Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Cybersecurity Industry Split Over Impact of Anthropic’s Mythos AI

  Advanced artificial intelligence systems are rapidly reshaping the cybersecurity industry, but experts remain sharply divided over whether...

All the recent news you need to know
Vishing Attack
BlackFile Extortion Cyber Attacks Hospitality Data Theft IT Impersonation Vishing Attack

BlackFile Extortion Gang Targets Retail and Hospitality Sectors

 

A new cyber threat actor known as BlackFile has emerged, launching data theft and extortion campaigns against retail and hospitality organizations since February 2026. Tracked also as CL-CRI-1116, UNC6671, and Cordial Spider, the group employs sophisticated vishing attacks by impersonating IT helpdesk staff via spoofed VoIP calls. This tactic preys on frontline employees, tricking them into revealing credentials on fake SSO login pages. 

BlackFile's attack chain begins with urgent phone calls claiming account security issues, directing victims to pixel-perfect phishing sites for credentials and MFA codes. Attackers then register rogue devices to bypass MFA, escalate privileges by scraping employee directories, and exploit SaaS APIs like Microsoft Graph and Salesforce to exfiltrate sensitive data. They target files with keywords such as "confidential," "SSN," or "salary," downloading massive volumes under legitimate-looking sessions. 

Unlike ransomware groups focused on encryption, BlackFile prioritizes pure extortion, leaking stolen data—including customer PII and employee records—on dark web sites before contacting victims. Demands reach seven figures, delivered via compromised emails or random Gmail addresses, with added pressure from psychological tactics like swatting executives. Researchers from Palo Alto Networks' Unit 42 link BlackFile with moderate confidence to "The Com," a network tied to broader cybercrimes.

The group's success exploits high staff turnover in retail and hospitality, where social engineering evades traditional defenses. RH-ISAC warns of rising incidents, noting similarities to groups like ShinyHunters. As SaaS platforms hold crown-jewel data, BlackFile signals a shift to "extortion-first" models, blending digital theft with real-world harassment. 

To counter BlackFile, organizations must enforce "callback" protocols—employees hang up and verify via internal lines—and audit SSO logs for suspicious device registrations. Regular social engineering training, API key rotations, and executive swatting briefings are essential for frontline resilience. Retail and hospitality firms ignoring these risks face multimillion-dollar breaches in 2026's volatile threat landscape.
Read more »
High Value Cybercrime
critical infrastructure attack Cyber Attacks Cyber Security Ransomware Attacks cyberattacks increase cybercriminals Ransomware Attack High Value Cybercrime

Targeted Ransomware Attacks Rise as Cybercriminals Shift Focus Toward High-Value Victims

 

Surprisingly, cyber attackers now prefer precision over volume, shifting from broad campaigns to targeted strikes meant to inflict severe damage on fewer targets. Although nationwide ransomware incidents declined in the UK last year, data collected by SonicWall reveals a rise in successful breaches across businesses. Instead of casting wide nets, hackers fine-tune their efforts, making each attempt harder to detect. 

What stands out is not the frequency of attacks but how many actually succeed. Focusing narrowly allows intruders to adapt quickly, exploiting specific weaknesses others might overlook. Eighty-seven percent fewer ransomware incidents were reported, though twenty percent more organizations faced breaches - a sign tactics have changed. Rather than casting wide nets, attackers now focus on specific companies with better odds of success or higher returns. Picking targets deliberately has become the norm, shifting away from mass campaigns toward precision strikes. 

One tactic draws attention by targeting firms with shaky safeguards - outdated systems, reliance on fragile operations. Called “big game hunting,” it zeroes in on weakness rather than strength. Smaller companies often find themselves in the line of fire. Breaches here frequently involve ransomware, showing up in 88% of cases. Larger organizations face such attacks less often, at only 39%. Vulnerability shapes who gets hit hardest. Older systems, sometimes called zombie tech, pose growing dangers according to security experts. 

