Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label AI. Show all posts
Threat Intelligence
AI AI Tool Data Privacy Technology Threat Intelligence

AI and Privacy – Issues and Challenges

 

Artificial intelligence is changing cybersecurity and digital privacy. It promises better security but also raises concerns about ethical boundaries, data exploitation, and spying. From facial recognition software to predictive crime prevention, customers are left wondering where to draw the line between safety and overreach as AI-driven systems become more and more integrated into daily life.

The same artificial intelligence (AI) tools that aid in spotting online threats, optimising security procedures, and stopping fraud can also be used for intrusive data collecting, behavioural tracking, and mass spying. The use of AI-powered surveillance in corporate data mining, law enforcement profiling, and government tracking has drawn criticism in recent years. AI runs the potential of undermining rather than defending basic rights in the absence of clear regulations and transparency. 

AI and data ethics

Despite encouraging developments, there are numerous instances of AI-driven inventions going awry, which raise serious questions. A face recognition business called Clearview AI amassed one of the largest facial recognition databases in the world by illegally scraping billions of photos from social media. Clearview's technology was employed by governments and law enforcement organisations across the globe, leading to legal action and regulatory action about mass surveillance. 

The UK Department for Work and Pensions used an AI system to detect welfare fraud. An internal investigation suggested that the system disproportionately targeted people based on their age, handicap, marital status, and country. This prejudice resulted in certain groups being unfairly picked for fraud investigations, raising questions about discrimination and the ethical use of artificial intelligence in public services. Despite earlier guarantees of impartiality, the findings have fuelled calls for increased openness and supervision in government AI use. 

Regulations and consumer protection

The ethical use of AI is being regulated by governments worldwide, with a number of significant regulations having an immediate impact on consumers. The AI Act of the European Union, which is scheduled to go into force in 2025, divides AI applications into risk categories. 

Strict regulations will be applied to high-risk technology, like biometric surveillance and facial recognition, to guarantee transparency and moral deployment. The EU's commitment to responsible AI governance is further reinforced by the possibility of severe sanctions for non compliant companies. 

Individuals in the United States have more control over their personal data according to California's Consumer Privacy Act. Consumers have the right to know what information firms gather about them, to seek its erasure, and to opt out of data sales. This rule adds an important layer of privacy protection in an era where AI-powered data processing is becoming more common. 

The White House has recently introduced the AI Bill of Rights, a framework aimed at encouraging responsible AI practices. While not legally enforceable, it emphasises the need of privacy, transparency, and algorithmic fairness, pointing to a larger push for ethical AI development in policy making.
Read more »
malware
Advanced Technology AI CyberCrime Cybersecurity CyberThreat malware

Attackers Exploit Click Tolerance to Deliver Malware to Users


 

The Multi-Factor Authentication (MFA) system has been a crucial component of modern cybersecurity for several years now. It is intended to enhance security by requiring additional forms of verification in addition to traditional passwords. MFA strengthens access control by integrating two or more authentication factors, which reduces the risk of credential-based attacks on the network. 

Generally, authentication factors are divided into three categories: knowledge-based factors, such as passwords or personal identification numbers (PINs); possession-based factors, such as hardware tokens sent to registered devices or one-time passcodes sent to registered devices; as well as inherent factors, such as fingerprints, facial recognition, or iris scans, which are biometric identifiers used to verify identity. Although Multi-factor authentication significantly reduces the probability that an unauthorized user will gain access to the computer, it is not entirely foolproof.

Cybercriminals continue to devise sophisticated methods to bypass authentication protocols, such as exploiting implementation gaps, exploiting technical vulnerabilities, or influencing human behaviour. With the evolution of threats, organizations need proactive security strategies to strengthen their multifactor authentication defences, making sure they remain resilient against new attack vectors. 

Researchers have recently found that cybercriminals are exploiting users' familiarity with verification procedures to deceive them into unknowingly installing malicious software on their computers. The HP Wolf Security report indicates that multiple threat campaigns have been identified in which attackers have taken advantage of the growing number of authentication challenges that users face to verify their identities, as a result of increasing the number of authentication challenges. 

The report discusses an emerging tactic known as "click tolerance" that highlights how using authentication protocols often has conditioned users to follow verification steps without thinking. Because of this, individuals are more likely to be deceptively prompted, which mimic legitimate security measures, as a result. 

Using this behavioural pattern, attackers deployed fraudulent CAPTCHAs that directed victims to malicious websites and manipulated them into accepting counterfeit authentication procedures designed to trick users into unwittingly granting them access or downloading harmful payloads. As a result of these fraudulent CAPTCHAs, attackers were able to leverage this pattern. 

For cybersecurity awareness to be effective and for security measures to be more sophisticatedtoo counter such deceptive attack strategies, heightened awareness and more sophisticated security measures are needed. A similar strategy was used in the past to steal one-time passcodes (OTPs) through the use of multi-factor authentication fatigue. The new campaign illustrates how security measures can unintentionally foster complacency in users, which is easily exploited by attackers. 

Pratt, a cybersecurity expert, states that the attack is designed to take advantage of the habitual engagement of users with authentication processes to exploit them. People are increasingly having difficulty distinguishing between legitimate security procedures and malicious attempts to deceive them, as they become accustomed to completing repetitive, often tedious verification steps. "The majority of users have become accustomed to receiving authentication prompts, which require them to complete a variety of steps to access their account. 

To verify access or to log in, many people follow these instructions without thinking about it. According to Pratt, cybercriminals are now exploiting this behaviour pattern by using fake CAPTCHAs to manipulate users into unwittingly compromising their security as a result of this behavioural pattern." As he further explained, this trend indicates a significant gap in employee cybersecurity training. Despite the widespread implementation of phishing awareness programs, many fail to adequately address what should be done once a user has fallen victim to an initial deception in the attack chain. 

To reduce the risks associated with these evolving threats, it is vital to focus training initiatives on post-compromise response strategies. When it comes to dealing with cyber threats in the age of artificial intelligence, organizations should adopt a proactive, comprehensive security strategy that will ensure that the entire digital ecosystem is protected from evolving threats. By deploying generative artificial intelligence as a force multiplier, threat detection, prevention, and response capability will be significantly enhanced. 

For cybersecurity resilience to be strengthened, the following key measures must be taken preparation, prevention, and defense. Security should begin with a comprehensive approach, utilizing Zero Trust principles to secure digital assets throughout their lifecycle, from devices to identities to infrastructure to data, cloud environments, networks, and artificial intelligence systems to secure digital assets. Taking such measures also entails safeguarding devices, identities, infrastructures, data, and networks.

To ensure robust identity verification, it is essential to use AI-powered analytics to monitor user and system behaviour to identify potential security breaches in real-time, and to identify potential security threats. To implement explicit authentication, AI-driven biometric authentication methods need to be paired with phishing-resistant protocols like Fast Identity Online (FIDO) and Multifactor Authentication (MFA) which can protect against phishing attacks. 

