Governance & Risk Management, Operational Technology (OT), Video CISO Tammy Klotz Highlights Peer Support Ahead of ManuSec 2025 Cecilia Limonta • August 15, 2025 Tammy Klotz, CISO, Trinseo In the realm of manufacturing, organizations encounter a myriad of challenges in…
The developer of Passwordstate, a robust password management solution tailored for enterprises, has issued an urgent alert for users to implement a critical update addressing a significant security vulnerability. This flaw, if exploited, could permit unauthorized access to sensitive administrative…
April 11, 2025
Cybercrime / Security Breach
Understanding IABs: Initial Access Brokers (IABs) focus on breaching computer systems and networks and then selling that access to other criminals. This specialization allows them to dedicate their efforts to exploiting vulnerabilities, using techniques like social engineering and brute-force attacks. By selling access rather than carrying out ransomware attacks themselves, IABs significantly lower their risks. They leverage their skills in infiltrating networks, simplifying the attack process for their buyers.
This business model not only helps IABs maintain a lower profile and reduce risks but also allows them to profit from their technical expertise. Primarily operating on dark web forums and in underground markets, IABs may work independently or as part of larger operations, such as Ransomware-as-a-Service (RaaS) groups. They serve as a vital component of the cybercrime ecosystem, connecting various players in this illicit landscape.
Initial Access Brokers Adjust Strategies, Offering Increased Access at Reduced Rates April 11, 2025 — Cybercrime / Security Breach Recent developments in the cybercrime landscape reveal a shift in tactics employed by Initial Access Brokers (IABs). These individuals or groups…
Federation of Independent Financial Advisors Raises Alarm over NSE Mutual Fund Platform In a recent development, the Federation of Independent Financial Advisors (FIFA), an influential body representing mutual fund distributors, sub-brokers, and independent financial advisors, has expressed serious concerns regarding…
April 5, 2023
Endpoint / Network Security
Each year, hundreds of millions of malware attacks occur globally, leaving businesses to contend with the fallout from viruses, worms, keyloggers, and ransomware. Malware poses a significant threat and drives many organizations to seek cybersecurity solutions. However, simply focusing on malware protection isn’t sufficient. A comprehensive strategy is essential.
Businesses must first defend against malware infiltrating their networks. Then, they should implement systems and processes that minimize the potential damage in case a user device becomes infected. This proactive approach not only helps in thwarting and mitigating the effects of malware but also fortifies defenses against various other threats, including credential theft via phishing, insider risks, and supply chain vulnerabilities.
Element 1: Comprehensive Malware Protection and Web Filtering
The first step…
Fortify Your Organization: Simplifying Ransomware Prevention April 5, 2023 In the ever-evolving landscape of cybersecurity, organizations face an alarming increase in malware incidents yearly, with hundreds of millions of attacks reported globally. Ransomware, alongside viruses, worms, and keyloggers, has emerged…
Artificial Intelligence & Machine Learning, Next-Generation Technologies & Secure Development Evaluations of AI Models by Industry Giants Highlight Safety Risks Rashmi Ramesh (rashmiramesh_) • August 28, 2025 Image: Shutterstock This past summer, OpenAI and Anthropic engaged in a unique exercise…
A supply chain attack known as “s1ngularity” has targeted Nx versions 20.9.0-21.8.0, leading to the theft of thousands of developer credentials. The attack primarily focused on macOS systems and AI tools, as outlined in an analysis by GitGuardian. On August…
Fortinet Alerts: Attackers Maintain Read-Only Access to FortiGate Devices After Patching Using SSL-VPN Symlink Exploit
April 11, 2025
Network Security / Vulnerability
Fortinet has disclosed that cybercriminals have discovered a method to preserve read-only access to compromised FortiGate devices, even after vulnerabilities exploited for initial breaches have been patched. The attackers reportedly utilized known security weaknesses, including CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762. “A threat actor exploited a known vulnerability to establish read-only access to affected FortiGate devices,” the network security firm stated in an advisory released Thursday. “This was accomplished by creating a symbolic link that connects the user file system with the root file system in a directory used for SSL-VPN language files.” Fortinet noted that these alterations occurred within the user file system and were able to evade detection, leaving the symlink intact even after the original vulnerabilities were remedied. This situation has enabled the attackers to retain access…
Fortinet Warns of Persistent Access Threats to FortiGate Devices Post-Patching On April 11, 2025, Fortinet disclosed concerning information regarding a persistent security vulnerability affecting its FortiGate devices. The network security firm reported that cybercriminals have successfully established read-only access to…
The UK government is under scrutiny for its delayed response in implementing recommendations from a comprehensive review concerning serious public sector data breaches. These breaches have had significant ramifications, affecting vulnerable populations including Afghans who collaborated with British military forces,…
May 14, 2025
Vulnerability / Malware
Samsung has issued software updates to fix a critical security vulnerability in MagicINFO 9 Server that has been actively targeted. Identified as CVE-2025-4632 (CVSS score: 9.8), this path traversal flaw allows attackers to write arbitrary files with system-level permissions. According to the advisory, the vulnerability arises from “improper limitation of a pathname to a restricted directory” in versions before 21.1052 of the MagicINFO 9 Server. Notably, CVE-2025-4632 serves as a patch bypass for a previously addressed vulnerability, CVE-2024-7399, which was mitigated by Samsung in August 2024. Shortly after a proof-of-concept was released by SSD Disclosure on April 30, 2025, CVE-2025-4632 began to be exploited in the wild, with reports of it being used to deploy the Mirai botnet. Initial investigations into these attacks mistakenly pointed to CVE-2024-7399, but cybersecurity firm Huntress later clarified the situation.
Samsung Addresses Critical Vulnerability in MagicINFO 9 Server Used by Attackers May 14, 2025 In a significant security update, Samsung has released patches to address a critical vulnerability identified as CVE-2025-4632, which affects the MagicINFO 9 Server. This vulnerability, which…
