Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Security. Show all posts
regulatory policies
AI Risk Management Cyber Security MSP cybersecurity organizations regulatory policies

AI-Driven Risk Management Is Becoming a Key Growth Strategy for MSPs

 



Expanding cybersecurity services as a Managed Service Provider (MSP) or Managed Security Service Provider (MSSP) requires more than strong technical capabilities. Providers also need a sustainable business approach that can deliver clear and measurable value to clients while supporting growth at scale.

One approach gaining attention across the cybersecurity industry is risk-based security management. When implemented effectively, this model can strengthen trust with customers, create opportunities to offer additional services, and establish stable recurring revenue streams. However, maintaining such a strategy consistently requires structured workflows and the right supporting technologies.

To help providers adopt this approach, a new resource titled “The MSP Growth Guide: How MSPs Use AI-Powered Risk Management to Scale Their Cybersecurity Business” outlines how organizations can transition toward scalable cybersecurity services centered on risk management. The guide provides insights into the operational difficulties many MSPs encounter, offers recommendations from industry experts, and explains how AI-driven risk management platforms can help build a more scalable and profitable service model.


Why Risk-Focused Security Enables Service Expansion

Many MSPs already deliver essential cybersecurity capabilities such as endpoint protection, regulatory compliance assistance, and other defensive tools. While these services remain critical, they are often delivered as separate engagements rather than as part of a unified strategy. As a result, the long-term strategic value of these services may remain limited, and opportunities to generate consistent recurring revenue may be reduced.

Adopting a risk-centered cybersecurity framework can shift this dynamic. Instead of addressing isolated technical issues, providers evaluate the complete threat environment facing a client organization. Security risks are then prioritized according to their potential impact on business operations.

This broader perspective allows MSPs to move away from reactive fixes and instead deliver continuous, proactive security management.

Organizations that implement this risk-first model can gain several advantages:

• Security teams can detect and address threats before they escalate into damaging incidents.

• Defensive measures can be continuously updated as the cyber threat landscape evolves.

• Critical assets, daily operations, and organizational reputation can be protected even when compliance regulations do not explicitly require certain safeguards.

Another major benefit is alignment with modern cybersecurity frameworks. Many current standards require companies to conduct formal and ongoing risk evaluations. By integrating risk management into their core service offerings, MSPs can position themselves to pursue higher-value contracts and offer additional services driven by regulatory compliance requirements.


Common Obstacles That Limit Risk Management Services

Although risk-focused security delivers substantial value, MSPs often encounter operational barriers that make these services difficult to scale or demonstrate clearly to clients.

Several recurring challenges affect service delivery and growth:

Manual assessment processes

Traditional risk evaluations often rely heavily on manual work. This approach can consume a vast majority of time, introduce inconsistencies, and make it difficult to expand services efficiently.

Lack of actionable remediation plans

Risk reports sometimes underline security weaknesses but fail to outline clear steps for resolving them. Without defined guidance, clients may struggle to understand how to address the issues that have been identified.

Complex regulatory alignment

Organizations frequently need to comply with multiple cybersecurity standards and regulatory frameworks. Managing these requirements manually can create inefficiencies and inconsistencies.

Limited business context in security reports

Many security assessments are written in highly technical language. As a result, business leaders and non-technical stakeholders may find it difficult to interpret the results or understand the real impact on their organization.

Shortage of specialized cybersecurity professionals

Skilled risk management experts remain in high demand across the industry, making it difficult for service providers to recruit and retain qualified personnel.

Third-party risk visibility gaps

Many cybersecurity platforms focus only on internal infrastructure and overlook risks introduced by external vendors and service providers.

These challenges can make it difficult for MSPs to transform risk management into a scalable and profitable cybersecurity offering.


How AI-Powered Platforms Help Address These Barriers

To overcome these operational difficulties, many providers are turning to artificial intelligence-driven risk management tools.

AI-based platforms can automate large portions of the risk management process. Tasks that previously required extensive manual effort, such as risk assessment, prioritization, and reporting, can be completed more quickly and consistently.