It has been shown that passwordless authentication increases security, and continuous identity infrastructure management – including permission oversight and removing obsolete applications – reduces vulnerability. In order to accelerate mitigation efforts, we need to implement generative artificial intelligence with Extended Detection and Response (XDR) solutions. These technologies can assist in identifying, investigating, and responding to security incidents quickly and efficiently. 

It is also critical to integrate exposure management tools with organizations' security posture to help them prevent breaches before they occur. Protecting data remains the top priority, which requires the use of enhanced security and insider risk management. Using AI-driven classification and protection mechanisms will allow sensitive data to be automatically secured across all environments, regardless of their location. It is also essential for organizations to take advantage of insider risk management tools that can identify anomalous user activities as well as data misuse, enabling timely intervention and risk mitigation. 

Organizations need to ensure robust AI security and governance frameworks are in place before implementing AI. It is imperative to conduct regular red teaming exercises to identify vulnerabilities in the system before they can be exploited by real-world attackers. An understanding of artificial intelligence applications within the organization is crucial to ensuring that AI technologies are deployed in accordance with security, privacy, and ethical standards. To maintain system integrity, updates of both software and firmware must be performed consistently. 

Automating patch management can prevent attackers from exploiting known security gaps by remediating vulnerabilities promptly. To maintain good digital hygiene, it is important not to overlook these practices. Keeping browsing data, such as users' history, cookies, and cached site information, clean reduces their exposure to online threats. Users should also avoid entering sensitive personal information on insecure websites, which is also critical to preventing online threats. Keeping digital environments secure requires proactive monitoring and threat filtering. 

The organization should ensure that advanced phishing and spam filters are implemented and that mobile devices are configured in a way that blocks malicious content on them. To enhance collective defences, the industry needs to collaborate to make these defences more effective. Microsoft Sentinel is a platform powered by artificial intelligence, which allows organizations to share threat intelligence, thus creating a unified approach to cybersecurity, which will allow organizations to be on top of emerging threats, and it is only through continuous awareness and development of skills that a strong cybersecurity culture can be achieved.

Employees must receive regular training on how to protect their assets as well as assets belonging to the organization. With an AI-enabled learning platform, employees can be upskilled and retrained to ensure they remain prepared for the ever-evolving cybersecurity landscape, through upskilling and reskilling.
Read more »
Technology
AI AI vulnerabilities API Artificial Intelligence CERT-In CyberCrime Cyberhackers CyberThreat Technology

AI as a Key Solution for Mitigating API Cybersecurity Threats

 


Artificial Intelligence (AI) is continuously evolving, and it is fundamentally changing the cybersecurity landscape, enabling organizations to mitigate vulnerabilities more effectively as a result. As artificial intelligence has improved the speed and scale with which threats can be detected and responded, it has also introduced a range of complexities that necessitate a hybrid approach to security management. 

An approach that combines traditional security frameworks with human-digital interventions is necessary. There is one of the biggest challenges AI presents to us, and that is the expansion of the attack surface for Application Programming Interfaces (APIs). The proliferation of AI-powered systems raises questions regarding API resilience as sophisticated threats become increasingly sophisticated. As AI-driven functionality is integrated into APIs, security concerns have increased, which has led to the need for robust defensive strategies. 

In the context of AI security, the implications of the technology extend beyond APIs to the very foundation of Machine Learning (ML) applications as well as large language models. Many of these models are trained on highly sensitive datasets, raising concerns about their privacy, integrity, and potential exploitation. When training data is handled improperly, unauthorized access can occur, data poisoning can occur, and model manipulation may occur, which can further increase the security vulnerability. 

It is important to note, however, that artificial intelligence is also leading security teams to refine their threat modeling strategies while simultaneously posing security challenges. Using AI's analytical capabilities, organizations can enhance their predictive capabilities, automate risk assessments, and implement smarter security frameworks that can be adapted to the changing environment. By adapting to this evolution, security professionals are forced to adopt a proactive and adaptive approach to reducing potential threats. 

Using artificial intelligence effectively while safeguarding digital assets requires an integrated approach that combines traditional security mechanisms with AI-driven security solutions. This is necessary to ensure an effective synergy between automation and human oversight. Enterprises must foster a comprehensive security posture that integrates both legacy and emerging technologies to be more resilient in the face of a changing threat landscape. However, the deployment of AI in cybersecurity requires a well-organized, strategic approach. While AI is an excellent tool for cybersecurity, it does need to be embraced in a strategic and well-organized manner. 

Building a robust and adaptive cybersecurity ecosystem requires addressing API vulnerabilities, strengthening training data security, and refining threat modeling practices. A major part of modern digital applications is APIs, allowing seamless data exchange between various systems, enabling seamless data exchange. However, the widespread adoption of APIs has also led to them becoming prime targets for cyber threats, which have put organizations at risk of significant risks, such as data breaches, financial losses, and disruptions in services.

AI platforms and tools, such as OpenAI, Google's DeepMind, and IBM's Watson, have significantly contributed to advancements in several technological fields over the years. These innovations have revolutionized natural language processing, machine learning, and autonomous systems, leading to a wide range of applications in critical areas such as healthcare, finance, and business. Consequently, organizations worldwide are turning to artificial intelligence to maximize operational efficiency, simplify processes, and unlock new growth opportunities. 

While artificial intelligence is catalyzing progress, it also introduces potential security risks. In addition to manipulating the very technologies that enable industries to orchestrate sophisticated cyber threats, cybercriminals can also use those very technologies. As a result, AI is viewed as having two characteristics: while it is possible for AI-driven security systems to proactively identify, predict, and mitigate threats with extraordinary accuracy, adversaries can weaponize such technologies to create highly advanced cyberattacks, such as phishing schemes and ransomware. 

It is important to keep in mind that, as AI continues to grow, its role in cybersecurity is becoming more complex and dynamic. Organizations need to take proactive measures to protect their organizations from AI attacks by implementing robust frameworks that harness its defensive capabilities and mitigate its vulnerabilities. For a secure digital ecosystem that fosters innovation without compromising cybersecurity, it will be crucial for AI technologies to be developed ethically and responsibly. 

The Application Programming Interface (API) is the fundamental component of digital ecosystems in the 21st century, enabling seamless interactions across industries such as mobile banking, e-commerce, and enterprise solutions. They are also a prime target for cyber-attackers due to their widespread adoption. The consequences of successful breaches can include data compromises, financial losses, and operational disruptions that can pose significant challenges to businesses as well as consumers alike. 

Pratik Shah, F5 Networks' Managing Director for India and SAARC, highlighted that APIs are an integral part of today's digital landscape. AIM reports that APIs account for nearly 90% of worldwide web traffic and that the number of public APIs has grown 460% over the past decade. Despite this rapid proliferation, the company has been exposed to a wide array of cyber risks, including broken authentication, injection attacks, and server-side request forgery. According to him, the robustness of Indian API infrastructure significantly influences India's ambitions to become a global leader in the digital industry. 

