Alright team, it's been a busy 24 hours in the cyber world with significant updates on AI-related vulnerabilities, new malware, ongoing cybercrime operations, and shifts in the threat landscape. Let's dive in:

AI-Powered Vulnerabilities and RCE Risks 🛡️

- Anthropic has patched three critical flaws (path validation bypass, unrestricted git_init, argument injection) in its Git Model Context Protocol (MCP) server. When chained with the Filesystem MCP server, these bugs could enable remote code execution (RCE) via indirect prompt injection.
- The open-source AI framework Chainlit (used by financial, energy, and academic sectors) was found to have two "easy-to-exploit" vulnerabilities: an arbitrary file read (CVE-2026-22218) and a server-side request forgery (SSRF) (CVE-2026-22219). These could lead to data leakage, account takeover, and lateral movement in enterprise cloud environments.
- Google Gemini was hit by a prompt injection flaw, weaponising Calendar invites to bypass privacy controls, access private meeting data, and create deceptive events without user interaction. This highlights a "structural limitation" in how AI-integrated products interpret user intent in natural language.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/20/anthropic_prompt_injection_flaws/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/20/ai_framework_flaws_enterprise_clouds/
🕶️ Dark Reading | https://www.darkreading.com/cloud-security/google-gemini-flaw-calendar-invites-attack-vector

New Malware and AI-Assisted Development 🤖

- VoidLink, a sophisticated Linux malware targeting cloud environments (AWS, GCP, Azure, Alibaba, Tencent) with 37 plugins, was "almost entirely generated by artificial intelligence." Researchers believe a single individual, using the Trae Solo AI assistant, developed the functional implant in under a week.
- A regionally focused threat actor, tracked as Nomad Leopard, is targeting Afghan government employees with phishing emails disguised as official correspondence. These emails deliver FalseCub malware, designed for data exfiltration, and leverage GitHub for temporary payload hosting.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/20/voidlink_ai_developed/
🗞️ The Record | https://therecord.media/hackers-target-afghan-workers

Mass Spam and Illicit Marketplace Shutdowns ⚠️

- Multiple users are reporting a wave of mass spam emails originating from Zendesk domains, leveraging instances belonging to legitimate companies like Live Nation, Capcom, and Tinder. These emails are often bypassing spam filters, with Zendesk investigating potential relay attacks or misconfigurations.
- Tudou Guarantee, a major Telegram-based illicit marketplace that processed over $12 billion in transactions, appears to be winding down its operations. This shutdown is linked to recent law enforcement actions against Cambodian conglomerate Prince Group and its CEO, Chen Zhi, implicated in "pig butchering" scams.

🕶️ Dark Reading | https://www.darkreading.com/threat-intelligence/mass-spam-attacks-zendesk-instances
📰 The Hacker News | https://thehackernews.com/2026/01/tudou-guarantee-marketplace-halts.html

Evolving Threat Landscape: AI and Hacktivism 🚨

- Cybercrime has fully embraced AI, with "Dark LLMs" and deepfake tools now available as cheap, off-the-shelf services. Group-IB reports Dark LLMs for scams and malware can be rented for as little as $30/month, and synthetic identity kits for $5, significantly scaling social engineering and fraud.
- The UK's NCSC has warned of a sustained cyber threat from pro-Russian hacktivist groups, such as NoName057(16), continuing to target UK and international organisations with disruptive cyberattacks, including DDoS. These ideologically motivated groups, though less sophisticated than state-sponsored actors, can still cause significant real-world disruption.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/20/group_ib_ai_cycercrime_subscriptions/
🗞️ The Record | https://therecord.media/uk-ncsc-warning-russia-aligned-hacktivist-groups

Cybersecurity Legislation and Funding Updates 🏛️

- US lawmakers have once again moved to temporarily extend two key cybersecurity laws: the 2015 Cybersecurity and Information Sharing Act (CISA 2015) and the State and Local Cybersecurity Grant Program, through September 30. This is part of a compromise government funding bill, highlighting ongoing challenges for long-term reauthorization.
- The proposed funding bill also allocates $2.6 billion for the Cybersecurity and Infrastructure Security Agency (CISA), including $39.6 million for election security programs. The legislation also includes directives on CISA staffing levels, aiming to ensure sufficient personnel for its statutory missions.

