Access Management, Agentic AI, Identity & Access Management CyberArk Acquisition Enhances Palo Alto Networks’ Privileged Access Capabilities Michael Novinson (@MichaelNovinson) • July 30, 2025 Nikesh Arora, Chairman and CEO, Palo Alto Networks Nikesh Arora, CEO of Palo Alto Networks, announced the company’s intention to acquire CyberArk for $25 billion, driven…
Jun 26, 2025
Threat Intelligence / Ransomware
Cybersecurity experts are highlighting a wave of cyberattacks aimed at financial institutions across Africa, dating back to at least July 2023. These attacks leverage a combination of open-source and publicly available tools to sustain access. Researchers from Palo Alto Networks’ Unit 42 are monitoring this activity under the label CL-CRI-1014, where “CL” stands for “cluster” and “CRI” signifies “criminal motivation.” The primary objective appears to be gaining initial access to systems, which is then sold to other criminal actors in underground forums, effectively turning the threat actor into an initial access broker (IAB). “The threat actor mimics signatures from legitimate applications to create forged file signatures, camouflaging their toolset and concealing malicious activities,” noted researchers Tom Fakterman and Guy Levi. “Threat actors frequently spoof legitimate products for illicit purposes.” The attacks are marked by the use of tools such as PoshC2 and others.
Cyber Criminals Utilize Open-Source Tools to Target African Financial Institutions June 26, 2025 Threat Intelligence / Ransomware Recent investigations have revealed a troubling trend of cyber attacks aimed at financial institutions across Africa, with reports indicating that this wave of attacks began as early as July 2023. Cybersecurity experts at…
Jun 26, 2025
Threat Intelligence / Ransomware
Cybersecurity experts are highlighting a wave of cyberattacks aimed at financial institutions across Africa, dating back to at least July 2023. These attacks leverage a combination of open-source and publicly available tools to sustain access. Researchers from Palo Alto Networks’ Unit 42 are monitoring this activity under the label CL-CRI-1014, where “CL” stands for “cluster” and “CRI” signifies “criminal motivation.” The primary objective appears to be gaining initial access to systems, which is then sold to other criminal actors in underground forums, effectively turning the threat actor into an initial access broker (IAB). “The threat actor mimics signatures from legitimate applications to create forged file signatures, camouflaging their toolset and concealing malicious activities,” noted researchers Tom Fakterman and Guy Levi. “Threat actors frequently spoof legitimate products for illicit purposes.” The attacks are marked by the use of tools such as PoshC2 and others.
Microsoft has recently addressed two critical vulnerabilities, CVE-2025-49706 and CVE-2025-49704, part of their monthly update cycle. However, reports from over the weekend have revealed that the patches were insufficient, leaving organizations vulnerable to new types of cyberattacks. The primary targets of these attacks are organizations using SharePoint servers. The initial…
Cyberwarfare / Nation-State Attacks, Fraud Management & Cybercrime, Governance & Risk Management Security Researchers Warn of Widespread Access to Exploit Code by Diverse Hacking Groups Mathew J. Schwartz (euroinfosec) • July 22, 2025 Image: Shutterstock/Microsoft Recent assessments indicate that hackers have been exploiting zero-day vulnerabilities in Microsoft SharePoint, primarily to…
Governance & Risk Management, Patch Management Microsoft Rolls Out Emergency Patches for Authentication-Bypassing Attacks Prajeet Nair (@prajeetspeaks), Mathew J. Schwartz (euroinfosec) • July 21, 2025 Image: Shutterstock In a concerning development, cybersecurity experts have reported that attackers are exploiting two zero-day vulnerabilities in on-premises Microsoft SharePoint installations. This activity allows…
Researchers from Cisco’s Talos security team have identified a sophisticated malware-as-a-service (MaaS) operation that exploited public GitHub accounts to distribute various types of malicious software to targeted entities. This innovative distribution method capitalized on GitHub’s widespread acceptance in enterprise environments, where many organizations rely on the platform for software development.…
KT to Invest Over $724 Million in Cybersecurity Following SK Telecom Data Breach In response to heightened consumer concerns following a substantial data breach at SK Telecom, South Korean telecommunications leader KT has announced a commitment to invest more than 1 trillion won (approximately $724 million) over the next five…
Recent Investigative Findings on ICE Detention Centers: A Troubling Overview This week, WIRED unveiled a persuasive investigation into the alarming state of U.S. Immigration and Customs Enforcement (ICE) detention facilities. The report, backed by numerous audio recordings and records of emergency calls, exposes a multitude of life-threatening incidents inside these…
Cloud Security, Security Operations Presented by Palo Alto Networks 60 mins In an era where cloud environments are increasingly dynamic and complex, organizations are recognizing that traditional native firewalls often fall short of meeting enterprise-level requirements for visibility, control, and threat prevention. Responding to this challenge, Palo Alto Networks has…