“APIs are the backbone of our digital economy, interconnecting key sectors such as finance, healthcare, e-commerce, and government services,” Shah remarked. Shah claims that during the first half of 2024, the Indian Computer Emergency Response Team (CERT-In) reported a 62% increase in API-targeted attacks. The extent of these incidents goes beyond technical breaches, and they represent substantial economic risks that threaten data integrity, business continuity, and consumer trust in addition to technological breaches.

Aside from compromising sensitive information, these incidents have also undermined business continuity and undermined consumer confidence, in addition to compromising business continuity. APIs will continue to be at the heart of digital transformation, and for that reason, ensuring robust security measures will be critical to mitigating potential threats and protecting organisational integrity. 


Indusface recently published an article on API security that underscores the seriousness of API-related threats for the next 20 years. There has been an increase of 68% in attacks on APIs compared to traditional websites in the report. Furthermore, there has been a 94% increase in Distributed Denial-of-Service (DDoS) attacks on APIs compared with the previous quarter. This represents an astounding 1,600% increase when compared with website-based DDoS attacks. 

Additionally, bot-driven attacks on APIs increased by 39%, emphasizing the need to adopt robust security measures that protect these vital digital assets from threats. As a result of Artificial Intelligence, cloud security is being transformed by enhancing threat detection, automating responses, and providing predictive insights to mitigate cyber risks. 

Several cloud providers, including Google Cloud, Microsoft, and Amazon Web Services, employ artificial intelligence-driven solutions for monitoring security events, detecting anomalies, and preventing cyberattacks.

The solutions include Chronicle, Microsoft Defender for Cloud, and Amazon GuardDuty. Although there are challenges like false positives, adversarial AI attacks, high implementation costs, and concerns about data privacy, they are still important to consider. 

Although there are still some limitations, advances in self-learning AI models, security automation, and quantum computing are expected to raise AI's profile in the cybersecurity space to a higher level. The cloud environment should be safeguarded against evolving threats by using AI-powered security solutions that can be deployed by businesses.
Read more »
WhatsApp
AI Backdoor Data Encryption Pegasus Spyware Technology WhatsApp

Frances Proposes Law Requiring Tech Companies to Provide Encrypted Data


Law demanding companies to provide encrypted data

New proposals in the French Parliament will mandate tech companies to give decrypted messages, email. If businesses don’t comply, heavy fines will be imposed.

France has proposed a law requiring end-to-end encryption messaging apps like WhatsApp and Signal, and encrypted email services like Proton Mail to give law enforcement agencies access to decrypted data on demand. 

The move comes after France’s proposed “Narcotraffic” bill, asking tech companies to hand over encrypted chats of suspected criminals within 72 hours. 

The law has stirred debates in the tech community and civil society groups because it may lead to building of “backdoors” in encrypted devices that can be abused by threat actors and state-sponsored criminals.

Individuals failing to comply will face fines of €1.5m and companies may lose up to 2% of their annual world turnover in case they are not able to hand over encrypted communications to the government.

Criminals will exploit backdoors

Few experts believe it is not possible to bring backdoors into encrypted communications without weakening their security. 

According to Computer Weekly’s report, Matthias Pfau, CEO of Tuta Mail, a German encrypted mail provider, said, “A backdoor for the good guys only is a dangerous illusion. Weakening encryption for law enforcement inevitably creates vulnerabilities that can – and will – be exploited by cyber criminals and hostile foreign actors. This law would not just target criminals, it would destroy security for everyone.”

Researchers stress that the French proposals aren’t technically sound without “fundamentally weakening the security of messaging and email services.” Similar to the “Online Safety Act” in the UK, the proposed French law exposes a serious misunderstanding of the practical achievements with end-to-end encrypted systems. Experts believe “there are no safe backdoors into encrypted services.”

Use of spyware may be allowed

The law will allow using infamous spywares such as NSO Group’s Pegasus or Pragon that will enable officials to remotely surveil devices. “Tuta Mail has warned that if the proposals are passed, it would put France in conflict with European Union laws, and German IT security laws, including the IT Security Act and Germany’s Telecommunications Act (TKG) which require companies to secure their customer’s data,” reports Computer Weekly.

Read more »
Technology
AI Antivirus Internet Password Technology

These Four Basic PC Essentials Will Protect You From Hacking Attacks


There was a time when the internet could be considered safe, if the users were careful. Gone are the days, safe internet seems like a distant dream. It is not a user's fault when the data is leaked, passwords are compromised, and malware makes easy prey. 

Online attacks are a common thing in 2025. The rising AI use has contributed to cyberattacks with faster speed and advanced features, the change is unlikely to slow down. To help readers, this blog outlines the basics of digital safety. 

Antivirus

A good antivirus in your system helps you from malware, ransomware, phishing sites, and other major threats. 

For starters, having Microsoft’s built-in Windows Security antivirus is a must (it is usually active in the default settings, unless you have changed it). Microsoft antivirus is reliable and runs without being nosy in the background.

You can also purchase paid antivirus software, which provides an extra security and additional features, in an all-in-one single interface.

Password manager

A password manager is the spine of login security, whether an independent service, or a part of antivirus software, to protect login credentials across the web. In addition they also lower the chances of your data getting saved on the web.

A simple example: to maintain privacy, keep all the credit card info in your password manager, instead of allowing shopping websites to store sensitive details. 

You'll be comparatively safer in case a threat actor gets unauthorized access to your account and tries to scam you.

Two-factor authentication 

In today's digital world, just a standalone password isn't a safe bet to protect you from attackers. Two-factor authentication (2FA) or multi-factor authentication provides an extra security layer before users can access their account. For instance, if a hacker has your login credentials, trying to access your account, they won't have all the details for signing in. 

A safer option for users (if possible) is to use 2FA via app-generated one-time codes; these are safer than codes sent through SMS, which can be intercepted. 

Passkeys

If passwords and 2FA feel like a headache, you can use your phone or PC as a security option, through a passkey.

Passkeys are easy, fast, and simple; you don't have to remember them; you just store them on your device. Unlike passwords, passkeys are linked to the device you've saved them on, this prevents them from getting stolen or misused by hackers. You're done by just using PIN or biometric authentication to allow a passkey use.

Read more »
Technology
AI Artifical Intelligence CyberCrime Cybersecuriti CyberThreat Data data security Technology

Building Robust AI Systems with Verified Data Inputs

 


Artificial intelligence is inherently dependent on the quality of data that powers it for it to function properly. However, this reliance presents a major challenge to the development of artificial intelligence. There is a recent report that indicates that approximately half of executives do not believe their data infrastructure is adequately prepared to handle the evolving demands of artificial intelligence technologies.

As part of the study, conducted by Dun & Bradstreet, executives of companies actively integrating artificial intelligence into their business were surveyed. As a result of the survey, 54% of these executives expressed concern over the reliability and quality of their data, which was conducted on-site during the AI Summit New York, which occurred in December of 2017. Upon a broader analysis of AI-related concerns, it is evident that data governance and integrity are recurring themes.