Because updates stop for these outdated platforms, hackers find them easier targets - flaws linger without fixes. A case in point: a weakness first found ten years ago in Hikvision internet-connected cameras. In just twelve months across the UK, attackers tried to use this opening nearly 67 million times. About one out of every five break-in attempts logged by monitoring teams tied back to this issue alone. Surprisingly, few organizations grasp the duration attackers often stay undetected in their networks. 

Although the majority of IT leaders thought breaches would be spotted quickly - within hours - the data showed intruders typically lingered around 181 days. That mismatch, perception versus reality, opens space for malicious activity to unfold slowly, unnoticed. Quietly, threats spread across digital environments well before anyone responds. What once moved slowly now races forward - artificial intelligence fuels sharper rises in digital dangers. 

A surge appears: studies show nearly nine out of ten incidents involve AI-powered tools. Scanning nonstop, machines probe countless online points each moment, hunting weak spots. Speed becomes their weapon; defenses lag behind as holes get found quicker than fixes go live. Years go by, yet many organizations still run systems riddled with outdated flaws - perfect openings for digital intruders. 

Not only do skilled ransomware operators refine their tactics constantly, but they also rely on neglect: gaps known for ages stay unfixed. Danger grows quietly when precision strikes meet ignored risks. Small firms face just as much threat as large ones, simply because exposure piles up over time. Even basic protections often come too late, if at all. Though many still overlook it, keeping software up to date plays a key role in staying secure online. 

Instead of waiting for problems, frequent checks across networks help catch risks early. Some companies run into trouble simply because they trust aging tools too much. Old flaws thought harmless yesterday might open doors today. Attackers adapt quickly - especially those deploying tailored ransomware attacks. As these threats grow sharper, so does the risk for unprepared teams.
Read more »
Quantum threats
Bitcoin Security Blockchain Security Cryptographic Attacks Cyber Security Cyber Threats Elliptic Curve Cryptography Post Quantum Cryptography Quantum computing Quantum threats

Bitcoin Edges Closer to Q-Day Following Quantum Key Breakthrough


 After an anonymous researcher was able to compromise a simplified Bitcoin-style encryption key with the help of a publicly accessible quantum computer, a new and increasingly significant phase has emerged in the race between cryptographic resilience and quantum capability. 


By using a variant of Shor's algorithm, the breakthrough has been demonstrated as the largest quantum attack against elliptic curve cryptography (ECC) to date, and the security of Bitcoin and other blockchain networks relying on public-key cryptographic systems Project has been heightened as a result of this event. 

Eleven confirmed it had awarded its 1 Bitcoin “Q-Day Prize,” valued at nearly $78,000, to Italian researcher Giancarlo Lelli for successfully breaking a 15-bit ECC key. The demonstration was conducted using a highly simplified cryptographic model rather than a production-scale Bitcoin wallet, but it reinforced warnings from cybersecurity and quantum research communities that theoretical quantum threats are narrowing faster than previously anticipated as practical exploitation becomes more accessible.

In response to the rapid advancement in quantum computing research, digital assets have received renewed scrutiny due to the cryptographic foundations of digital assets. The publication of several research papers in March 2026 indicates that large-scale quantum systems may be able to undermine commonly used encryption methods far before earlier projections indicated. There is a concern concerning Shor's algorithm, a quantum technique capable of solving mathematical problems such as integer factorization and discrete logarithms for elliptic curves, which serve as the foundation for cryptocurrencies, secure communications, and digital authentication. 

Researchers at Google Quantum AI recently reported that a sufficiently advanced quantum computer capable of deriving a Bitcoin private key from its associated public key in less than ten minutes if it contained fewer than 500,000 physical qubits. This further raised concerns. As a result of such a capability, classical systems will no longer face computational infeasibility, which would result in years or even centuries of work to accomplish the same task. 

According to the study, blockchain developers, cryptographers, and security analysts are reassessing how rapidly they may need to prepare for "Q-Day" – a phenomenon when quantum computers become sufficiently powerful to compromise current cryptographic standards at scale and threaten global digital infrastructure integrity. It is noteworthy, however, that despite the growing alarm, the current hardware does not meet the threshold required for a real-world attack on Bitcoin. 

