Security Boulevard

Why is NHI Management Vital in Modern Cybersecurity? The rising tide of digitalization in various industries fuels the increasing relevance of Non-Human Identities (NHIs) management in cybersecurity. With organizations race to the cloud, have you considered the potential vulnerability in your system’s NHIs and their secrets? NHIs, defined as machine-generated identities that interact, are as […]

The post Stay Reassured with Latest NHI Security Practices appeared first on Entro.

The post Stay Reassured with Latest NHI Security Practices appeared first on Security Boulevard.

Authors/Presenters: Bård Aase

Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.

Permalink

The post BSidesLV24 – PasswordsCon – That’s Not My Name appeared first on Security Boulevard.

Overview: Akamai researchers have identified a significant privilege escalation vulnerability in Windows Server 2025, termed “BadSuccessor.” This flaw exploits the newly introduced delegated Managed Service Accounts (dMSAs) feature, allowing attackers to impersonate any Active Directory (AD) user, including domain administrators, without altering existing accounts or group memberships. Key Details: Impact: Exploitation of BadSuccessor can lead… Continue reading Cyber Heads Up: “BadSuccessor”—A Critical Active Directory Privilege Escalation Vulnerability in Windows Server 2025

The post Cyber Heads Up: “BadSuccessor”—A Critical Active Directory Privilege Escalation Vulnerability in Windows Server 2025 appeared first on Security Boulevard.

FedRAMP is the Federal Risk and Authorization Management Program, and it’s one of the most widely used governmental cybersecurity frameworks across the United States. It’s meant to serve as the gatekeeper for any contractor looking to work with the federal government to ensure that everyone across the board has a minimum level of cybersecurity in […]

The post How FedRAMP Reciprocity Works with Other Frameworks appeared first on Security Boulevard.

Are Your Non-human Identities and Secrets Secure? The security of Non-Human Identities (NHIs) and their secretive credentials has proven to be an essential dimension of data management. NHIs, as machine identities, play a crucial role in businesses, especially those operating. If not managed properly, these non-human identities can expose organizations to risks of significant security […]

The post Ensuring Stability with Robust NHI Strategies appeared first on Entro.

The post Ensuring Stability with Robust NHI Strategies appeared first on Security Boulevard.

How Relevant is NHI Security in Today’s Cloud-Dependent Society? It is becoming increasingly clear that the safe management of Non-Human Identities (NHIs) and their secrets is critical. A comprehensive approach to securing these machine identities is no longer optional but a necessity. Did you know that NHIs, when weakly managed, can become the focal point […]

The post Feel Protected: Advances in NHI Security Techniques appeared first on Entro.

The post Feel Protected: Advances in NHI Security Techniques appeared first on Security Boulevard.

 

As cryptocurrency becomes more popular and the adoption rises, we see a related increase in the number of cybercrimes, fraud, and malware schemes. Criminals like to hunt and plunder where there is money! If you hold cryptocurrency or are using Web3 platforms, you need to be careful.

Among other risks, the latest method is to use a crypto drainer! Crypto drainers are malicious code injected into software and webpages that compromise the victim’s crypto wallets or secret keys to drain the accounts.

This can be accomplished through:

· Phishing websites, emails, texts, and other social engineering practices

· Fake airdrops, contests, and ads

· Malicious digital contracts

· Fake exchanges, marketplaces, and crypto services

· And malicious or trojanized browser extensions

Crypto drainers are being productionalized for scale within the cybercriminal community, with Drainers-as-a-Service tools being offered to less savvy wannabe fraudsters. These packages include the malicious code, apps, social engineering functions, and back-end infrastructure to handle the unauthorized asset transfers at scale. Some come with management dashboards to oversee the progress of all the victimization, documentation, tutorials, system updates, and customer support!

Kits start at a mere $100, which is a low bar for many of the unscrupulous cybercriminals. The lure of high rewards, low effort, and a small investment will continue to bring many over to the dark side. Personal and corporate cybersecurity practices must be employed.

Some key recommendations for protecting crypto wallets include:

1. Enable multifactor authentication (2FA or MFA) when available on your wallets

2. Use hardware wallets or cold wallets for maximum security

3. Don’t be phished or socially engineered! Never click a questionable link, install untrusted software, or provide your private keys!