These systems are designed to streamline the entire risk management lifecycle while incorporating advanced security expertise into service delivery.


What Modern Risk Management Platforms Should Deliver

A well-designed AI-enabled risk management solution should do more than simply detect potential threats. It should also accelerate service delivery and support business growth for service providers.

Organizations adopting these platforms can expect several operational benefits:

• Faster onboarding and service deployment through automated and easy-to-use risk assessment tools

• More efficient compliance management supported by built-in mappings to cybersecurity frameworks and continuous monitoring capabilities

• Clearer reporting that presents cybersecurity risks in language business leaders can understand

• Demonstrable return on investment by reducing manual workloads and enabling more efficient service delivery

• Additional revenue opportunities by identifying new cybersecurity services clients may require based on their risk profile


Key Capabilities to Evaluate When Selecting a Platform

Selecting the right technology platform is critical for service providers that want to scale cybersecurity operations effectively.

Several capabilities are considered essential in modern risk management tools:

Automated risk assessment systems

Automation allows providers to generate assessment results within days rather than months, while minimizing human error and ensuring consistent outcomes.


Dynamic risk registers and visual risk mapping

Visualization tools such as heatmaps help security teams quickly identify which risks pose the greatest threat and should be addressed first.


Action-oriented remediation planning

Effective platforms convert risk findings into structured and prioritized tasks aligned with both compliance obligations and business objectives.


Customizable risk tolerance frameworks

Organizations can adapt risk scoring models to match each client’s specific operational priorities and appetite for risk.

The MSP Growth Guide provides additional details on the features providers should consider when evaluating potential solutions.


Building Long-Term Strategic Value with AI-Driven Risk Management

For MSPs and MSSPs seeking to expand their cybersecurity practices, AI-powered risk management offers a way to deliver consistent value while improving operational efficiency.

By automating risk assessments, prioritizing security issues based on business impact, and standardizing reporting processes, these platforms enable providers to deliver reliable cybersecurity services to a growing client base.

The guide “The MSP Growth Guide: How MSPs Use AI-Powered Risk Management to Scale Their Cybersecurity Business” explains how service providers can integrate AI-driven risk management into their offerings to support long-term growth.

Organizations interested in strengthening customer relationships, expanding cybersecurity services, and building a competitive advantage may benefit from adopting risk-focused security strategies supported by AI-enabled platforms.


Read more »
Malware Attack
AI Risks APT36 APT36 Cyber Espionage APT36 hackers Cloud Security cyber espionage Cyber Espionage Campaign Cyber Security Google Sheets API abuse Malware Attack

APT36 Uses AI-Generated “Vibeware” Malware and Google Sheets to Target Indian Government Networks

 

Researchers at Bitdefender have uncovered a new cyber campaign linked to the Pakistan-aligned threat group APT36, also known as Transparent Tribe. Unlike earlier operations that relied on carefully developed tools, this campaign focuses on mass-produced AI-generated malware. Instead of sophisticated code, the attackers are pushing large volumes of disposable malicious programs, suggesting a shift from precision attacks to broad, high-volume activity powered by artificial intelligence. Bitdefender describes the malware as “vibeware,” referring to cheap, short-lived tools generated rapidly with AI assistance. 

The strategy prioritizes quantity over accuracy, with attackers constantly releasing new variants to increase the chances that at least some will bypass security systems. Rather than targeting specific weaknesses, the campaign overwhelms defenses through continuous waves of new samples. To help evade detection, many of the programs are written in lesser-known programming languages such as Nim, Zig, and Crystal. Because most security tools are optimized to analyze malware written in more common languages, these alternatives can make detection more difficult. 

