Geek-Guy.com

Tag: more

Black Basta’s playbook lives on as former affiliates launch fast-scale intrusion campaign

A small group of former Black Basta affiliates have targeted more than 100 employees across dozens of organizations to intrude network systems for potential data theft, ransomware deployment and extortion, according to ReliaQuest. The social engineering campaign, which involves mass email bombing and Microsoft Teams help desk impersonation, surged last month and dates back to…

$12 million frozen, 20,000 victims identified in crypto scam crackdown

More than $12 million has been frozen, and over 20,000 victims have been identified in an international law enforcement operation targeting cryptocurrency and investment scammers. Authorities also uncovered more than $45 million in suspected cryptocurrency fraud losses worldwide. One UK victim identified during the operation is thought to have lost more than £52,000 to the…

$3.6 Million Crypto Heist Targets Bitcoin Depot

Attackers have stolen more than $3.6 million in Bitcoin from crypto ATM operator Bitcoin Depot after breaching its internal systems. The incident, disclosed in a recent regulatory filing, shows how quickly attackers can monetize access once inside corporate environments. The “unauthorized actor transferred approximately 50.903 Bitcoin from Company-controlled wallets, valued at approximately $3.665 million as…

Questions raised about how LinkedIn uses the petabytes of data it collects

Through LinkedIn’s more than one billion business users, the Microsoft unit has access to a vast array of personally-identifiable information, including data that could identify religious and political positions. What is less clear is what LinkedIn does with all of that data. A small European company that sells a browser extension to leverage different aspects…

Questions raised about how LinkedIn uses the petabytes of data it collects

Through LinkedIn’s more than one billion business users, the Microsoft unit has access to a vast array of personally-identifiable information, including data that could identify religious and political positions. What is less clear is what LinkedIn does with all of that data. A small European company that sells a browser extension to leverage different aspects…

Feds quash widespread Russia-backed espionage network spanning 18,000 devices

Russian state-sponsored attackers compromised more than 18,000 routers spread across more than 120 countries to gain deeper access to sensitive networks for a large-scale espionage campaign before it was recently neutralized, researchers and authorities said Tuesday. Forest Blizzard, also known as APT28 and Fancy Bear, exploited known vulnerabilities to steal credentials for thousands of TP-Link…

The rise of proactive cyber: Why defense is no longer enough

For more than two decades, cybersecurity has been built on a reactive model: detect intrusions, patch vulnerabilities, respond to incidents, and repeat. That model is now under sustained pressure from a threat environment that is faster, more coordinated, and increasingly automated. Two recent developments illustrate how quickly that model is breaking down. Earlier this month,…

Weekly Update 498

This week, more time than I’d have liked to spend went on talking about the trials of chasing invoices. This is off the back of a customer (who, for now, will remain unnamed), who had invoices stacking back more than 6 months overdue and despite payment terms of 30 days, paid on an avergae of…

From Reactive to Proactive: 5 Steps to SOC Maturity with Threat Intelligence 

Reaching a higher level of SOC maturity takes better, more consistent decision-making during malware and phishing investigation.  This requires a shift in how threat intelligence is used: not as a reference point, but as a core layer in the decision process.  Moving from reactive to confidently proactive security means establishing a threat intelligence workflow that: Solve key challenges, from alert fatigue to blind spots  Integrate across SOC workflows, supporting them  Deliver compounding…

From Reactive to Proactive: 5 Steps to SOC Maturity with Threat Intelligence 

Reaching a higher level of SOC maturity takes better, more consistent decision-making during malware and phishing investigation.  This requires a shift in how threat intelligence is used: not as a reference point, but as a core layer in the decision process.  Moving from reactive to confidently proactive security means establishing a threat intelligence workflow that: Solve key challenges, from alert fatigue to blind spots  Integrate across SOC workflows, supporting them  Deliver compounding…

Cybercriminals take aim at Hasbro, weeks of recovery ahead

Hasbro, an American toy maker with more than 5,000 employees, confirmed a cyberattack and proactively took certain systems offline. The intrusion was detected on March 28, and the company promptly activated its incident response protocols. The company said the investigation is ongoing with support from third-party cybersecurity professionals as it works to determine the scope…

Asana’s chief product officer: Why enterprise AI agents should be ‘multiplayer by design’