🗞️ The Record | https://therecord.media/lawmakers-move-to-extend-two-cyber-programs-again
🤫 CyberScoop | https://cyberscoop.com/congressional-appropriators-move-to-extend-information-sharing-law-fund-cisa

Cloudflare WAF Bypass Fixed 🌐

- Cloudflare has patched a security vulnerability in its Automatic Certificate Management Environment (ACME) validation logic. The flaw could have allowed a bypass of Web Application Firewall (WAF) rules, enabling requests to reach origin servers. No evidence of malicious exploitation was found.

📰 The Hacker News | https://thehackernews.com/2026/01/cloudflare-fixes-acme-validation-bug.html

Predator Bots and API Security 🤖

- The rise of "predator bots" — self-learning programs leveraging AI to mimic human behaviour and exploit APIs — is causing up to $186 billion in annual economic harm through credential theft, scalping, and fraud. Defending against these adaptive threats requires deep API knowledge, complete API discovery, and machine-speed behavioral detection.

🤫 CyberScoop | https://cyberscoop.com/malicious-bots-predator-bots-api-security-machine-speed-defense/

#CyberSecurity #ThreatIntelligence #Vulnerabilities #AI #PromptInjection #RCE #Malware #CloudSecurity #APIsecurity #Hacktivism #Cybercrime #InfoSec #IncidentResponse #ThreatLandscape

The British Army’s £279M investment in a permanent cyber regiment base signals how cyber defence is being treated as critical operational infrastructure.

With tens of thousands of attempted intrusions reported in recent years, the focus is shifting toward secure facilities, specialist training environments, and long-term capability building - rather than ad-hoc cyber responses.

From an InfoSec standpoint, this raises important questions around resilience, talent development, and sustained defensive readiness.

Follow @technadu for neutral analysis on cyber defence, threat landscapes, and security strategy.

Professional discussion welcome.

#CyberDefense #MilitaryCyber #InfoSec #CyberResilience #SecurityOperations #CyberInfrastructure #ThreatLandscape #DefenseTech

PoC exploits are now public for CVE-2025-69258 in Trend Micro Apex Central (on-premise), a vulnerability that could allow unauthenticated RCE on affected systems.

A patch is available, and there are no confirmed exploitation reports so far. Public PoCs, however, tend to accelerate attacker interest.

Follow @technadu for objective and technically grounded infosec updates.

Source: https://www.helpnetsecurity.com/2026/01/08/trend-micro-apex-central-cve-2025-69258-rce-poc/

#Infosec #VulnerabilityDisclosure #PatchManagement #RCE #EnterpriseSecurity #ThreatLandscape

A previously concluded cybercrime case related to the 2016 Bitfinex incident is seeing renewed attention after an early release under U.S. prison reform provisions.

The development underscores ongoing challenges in aligning cybercrime sentencing, rehabilitation, and policy consistency in an evolving threat landscape.

From an infosec perspective, how should accountability evolve for financially motivated cybercrime?

Share your insights and follow @technadu for objective infosec reporting.

#Infosec #CyberLaw #CyberCrimeAnalysis #CryptoSecurity #ThreatLandscape

The biggest cyber stories of 2025 share one theme: AI-driven attacks, identity abuse, and ransomware at industrial scale. Complexity rose fast — resilience didn’t always keep up. ⚠️📉 #CyberTrends #ThreatLandscape

https://www.bleepingcomputer.com/news/security/the-biggest-cybersecurity-and-cyberattack-stories-of-2025/

Collaboration tools like Teams, Slack, and Zoom have become prime targets for attackers—and Microsoft’s latest roadmap updates reflect that shift.

These new security features tell us a lot about the evolving threat landscape and where organizations still need to pay attention. If your security strategy hasn’t caught up with how people actually communicate, this Cyberside Chats episode is worth a listen: https://www.chatcyberside.com/e/collaboration-under-siege-microsoft-s-teams-security-overhaul/

#CybersideChats #Cybersecurity #ThreatLandscape #Microsoft365 #CollaborationSecurity #Phishing #IdentitySecurity #SecurityAwareness

What Is a Supply Chain Attack? Lessons from Recent Incidents

924 words, 5 minutes read time.