Several key issues have been identified, including data security (46%), risks associated with data privacy breaches (43%), the possibility of exposing confidential or proprietary data (42%), as well as the role data plays in reinforcing bias in artificial intelligence models (26%) As organizations continue to integrate AI-driven solutions, the importance of ensuring that data is accurate, secure, and ethically used continues to grow. AI applications must be addressed as soon as possible to foster trust and maximize their effectiveness across industries. In today's world, companies are increasingly using artificial intelligence (AI) to enhance innovation, efficiency, and productivity. 

Therefore, ensuring the integrity and security of their data has become a critical priority for them. Using artificial intelligence to automate data processing streamlines business operations; however, it also presents inherent risks, especially in regards to data accuracy, confidentiality, and regulatory compliance. A stringent data governance framework is a critical component of ensuring the security of sensitive financial information within companies that are developing artificial intelligence. 

Developing robust management practices, conducting regular audits, and enforcing rigorous access control measures are crucial steps in safeguarding sensitive financial information in AI development companies. Businesses must remain focused on complying with regulatory requirements so as to mitigate the potential legal and financial repercussions. During business expansion, organizations may be exposed to significant vulnerabilities if they fail to maintain data integrity and security. 

As long as data protection mechanisms are reinforced and regulatory compliance is maintained, businesses will be able to minimize risks, maintain stakeholder trust, and ensure long-term success of AI-driven initiatives by ensuring compliance with regulatory requirements. As far as a variety of industries are concerned, the impact of a compromised AI system could be devastating. From a financial point of view, inaccuracies or manipulations in AI-driven decision-making, as is the case with algorithmic trading, can result in substantial losses for the company. 

Similarly, in safety-critical applications, including autonomous driving, the integrity of artificial intelligence models is directly related to human lives. When data accuracy is compromised or system reliability is compromised, catastrophic failures can occur, endangering both passengers and pedestrians at the same time. The safety of the AI-driven solutions must be maintained and trusted by ensuring robust security measures and continuous monitoring.

Experts in the field of artificial intelligence recognize that there is an insufficient amount of actionable data available to fully support the transforming landscape of artificial intelligence. Because of this scarcity of reliable data, many AI-driven initiatives have been questioned by many people as a result. As Kunju Kashalikar, Senior Director of Product Management at Pentaho points out, organizations often have difficulty seeing their data, since they do not know who owns it, where it originated from, and how it has changed. 

Lack of transparency severely undermines the confidence that users have in the capabilities of AI systems and their results. To be honest, the challenges associated with the use of unverified or unreliable data go beyond inefficiency in operations. According to Kasalikar, if data governance is lacking, proprietary information or biased information may be fed into artificial intelligence models, potentially resulting in intellectual property violations and data protection violations. Further, the absence of clear data accountability makes it difficult to comply with industry standards and regulatory frameworks when there is no clear accountability for data. 

There are several challenges faced by organizations when it comes to managing structured data. Structured data management strategies ensure seamless integration across various AI-driven projects by cataloguing data at its source in standardized, easily understandable terminology. Establishing well-defined governance and discovery frameworks will enhance the reliability of AI systems. These frameworks will also support regulatory compliance, promoting greater trust in AI applications and transparency. 

Ensuring the integrity of AI models is crucial for maintaining their security, reliability, and compliance. To ensure that these systems remain authenticated and safe from tampering or unauthorized modification, several verification techniques have been developed. Hashing and checksums enable organizations to calculate and compare hash values following the training process, allowing them to detect any discrepancies which could indicate corruption. 

Models are watermarked with unique digital signatures to verify their authenticity and prevent unauthorized modifications. In the field of simulation, simulation behavior analysis assists with identifying anomalies that could signal system integrity breaches by tracking model outputs and decision-making patterns. Using provenance tracking, a comprehensive record of all interactions, updates, and modifications is maintained, enhancing accountability and traceability. Although these verification methods have been developed over the last few decades, they remain challenging because of the rapidly evolving nature of artificial intelligence. 

As modern models are becoming more complex, especially large-scale systems with billions of parameters, integrity assessment has become increasingly challenging. Furthermore, AI's ability to learn and adapt creates a challenge in detecting unauthorized modifications from legitimate updates. Security efforts become even more challenging in decentralized deployments, such as edge computing environments, where verifying model consistency across multiple nodes is a significant issue. This problem requires implementing an advanced monitoring, authentication, and tracking framework that integrates advanced monitoring, authentication, and tracking mechanisms to deal with these challenges. 

When organizations are adopting AI at an increasingly rapid rate, they must prioritize model integrity and be equally committed to ensuring that AI deployment is ethical and secure. Effective data management is crucial for maintaining accuracy and compliance in a world where data is becoming increasingly important. 

AI plays a crucial role in maintaining entity records that are as up-to-date as possible with the use of extracting, verifying, and centralized information, thereby lowering the risk of inaccurate or outdated information being generated as a result of overuse of artificial intelligence. The advantages that can be gained by implementing an artificial intelligence-driven data management process are numerous, including increased accuracy and reduced costs through continuous data enrichment, the ability to automate data extraction and organization, and the ability to maintain regulatory compliance with the use of real-time, accurate data that is easily accessible. 

In a world where artificial intelligence is advancing at a faster rate than ever before, its ability to maintain data integrity will become of even greater importance to organizations. Organizations that leverage AI-driven solutions can make their compliance efforts stronger, optimize resources, and handle regulatory changes with confidence.
Read more »
Technology
AI ChatGPT Email Gen AI Phishing scam Technology

Dangers of AI Phishing Scam and How to Spot Them

Dangers of AI Phishing Scam and How to Spot Them

Supercharged AI phishing campaigns are extremely challenging to notice. Attackers use AI phishing scams with better grammar, structure, and spelling, to appear legit and trick the user. In this blog, we learn how to spot AI scams and avoid becoming victims. 

Checking email language

Earlier, it was easier to spot irregularities in an e-mail, all it took was one glance. As Gen AI models use flawless grammar,  it is almost impossible to find errors in your mail copy, 

Analyze the Language of the Email Carefully

In the past, one quick skim was enough to recognize something is off with an email, typically the incorrect grammar and laughable typos being the giveaways. Since scammers now use generative AI language models, most phishing messages have flawless grammar.

But there is hope. It is easier to identify Gen AI text, and keep an eye out for an unnatural flow of sentences, if everything seems to be too perfect, chances are it’s AI.

Red flags are everywhere, even mails

Though AI has made it difficult for users to find phishing scams, they show some classic behavior. The same tips apply to detect phishing emails.

In most cases, scammers mimic businesses and wish you won’t notice. For instance, instead of an official “info@members.hotstar.com” email ID, you may notice something like “info@members.hotstar-support.com.” You may also get unrequested links or attachments, which are a huge tell. URLs (mismatched) having subtle typos or extra words/letters are comparatively difficult to notice but a huge ti-off that you are on a malicious website or interacting with a fake business.

Beware of Deepfake video scams

The biggest issue these days is combating deepfakes, which are also difficult to spot. 