As AI agents become more embedded in workplace tools, Asana is positioning its approach around collaboration rather than individual productivity. “We believe in AI being ‘multiplayer’ by design,” said chief product officer Arnab Bose. “The future of the agentic enterprise will only be realized if agents can work independently and with multiple people, versus just…

Application Control Bypass for Data Exfiltration, (Tue, Mar 31st)

In case of a cyber incident, most organizations fear more of data loss (via exfiltration) than regular data encryption because they have a good backup policy in place. If exfiltration happened, it means a total loss of control of the stolen data with all the consequences (PII, CC numbers, …). While performing a security assessment of a…

Bearlyfy Hits 70+ Russian Firms with Custom GenieLocker Ransomware

A pro-Ukrainian group called Bearlyfy has been attributed to more than 70 cyber attacks targeting Russian companies since it first surfaced in the threat landscape in January 2025, with recent attacks leveraging a custom Windows ransomware strain codenamed GenieLocker. “Bearlyfy (also known as Labubu) operates as a dual-purpose group aimed at inflicting maximum damage upon…

European Parliament delays implementation of parts of the EU AI Act

The European Parliament’s Thursday vote to delay parts of the EU AI Act adds more uncertainty to the already chaotic AI compliance universe. But analysts say that CIOs must proceed as though the compliance rules are in effect.  In a statement, Parliament said that its members decided to “delay the application of certain rules on…

Enterprise Security in 2026: Why Most Organizations Are Still Getting It Wrong

Enterprise security has never been more urgent — or more misunderstood. Despite ballooning security budgets, the average cost of a data breach hit a record high in 2024, and the trend hasn’t reversed. Organizations are spending more on tools than ever before, yet the breaches keep coming. The uncomfortable truth? Spending more isn’t the problem.…

Critical NetScaler ADC, Gateway flaw may soon be exploited (CVE-2026-3055)

Citrix has fixed two vulnerabilities in NetScaler ADC and NetScaler Gateway, with the more serious flaw (CVE-2026-3055) potentially allowing attackers to extract active session tokens from the memory of affected devices. Anil Shetty, senior VP of Engineering with Cloud Software Group (Citrix’s parent company), stated on Saturday that Cloud Software Group “is not aware of…

The Hidden Cost of Cybersecurity Specialization: Losing Foundational Skills

Cybersecurity has changed fast. Roles are more specialized, and tooling is more advanced. On paper, this should make organizations more secure. But in practice, many teams struggle with the same basic problems they faced years ago: unclear risk priorities, misaligned tooling decisions, and difficulty explaining security issues in terms the business understands. These challenges do not

TeamPCP Hacks Checkmarx GitHub Actions Using Stolen CI Credentials

Two more GitHub Actions workflows have become the latest to be compromised by credential-stealing malware by a threat actor known as TeamPCP, the cloud-native cybercriminal operation also behind the Trivy supply chain attack. The workflows, both maintained by the supply chain security company Checkmarx, are listed below – checkmarx/ast-github-action checkmarx/kics-github-action Cloud security

Product showcase: Cross-platform and third-party endpoint patching with Action1

Keeping endpoints patched is one of the more annoying chores in IT operations. Action1 is a cloud-based autonomous endpoint management platform that addresses this challenge head-on, covering third-party apps and OS updates (Windows, macOS, and now Linux) from a single, centralized console. Built as a SaaS solution, it requires no on-premises infrastructure, no VPN tunnels,…

Experts insist Trump administration’s cyber strategy is already paying off

SAN FRANCISCO — The Trump administration’s two-week old cyber strategy that aims to promote more proactive, offensive actions while bolstering federal networks and critical infrastructure, is a significant shift that’s already materializing in meaningful ways, a group of experts said Monday at the RSAC 2026 Conference.  Despite the federal government’s absence from the industry’s largest…

How MSPs Should Evaluate Cloud Partners in 2026

MSPs are rethinking cloud partnerships as the market grows more competitive and complex, shifting evaluation beyond technical performance to long-term viability, economics, and operational fit. Why MSPs are re-evaluating cloud partnerships amid rapid growth The MSP market is expanding rapidly, with global revenue projected to reach $354 billion in 2026 and partner programs driving 40%…

Abnormal AI Attune 1.0 targets AI-driven attacks with behavioral detection

Abnormal AI has unveiled the launch of Attune 1.0, a behavioral foundation model for cybersecurity. Trained on more than one billion derived behavioral signals, Attune now powers 85% of detections across the Abnormal Behavior Platform and establishes a shared intelligence layer for the company’s expanding security portfolio. Communication is how organizations build trust. That trust…