I’ve been in computer programming with a vested interest in Cybersecurity long enough to know that your most dangerous threats rarely come through the obvious channels. It’s not always a hacker pounding at your firewall or a phishing email landing in an inbox. Sometimes, the breach comes quietly through the vendors, service providers, and software updates you rely on every day. That’s the harsh reality of supply chain attacks. These incidents exploit trust, infiltrating organizations by targeting upstream partners or seemingly benign components. They’re not theoretical—they’re real, costly, and increasingly sophisticated. In this article, I’m going to break down what supply chain attacks are, examine lessons from high-profile incidents, and share actionable insights for SOC analysts, CISOs, and anyone responsible for protecting enterprise assets.

Understanding Supply Chain Attacks: How Trusted Vendors Can Be Threat Vectors

A supply chain attack occurs when a threat actor compromises an organization through a third party, whether that’s a software vendor, cloud provider, managed service provider, or even a hardware supplier. The key distinction from conventional attacks is that the adversary leverages trust relationships. Your defenses often treat trusted partners as safe zones, which makes these attacks particularly insidious. The infamous SolarWinds breach in 2020 is a perfect example. Hackers injected malicious code into an update of the Orion platform, and thousands of organizations unknowingly installed the compromised software. From the perspective of a SOC analyst, it’s a nightmare scenario: alerts may look normal, endpoints behave according to expectation, and yet an attacker has already bypassed perimeter defenses. Supply chain compromises come in many forms: software updates carrying hidden malware, tampered firmware or hardware, and cloud or SaaS services used as stepping stones for broader attacks. The lesson here is brutal but simple: every external dependency is a potential attack vector, and assuming trust without verification is a vulnerability in itself.

Lessons from Real-World Supply Chain Attacks

History has provided some of the most instructive lessons in this area, and the pain was often widespread. The NotPetya attack in 2017 masqueraded as a routine software update for a Ukrainian accounting package but quickly spread globally, leaving a trail of destruction across multiple sectors. It was not a random incident—it was a strategic strike exploiting the implicit trust organizations placed in a single provider. Then came Kaseya in 2021, where attackers leveraged a managed service provider to distribute ransomware to hundreds of businesses in a single stroke. The compromise of one MSP cascaded through client systems, illustrating that upstream vulnerabilities can multiply downstream consequences exponentially. Even smaller incidents, such as a compromised open-source library or a misconfigured cloud service, can serve as a launchpad for attackers. What these incidents have in common is efficiency, stealth, and scale. Attackers increasingly prefer the supply chain route because it requires fewer direct compromises while yielding enormous operational impact. For anyone working in a SOC, these cases underscore the need to monitor not just your environment but the upstream components that support it, as blind trust can be fatal.

Mitigating Supply Chain Risk: Visibility, Zero Trust, and Preparedness

Mitigating supply chain risk requires a proactive, multifaceted approach. The first step is visibility—knowing exactly what software, services, and hardware your organization depends on. You cannot defend what you cannot see. Mapping these dependencies allows you to understand which systems are critical and which could serve as entry points for attackers. Second, you need to enforce Zero Trust principles. Even trusted vendors should have segmented access and stringent authentication. Multi-factor authentication, network segmentation, and least-privilege policies reduce the potential blast radius if a compromise occurs. Threat hunting also becomes crucial, as anomalies from trusted sources are often the first signs of a breach. Beyond technical controls, preparation is equally important. Tabletop exercises, updated incident response plans, and comprehensive logging equip teams to react swiftly when compromise is detected. For CISOs, it also means communicating supply chain risk clearly to executives and boards. Stakeholders must understand that absolute prevention is impossible, and resilience—rapid detection, containment, and recovery—is the only realistic safeguard.