The most advanced quantum processors currently operate at approximately 1,000 qubits, leaving a significant technological gap before practical cryptographic compromise is feasible. Project Eleven's latest experiment, however, has been regarded as an early indicator that the cryptocurrency sector is entering a transition period where quantum-resistant security models are required to be developed before theoretical risks become operational threats. 

Increasing quantum developments are transforming broader market sentiment about digital assets, as concerns about cryptographic durability have moved beyond theoretical discussions and have become institutional risk assessments. Bitcoin's security architecture relies on the elliptic curve cryptography system to authenticate ownership and to secure transactions over the network for many years. 

Quantum research is progressing, however, which is leading analysts and security experts to question whether future quantum systems will undermine the mathematical assumptions underlying blockchain security. The debate is already influencing financial positioning within traditional markets. Upon the removal of Bitcoin from Jefferies' model portfolio, Christopher Wood, global head of equity strategy, noted that continued advances in quantum computing could adversely affect the credibility of the cryptocurrency as a long-term store of value, unless its cryptographic protections are successfully compromised. 

The concerns gained additional traction after Google Quantum AI released a whitepaper on March 31, which presented significant reductions in hardware requirements for executing quantum attacks against the elliptic curve cryptography that is used by Bitcoin, Ether, and most major blockchain networks. 

Researchers have estimated that fewer than 500,000 physical qubits of a superconducting quantum computer could theoretically be sufficient to compromise these cryptographic systems, a number twenty times lower than earlier projections that suggested the requirement would be in the multimillion-qubit range. Several academics and institutions contributed to the research, including Justin Drake, Dan Boneh, and six researchers from Google Quantum AI led by Ryan Babbush and Hartmut Neven. 

Google also disclosed the research had been coordinated with U.S. government stakeholders prior to publication. Coinbase, Stanford Institute for Blockchain Research, and Ethereum Foundation were among the organizations that collaborated with Coinbase to develop the report. Research indicates, however, that quantum computing is not yet able to reach the operational scale required to perform such attacks on live blockchain networks. 

Google's most advanced quantum processor, Willow, currently operates with 105 qubits-well below the company's projections for such processors. Despite this, the industry's perception of the timeline has changed due to the rapid reduction in estimated hardware requirements. The concept was once considered a distant theoretical possibility, but is now increasingly seen as a long-term engineering challenge that must be mitigated with proactive measures, especially as the interval between quantum capabilities and cryptographically relevant quantum systems continues to narrow faster than many researchers expected. 

Project Eleven's "Q-Day Prize" launched in 2025 to assess whether publicly accessible quantum systems could progress beyond the limited proof-of-concept exercises that have long defined the field has also gained renewed visibility through the latest demonstration. It was designed to counter persistent criticisms that existing quantum hardware has only been able to demonstrate mathematically trivial demonstrations, including dividing the number 21 into 3 and 7, in an attempt to counter persistent criticism that quantum computers will be capable of breaking modern cryptographic systems at scale. 

During Giancarlo Lelli’s successful attack on that boundary, he solved a 15-bit elliptic curve cryptography problem covering 32,767 possible values, resulting in a significant improvement in the complexity publicly achieved using accessible quantum infrastructure.

In the opinion of Project Eleven co-founder Alex Pruden, the significance of the result has less to do with the size of the broken key than it does with the evidence of sustained technological advancement within quantum science. "The good news here is that progress is being made," Pruden said, arguing that the experiment demonstrates quantum computing has advanced beyond symbolic accomplishments. 

As reported by the media, the attack involved the implementation of a quantum system with approximately 70 qubits which was executed within minutes of the algorithmic framework having been finalized. 

A qubit is different from classical binary bits, in that they can exist simultaneously in multiple probability states, allowing quantum systems to perform certain cryptographic calculations exponentially faster under the right conditions. 

