Why Cybersecurity Needs to Focus More on Investigation and Less on Just Detection and Response
Cybersecurity strategies prioritize detection and response, but over‑reliance limits long‑term protection. The article argues that investigative analysis—examining packet‑level data, attack vectors, and root causes—provides essential insights to prevent repeat incidents. Advanced threats like APTs and zero‑days often evade detection, making investigation critical. Integrating tools such as NETSCOUT Omnis with deep packet inspection bridges the gap between rapid response and strategic learning.
5 Myths About DDoS Attacks and Protection
The article debunks five common DDoS myths, highlighting that attacks are far more frequent and diverse than many believe. NETSCOUT’s ASERT team recorded over 15 million DDoS incidents in 2024, with a 43 % rise in sub‑gigabit, application‑layer assaults. It explains why...
Researchers Warn of Data Exposure Risks in Claude Chrome Extension
Anthropic launched a beta Claude Chrome extension that lets the AI browse, click, and type on users' behalf, fundamentally shifting the browser security model. Zenity Labs discovered the tool stays logged in permanently, exposing OAuth tokens, console logs, and personal...
Stress Caused by Cybersecurity Threats Is Taking Its Toll
Cyber threats are increasingly complex, sparking a mental‑health crisis among IT and security teams. A recent Object First survey of 500 professionals found 84% feel uncomfortably stressed and 78% fear personal blame for breaches. Nearly 60% are actively looking for...
Ca: Leduc County Target of Christmas Day Cybersecurity Attack
Leduc County in Alberta disclosed that a deliberate ransomware attack struck on December 25, disabling several of its information technology systems. The county became aware of the intrusion on Christmas Day and immediately initiated incident response protocols. While officials have...
VVS Stealer Uses Advanced Obfuscation to Target Discord Users
The VVS stealer, a Python‑based malware family distributed as a PyInstaller package, employs Pyarmor obfuscation to evade detection and specifically harvest Discord tokens and browser credentials. It injects malicious JavaScript into the Discord client, extracts data from Chromium‑based and Firefox...
Handala Leak Shows Telegram Account Risk, Not iPhone Hacks
Iran‑linked group Handala claimed full phone compromise of former Israeli PM Naftali Bennett and Chief of Staff Tzachi Braverman, but Kela researchers found the breach was limited to their Telegram accounts. The attackers likely used SIM‑swap, SS7 interception, phishing lures...
Reminder: Survey on Threats Experienced by Journalists and Security Researchers
DataBreaches.net and security journalist Zack Whittaker have issued a reminder for cybersecurity journalists and researchers to complete a threat‑experience survey. The questionnaire captures legal actions, court orders, and violent intimidation faced while covering cybercrime. Participation is free via a Google...
8 WhatsApp Features to Boost Your Security and Privacy
WhatsApp, with over 3 billion users, faces growing security threats such as GhostPairing and mass phone‑number exposure. Meta has added a suite of privacy tools—including Privacy Checkup, disappearing messages, two‑factor authentication with PIN, app and chat locks, advanced security settings, and...
How to Protect Your iPhone or Android Device From Spyware
Recent zero‑click spyware attacks on iPhone and Android devices have prompted Apple and Google to release critical patches. High‑profile victims such as Jeff Bezos and activists illustrate the threat’s reach beyond nation‑state targets. Experts advise using Lockdown Mode, Android Advanced...
Cybersecurity Predictions for 2026: Navigating the Future of Digital Threats
In a year‑end panel, cybersecurity leaders forecast that 2026 will be dominated by AI‑driven threats, with agentic AI and deepfake‑enabled social engineering emerging as top attack vectors. Identity management will shift toward zero‑trust models that include non‑human identities, while supply‑chain...
CTO New Year's Resolutions for a More Secure 2026
Security‑focused CTOs are setting five priority resolutions for 2026. First, they will operationalize AI governance by embedding repeatable controls, model gateways and telemetry into engineering pipelines to enforce "secure to ship" AI features. Second, they will add dedicated security controls...
Transparent Tribe Launches New RAT Attacks Against Indian Government and Academia
Transparent Tribe, also known as APT36, has launched a new wave of remote‑access‑trojan (RAT) attacks against Indian government, academic and strategic organizations. The campaign delivers weaponized LNK files disguised as PDFs, which execute HTA scripts via mshta.exe and load a...
