could violate privacy norms and potentially aid in surveillance. This issue underscores the need for stringent data governance and highlights the challenges users face in controlling their personal information. The situation calls for urgent regulatory actions to ensure that data handling by tech companies adheres to ethical standards and legal requirements, protecting individuals from unauthorised data exploitation.
New Malware Campaign Uses Cracked Software to Spread Lumma and ACR Stealer
The Hacker News by Ravie Lakshmanan
A new malware campaign exploiting cracked software to spread Lumma and ACR Stealer has been uncovered, targeting users looking for free software alternatives. This campaign leverages the allure of cracked software to deploy malware that can steal sensitive information, including passwords and financial data. The use of such software poses significant risks, as it often bypasses traditional antivirus protections. Cybersecurity experts strongly advise against the use of pirated software and emphasise the importance of maintaining rigorous security protocols, including using only legitimate and licensed software, conducting regular system scans, and keeping all software up to date to avoid falling victim to these sophisticated cyber threats.
Engineers Australia launches ‘chartered’ cyber credential
InnovationAus by David McClure
Engineers Australia has introduced a new ‘chartered’ credential for cybersecurity professionals, aiming to standardise and elevate expertise within the industry. This credential recognises and certifies the skills and knowledge of engineers working in cybersecurity, offering a structured pathway for professional development. It responds to the increasing complexity of cyber threats and the critical need for qualified professionals who can secure modern digital infrastructures. This credential enhances individual careers and contributes to strengthening national and organisational cybersecurity capabilities.
The software UK techies need to protect themselves now Apple’s ADP won’t
The Register by Connor Jones
With Apple’s decision to not extend Advanced Data Protection (ADP) to the UK, tech professionals are urged to explore alternative software solutions to safeguard their digital assets effectively. This situation highlights the need for robust, end-to-end encryption and other security measures that can compensate for the lack of ADP. The discussion includes a variety of software options that offer strong encryption standards and data protection policies, aiming to assist UK techies in maintaining their privacy and data integrity against potential cyber threats. The article emphasises the importance of proactive security practices in a landscape where traditional data protection mechanisms are increasingly insufficient.
Gov bans Kaspersky from its systems and devices
itNews by Eleanor Dickinson
The Australian government has implemented a ban on Kaspersky software across all its systems and devices due to security concerns, marking a significant stance on protecting national security. This precautionary measure addresses the risks associated with potential espionage and cyberattacks that could exploit vulnerabilities within the software. The ban underscores the critical need for trusted security solutions in government operations and highlights the broader implications for software vendors striving to maintain credibility in a market that increasingly values transparency and reliability in cybersecurity practices.
Microsoft Power Pages vulnerability exploited in the wild
Cybersecurity Dive by Rob Wright
A vulnerability in Microsoft Power Pages has been actively exploited, presenting serious security concerns for users. This flaw allows attackers to execute arbitrary code and potentially take control of affected systems, exposing sensitive data. The urgency of addressing this issue is paramount, as the exploitation of such vulnerabilities can lead to significant breaches, undermining trust in digital infrastructures. Users are advised to apply patches provided by Microsoft immediately to mitigate the risk and protect their data from unauthorised access. This situation highlights the ongoing challenges in maintaining secure web environments and the necessity for continuous vigilance and prompt updates in cybersecurity protocols.
A Data Leak Exposes the Operations of the Chinese Private Firm TopSec, Which Provides Censorship-as-a-Service
Security Affairs by Pierluigi Paganini
A significant data leak at TopSec, a Chinese firm known for providing censorship-as-a-service, has exposed extensive details about its operations. This breach reveals the extent to which the company engages in information control and surveillance for the Chinese government. The exposed data includes sensitive information about the methods and technologies used to monitor and suppress online content. This incident not only raises concerns about privacy and freedom of expression but also underscores the vulnerabilities in the security practices of companies involved in state-sponsored censorship activities. The leak prompts a critical examination of the implications for global internet freedom and the ethical responsibilities of technology providers.
Australia facing higher rate of cyber threats as part of APAC regional surge
itWire by Rosalyn Page
Australia is experiencing an elevated rate of cyber threats, part of a broader surge across the Asia-Pacific region. This increase is driven by the escalating sophistication of cyberattacks targeting both public and private sectors. The rise in cyber threats includes phishing, ransomware, and state-sponsored attacks, putting critical infrastructure and data at risk. This trend necessitates stronger cybersecurity measures, enhanced threat intelligence sharing, and more robust collaboration between government agencies and industry leaders. The aim is to fortify defences, raise awareness about cyber hygiene practices, and develop more resilient digital ecosystems to counteract the growing cyber threat landscape.