The attacker makes realistic video clips using photo and video prompts and uses video calling like Zoom or FaceTime to trap potential victims (especially elders and senior citizens) to give away sensitive data. 

One may think that only old people may fall for deepfakes, but due to their sophistication, even experts fall prey to them. One famous incident happened in Hong Kong, where scammers deepfake a company CFO and looted HK$200 million (roughly $25 million).

AI is advancing, and becoming stronger every day. It is a double-edged sword, both a blessing and a curse. One should tread the ethical lines carefully and hope they don’t fall to the dark side of AI.

Read more »
trending news
AI AI news Quantum Technology trending news

AI and Quantum Computing Revive Search Efforts for Missing Malaysia Airlines Flight MH370

 

A decade after the mysterious disappearance of Malaysia Airlines Flight MH370, advancements in technology are breathing new life into the search for answers. Despite extensive global investigations, the aircraft’s exact whereabouts remain unknown. However, emerging tools like artificial intelligence (AI), quantum computing, and cutting-edge underwater exploration are revolutionizing the way data is analyzed and search efforts are conducted, offering renewed hope for a breakthrough. 

AI is now at the forefront of processing and interpreting vast datasets, including satellite signals, ocean currents, and previous search findings. By identifying subtle patterns that might have gone unnoticed before, AI-driven algorithms are refining estimates of the aircraft’s possible location. 

At the same time, quantum computing is dramatically accelerating complex calculations that would take traditional systems years to complete. Researchers, including those from IBM’s Quantum Research Team, are using simulations to model how ocean currents may have dispersed MH370’s debris, leading to more accurate predictions of its final location. Underwater exploration is also taking a major leap forward with AI-equipped autonomous drones. 

These deep-sea vehicles, fitted with advanced sensors, can scan the ocean floor in unprecedented detail and access depths that were once unreachable. A new fleet of these drones is set to be deployed in the southern Indian Ocean, targeting previously difficult-to-explore regions. Meanwhile, improvements in satellite imaging are allowing analysts to reassess older data with enhanced clarity. 

High-resolution sensors and advanced real-time processing are helping experts identify potential debris that may have been missed in earlier searches. Private space firms are collaborating with global investigative teams to leverage these advancements and refine MH370’s last known trajectory. 

The renewed search efforts are the result of international cooperation, bringing together experts from aviation, oceanography, and data science to create a more comprehensive investigative approach. Aviation safety specialist Grant Quixley underscored the importance of these innovations, stating, “New technologies could finally help solve the mystery of MH370’s disappearance.” 

This fusion of expertise and cutting-edge science is making the investigation more thorough and data-driven than ever before. Beyond the ongoing search, these technological breakthroughs have far-reaching implications for the aviation industry.

AI and quantum computing are expected to transform areas such as predictive aircraft maintenance, air traffic management, and emergency response planning. Insights gained from the MH370 case may contribute to enhanced safety protocols, potentially preventing similar incidents in the future.
Read more »
Technology
AI Fake Sites Internet Microsoft Scareware Tech Support Scam Technology

New Microsoft "Scareware Blocker" Prevents Users from Tech Support Scams

New Microsoft "Scareware Blocker" Prevents Users from Tech Support Scams

Scareware is a malware type that uses fear tactics to trap users and trick them into installing malware unknowingly or disclosing private information before they realize they are being scammed. Generally, the scareware attacks are disguised as full-screen alerts that spoof antivirus warnings. 

Scareware aka Tech Support Scam

One infamous example is the “tech support scam,” where a fake warning tells the user their device is infected with malware and they need to reach out to contact support number (fake) or install fake anti-malware software to restore the system and clean up things. Over the years, users have noticed a few Microsoft IT support fraud pop-ups.

Realizing the threat, Microsoft is combating the issue with its new Scareware Blockers feature in Edge, which was first rolled out in November last year at the Ignite conference.

Defender SmartScreen, a feature that saves Edge users from scams, starts after a malicious site is caught and added to its index of abusive web pages to protect users globally.

AI-powered Edge scareware blocker

The new AI-powered Edge scareware blocker by Microsoft “offers extra protection by detecting signs of scareware scams in real-time using a local machine learning model,” says Bleeping Computer.

Talking about Scareware, Microsoft says, “The blocker adds a new, first line of defense to help protect the users exposed to a new scam if it attempts to open a full-screen page.” “Scareware blocker uses a machine learning model that runs on the local computer,” it further adds.

Once the blocker catches a scam page, it informs users and allows them to continue using the webpage if they trust the website. 

Activating Scareware Blocker

Before activating the blocker, the user needs to install the Microsoft Edge beta version. The version installs along with the main release variant of Edge, easing the user’s headache of co-mingling the versions. If the user is on a managed system, they should make sure previews are enabled admin. 

"After making sure you have the latest updates, you should see the scareware blocker preview listed under "Privacy Search and Services,'" Microsoft says. Talking about reporting the scam site from users’ end for the blocker to work, Microsoft says it helps them “make the feature more reliable to catch the real scams. 

Beyond just blocking individual scam outbreaks” their Digital Crimes Unit “goes even further to target the cybercrime supply chain directly.”

Read more »
Technology
AI AI cybersecurity tools AI-powered security cybersecurity for businesses small business cybersecurity Technology

AI Revolutionizes Cybersecurity: Businesses Leverage AI to Combat Advanced Cyberattacks

 

Staying ahead of cybercriminals is a constant challenge, especially for smaller businesses. To tackle this issue, many companies are now adopting artificial intelligence (AI) for cybersecurity, even without in-house experts. Recent data from financial news site Pymnts reveals that the adoption of AI-powered cybersecurity systems by chief operating officers (COOs) has tripled since early 2024. In May, 17% of COOs surveyed reported using AI for cybersecurity. By the end of 2024, this figure had surged to 55%.

This rise underscores how AI is not only enabling malicious actors to launch sophisticated attacks but also helping organizations fortify their defenses. While the Pymnts survey focused on larger firms, it’s evident that AI can significantly enhance small businesses' ability to fend off cyber threats, much like it aids in scaling operations.

According to the survey, COOs are increasingly turning to AI-powered tools because “companies face the threat of cyberattacks that are growing more sophisticated.” This aligns with broader findings that generative AI tools have made hacking simpler. Throughout 2024, major tech companies such as Google and Microsoft introduced AI-driven cybersecurity solutions to combat this growing risk. At the Munich Security Conference in February, Google CEO Sundar Pichai acknowledged concerns about AI amplifying cybersecurity issues. While he agreed that such fears are justified, Pichai maintained that “AI tools can yield positive cybersecurity benefits.”

The Pymnts data validates Pichai's assertion, as more COOs consider AI an “essential tool for protecting organizations from security breaches and fraud.” Beyond addressing immediate threats, these tools are driving long-term security innovations. Additionally, companies implementing AI cybersecurity solutions reported saving an average of 5.9% in annual revenue, with some achieving savings as high as 7.7%. Respondents predict AI will become “fully embedded” in their organizations within seven years.