The Strategic Imperative: Assume Breach and Build Resilience

The reality of supply chain attacks is unavoidable: organizations are connected in complex webs, and attackers exploit these dependencies with increasing sophistication. The lessons are clear: maintain visibility over your entire ecosystem, enforce Zero Trust rigorously, hunt for subtle anomalies, and prepare incident response plans that include upstream components. These attacks are not hypothetical scenarios—they are the evolving face of cybersecurity threats, capable of causing widespread disruption. Supply chain security is not a checkbox or a one-time audit; it is a mindset that prioritizes vigilance, resilience, and strategic thinking. By assuming breach, questioning trust, and actively monitoring both internal and upstream environments, security teams can turn potential vulnerabilities into manageable risks. The stakes are high, but so are the rewards for those who approach supply chain security with discipline, foresight, and a relentless commitment to defense.

Call to Action

If this breakdown helped you think a little clearer about the threats out there, don’t just click away. Subscribe for more no-nonsense security insights, drop a comment with your thoughts or questions, or reach out if there’s a topic you want me to tackle next. Stay sharp out there.

D. Bryan King

Sources

• CISA: Supply Chain Security Resources
• NIST SP 800-161: Supply Chain Risk Management Practices
• KrebsOnSecurity: Cybersecurity News & Analysis
• CrowdStrike: Threat Intelligence Reports
• Mandiant Threat Reports
• Schneier on Security
• Verizon Data Breach Investigations Report (DBIR)
• Black Hat Conference Talks
• DEF CON Conference Resources
• Academic Papers on Cybersecurity

Disclaimer:

The views and opinions expressed in this post are solely those of the author. The information provided is based on personal research, experience, and understanding of the subject matter at the time of writing. Readers should consult relevant experts or authorities for specific guidance related to their unique situations.

#anomalyDetection #attackVector #breachDetection #breachResponse #CISO #cloudSecurity #cyberattackLessons #cybersecurity #cybersecurityGovernance #cybersecurityIncident #cybersecurityMindset #cybersecurityPreparedness #cybersecurityResilience #cybersecurityStrategy #EndpointSecurity #enterpriseRiskManagement #enterpriseSecurity #hardwareCompromise #hardwareSecurity #incidentResponse #incidentResponsePlan #ITRiskManagement #ITSecurityPosture #ITSecurityStrategy #Kaseya #maliciousUpdate #MFASecurity #MSPSecurity #networkSegmentation #NotPetya #organizationalSecurity #perimeterBypass #ransomware #riskAssessment #SaaSRisk #securityAudit #securityControls #SOCAnalyst #SOCBestPractices #SOCOperations #softwareSecurity #softwareSupplyChain #softwareUpdateThreat #SolarWinds #supplyChainAttack #supplyChainMitigation #supplyChainRisk #supplyChainSecurityFramework #supplyChainVulnerabilities #thirdPartyCompromise #threatHunting #threatLandscape #trustedVendorAttack #upstreamCompromise #upstreamMonitoring #vendorDependency #vendorRiskManagement #vendorSecurity #vendorTrust #zeroTrust

☝️ Global ransomware trends in 2025 show data extortion overtaking encryption, bigger payouts, and faster attacks. Defense must be proactive, not reactive. 🗂️💣 #Ransomware #ThreatLandscape

https://www.helpnetsecurity.com/2025/12/12/global-ransomware-trends-2025/

Today’s briefing highlights rising ransomware, phishing kits, and AI-driven threats — the attack surface is expanding faster than defenses. Constant adaptation is the new baseline. ⚡🛡️ #ThreatLandscape #CyberDefense

https://thecyberwire.com/newsletters/daily-briefing/14/227

Alright team, it's been a pretty packed 24 hours in the cyber world! We've got updates on some serious nation-state activity, a couple of actively exploited vulnerabilities, new malware campaigns, and a stark reminder about data privacy and the evolving threat landscape. Let's dive in:

Russian Insurer Hit, Schools Blamed for PowerSchool Breach 💥
- Russian insurer VSK is facing widespread outages after a major cyberattack, suspected to be ransomware, disrupted its website, mobile app, and other services for millions of customers. VSK claims no data was compromised, but alleged leaks are circulating. This comes after VSK was sanctioned for supporting Russia's "shadow fleet."
- Canadian privacy regulators in Ontario and Alberta have laid significant blame on school systems for the massive PowerSchool data leak, which exposed data for over 62 million students and 9 million teachers. Failures included inadequate privacy/security provisions in contracts, poor oversight of PowerSchool's security (especially MFA), and insufficient breach response plans.