In the report, it was stated that Lelli's submission was reviewed by a panel of independent researchers from academia and industry, including experts associated with the University of Wisconsin–Madison and the quantum software company qBraid. Quantum hardware developers and academic institutions continue to publish increasingly ambitious projections for attaining cryptographically relevant quantum systems at the time of this announcement. 

Google Quantum AI made public commitments to transitioning its infrastructure to post-quantum cryptography by 2029 as a result of rapid advances in quantum hardware scalability, error correction techniques, and declining estimates for computing resources required to compromise current encryption standards in March. As a consequence, competing research estimates continue to narrow the perceived distance to practical attacks on blockchain cryptography. 

Using Google's estimate, less than 500,000 physical qubits are required to compromise Bitcoin's elliptic curve protection. However, a separate study conducted by the California Institute of Technology and Oratomic indicates that a neutral-atom quantum architecture may be able to reduce the amount of qubits required to 10,000 to 20,000. 

The focus of Pruden's organization is currently on 2029 as a worst-case estimate for the arrival of "Q-Day," emphasizing that forecasting the pace of scientific breakthroughs remains inherently uncertain due to the unpredictable nature of both engineering improvements and human innovation. The Project Eleven project estimates that approximately 6.9 million Bitcoins currently stored in wallets with publicly exposed keys on the blockchain could become theoretically vulnerable to quantum-based attacks if such systems eventually come into existence. 

However, it remains the belief of many within the cryptocurrency sector that the issue is more of a long-term infrastructure challenge than an immediate threat to the system. A number of defensive proposals are being discussed among Bitcoin developers with the purpose of transitioning the network to quantum-resistant cryptographic models. 

A proposed upgrade such as BIP-360 introduces quantum-secure transaction formats, while BIP-361 phases out older signature schemes and may freeze dormant coins unable to migrate to the enhanced security protocols. A dedicated post-quantum security initiative has been launched by the Ethereum Foundation, with co-founder Vitalik Buterin presenting plans for replacement of vulnerable components of Ethereum's cryptographic architecture over the long term.

Pruden also emphasized that advances in artificial intelligence could accelerate Q-Day even further by increasing quantum error-correction efficiency, thereby aiding researchers and attackers in quickly identifying weaker cryptographic targets, potentially compressing the timeframe available for blockchain networks to implement defensive transitions. 

In spite of the ongoing debate within the cryptocurrency industry regarding the urgency of quantum threats, the direction of research suggests that the conversation has shifted from theoretical speculation to strategic planning for the long term. Currently, Bitcoin and other blockchain networks remain protected by an enormous technological gap that separates current quantum hardware from the capability required to conduct a successful cryptographic attack.

Despite this, the steady reduction in estimated qubit requirements, combined with rapid advancements in quantum engineering and artificial intelligence, are intensifying pressure on developers and exchanges to prepare for a post-quantum future as soon as possible. Institutions are now reviewing their risk models as blockchain ecosystems move towards quantum-resistant security standards, and emergence of a "Q-Day" is no longer considered a question of whether it will occur, but rather a question of when.
Read more »
Technology
Digital Sovereignty Europe France Microsoft Technology

France’s Break From Microsoft Signals Europe’s Growing Push for Digital Sovereignty


In a move that reflects Europe’s deepening concerns over data sovereignty and foreign technological dependence, France has decided to move its national Health Data Hub away from Microsoft's cloud infrastructure and into the hands of domestic provider Scaleway. The decision marks one of the most significant shifts yet in Europe’s growing effort to reclaim control over sensitive public data. 
 
The Health Data Hub contains medical information relating to millions of French citizens and serves as a major research platform for healthcare analysis and innovation. Since 2019, the system had been hosted on Microsoft Azure, a decision that triggered years of political and legal controversy due to fears surrounding American surveillance laws and extraterritorial access to European data.   
 
French authorities have now selected Scaleway, a subsidiary of Iliad, after an extensive evaluation involving more than 350 technical criteria related to security, resilience, and operational capacity. The migration is expected to be completed between late 2026 and early 2027.   
 