AI is transforming how IT departments address cyber threats. The technology automates initial responses during cyberattacks by analyzing large datasets, enabling faster resolutions. AI can also shift cybersecurity strategies from reactive to proactive by identifying threats like phishing attempts before they cause harm.

The urgency for smarter cybersecurity has grown as AI democratizes the ability to launch cyberattacks— an activity previously requiring advanced coding skills. CJ Moses, Amazon’s Chief Information Security Officer, noted that hacking attempts targeting Amazon had increased more than sevenfold in just six months, primarily driven by AI tools.

Although the Pymnts data primarily reflects trends in larger firms, the accessibility of AI means smaller businesses can now deploy advanced cybersecurity solutions without needing specialized technical expertise. This democratization empowers businesses of all sizes to safeguard their data and operations in an increasingly digital world.
Read more »
Technology
AGI AI Artificial Intelligence CyberCrime Cybersecurity Cyberthreats Human Level Intelligence OpenAI Technology

OpenAI's O3 Achieves Breakthrough in Artificial General Intelligence

 



 
In recent times, the rapid development of artificial intelligence took a significant turn when OpenAI introduced its O3 model, a system demonstrating human-level performance on tests designed to measure “general intelligence.” This achievement has reignited discussions on artificial intelligence, with a focus on understanding what makes O3 unique and how it could shape the future of AI.

Performance on the ARC-AGI Test 
 
OpenAI's O3 model showcased its exceptional capabilities by matching the average human score on the ARC-AGI test. This test evaluates an AI system's ability to solve abstract grid problems with minimal examples, measuring how effectively it can generalize information and adapt to new scenarios. Key highlights include:
  • Test Outcomes: O3 not only matched human performance but set a new benchmark in Artificial General Intelligence (AGI) development.
  • Adaptability: The model demonstrated the ability to draw generalized rules from limited examples, a critical capability for AGI progress.
Breakthrough in Science Problem-Solving 
 
Beyond the ARC-AGI test, the O3 model excelled in solving complex scientific questions. It achieved an impressive score of 87.7% compared to the 70% score of PhD-level experts, underscoring its advanced reasoning abilities. 
 
While OpenAI has not disclosed the specifics of O3’s development, its performance suggests the use of simple yet effective heuristics similar to AlphaGo’s training process. By evaluating patterns and applying generalized thought processes, O3 efficiently solves complex problems, redefining AI capabilities. An example rule demonstrates its approach.

“Any shape containing a salient line will be moved to the end of that line and will cover all the overlapping shapes in its new position.”
 
O3 and O3 Mini models represent a significant leap in AI, combining unmatched performance with general learning capabilities. However, their potential brings challenges related to cost, security, and ethical adoption that must be addressed for responsible use. As technology advances into this new frontier, the focus must remain on harnessing AI advancements to facilitate progress and drive positive change. With O3, OpenAI has ushered in a new era of opportunity, redefining the boundaries of what is possible in artificial intelligence.
Read more »
Technology
AI ChatGPT CyberCrime Cyberhackers Cybersecurity CyberThreat Technology

Generative AI Fuels Financial Fraud

 


According to the FBI, criminals are increasingly using generative artificial intelligence (AI) to make their fraudulent schemes more convincing. This technology enables fraudsters to produce large amounts of realistic content with minimal time and effort, increasing the scale and sophistication of their operations.

Generative AI systems work by synthesizing new content based on patterns learned from existing data. While creating or distributing synthetic content is not inherently illegal, such tools can be misused for activities like fraud, extortion, and misinformation. The accessibility of generative AI raises concerns about its potential for exploitation.

AI offers significant benefits across industries, including enhanced operational efficiency, regulatory compliance, and advanced analytics. In the financial sector, it has been instrumental in improving product customization and streamlining processes. However, alongside these benefits, vulnerabilities have emerged, including third-party dependencies, market correlations, cyber risks, and concerns about data quality and governance.

The misuse of generative AI poses additional risks to financial markets, such as facilitating financial fraud and spreading false information. Misaligned or poorly calibrated AI models may result in unintended consequences, potentially impacting financial stability. Long-term implications, including shifts in market structures, macroeconomic conditions, and energy consumption, further underscore the importance of responsible AI deployment.

Fraudsters have increasingly turned to generative AI to enhance their schemes, using AI-generated text and media to craft convincing narratives. These include social engineering tactics, spear-phishing, romance scams, and investment frauds. Additionally, AI can generate large volumes of fake social media profiles or deepfake videos, which are used to manipulate victims into divulging sensitive information or transferring funds. Criminals have even employed AI-generated audio to mimic voices, misleading individuals into believing they are interacting with trusted contacts.

In one notable incident reported by the FBI, a North Korean cybercriminal used a deepfake video to secure employment with an AI-focused company, exploiting the position to access sensitive information. Similarly, Russian threat actors have been linked to fake videos aimed at influencing elections. These cases highlight the broad potential for misuse of generative AI across various domains.

To address these challenges, the FBI advises individuals to take several precautions. These include establishing secret codes with trusted contacts to verify identities, minimizing the sharing of personal images or voice data online, and scrutinizing suspicious content. The agency also cautions against transferring funds, purchasing gift cards, or sending cryptocurrency to unknown parties, as these are common tactics employed in scams.

Generative AI tools have been used to improve the quality of phishing messages by reducing grammatical errors and refining language, making scams more convincing. Fraudulent websites have also employed AI-powered chatbots to lure victims into clicking harmful links. To reduce exposure to such threats, individuals are advised to avoid sharing sensitive personal information online or over the phone with unverified sources.

By remaining vigilant and adopting these protective measures, individuals can mitigate their risk of falling victim to fraud schemes enabled by emerging AI technologies.

Read more »
Technology
AI cyberattacks trending news cyberspace concerns News space cyber attacks Technology

Orbit Under Siege: The Cybersecurity Challenges of Space Missions


The integration of emerging technologies is reshaping industries worldwide, and the space sector is no exception. Artificial intelligence (AI), now a core component in many industries, has significantly transformed space missions. However, this progress also introduces new cybersecurity risks. 

In recent years, spacecraft, satellites, and space-based systems have increasingly become targets for malicious actors, including nation-sponsored hacker groups, raising serious concerns about mission safety and national security. According to a 2024 Deloitte report, the number of active satellites in orbit is approaching 10,000 and is expected to double every 18 months. This rapid growth increases the risk of cyberattacks on satellites, ground stations, and communication links.   

Potential Risks and Consequences  


These vulnerabilities could have far-reaching consequences, from disrupting critical infrastructure and compromising national security to negatively impacting the economy and environment. William Russell, Director of Contracting and National Security Acquisitions at the U.S. Government Accountability Office, highlighted the challenges during an interview with CNBC:   > "Space systems face unique challenges where physical access for repairs is impossible post-launch. A cyber breach could lead to mission failures, data loss, or even hostile control of space vehicles."  