🗞️ The Record | https://therecord.media/russia-vsk-cyberattack-outages
🗞️ The Record | https://therecord.media/canadian-privacy-regulators-say-schools-share-blame-powerschool-hack

New Threats: China's PlushDaemon, AI Botnets, and WhatsApp Worms 🦠
- China-linked threat group "PlushDaemon" is conducting widespread cyberespionage using "EdgeStepper" network implants. This technique redirects DNS queries to malicious servers to deliver backdoors, targeting entities in the U.S., Taiwan, and other East Asia-Pacific regions since 2019.
- A "ShadowRay 2.0" botnet is actively exploiting an unpatched, critical (CVSS 9.8) vulnerability (CVE-2023-48022) in internet-facing Ray AI clusters. Attackers, operating as "IronErn440," are leveraging Ray's legitimate orchestration features for cryptojacking, lateral movement, data theft (including AI models and source code), and DDoS attacks. The vendor, Anyscale, considers this a configuration issue, not a bug, as Ray isn't meant for external exposure. Attackers are using AI-generated payloads and quickly re-establishing operations after C2 takedowns on GitLab and GitHub.
- A new Python-based WhatsApp worm is spreading the "Eternidade Stealer" banking trojan across Brazilian devices. It uses social engineering and WhatsApp hijacking, dynamically retrieving C2 addresses via IMAP. The worm harvests contact lists and sends malicious MSI installers, specifically targeting Brazilian Portuguese OS users to steal credentials for banking, payment, and cryptocurrency services.
- ServiceNow's Now Assist AI platform is vulnerable to "second-order prompt injection" attacks due to default configurations enabling agent-to-agent collaboration. This allows malicious actors to trick benign agents into recruiting more powerful ones to exfiltrate data, modify records, or escalate privileges silently. ServiceNow has updated documentation, advising supervised execution, disabling autonomous overrides, and segmenting agent duties.

🗞️ The Record | https://therecord.media/china-aligned-threat-actor-espionage-network-devices
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/18/selfreplicating_botnet_ray_clusters/
🤫 CyberScoop | https://cyberscoop.com/ray-ai-cryptojacking-vulnerability-exposed-clusters-attack-oligo-security/
🚨 The Hacker News | https://thehackernews.com/2025/11/python-based-whatsapp-worm-spreads-eternidade-stealer.html
🚨 The Hacker News | https://thehackernews.com/2025/11/servicenow-ai-agents-can-be-tricked.html

Actively Exploited Vulnerabilities & Massive Data Leak ⚠️
- Around 50,000 end-of-life ASUS WRT routers have been compromised in "Operation WrtHug," a suspected China-linked espionage campaign. Attackers are exploiting multiple known command injection vulnerabilities (CVE-2023-41345 to -41348, CVE-2024-12912, CVE-2025-2492, CVE-2023-39780) to establish operational relay boxes (ORBs) for stealthy data theft, primarily in Taiwan and Southeast Asia. A key indicator is an unusual 100-year self-signed TLS certificate on the AiCloud service.
- A symbolic link-based RCE vulnerability (CVE-2025-11001, CVSS 7.0) in 7-Zip is under active exploitation. This flaw, fixed in version 25.00, allows remote code execution via crafted ZIP files and directory traversal, primarily affecting Windows systems when exploited from an elevated user or service account.
- Researchers uncovered a WhatsApp enumeration flaw that allowed them to collect basic personal data (phone numbers, names, profile images) of over 3.5 billion users due to a lack of effective rate limiting. This "largest data leak in history" could facilitate spam, phishing, and robocall attacks, and exposed users in countries where WhatsApp is banned. Meta has since implemented countermeasures.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/19/thousands_more_asus_routers_pwned/
🚨 The Hacker News | https://thehackernews.com/2025/11/hackers-actively-exploiting-7-zip.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/19/whatsapp_enumeration_flaw/