The ROI Problem in Attack Surface Management
Attack surface management (ASM) tools promise reduced risk by expanding visibility, yet most programs deliver only larger asset inventories and louder dashboards. Security teams see counts climb and alerts surge, but leadership still struggles to answer whether incidents actually decline....
Identity Security 2026: Four Predictions & Recommendations
Todd Thiemann forecasts four identity‑security trends for 2026. AI agents will move from SaaS sandboxes into core business processes, creating new breach vectors that demand holistic identity controls. Mid‑market firms, facing app sprawl, will finally adopt Identity Governance and Administration...
Fears Mount That US Federal Cybersecurity Is Stagnating—Or Worse
U.S. federal cybersecurity faces a potential setback as the Cybersecurity and Infrastructure Security Agency (CISA) shed roughly 1,000 employees, leaving a 40% vacancy rate across critical mission areas. Recent White House staffing cuts, compounded by the lingering effects of the...
Cybercrime Economics: AI’s Impact and How to Shift Defenses
Generative AI is reshaping fraud economics by automating and personalizing attacks, lowering the skill barrier for cybercriminals. The article explains how traditional perimeter‑centric, rule‑based defenses are increasingly ineffective against AI‑driven, adaptive threats. It advocates a shift to continuous, behavior‑driven detection,...
U.S. Treasury Lifts Sanctions on Three Individuals Linked to Intellexa and Predator Spyware
The U.S. Treasury’s Office of Foreign Assets Control removed three individuals tied to the Intellexa Consortium—responsible for the Predator commercial spyware—from the Specially Designated Nationals list. The delisting followed petitions asserting the subjects had distanced themselves from the consortium, though...
Cybersecurity Predictions 2026: An AI Arms Race and Malware Autonomy
Tyler Shields predicts that 2026 will see an AI‑driven escalation of both offensive cyber attacks and defensive tools, with attackers automating phishing, deep‑fakes, and vulnerability hunting at scale. Security teams will adopt autonomous containment, probabilistic exposure mitigation, and AI‑generated detection...
New Tech Deployments That Cyber Insurers Recommend for 2026
Cyber insurers see a sharp rise in AI‑driven phishing losses and a drop in vendor‑outage claims in H1 2025, prompting a shift in recommended defenses for 2026. Resilience’s Jud Dressler highlights role‑based access controls as the top technology to limit breach...
Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware
Silver Fox, a China‑based cyber‑crime group, has shifted its phishing focus to India, using income‑tax‑themed emails to deliver the modular ValleyRAT remote‑access trojan. The campaign tricks recipients into opening a PDF that redirects to a malicious zip file, which contains...
How to Integrate AI Into Modern SOC Workflows
AI is rapidly entering security operations, yet many SOCs lack a structured integration strategy. The 2025 SANS SOC Survey shows 40% of teams use AI tools without defined processes and 42% deploy them out‑of‑the‑box, leading to inconsistent value. Effective adoption...
How Can CISOs Create the Ideal Cyber Budget?
Cybersecurity budgets have hit a five‑year low in growth, leaving CISOs to stretch limited funds while confronting emerging AI‑related risks. Chris Wheeler, CISO of Resilience, advises a budgeting approach that prioritizes compliance, seeks controls with positive return‑on‑controls, and plans for...
Dark Reading Confidential: Stop Secrets Creep Across Developer Platforms
Developers are increasingly leaking sensitive credentials across a growing array of platforms, from Git repositories to collaboration tools like JIRA and Slack. A recent “state of secret sprawl” report identified 23 million secrets in the public domain last year, and experts...
SBOMs in 2026: Some Love, Some Hate, Much Ambivalence
Software bills of materials (SBOMs) remain a cornerstone of supply‑chain security, yet widespread adoption stalls due to incomplete data, late‑stage generation, and open‑source gaps. Docker’s Hardened Images showcase a best‑practice model, embedding full SBOMs and Level 3 SLSA provenance, while many...
5 Threats That Defined Security in 2025
2025 was defined by a wave of high‑impact cyber threats, from the Chinese state‑backed APT Salt Typhoon targeting telecom networks and the US National Guard, to severe budget cuts at the Cybersecurity and Infrastructure Security Agency (CISA). The year also saw...