4. Avoid browser extensions! They can hijack your webpages and anything you input on them.

5. Secure your seeds and private keys in a password manager or offline.

Watch your wallets for unusual activity — although if you see any, it will likely be too late for that wallet!

Cryptocurrency is great, but like any innovative and disruptive technology, the attackers are motivated to find creative ways to victimize users! Understand the risks, act securely, and be cautious.

For more Cybersecurity Insights, follow me on:

• LinkedIn: https://www.linkedin.com/in/matthewrosenquist/ 
• YouTube: https://www.youtube.com/CybersecurityInsights 
• Substack: https://substack.com/@matthewrosenquist 
• Cybersecurity Insights: https://www.cybersecurityinsights.us/

The post Crypto Drainers are Targeting Cryptocurrency Users appeared first on Security Boulevard.

AttackIQ has released two new attack graphs that emulate the behaviors exhibited by DragonForce ransomware since its emergence in August 2023. Initially based entirely on the leaked LockBit 3.0 (Black) builder, it evolved with the introduction of a customized variant derived from the Conti V3 codebase. DragonForce operators may potentially be behind the recent cyber attacks that involved Marks & Spencer, Co-Op, and Harrods.

The post Emulating the Blazing DragonForce Ransomware appeared first on AttackIQ.

The post Emulating the Blazing DragonForce Ransomware appeared first on Security Boulevard.

U.S. authorities seized the infrastructure of the DanaBot malware and charged 16 people in an action that is part of the larger Operation Endgame, a multinational initiative launched last year to disrupt and take apart global cybercriminals operations.

The post U.S. Authorities Seize DanaBot Malware Operation, Indict 16 appeared first on Security Boulevard.

This year, we had a fantastic time meeting attendees, partners, friends, and customers at the RSA Conference Expo floor. You probably noticed this contraption attached to our coffee machine if you stopped by our booth for coffee. What was this, and how did it come to be? And what was it doing at the booth? […]

The post ColorTokens OT-in-a-Box: From Concept to Completion appeared first on ColorTokens.

The post ColorTokens OT-in-a-Box: From Concept to Completion appeared first on Security Boulevard.

Artificial intelligence (AI) and machine learning (ML) are now inextricably linked to the software supply chain. ML models, which are based on large language models (LLMs), are powering the enterprise — and offer an infinite number of solutions to organizations’ mission-critical needs. The widespread and increasing use of generative AI tools like OpenAI’s ChatGPT, in addition to developer community resources like Hugging Face – a platform dedicated to collaboration and sharing of ML projects – show how software, coding and AI/ML are now one and the same. 

But as with any new technological advancement, the pressing need for ML models has created a new and ever-evolving attack surface that the cybersecurity industry is racing to understand and mitigate. Recognizing the convergence of AI and the software supply chain, ReversingLabs (RL) researchers and engineers have taken steps to better understand the threat posed by malicious ML models. 

One such threat that RL researchers have previously flagged is the Pickle file format, a popular but insecure Python module that is used widely for serializing and deserializing ML model data. Dhaval Shah, RL’s senior director of product management, wrote recently that Pickle files open the door to malicious actors who can abuse it to inject harmful code into the model files.

That warning proved true with the discovery of nullifAI, discovered by RL threat researchers in February, in which threat actors abused ML models in the Pickle file format to distribute malicious ML models on Hugging Face. With this latest discovery, RL researchers uncovered a new malicious campaign that further proves threat actors’ newly favored method of exploiting the Pickle file format — this time on the Python Package Index (PyPI). 

Last Tuesday, RL researchers detected three, newly uploaded malicious packages that pose as a “Python SDK for interacting with Aliyun AI Labs services.” As the package description indicates, this is an attack that targets users of Alibaba AI labs. Once installed, the malicious package delivers an infostealer payload hidden inside a PyTorch model loaded from the initialization script. (PyTorch models are basically zipped Pickle files.) The malicious payload exfiltrates basic information about the infected machine and the content of the .gitconfig file.

Here’s what RL researchers discovered — and what this new malicious campaign means for the security of ML models, as well as how open-source software (OSS) platforms are still a favored supply chain attack vector.

The post Malicious attack method on hosted ML models now targets PyPI appeared first on Security Boulevard.