3.9 Billion Passwords Stolen—Infostealer Malware Blamed
Forbes by Davey Winder
In a major cybersecurity alert, Forbes reports that 3.9 billion passwords have been stolen, attributed to a sophisticated infostealer malware. This breach highlights a severe lapse in digital security protocols globally, prompting an urgent call for heightened cybersecurity measures. Experts stress the need for robust protective technologies and enhanced user vigilance. They recommend immediate action to upgrade defense systems against such malicious software, which is becoming increasingly capable of evading traditional security checks. This incident marks a significant moment in cybersecurity, urging a reevaluation of how personal data is protected online.
Australia fines Telegram for delay in answering questions
itNews
Australian regulators have imposed a significant fine on the messaging app Telegram for its delayed response to inquiries regarding its data handling and privacy practices. According to itNews, this action reflects Australia’s stringent approach to enforcing digital communication compliance amid growing concerns over data security. The fine serves as a warning to other tech companies about the importance of quick and transparent responses to regulatory questions. Experts emphasise that maintaining rigorous data protection standards is crucial for preserving user trust and ensuring compliance with global data privacy laws. This case highlights the escalating demands on digital platforms to adhere to strict regulatory expectations and the potential repercussions of non-compliance.
Fake CS2 tournament streams used to steal crypto, Steam accounts
BleepingComputer by Bill Toulas
Cybercriminals are exploiting the popularity of CS2 tournaments by hosting fake streams that deceive gamers into downloading malware, leading to significant losses of cryptocurrency and Steam accounts. BleepingComputer reports that these fraudulent streams lure viewers with the promise of live competitive play, only to trick them into installing software that steals sensitive information. This scam highlights the increasing sophistication of cyber threats targeting online gaming communities. Experts advise gamers to verify the authenticity of streams and download sources, maintain robust security software, and stay informed about common phishing tactics to safeguard their digital and financial assets effectively.
Former NSA, Cyber Command chief Paul Nakasone says U.S. falling behind its enemies in cyberspace
Cyberscoop by Tim Starks
In a candid interview with Cyberscoop, former NSA and Cyber Command chief Paul Nakasone expressed concerns that the United States is falling behind its adversaries in cyberspace. Nakasone emphasized the strategic gaps in America’s cyber defenses, highlighting that current efforts are insufficient to counteract the sophisticated cyber tactics employed by foreign enemies. He stresses the need for a comprehensive national cyber strategy that proactively enhances cybersecurity infrastructure and fosters greater collaboration between government agencies and the private sector. This strategic overhaul, he argues, is essential to maintaining national security and staying ahead in the constantly evolving cyber threat landscape.
Critical New PayPal Warning: Genuine Emails Used In Ongoing Attack
Forbes by Davey Winder
Forbes has issued a critical alert regarding a new phishing scam where attackers are using genuine-looking PayPal emails to execute sophisticated attacks. This campaign involves cybercriminals crafting emails that mimic official PayPal communications, tricking recipients into divulging sensitive information such as login credentials and financial details. The article stresses the importance of vigilance and educating users on the hallmarks of phishing attempts. It also calls for enhanced email filtering technologies and user education to combat these types of cyber threats effectively. This incident serves as a stark reminder of the evolving nature of cyberattacks and the need for continuous updates to security measures.
Beware: PayPal “New Address” feature abused to send phishing emails
BleepingComputer by Lawrence Abrams
BleepingComputer reports a new phishing tactic exploiting PayPal’s “New Address” feature, where cybercriminals send fraudulent emails urging users to verify their account details. This scam cleverly disguises itself within legitimate-looking PayPal communications, convincing users to input sensitive information, which leads to data breaches and financial loss. The article highlights the necessity for users to be extremely cautious with email links and to verify any changes through official PayPal channels directly. It also emphasizes the importance of ongoing cybersecurity education to recognize and thwart such deceptive techniques, ensuring personal and financial information remains secure.
NSW finds new permanent cyber chief
itNews by Eleanor Dickinson
New South Wales has appointed a new permanent cyber chief to oversee the state’s cybersecurity strategy, aiming to strengthen defenses against a rising tide of cyber threats. This appointment underscores the growing recognition of the critical importance of cybersecurity at the state level. The new cyber chief’s role will focus on enhancing collaboration between government agencies, bolstering cyber incident response capabilities, and developing comprehensive policies to protect public and private sector data. This strategic move is part of a broader effort to fortify digital infrastructure and ensure robust protection for citizens’ data in the face of increasingly sophisticated cyberattacks.