⚡ Weekly Recap: MongoDB Attacks, Wallet Breaches, Android Spyware, Insider Crime & More
The weekly cyber recap highlights a wave of active exploits, most notably the MongoDB "MongoBleed" vulnerability (CVE‑2025‑14847) being leveraged against over 87,000 instances worldwide. High‑profile breaches include a Trust Wallet Chrome extension hack that cost users roughly $7 million and a...
The Worst Hacks of 2025
The worst cyber incidents of 2025 ranged from supply‑chain breaches of Salesforce integrations to ransomware attacks on Oracle’s E‑Business platform, massive data leaks at Aflac and Mixpanel, and a production‑shutting hack of Jaguar Land Rover. Hackers leveraged third‑party connectors, exploited...
The New Surveillance State Is You
In the first year of President Trump’s second term, citizens have flooded social media with videos and apps that track ICE and other federal agents during raids and arrests. The Department of Homeland Security responded with subpoenas to Meta, criminal...
This Month in Security with Tony Anscombe – December 2025 Edition
Tony Anscombe, ESET’s chief security evangelist, recaps the year’s most consequential cyber events in his December 2025 roundup. He highlights that U.S. organizations paid more than $2.1 billion in ransomware ransom from 2022‑2024, a figure FinCEN says only scratches the surface. The...
MongoDB Vulnerability CVE-2025-14847 Under Active Exploitation Worldwide
MongoDB disclosed a critical vulnerability (CVE‑2025‑14847, CVSS 8.7) that allows unauthenticated attackers to read server memory via a flaw in zlib compression. Over 87,000 internet‑exposed instances have been identified, with 42% of cloud environments hosting at least one vulnerable deployment. The...
The US Must Stop Underestimating Drone Warfare
The article warns that the United States is vulnerable to low‑cost commercial drone attacks, citing recent strikes by Ukraine, Israel, and Houthi rebels that demonstrated drones’ ability to hit high‑value targets far from battlefields. Despite the Pentagon’s 2025 budget allocating...
Mentorship & Diversity: Shaping the Next Generation of Cyber Experts
Patricia Voight, CISO of Webster Bank, shared her journey from telecom security to leading financial‑services cyber risk, emphasizing the sector’s constant evolution. She highlighted the bank’s mentorship and summer‑intern programs, which deliberately recruit neurodivergent talent and partner with universities. Voight...
China-Linked Evasive Panda Ran DNS Poisoning Campaign to Deliver MgBot Malware
Kaspersky attributes a two‑year cyber‑espionage campaign to the China‑linked APT group Evasive Panda, which used DNS‑poisoning to deliver its MgBot backdoor. The attacks, observed from November 2022 to November 2024, targeted organizations in Turkey, China and India by hijacking DNS responses for...
These Are the Cybersecurity Stories We Were Jealous of in 2025
TechCrunch’s year‑end roundup spotlights the most compelling cybersecurity stories it didn’t publish in 2025, ranging from high‑profile investigations to niche technical exposés. Highlights include The Washington Post revealing a secret UK court order forcing Apple to build a backdoor, The...
_Yuri_Arcurs_alamy.jpg?width=1280&auto=webp&quality=80&disable=upscale)
Dark Reading Opens State of Application Security Survey
Dark Reading has launched its 2026 State of Application Security survey, extending the 2025 study that gathered insights from over 100 cybersecurity professionals. The new questionnaire adds topics like vibe coding and secure‑coding training while retaining core questions for year‑over‑year...
How a Spanish Virus Brought Google to Málaga
Bernardo Quintero finally identified the anonymous programmer behind the 1992 Virus Málaga, a harmless malware that sparked his fascination with cybersecurity. The discovery linked the virus to Antonio Enrique Astorga, who later became a teacher and left a lasting legacy....
LastPass 2022 Breach Led to Years-Long Cryptocurrency Thefts, TRM Labs Finds
In 2022 LastPass suffered a breach that exposed encrypted vault backups containing cryptocurrency private keys and seed phrases. TRM Labs now reports that weak master passwords allowed attackers to decrypt these vaults offline, siphoning roughly $35 million in crypto assets through...