Author/Presenter: Jeff Deifik

Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.

Permalink

The post BSidesLV24 – PasswordsCon – Passwords 101 appeared first on Security Boulevard.

See how Escape’s Jira integration turns security alerts into actionable tickets, speeding up issue resolution and improving collaboration.

The post From Alert to Action: Escape’s Jira Integration Explained appeared first on Security Boulevard.

It’s been a few weeks since the marketing excesses of the RSA Conference, and a quick glance at any day’s headlines confirms: attackers are collaborating and innovating faster than defenders can keep up. DeepTempo empowers security teams with purpose-built deep learning to detect threats earlier, streamline SOC workflows, and boost overall cyber resilience.

While at the show, DeepTempo won the “Advanced Threat Identification” category in Cyber Defense Magazine’s Global InfoSec Awards 2025, recognizing its significant contributions to modernizing threat detection through deep learning and MITRE ATT&CK® mapping. The judges had access to confidential success stories that we will share more broadly, at least in anonymized form, in the next month or two. This is Cyber Defense Magazine’s thirteenth year of honoring InfoSec innovators from around the Globe who believe they have a unique and compelling value proposition for their product or service. It’s recognition like this that validates our team’s efforts and the impact our customers are already seeing.

Win award, crack Dad joke

https://www.linkedin.com/posts/miliefsky_cybersecurity-gia2025-infosecchampions-activity-7324118035714236416-npxv?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAAV77YBmNx6IYcPuh1n6km5MMwqF7R-xm4

The few months since we emerged from stealth mode with the launch of Tempo, our deep learning-based Snowflake Native App for cybersecurity ( available in the Snowflake Marketplace), have been amongst the most gratifying of my career. Our InfoSec Award follows successful collaborations with BNY through the Ascent Program and Snowflake’s Native App Accelerator. While I’m most excited about the success we are having in helping major enterprises and other organizations change the game in cyberdefense, the recognition we can talk about via these programs and accelerators, and awards is gratifying as well.

To learn more about DeepTempo, please download our whitepaper: DeepTempo: Revolutionizing Cybersecurity with Deep Learning or coordinate a walk-through, discussion of on-premise and on-cloud options, and demo: https://www.deeptempo.ai/contact-us.html

The post DeepTempo Wins Global InfoSec Award for Advanced Threat Identification appeared first on Security Boulevard.

A survey of 1,042 senior cybersecurity managers in the U.S., the United Kingdom and Australia finds only 5% have implemented quantum-safe encryption, even though 69% recognize the risk quantum computing poses to legacy encryption technologies.

The post Survey Surfaces Limited Amount of Post Quantum Cryptography Progress appeared first on Security Boulevard.

How Hunters International Used the Browser to Breach Enterprises — And Why They Didn’t See It Coming

At RSAC 2025, Cato Networks delivered a presentation that SOC teams and CISOs will want to pay attention to: “Suspicious Minds — Hunting Threats That Don’t Trigger Security Alerts.” The session showcased ransomware campaigns that bypassed traditional detection. In some cases, this was not because security solutions malfunctioned, but because there was no visibility into key attack vectors. Among the examples highlighted, the Hunters International operation stood out to me due to how seamlessly it exploited the browser to gain access to an enterprise.

Likely emerging from the remains of the Hive ransomware gang, Hunters International has rapidly grown into a prolific and disruptive ransomware syndicate. They use multiple methods to gain initial access, but the one that Cato Networks highlighted in its presentation leveraged legitimate IT management tools and strategic abuse of the browser environment — which is a growing blind spot that enables many modern security stacks.

Let’s unpack this particular case study on Hunter International — and review how Browser Detection and Response (BDR) could have stopped it before any damage occurred.

From a Sponsored Link to Systemwide Infection

Cato’s researchers traced the origin of the breach to a malvertising campaign embedded in Google Ads. Threat actors bought ads for widely searched utilities like Angry IP Scanner, redirecting unsuspecting users to typosquatted sites such as angryipo[.]org. These sites, masked behind reputable-looking CDNs and cloud services, appeared legitimate. In fact, buying ads that direct visitors to malicious sites has become a popular method for attackers, as most paid ads don’t go through the same security scrutiny as a phishing email would these days.