Hackers steal $1.5bn from crypto exchange in ‘biggest digital heist ever’
The Guardian by Joanna Partridge
The Guardian reports a monumental theft where hackers stole $1.5 billion from a cryptocurrency exchange, marking it as the biggest digital heist in history. This staggering breach involved sophisticated cyber tactics that overcame existing security measures, prompting a global reevaluation of cryptocurrency security protocols. The incident has sent shockwaves through the financial technology industry, highlighting vulnerabilities that could potentially expose other platforms. Experts are now calling for heightened security measures, including advanced encryption and multi-factor authentication, to protect against similar attacks and to reassure the increasingly anxious investor community about the safety of their digital assets.
DOGE Sparks Surveillance Fear Across the US Government
Wired by Paresh Dave, Dell Cameron & Alexa O’Brien
Wired reports escalating concerns within the US government regarding the cryptocurrency DOGE and its potential use in surveillance and data collection. These fears stem from DOGE’s rapid integration into mainstream financial systems and its accessibility to top cybersecurity agencies. Government officials are debating the implications of such technologies, which could potentially be exploited for mass surveillance or violate privacy rights. This issue highlights the ongoing tension between technological innovation and civil liberties, prompting a call for strict regulatory frameworks to govern the use of cryptocurrencies in government operations while safeguarding individual privacy.
Telegram fined nearly $1m by Australian watchdog for delay in reporting about terrorism and child abuse material
The Guardian by Josh Taylor
Australian regulators have imposed a fine of nearly $1 million on Telegram for its delayed action in reporting incidents involving terrorism and child abuse material, as detailed by The Guardian. This penalty emphasizes the critical role social media platforms play in preventing the spread of harmful content. It also spotlights the stringent expectations from authorities worldwide that platforms enforce proactive monitoring and swift reporting practices. The case serves as a caution to other companies about the severe consequences of failing to adhere to legal and ethical standards in content management.
ANALYSIS
Apple removes advanced data protection tool in face of UK government request
The Guardian by Rachel Hall
In response to a UK government request, Apple has removed an advanced data protection tool from its products in the UK, a move that has sparked widespread concerns over privacy. This action highlights the ongoing struggle between government surveillance needs and individual privacy rights. Critics and privacy advocates are alarmed, suggesting that this could undermine user trust and set a troubling precedent for tech companies, potentially eroding privacy protections globally. The debate continues about the balance that needs to be struck between national security and protecting citizens’ private data.
DOGE Now Has Access to the Top US Cybersecurity Agency
Wired by Kim Zetter
Wired reveals that the cryptocurrency DOGE has gained unprecedented access to a top U.S. cybersecurity agency, stirring debates over the implications for national security and privacy. This development comes as government entities increasingly explore the potential of blockchain technologies for enhancing security operations. However, the integration of DOGE raises concerns about the security and transparency of governmental use of cryptocurrency technologies. Critics argue this could lead to potential vulnerabilities, calling for rigorous oversight and clear guidelines to ensure that such technologies do not compromise the integrity of national security measures.
Apple’s Bold Move in the UK: No Backdoor, No Extra Encryption
PrivID (Substack)
In a decisive stance, Apple has opted not to include additional encryption or backdoor access in its UK products, as reported by PrivID on Substack. This decision highlights Apple’s commitment to user privacy amidst pressure from the UK government to allow backdoor access for law enforcement purposes. The article elaborates on the broader implications of this move for privacy advocacy and cybersecurity, arguing that resisting government pressure helps maintain trust and security for users globally. It discusses the potential consequences for Apple in terms of legal challenges and market dynamics, emphasizing the delicate balance between national security demands and the preservation of individual privacy rights.
Cybersecurity Needs to Stay Nonpartisan in the Age of DOGE
Lohrmann on Cybersecurity by Dan Lohrmann
In his commentary for “Lohrmann on Cybersecurity,” Dan Lohrmann stresses the importance of nonpartisanship in cybersecurity, particularly as the influence of cryptocurrencies like DOGE grows within national security frameworks. According to Lohrmann, the entanglement of digital currencies with security issues could lead to political exploitation. He advocates for a bipartisan approach to cybersecurity, urging that policies and actions should transcend political divisions to effectively protect national interests. Lohrmann argues that cybersecurity resilience depends on collaborative efforts and adherence to shared principles, rather than being influenced by fluctuating political agendas.