Cyber-Kinetic Warfare and Espionage 🛡️
- Amazon Threat Intelligence warns of a global rise in "cyber-enabled kinetic targeting," where cyberattacks directly enable physical military strikes. Nation-state actors are compromising systems like CCTV and maritime platforms for real-time intelligence to adjust kinetic operations, as seen with Iranian groups MuddyWater and Imperial Kitten. This necessitates an integrated approach to physical and digital security.
- MI5 has issued an espionage alert, warning that Chinese intelligence is actively recruiting sources in the UK with access to sensitive information. They're using social media platforms like LinkedIn and fake headhunters to target parliamentarians, staff, economists, and government officials. This highlights China's broad intelligence gathering efforts and follows the UK's removal of Chinese surveillance equipment from sensitive sites.

🤫 CyberScoop | https://cyberscoop.com/amazon-cyber-enabled-kinetic-targeting/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/19/amazon_cso_warfare_cyber_kinetic/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/19/mi5_linkedin_china_spy_warning/

Airline Data Broker Halts Government Sales 🔒
- The Airlines Reporting Corporation (ARC), an airline-owned data broker, will cease selling hundreds of millions of customer travel records to government agencies. This decision follows pressure from lawmakers after the IRS admitted to violating federal law by purchasing ARC's data, which included flight details and credit card information, without a warrant. ARC's "Travel Intelligence Program" also enabled "prospective surveillance."

🗞️ The Record | https://therecord.media/airline-data-broker-stop-selling-to-government

EU Proposal Threatens GDPR and AI Act Protections ⚖️
- The European Commission has proposed a "Digital Omnibus" that critics argue would significantly weaken the GDPR and AI Act. The proposal seeks to delay regulations for high-risk AI systems and allow companies to train AI models on personal data without prior consent in most cases. Privacy advocates warn this deregulation benefits big tech and rolls back fundamental data protections, despite official claims of fostering innovation.

🗞️ The Record | https://therecord.media/european-commission-proposal-gdpr-ai-simplification

CISA 2015 Law's Expiration Concerns 🏛️
- The temporary expiration of the Cybersecurity Information Sharing Act of 2015 (CISA 2015) until the end of January could jeopardise government vulnerability hunting efforts and critical information sharing between companies. Senators Mike Rounds and Gary Peters are pushing for a 10-year reauthorization, but political disagreements, particularly from Senator Rand Paul regarding CISA's past activities, are complicating a permanent renewal.

🤫 CyberScoop | https://cyberscoop.com/cyber-threat-data-sharing-law-expiration-security-risk-mike-rounds-gary-peters-rand-paul/

International Crypto Tracing Disrupts Piracy 💰
- An international operation led by Europol successfully traced $55 million in cryptocurrency linked to 69 digital piracy sites. Investigators used crypto to pay for pirated services, gaining insight into criminal financial infrastructure. Collaborating with platforms like Coinbase and Binance, this effort aims to disrupt illicit streaming services by cutting off their payment mechanisms.

🗞️ The Record | https://therecord.media/international-operation-traces-millions-crypto-streaming-piracy

#CyberSecurity #ThreatIntelligence #APT #Ransomware #Malware #Vulnerability #RCE #ZeroDay #DataPrivacy #GDPR #AI #CyberKinetic #Espionage #InfoSec #CyberAttack #IncidentResponse #ThreatLandscape

This week’s infosec highlights: zero-days, phishing kits, and rising supply-chain attacks. The threat landscape isn’t slowing — neither can defenders. ⚡🛡️ #ThreatLandscape #SecurityUpdates

https://www.theregister.com/2025/11/16/infosec_news_in_brief/

Browser security risks are rising fast — from zero-days to extension abuse. Your browser is now the frontline of defense. Stay patched, stay selective. 🌐🛡️ #BrowserSecurity #ThreatLandscape

https://www.helpnetsecurity.com/2025/11/13/browser-security-risks-report/

AI is changing the ransomware game—making high-stakes attacks accessible even to amateurs and pushing average ransom payments into the millions. How are companies gearing up to fight back?