Why Europe Is Growing Wary of American Cloud Giants 

 
The decision is part of a much broader European movement toward what policymakers increasingly describe as “digital sovereignty.” Governments across Europe have become increasingly uneasy about relying on American technology firms for critical infrastructure, especially after repeated debates surrounding the US CLOUD Act, which can compel US companies to provide data to American authorities even if that data is stored overseas.  
 
In France, these concerns intensified after Microsoft reportedly acknowledged before a French Senate inquiry that it could not fully resist certain US government data requests involving French citizens. That revelation significantly strengthened calls for sovereign cloud infrastructure controlled entirely within European legal jurisdiction. The shift also aligns with France’s wider technological repositioning. Earlier this year, the country announced plans to reduce reliance on Microsoft products across government systems, replacing several US-based platforms with domestic or open source alternatives.   
 

A Defining Moment for Europe’s Tech Independence 

 
France’s decision extends beyond healthcare infrastructure as it clearly represents a symbolic turning point in Europe’s evolving relationship with Big Tech. 
 
For years, European nations depended heavily on American cloud providers because of their scale, maturity, and technological dominance. But growing geopolitical tensions, concerns around privacy, and the strategic importance of data have begun reshaping that equation. 
 
By transferring one of its most sensitive national databases to a domestic provider, France is effectively signalling that technological convenience can no longer outweigh sovereignty concerns. The move may now encourage other European governments to reassess where their own critical data resides. 
 
At its core, this is no longer simply a cloud migration story. It is a declaration that, in the age of AI and mass data infrastructure, control over information has become inseparable from national security itself.
Read more »
WebVPN
CISA Cisco Firewall malware Vulnerabilities WebVPN

Firestarter Malware Persists on Cisco Firewalls Even After Security Updates

 



Cybersecurity authorities in the United States and the United Kingdom have issued a joint alert about a previously undocumented malware strain called Firestarter that is capable of maintaining access on Cisco firewall systems even after updates and security patches are applied.

The malware affects Cisco Firepower and Secure Firewall devices running Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software. Investigators have linked the activity to a threat actor tracked by Cisco Talos as UAT-4356, a group associated with espionage-focused operations, including campaigns such as ArcaneDoor.

According to assessments from the Cybersecurity and Infrastructure Security Agency (CISA) and the UK’s National Cyber Security Centre (NCSC), the attackers likely gained initial entry by exploiting two vulnerabilities. One is an authorization flaw identified as CVE-2025-20333, and the other is a buffer overflow issue tracked as CVE-2025-20362. Both weaknesses could allow unauthorized access to targeted devices.

In one confirmed case involving a U.S. federal civilian executive branch agency, investigators observed a staged intrusion. The attackers first deployed a tool called Line Viper, which operates as a user-mode shellcode loader. This malware was used to establish VPN connections and extract sensitive configuration data from the device, including administrator credentials, certificates, and private cryptographic keys.

After this initial access phase, the attackers introduced the Firestarter backdoor to ensure continued control. CISA noted that while the precise date of the breach has not been verified, the compromise likely occurred in early September 2025, before the agency applied patches required under Emergency Directive 25-03.

Firestarter is designed to maintain persistence. Once installed, it continues functioning across system reboots, firmware upgrades, and security patching. In addition, if its process is terminated, it is capable of restarting itself automatically.

The malware achieves this persistence by integrating with LINA, a core process within Cisco ASA systems. It uses signal-handling mechanisms to detect termination events and trigger routines that reinstall the malware.

A joint technical analysis from CISA and NCSC found that Firestarter modifies the system’s boot configuration by altering the CSP_MOUNT_LIST file, ensuring that it executes during device startup. It also stores a copy of itself within system log directories and restores its executable into a critical system path, allowing it to run silently in the background.

Separate analysis from Cisco Talos indicates that the persistence mechanism is activated when the system receives a process termination signal, such as during a controlled or “graceful” reboot.

The primary function of Firestarter is to act as a backdoor, providing attackers with remote access to compromised devices. It can also execute arbitrary shellcode supplied by the attacker.