Atomic-Scale Randomness in Graphene Enables Hardware-Level Security Keys
Researchers at UIC, Wayne State and Northwestern have turned random atomic defects in graphene transistors into a physical unclonable function (PUF) for hardware security. Each transistor emits a unique radio signature that encodes its microscopic irregularities, creating a one‑of‑a‑kind cryptographic...
Fortinet Warns of Active Exploitation of FortiOS SSL VPN 2FA Bypass Vulnerability
Fortinet disclosed that CVE‑2020‑12812, a case‑sensitivity flaw in its SSL VPN, is being actively exploited in the wild. The vulnerability lets attackers bypass two‑factor authentication when local users are linked to LDAP groups and usernames are entered with different casing....
New MacSync macOS Stealer Uses Signed App to Bypass Apple Gatekeeper
Researchers uncovered a new macOS stealer, MacSync, delivered via a digitally signed and notarized Swift application masquerading as a messenger installer. The signed DMG bypasses Apple Gatekeeper and XProtect, allowing the dropper to execute an encoded script after user interaction....
Industry Continues to Push Back on HIPAA Security Rule Overhaul
The U.S. Department of Health and Human Services unveiled a sweeping update to the HIPAA Security Rule in January 2025, aiming to tighten cybersecurity across hospitals and clinics. A coalition of 100 health‑care groups led by CHIME has called for...
Sprawling 'Operation Sentinel' Neutralizes African Cybercrime Syndicates
Operation Sentinel, a 19‑nation Interpol‑led effort, dismantled multiple African cybercrime syndicates, arresting 574 suspects and seizing roughly $3 million in assets. The investigation neutralized over 6,000 malicious links and decrypted six ransomware strains, uncovering $21 million in losses from BEC, extortion and...
US Insurance Giant Aflac Says Hackers Stole Personal and Health Data of 22.6 Million People
Aflac announced that hackers accessed personal and health information of 22.65 million customers, including Social Security numbers, medical records, and government IDs. The breach, disclosed in June, is linked to the Scattered Spider cyber‑criminal collective, which has been targeting insurers. Aflac’s...
Inside Uzbekistan’s Nationwide License Plate Surveillance System
Uzbekistan’s Ministry of Internal Affairs operates a national license‑plate‑reading system that monitors traffic with over a hundred high‑resolution cameras across the country. Security researcher Anurag Sen uncovered that the system’s web interface is publicly accessible without authentication, exposing GPS locations...
A Brush with Online Fraud: What Are Brushing Scams and How Do I Stay Safe?
Global e‑commerce sales are set to surpass $6.4 trillion in 2025, fueling intense competition on marketplace review systems. Brushing scams exploit this pressure by sending low‑value items to random addresses, then posting fabricated 5‑star reviews to inflate product rankings. Victims often...
Cybersecurity Stagnation in Healthcare: The Hidden Financial Costs
Healthcare providers are confronting a stark financial reality: the cost of maintaining an immature cybersecurity program now exceeds the expense of modernizing it. Breach incidents in the sector average $11‑12 million, while prolonged outages and regulatory penalties add further strain....
Threat Actors Exploit Zero-Day in WatchGuard Firebox Devices
WatchGuard disclosed a critical zero‑day vulnerability (CVE‑2025‑14733) in its Firebox firewalls, enabling remote code execution via an out‑of‑bounds write in the Fireware OS. The flaw affects multiple firmware versions and specifically targets the IKEv2 VPN processes, with threat actors actively...
Uzbek Users Under Attack by Android SMS-Stealers
Group‑IB reported a fresh wave of Android SMS‑stealer campaigns targeting users in Uzbekistan since October 2025. Threat groups such as TrickyWonders, Blazefang and Ajina distribute malicious APKs via sideloading and Telegram, exploiting stolen Telegram accounts to lure contacts into installation....
Product Spotlight: 2025 Year in Review
The 2025 Year in Review product spotlight showcases six security‑focused solutions targeting education, enterprise, and financial sectors. Connect ONE’s ERP consolidates school data and grants first‑responder‑only access, while Genetec embeds cloud‑native audio into its Security Center SaaS for real‑time coordination....