The escalating space race between global powers such as the U.S. and China further amplifies cybersecurity concerns. Notable incidents include a cyberattack on Japan’s space agency JAXA and breaches targeting SpaceX’s Starlink satellites.   

Collaborative Efforts to Enhance Security 


In response to these threats, leading technology companies are collaborating with governments to strengthen space cybersecurity. For instance:   

  • Microsoft partners with the U.S. Space Force, providing Azure cloud infrastructure and cybersecurity tools. 
  • Nvidia enhances satellite data analysis with advanced GPUs. 
  • Google and Amazon Web Services (AWS) offer secure cloud solutions to support space missions. 

Despite these efforts, overreliance on automated systems presents additional risks. Wayne Lonstein, co-founder and CEO at VFT Solutions and co-author of Cyber-Human Systems, Space Technologies, and Threats warned: > "High dependency on automated systems could lead to catastrophic failures if those systems malfunction." 

A Secure-By-Design Approach 


To mitigate these risks, the Deloitte report emphasizes the importance of adopting a "secure-by-design" approach, embedding cybersecurity measures throughout the design and development phases of space systems. Key recommendations include:   

1. Enhancing real-time threat detection and response capabilities. 
2. Promoting collaboration among industry stakeholders to share critical information. 
3. Establishing robust cybersecurity protocols across the supply chain.   

By taking a proactive approach, the space industry can better safeguard its operations and minimize the potential impact of cyber incidents on vital systems, both in orbit and on Earth.
Read more »
Technology
AI Europe GDPR Meta Ray-Ban Glasses Technology

Meta Introduces AI Features For Ray-Ban Glasses in Europe

 

Meta has officially introduced certain AI functions for its Ray-Ban Meta augmented reality (AR) glasses in France, Italy, and Spain, marking a significant step in the company's spread of its innovative wearable technology across Europe. 

Starting earlier this week, customers in these nations were able to interact with Meta's AI assistant solely through their voice, allowing them to ask general enquiries and receive responses through the glasses. 

As part of Meta's larger initiative to make its AI assistant more widely available, this latest deployment covers French, Italian, and Spanish in addition to English. The announcement was made nearly a year after the Ray-Ban Meta spectacles were first released in September 2023.

In a blog post outlining the update, Meta stated, "We are thrilled to introduce Meta AI and its cutting-edge features to regions of the EU, and we look forward to expanding to more European countries soon.” However, not all of the features accessible in other regions will be included in the European rollout. 

While customers in the United States, Canada, and Australia benefit from multimodal AI capabilities on their Ray-Ban Meta glasses, such as the ability to gain information about objects in view of the glasses' camera, these functions will not be included in the European update at present.

For example, users in the United States can ask their glasses to identify landmarks in their surroundings, such as "Tell me more about this landmark," but these functionalities are not available in Europe due to ongoing regulatory issues. 

Meta has stated its commitment to dealing with Europe's complicated legal environment, specifically the EU's AI Act and the General Data Protection Regulation (GDPR). The company indicated that it is aiming to offer multimodal capabilities to more countries in the future, but there is no set date. 

While the rollout in France, Italy, and Spain marks a significant milestone, Meta's journey in the European market is far from done. As the firm navigates the regulatory landscape and expands its AI solutions, users in Europe can expect more updates and new features for their Ray-Ban Meta glasses in the coming months. 

As Meta continues to grow its devices and expand its AI capabilities, all eyes will be on how the firm adjusts to Europe's legal system and how this will impact the future of AR technology worldwide.
Read more »
Technology
AI ChatGPT JarkaStealer Python Libraries Technology

PyPI Attack: Hackers Use AI Models to Deliver JarkaStealer via Python Libraries

PyPI Attack: Hackers Use AI Models to Deliver JarkaStealer via Python Libraries

Cybersecurity researchers have discovered two malicious packages uploaded to the Python Package Index (PyPI) repository that impersonated popular artificial intelligence (AI) models like OpenAI ChatGPT and Anthropic Claude to deliver an information stealer called JarkaStealer. 

The supply chain campaign shows the advancement of cyber threats attacking developers and the urgent need for caution in open-source activities. 

Experts have found two malicious packages uploaded to the Python Index (PyPI) repository pretending to be popular artificial intelligence (AI) models like OpenAI Chatgpt and Anthropic Claude to distribute an information stealer known as JarkaStealer. 

About attack vector

Called gptplus and claudeai-eng, the packages were uploaded by a user called "Xeroline" last year, resulting in 1,748 and 1,826 downloads. The two libraries can't be downloaded from PyPI. According to Kaspersky, the malicious packages were uploaded to the repository by one author and differed only in name and description. 

Experts believe the package offered a way to access GPT-4 Turbo and Claude AI API but contained malicious code that, upon installation, started the installation of malware. 

Particularly, the "__init__.py" file in these packages included Base64-encoded data that included code to download a Java archive file ("JavaUpdater.jar") from a GitHub repository, also downloading the Java Runtime Environment (JRE) from a Dropbox URL in case Java isn't already deployed on the host, before running the JAR file.

The impact

Based on information stealer JarkaStealer, the JAR file can steal a variety of sensitive data like web browser data, system data, session tokens, and screenshots from a wide range of applications like Steam, Telegram, and Discord. 

In the last step, the stolen data is archived, sent to the attacker's server, and then removed from the target's machine.JarkaStealer is known to offer under a malware-as-a-service (MaaS) model through a Telegram channel for a cost between $20 and $50, however, the source code has been leaked on GitHub. 

ClickPy stats suggest packages were downloaded over 3,500 times, primarily by users in China, the U.S., India, Russia, Germany, and France. The attack was part of an all-year supply chain attack campaign. 

How JarkaStealer steals

  • Steals web browser data- cookies, browsing history, and saved passwords. 
  • Compromises system data and setals OS details and user login details.
  • Steals session tokens from apps like Discord, Telegram, and Steam.
  • Captures real-time desktop activity through screenshots.

The stolen information is compressed and transmitted to a remote server controlled by the hacker, where it is removed from the target’s device.

Read more »
Security
AI Business Cyber Security India Mallox RansomHub Ransomware Security

India Faces Rising Ransomware Threat Amid Digital Growth

 


India, with rapid digital growth and reliance on technology, is in the hit list of cybercriminals. As one of the world's biggest economies, the country poses a distinct digital threat that cyber-crooks might exploit due to security holes in businesses, institutions, and personal users.

India recently saw a 51 percent surge in ransomware attacks in 2023 according to the Indian Computer Emergency Response Team, or CERT-In. Small and medium-sized businesses have been an especially vulnerable target, with more than 300 small banks being forced to close briefly in July after falling prey to a ransomware attack. For millions of Indians using digital banking for daily purchases and payments, such glitches underscore the need for further improvement in cybersecurity measures. A report from Kaspersky shows that 53% of SMBs operating in India have experienced the incidents of ransomware up till now this year, with more than 559 million cases being reported over just two months, starting from April and May this year.