https://thedefendopsdiaries.com/how-ai-is-supercharging-the-ransomware-threat-landscape/

#ai
#ransomware
#cybersecurity
#threatlandscape
#ransomwareasaservice

OpenCTI vs. MISP: A CTI Analyst’s Perspective on Two Core Threat Intelligence Platforms

#threatintel #threatintelligence #ThreatLandscape #cybersecurity #infosec

https://medium.com/@cybcyb789/opencti-vs-misp-a-cti-analysts-perspective-on-two-core-threat-intelligence-platforms-f21ca56b3c77

Elastic’s latest report shows attackers doubling down on Windows systems — proving legacy dominance still means prime target status. 🪟🎯 #EndpointSecurity #ThreatLandscape

https://www.helpnetsecurity.com/2025/10/13/elastic-report-attackers-target-windows-systems/

American Farm Bureau partners with Food and Ag-ISAC to boost cyber defenses across agriculture sector

The Food and Agriculture – Information Sharing and Analysis Center …
#dining #cooking #diet #food #Food #agriculturesector #AmericanFarmBureau #cyberattacks #cyberdefenses #cyberthreats #FoodandAg-ISAC #resilience #security #supplychain #threatlandscape
https://www.diningandcooking.com/2311248/american-farm-bureau-partners-with-food-and-ag-isac-to-boost-cyber-defenses-across-agriculture-sector/

You need to prove that your #security program mitigates risk. But, are you tracking the right metrics to show that it is? 🤔 #Cybersecurity metrics quantify your security controls’ effectiveness. And, as the threat landscape becomes more complex, teams often struggle to identify the best metrics to showcase their value. 💎

😌 Do not worry! We got ya. Here are numbers 1 through 10 from the list you've been waiting for...

1️⃣ Mean Time to Detect (MTTD)
2️⃣ Mean Time to Respond (MTTR)
3️⃣ Mean Time to Recover/Mean Time to Resolve (MTTR)
4️⃣ Mean Time to Contain (MTTC)
5️⃣ Mean Time to Acknowledge (MTTA)
6️⃣ Non-Human Network Traffic
7️⃣ Number of Detected Incidents
8️⃣ Incident Severity Levels
9️⃣ Patching Cadence
🔟 Patch Latency

To see the full list of metrics that you should be tracking, read our latest blog! 👓 📖 👇

https://graylog.org/post/40-infosec-metrics-organizations-should-track/ #SIEM #threatlandscape #infosec #infosecurity

Darktrace’s H1 2025 threat review shows:
- 12.6M+ phishing emails (25% targeting VIPs)
- AI-assisted phishing & ClickFix resurgence
- MFA-bypass phishing kits & SaaS ransomware attacks
- Exploitation of known CVEs in edge systems
- APT activity featuring BlindEagle and LapDogs, and evolved malware like Raspberry Robin

Conventional detection tools aren’t cutting it. Anomaly-based detection is essential for modern SOC resilience.

💬 How are anomaly models evolving in your SOC?

#Cybersecurity #Darktrace #ThreatLandscape #AI #Infosec

Hey everyone! It's been a bit quiet over the last 24 hours, so we've got a short but important update today focusing on critical infrastructure security hygiene.

CISA Roasts CNI for Shoddy Security ⚠️

- CISA and the US Coast Guard have called out an unnamed critical national infrastructure (CNI) organisation for severe cybersecurity hygiene failings, despite finding no active compromise during their assessment.
- Key issues included storing shared local admin credentials in plaintext batch scripts with non-unique, non-expiring passwords, and improper segmentation of operational technology (OT) environments, allowing standard user access to SCADA VLANs.
- These weaknesses create significant risks for widespread unauthorised access, lateral movement, and potential real-world safety hazards if OT systems are compromised, compounded by insufficient logging that hinders threat detection.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/08/02/cisa_coast_guard_cni/

#CyberSecurity #InfoSec #CriticalInfrastructure #CISA #OTSecurity #CyberHygiene #ThreatLandscape #SCADA #IncidentResponse

Just in case your #cyber #threatlandscape wasn’t busy enough self replicating #AI is here 😱

https://arxiv.org/abs/2412.12140