In the Cato case study, users who downloaded what they believed was the actual utility were instead given the WorkersDevBackdoor malware, often hosted on platforms like Dropbox or Microsoft’s content delivery network.

The kill chain progressed in structured stages:

• Privileged devices (e.g., admin endpoints) were targeted first to maximize access.
• Malware initiated silent lateral movement across the network.
• Data exfiltration was handled by utilities like RoboCopy, with outbound traffic tunneled through AnyDesk into attacker-controlled AWS EC2 instance.
• The final blow: ransomware was executed, encrypting files with the .locked extension and depositing a ransom note titled Contact Us.txt (Picus Security).

Why Traditional Security Solutions Missed It

The failure wasn’t in detection engines per se — it was a matter of visibility gaps.

Most traditional tools are blind to what happens inside the browser.

• Secure Web Gateways (SWGs) can monitor URLs and downloads but lack the capability to interpret dynamic page behaviors, script execution, or real-time DOM manipulation.
• Endpoint Detection and Response (EDR) tools might flag suspicious executables — but typically only after the malware is dropped to the disk or executed.

By the time EDR or SASE/SSE detected any signs of malicious activity, the attackers had already spread laterally.

By the time EDR or SASE/SSE detected any signs of malicious activity, the attackers had already spread laterally.

Where BDR Would Have Changed the Outcome

With a Browser Detection and Response (BDR) solution, this attack could have been interrupted at the very first step.

Here’s how BDR could have disrupted the campaign:

• Identified suspicious domain impersonation and alerted on typosquatting patterns as well as sponsored search result ads and block them from being accessed.
• Detected and flagged file downloads triggered via script-based automation, rather than legitimate user clicks.
• Contained the download within an isolated browser container, preventing execution on the local device.
• Maintained comprehensive telemetry on browser-side actions, including script injection, clipboard access, and DOM alterations — correlated with user identity and session details.

This layered visibility would have enabled early intervention, long before ransomware deployment or data exfiltration.

Don’t Wait for the Next Unseen Attack

Ransomware operators like Hunters International are increasingly targeting the spaces where your tools have the least insight. The browser is now the frontline attack surface — and attackers know it.

It’s time to deploy defenses that operate where the breach begins.

👉 Run a browser threat detection check now at https://scan.browser.security 👉 Or book a demo to explore how SquareX can secure your browser perimeter.

How Hunters International Used the Browser to Breach Enterprises — And Why They Didn’t See It… was originally published in SquareX Labs on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post How Hunters International Used the Browser to Breach Enterprises — And Why They Didn’t See It… appeared first on Security Boulevard.

Operation Endgame, “Season 2”, is officially announced as of Friday, May 23rd, 2025. International law enforcement agencies and their partners have once again joined forces to disrupt and dismantle botnet infrastructure and their operators. In this post, get details of the take-down itself and Spamhaus’ role in victim account remediation.

The post Botnets disrupted worldwide…Operation Endgame is BACK! appeared first on Security Boulevard.

Discover how ImpactQuill launched IQDMARC using PowerDMARC’s white label solution to enhance email security, and boost deliverability for clients.

The post DMARC MSP Case Study: ImpactQuill Enhances Email Security and Visibility for Clients with PowerDMARC appeared first on Security Boulevard.

As digital transformation becomes a strategic imperative, development teams have emerged as a pillar of organizations. Agile and DevOps practices have revolutionized the pace of innovation, enabling businesses to respond rapidly to evolving market demands. However, this accelerated development comes with a cost—the expansion of the application attack surface. Every new feature or update introduces […]

The post Detect Vulnerabilities Faster With Website Scanner appeared first on Kratikal Blogs - Information Hub For Cyber Security Experts.

The post Detect Vulnerabilities Faster With Website Scanner appeared first on Security Boulevard.

Ask me how many applications are running in a typical enterprise cloud environment, and I’ll give you an estimate. Ask me again a few minutes later, and I might give you a completely different number. It’s not that I’m unsure on purpose — it’s just that the landscape shifts constantly. From CI/CD pipelines redeploying workloads,...

The post Why continuous discovery is critical to closing security gaps appeared first on Strata.io.

The post Why continuous discovery is critical to closing security gaps appeared first on Security Boulevard.