Cybersecurity in 2025: A Battle of Interwoven Interests
The Peninsula by Dr. Khaled Walid Mahmoud
Dr. Khaled Walid Mahmoud’s article in The Peninsula addresses critical challenges in the cybersecurity landscape of 2025, particularly emphasizing the growing resilience disparity between large and small institutions. He highlights how smaller entities often lack the resources to implement comprehensive cyber defenses, making them particularly vulnerable to attacks. Amidst this scenario, Dr. Mahmoud poses an essential question regarding the position of Arab nations within the global cybersecurity equation. He discusses their unique vulnerabilities and the need for regional cooperation to enhance security frameworks and reduce disparities. This dialogue is crucial as it underscores the importance of tailored cybersecurity strategies that account for varied economic and technological capabilities across different regions.
Cyber Insurance is Useless Without Encryption
PrivID (Substack)
The PrivID article highlights a crucial aspect of cyber risk management: the ineffectiveness of cyber insurance without robust encryption practices. As cyber threats evolve, merely relying on insurance policies without securing data at its core leaves organizations vulnerable. The piece emphasizes that encryption is essential not just for safeguarding data but also for meeting the stringent requirements that insurance policies increasingly demand. It calls on organizations, particularly SMEs, to integrate strong encryption methods as a standard practice to enhance their overall cybersecurity measures and ensure that they are genuinely protected against potential breaches.
CyAN Members: Op Eds, Articles, etc.
The 3 Levels of Threat Intelligence: How They Help You Stay Secure
Fel Gayanilo
In this insightful piece, CyAN General Secretary Fel Gayanilo breaks down threat intelligence into three distinct levels—strategic, tactical, and operational. Fel explains how each level plays a crucial role in enhancing an organization’s cybersecurity posture. Strategic threat intelligence helps in understanding the broad risk landscape, tactical intelligence focuses on immediate threats, and operational intelligence deals with day-to-day security events. This layered approach, Fel argues, enables organizations to better anticipate potential threats and tailor their defenses accordingly, thereby staying one step ahead of cyber adversaries.
Quantum Computing and the Urgent Need for Universal End-to-End Encryption
Kim Chandler McDonald
CyAN VP Kim Chandler McDonald discusses the transformative impact of quantum computing on cybersecurity, particularly stressing the urgent need for universal end-to-end encryption. Kim highlights how quantum computing poses significant risks to current encryption methods and could potentially break many of the cryptographic systems currently in use. The article calls for proactive measures to develop quantum-resistant encryption technologies to protect data against future threats. Kim’s insights underline the importance of preparing for quantum advancements to ensure privacy and security in the digital age.
Smart Security Everywhere: Empowering CXOs with Always-On Protection
Shantanu Bhattacharya
CyAN member Shantanu Bhattacharya addresses the need for comprehensive security solutions in his article on ‘Smart Security Everywhere’. He advocates for an ‘Always-On’ protection model that empowers CXOs to manage and mitigate risks continuously. Shantanu outlines how integrating smart security technologies across all organizational levels can provide real-time threat detection and response, thus safeguarding critical assets. His recommendations emphasize the role of leadership in fostering a culture of security that aligns with business objectives and adapts to the evolving cyber threat landscape.
Upcoming CyAN Global Events
📌 Breaking the Cycle: Combating Online IBSA for a Safer Digital Experience
🗓 March 6th | EST 6 AM | CET 12 PM | AEST 10 PM
Join the webinar
📌 CyAN APAC: The Geopolitical Impacts of Cyber Threats: From Espionage to Influence
🗓 March 12th | Peoplebank, Sydney | Keynote by Dan Elliot
Event details
📌 GITEX AFRICA, Marrakesh, Morocco
🗓 April 14-16
More info
📌 GITEX ASIA, Singapore (Marina Bay Sands)
🗓 April 23-25
More info
📌 GISEC, Dubai World Trade Center, UAE
🗓 May 6-8
More info
📌 The Cyber Outstanding Security Performance Awards (Cyber OSPAs), London, UK
🗓 May 8
More info
📌 World AI Technology Expo UAE, Dubai, UAE
🗓 May 14-15
More info
📌 MaTeCC: Rabat, Morocco
🗓 June 7-9
📍 The third annual North Africa and beyond cybersecurity event, hosted by CyAN partner organisation École High-Tech
More info
📄 Download the full issue of CyAN Cyber (In)Securities Issue 127
Click here to view the PDF
Cyber (In)Securities – Issue 126
Information Security News Ghost Ransomware Targets Orgs in 70+ CountriesDark Reading by Elizabeth MontalbanoGhost ransomware continues to pose a significant threat globally, now targeting organisations in over 70 countries. This ransomware variant is particularly insidious due to its ability to encrypt data swiftly and demand …