RondoDox botnet expands arsenal targeting 174 flaws, and hits 15,000 daily exploit attempts

RondoDox botnet targets 174 flaws, reaching 15,000 daily exploit attempts in a more focused and strategic campaign. RondoDox botnet is ramping up attacks, targeting 174 vulnerabilities with up to 15,000 daily exploitation attempts in a more focused and strategic campaign, Bitsight reported. “We gathered all these exploit attempts (identifiable by indicators like the User-Agent and…

Every significant B2B company is becoming a security company

Every platform giant is becoming a security company. As every enterprise is becoming more and more tech-enabled, the responsibility for protecting data, identities, and infrastructure starts to fall on the platforms where that work happens. Over the past several years, I have come to a simple realization: that every platform vendor eventually becomes a security…

Snowflake Research Reveals AI-Driven Job Creation Outpaces Job Loss across Australia and New Zealand, with 74% Reporting Workforce Gains

GUEST RESEARCH: AI’s workforce impact is more nuanced than headlines suggest, with 74% of A/NZ organisations reporting AI-driven job creation compared to 50% reporting job losses A/NZ workers were most likely to use Gen AI tools without company approval with 67% reporting use of non-approved tools, suggesting pent-up demand  A/NZ organisations, more than any other…

Software vulnerabilities push credential abuse aside in cloud intrusions

Cloud intrusions are unfolding on shorter timelines, with attackers leaning more on unpatched software and compromised identities. H2 2025 distribution of initial access vectors exploited in Google Cloud (Source: Google) Google Cloud’s Cloud Threat Horizons Report H1 2026 reflects incident response and intelligence findings from the second half of 2025 and shows how access methods…

I replaced manual pen tests with automation. Here’s what I learned.

More accreditation and compliance requirements have been added in response to cyber incidents. While these frameworks play an important role in establishing security baselines, true security is more than just achieving a perfect compliance score. As I often say, “policies and procedures won’t stop an attacker, they’ll just have more documents to exfiltrate when they…

Why MSPs Should Focus on Managed Patch Management in 2026

In 2026, patch management is more critical than ever as organizations face a rapidly evolving threat environment. AI-driven attacks have increased both the volume and sophistication of exploits, making vulnerabilities easier and faster for threat actors to weaponize.  As a result, MSPs and internal IT teams alike must implement effective patch management strategies to keep…

FBI Arrests Suspect in $46M U.S. Marshals Crypto Theft

A suspect accused of stealing more than $46 million in cryptocurrency linked to assets managed by the U.S. Marshals Service (USMS) has been arrested in an international law enforcement operation. The suspect, identified as John Daghita, was apprehended Wednesday on the Caribbean island of Saint Martin.  “Last night, John Daghita – a U.S. government contractor…

Gov’t IT spending seen as key to building Europe’s tech ecosystem

As more European organizations reconsider their reliance on US technology suppliers amid rising geopolitical and trade tensions, public sector organizations are leading the way in a potential shift to local tech providers.  The German state of Schleswig-Holstein is moving tens of thousands of employees from Microsoft apps Office, Windows and Exchange to open-source alternatives, for…

Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities

Cisco has disclosed that two more vulnerabilities affecting Catalyst SD-WAN Manager (formerly SD-WAN vManage) have come under active exploitation in the wild. The vulnerabilities in question are listed below – CVE-2026-20122 (CVSS score: 7.1) – An arbitrary file overwrite vulnerability that could allow an authenticated, remote attacker to overwrite arbitrary files on the local file…

DataDome Adjusts Partner Program to Build Ecosystem

DataDome has launched an enhanced Partner Program to more tightly integrate resellers with its technology and cloud alliances, as AI agents introduce new security complexities for enterprise customers. Announced on Tuesday, the updated program is designed to move beyond traditional channel structures where resellers, technology alliances, and cloud alliances operate independently.  New structure connects resellers…

Jack Dorsey shrinks Block to ‘intelligence‑native’ model, cutting 4,000 jobs

Block, the payments and financial services company led by Jack Dorsey, is cutting more than 4,000 jobs, nearly half its workforce, because AI tools have made a leaner organisation not just possible, but strategically preferable, Dorsey said in a letter to its shareholders. The cuts will reduce Block’s headcount from over 10,000 to just under…