Threat hunters have exposed a novel campaign that makes use of search engine optimization (SEO) poisoning techniques to target employee mobile devices and facilitate payroll fraud. The activity, first detected by ReliaQuest in May 2025 targeting an unnamed customer in… Read More "Employees Searching Payroll Portals on Google Tricked Into Sending Paychecks to Hackers"
The US government has begun an audit of its National Vulnerability Database (NVD) to ensure its team can catch up with the vulnerability backlog. In a May 20 memo, the US Department of Commerce’s Office (DoC) of Inspector General announced… Read More "US Government Launches Audit of NIST’s National Vulnerability Database"
%20(1).png?w=1140&resize=1140,855&ssl=1 "How to Prepare for a Cyber Essentials Plus Audit")
Cyber Essentials is a UK government-supported certification scheme that helps organizations protect themselves against cyber threats by providing a framework of basic security controls for safeguarding systems. Cyber Essentials Plus builds on this foundation by requiring a more in-depth, hands-on… Read More "How to Prepare for a Cyber Essentials Plus Audit"
From your email to your web browsing, it’s highly likely that your daily online life is dominated by a small number of tech giants—namely Google, Microsoft, and Apple. But since Big Tech has been cozying up to the second Trump… Read More "The Privacy-Friendly Tech to Replace Your US-Based Email, Browser, and Search"
May 27, 2025Ravie LakshmananData Breach / Social Engineering The U.S. Federal Bureau of Investigation (FBI) has warned of social engineering attacks mounted by a criminal extortion actor known as Luna Moth targeting law firms over the past two years. The… Read More "FBI Alerts Law Firms to Luna Moth’s Stealth Phishing Campaign"
In the early morning of July 19, a software update to CrowdStrike’s Falcon sensor started to cause one of the most extensive IT outages in history, affecting several industry sectors, including financial services, healthcare, transportation, and others. According to CrowdStrike,… Read More "CrowdStrike Outage: What Happened and How to Limit Future Risk"
May 27, 2025Ravie LakshmananMalware / Threat Intelligence The Russia-aligned threat actor known as TAG-110 has been observed conducting a spear-phishing campaign targeting Tajikistan using macro-enabled Word templates as an initial payload. The attack chain is a departure from the threat… Read More "Russia-Linked Hackers Target Tajikistan Government with Weaponized Word Documents"
The UK’s Marks & Spencer suffered a cyberattack in late April that damaged the high-end retailer’s operations and is expected to cost the company over $400 million. That attack was quickly followed by similar incidents that struck two other iconic… Read More "How CISOs can defend against Scattered Spider ransomware attacks"
From U.S. executive orders to cyber regulations, prominent cybersecurity policies are increasing their inclusion of Third-Party Risk Management standards, and for good reason – every organization, no matter what size, is impacted by third-party risks. If you’re looking for a… Read More "12 Best Third-Party Risk Management Software Solutions (2025)"
With the majority of data breaches now caused by compromised third-party vendors, cybersecurity programs are quickly evolving towards a greater emphasis on Vendor Risk Management. For advice on choosing the best VRM solution for your specific data breach mitigation requirements,… Read More "11 Best Vendor Risk Management Software Solutions (2025 Edition)"