Cyber Thugs are not only locking computers in businesses but extending attacks to individuals, even if it is personal electronic gadgets, stealing sensitive and highly confidential information. A well-organised group of attacks in the wave includes Mallox, RansomHub, LockBit, Kill Security, and ARCrypter. Such entities take advantage of Indian infrastructure weaknesses and focus on ransomware-as-a-service platforms that support Microsoft SQL databases. Recovery costs for affected organisations usually exceeded ₹11 crore and averaged ₹40 crore per incident in India, according to estimates for 2023. The financial sector, in particular the National Payment Corporation of India (NPCI), has been attacked very dearly, and it is crystal clear that there is an imperative need to strengthen the digital financial framework of India.

Cyber Defence Through AI

Indian organisations are now employing AI to fortify their digital defence. AI-based tools process enormous data in real time and report anomalies much more speedily than any manual system. From financial to healthcare sectors, high-security risks make AI become more integral in cybersecurity strategies in the sector. Lenovo's recent AI-enabled security initiatives exemplify how the technology has become mainstream with 71% of retailers in India adopting or planning to adopt AI-powered security.

As India pushes forward on its digital agenda, the threat of ransomware cannot be taken lightly. It will require intimate collaboration between government and private entities, investment in education in AI and cybersecurity, as well as creating safer environments for digital existence. For this, the government Cyber Commando initiative promises forward movement, but collective endeavours will be crucial to safeguarding India's burgeoning digital economy.


Read more »
Ransomware
AI Cyber Crime Cyberattacks CyberCrime Cybersecurity Cyberthreats EMBARGO ESET MDeployer Ransomware

Embargo Ransomware Uses Custom Rust-Based Tools for Advanced Defense Evasion

 


Researchers at ESET claim that Embargo ransomware is using custom Rust-based tools to overcome cybersecurity defences built by vendors such as Microsoft and IBM. An instance of this new toolkit was observed during a ransomware incident targeting US companies in July 2024 and was composed of a loader and an EDR killer, namely MDeployer and MS4Killer, respectively, and was observed during a ransomware attack targeting US companies. 

Unlike other viruses, MS4Killer was customized for each victim's environment, excluding only selected security solutions. This makes it particularly dangerous to those who are unaware of its existence. It appears that the tools were created together and that some of the functionality in the tools overlaps. This report has revealed that the ransomware payloads of MDeployer, MS4Killer and Embargo were all made in Rust, which indicates that this language is the programming language that the group favours. 

During the summer of 2024, the first identification of the Embargo gang took place. This company appears to have a good amount of resources, being able to develop custom tools as well as set up its own infrastructure to help communicate with those affected. A double extortion method is used by the group - as well as encrypting the victims' data and extorting data from them, they threaten to publish those data on a leak site, demonstrating their intention to leak their data. 

Moreover, ESET considers Embargo to be a provider of ransomware-as-a-service (RaaS) that provides threats to users. The group is also able to adjust quickly during attacks. “The main purpose of the Embargo toolkit is to secure successful deployment of the ransomware payload by disabling the security solution in the victim’s infrastructure. Embargo puts a lot of effort into that, replicating the same functionality at different stages of the attack,” the researchers wrote. 

“We have also observed the attackers’ ability to adjust their tools on the fly, during an active intrusion, for a particular security solution,” they added. MDeployer is the main malicious loader Embargo attempts to deploy on victims’ machines in the compromised network. Its purpose is to facilitate ransomware execution and file encryption. It executes two payloads, MS4Killer and Embargo ransomware, and decrypts two encrypted files a.cache and b.cache that were dropped by an unknown previous stage. 

When the ransomware finishes encrypting the system, MDeployer terminates the MS4Killer process, deletes the decrypted payloads and a driver file dropped by MS4Killer, and finally reboots the system. Another feature of MDeployer is when it is executed with admin privileges as a DLL file, it attempts to reboot the victim’s system into Safe Mode to disable selected security solutions. As most cybersecurity defenses are not in effect in Safe Mode, it helps threat actors avoid detection. 

MS4Killer is a defense evasion tool that terminates security product processes using a technique known as bring your own vulnerable driver (BYOVD). MS4Killer terminates security products from the kernel by installing and abusing a vulnerable driver that is stored in a global variable. The process identifier of the process to terminate is passed to s4killer as a program argument. 

Embargo has extended the tool’s functionality with features such as running in an endless loop to constantly scan for running processes and hardcoding the list of process names to kill in the binary. After disabling the security tooling, Embargo affiliates can run the ransomware payload without worrying whether their payload gets detected. During attacks, the group can also adjust to the environment quickly, which is another advantage.

Basically, what Embargo toolkit does is that it offers a method of ensuring the successful deployment of the ransomware payload and prevents the security solution from being enabled in the victim's infrastructure on the day of deployment. This is something that Embargo invests a lot of time and effort into, replicating the same functionality at different stages of the attack process," wrote the researchers. They added that the attackers also showed a capability to modify their tools on the fly, during an active intrusion, by adjusting the settings on different security solutions on the fly. 

As part of Embargo's campaign against victims in the compromised network, MDeployer is one of the main malicious loaders that it attempts to deploy on victims' machines. With the use of this tool, ransomware can be executed and files can be encrypted easily. During the execution process, two payloads are executed, MS4Killer and Embargo ransomware, which decrypt two encrypted files a.cache and b.cache that have been left over from an unknown earlier stage onto the system.

After its encryption process, the MDeployer program systematically terminates the MS4Killer process, erases any decrypted payloads, and removes a driver previously introduced by MS4Killer. Upon completing these actions, the MDeployer initiates a system reboot. This process helps ensure that no remnants of the decryption or defence-evasion components persist on the system, potentially aiding threat actors in maintaining operational security. In scenarios where MDeployer is executed as a DLL file with administrative privileges, it has an additional capability: rebooting the compromised system into Safe Mode. 

This mode restricts numerous core functionalities, which is often leveraged by threat actors to minimize the effectiveness of cybersecurity defences and enhance stealth. Since most security tools do not operate in Safe Mode, this functionality enables attackers to evade detection more effectively and hinder any active defences, making detection and response significantly more challenging. The MS4Killer utility functions as a defense-evasion mechanism that specifically targets security product processes for termination. This is achieved using a technique referred to as "bring your own vulnerable driver" (BYOVD), wherein threat actors exploit a known vulnerable driver. 

By installing and leveraging this driver, which is maintained within a global variable, MS4Killer is able to terminate security processes from the kernel level, bypassing higher-level protections. The identifier for the targeted process is supplied as an argument to the MS4Killer program. To further enhance MS4Killer’s effectiveness, Embargo has incorporated additional capabilities, such as enabling the tool to run continuously in a loop. This looping function allows it to monitor for active processes that match a predefined list, which is hardcoded within the binary, and terminate them as they appear. 

By persistently disabling security tools, Embargo affiliates can then deploy ransomware payloads with minimal risk of detection or interference, creating an environment highly conducive to successful exploitation.
Read more »
Subscribe to: Posts (Atom)