This capability is enabled by modifying an internal XML handler within the LINA process and injecting malicious code directly into memory. Execution is triggered through specially crafted WebVPN requests. Once a built-in identifier is validated, the malware loads and executes attacker-provided payloads in memory without writing them to disk. Authorities have not disclosed details about the specific payloads used in observed incidents.

Cisco has released a security advisory outlining mitigation steps, recommended workarounds, and indicators of compromise to help identify infections. The company advises organizations to fully reimage affected devices and upgrade to fixed software versions, regardless of whether compromise has been confirmed.

To check for signs of infection, administrators are instructed to run a diagnostic command that inspects running processes. If any output is returned indicating the presence of a specific process, the device should be treated as compromised.

As an alternative, Cisco noted that performing a complete power shutdown may remove the malware. However, this approach is not recommended because it introduces the risk of database or disk corruption, which could lead to system instability or boot failures.

To assist with detection, CISA has also released two YARA rules that can identify the Firestarter backdoor when analyzing disk images or memory dumps from affected systems.

There is a noticeable change in how attackers approach the network infrastructure. Instead of focusing only on endpoints such as laptops or servers, threat actors are placing long-term implants directly within security appliances that sit at the edge of enterprise networks.

Firestarter introduces a specific operational challenge. Even after vulnerabilities are patched, the implanted malware remains active because it embeds itself within core system processes and startup routines. This separates the persistence mechanism from the original point of entry.

The use of in-memory execution through WebVPN requests also reduces visibility. Since payloads are not written to disk, traditional file-based detection methods may not identify malicious activity.

For defenders, this means that patching alone cannot be treated as confirmation that a system is secure. Additional validation steps are required, including process inspection, firmware integrity checks, and monitoring for abnormal behavior in network appliances.

The incident also reinforces the importance of restricting exposure of management interfaces and ensuring that critical infrastructure devices are continuously monitored, not just periodically updated.

Read more »
User Security
Cyber Attacks Financial Scam Srilanka User Security

Sri Lanka Finance Ministry Loses $2.5 Million in Cyberattack on Payment System

 

Sri Lanka is trying to recover $2.5 million after a cyberattack on the Finance Ministry’s payment system redirected funds away from their intended recipient, exposing fresh weaknesses in the country’s public financial controls. Officials say the breach involved email manipulation, and the issue surfaced after opposition lawmakers alleged that treasury money had landed in a hacker’s account instead of reaching the correct creditor. The incident has prompted a high-level probe, with authorities treating it as both a financial loss and a serious security breach. 

According to finance ministry secretary Harshana Suriyapperuma, cybercriminals were first detected trying to enter the External Resources Department’s system in January 2026, and the ministry took steps with overseas partners to stop further damage. He said the earlier attempt was contained, but the later payment breach still led to losses that are now under review. The stolen amount formed part of a larger $22.9 million payment, with $2.5 million reportedly disbursed between December 2025 and January 31, 2026. 

The incident has drawn wider attention because it involves government debt repayment funds and an apparent failure in payment verification. Australia’s high commissioner in Sri Lanka said Canberra was aware of irregularities in payments owed to it, and Australian officials are assisting the investigation. That international angle has made the breach more sensitive, since the diverted funds were tied to a sovereign obligation rather than a routine domestic transaction. 

A high-powered committee has been formed to investigate the hacking incident and identify how the payment was rerouted. Opposition lawyers have also asked Parliament to examine the matter, arguing that public finances fall under legislative oversight. The issue has been raised before the Committee on Public Accounts, adding political pressure on the government to explain how the breach happened and whether more funds may have been exposed. 

The episode is a damaging reminder that cyberattacks can hit not just banks and companies but also state payment systems handling international debt obligations. For Sri Lanka, which is still recovering from its severe economic crisis and debt default, even a single diverted payment can deepen concerns about administrative safeguards and digital resilience. The investigation will likely focus on email security, approval controls, and how quickly suspicious payment changes were detected.
Read more »
Subscribe to: Posts (Atom)

Featured