Despite the rapid development pace, researchers found that several tools were poorly built. In one case, a browser data-stealing script lacked the server address needed to send stolen information, leaving the malware effectively useless. Bitdefender’s analysis also revealed signs of deliberate misdirection. Some malicious files contained the common Indian name “Kumar” embedded within file paths, which researchers believe may have been placed to mislead investigators toward a domestic source. In addition, a Discord server named “Jinwoo’s Server,” referencing a popular anime character, was used as part of the infrastructure, likely to blend malicious activity into normal online environments. 

Although some tools appear sloppy, others demonstrate more advanced capabilities. One component known as LuminousCookies attempts to bypass App-Bound Encryption, the protection used by Google Chrome and Microsoft Edge to secure stored credentials. Instead of breaking the encryption externally, the malware injects itself into the browser’s memory and impersonates legitimate processes to access protected data. The campaign often begins with social engineering. Victims receive what appears to be a job application or resume in PDF format. Opening the document prompts them to click a download button, which silently installs malware on the system. 

Another tactic involves modifying desktop shortcuts for Chrome or Edge. When the browser is launched through the altered shortcut, malicious code runs in the background while normal browsing continues. To hide command-and-control activity, the attackers rely on trusted cloud platforms. Instructions for infected machines are stored in Google Sheets, while stolen data is transmitted through services such as Slack and Discord. Because these services are widely used in workplaces, the malicious traffic often blends in with routine network activity. 

Once inside a network, attackers deploy monitoring tools including BackupSpy. The program scans internal drives and USB storage for specific file types such as Word documents, spreadsheets, PDFs, images, and web files. It also creates a manifest listing every file that has been collected and exfiltrated. Bitdefender describes the overall strategy as a “Distributed Denial of Detection.” Instead of relying on a single advanced tool, the attackers release large numbers of AI-generated malware samples, many of which are flawed. However, the constant stream of variants increases the likelihood that some will evade security defenses. 

The campaign highlights how artificial intelligence may enable cyber groups to produce malware at scale. For defenders, the challenge is no longer limited to identifying sophisticated attacks, but also managing an ongoing flood of low-quality yet constantly evolving threats.
Read more »
Wordpress Vulnerability
Cyber Security cyber threat Plugin Privilege Escalation Website Takeover Risk WordPress Security Flaw Wordpress Vulnerability

Newly Discovered WordPress Plugin Bug Enables Privilege Escalation to Admin


 

With WordPress, millions of websites depend on its convenience, but it also includes a complex web of extensions, which quietly handle everything from user onboarding to payment-based membership. In addition to simplifying site management and extending functionality, these plugins often work with deep integration into the platform's authentication and permission systems.

If any minor mistake is made within this layer, the consequences can extend far beyond a routine software malfunction. Having recently discovered a security flaw in a widely deployed membership management plugin, attention has been drawn to this fragile intersection between functionality and security, showing how external parties could bypass normal security safeguards by bypassing the user registration process and achieving the highest level of administrative privileges. 

An issue that affects affected sites is not simply one of technical misconfiguration, but also one that may allow unauthorized actors to take complete control of the website. In the past few years, WordPress has been powered by a robust ecosystem of plugins, enabling everything from membership portals to subscription-based services with minimal technical effort. 

Nevertheless, when input validation and access controls are not carefully applied, this same flexibility can pose subtle security risks. Recent disclosures of a vulnerability in a widely used membership plugin highlight this fragile balance, which opens the door to a possible takeover of tens of thousands of WordPress installations. 

It has been confirmed that malicious actors have already exploited the vulnerability, tracked as CVE-2026-1492, by manipulating account roles during the sign-up process, granting them administrator-level privileges without authentication and effectively gaining full control over affected sites through exploiting a flaw in the plugin's registration process.

It is estimated that the vulnerability affects more than 60,000 websites using WPEverest's User Registration & Membership plugin. As a result, the plugin fails to properly validate role parameters entered during registration, which leads to the issue. 

Unauthenticated attackers can tamper with this input to assign elevated privileges to newly created accounts, bypassing the intended permission restrictions, allowing them to register directly as site administrators. By obtaining such access, attackers can install malicious plugins, alter site content, extract sensitive information, such as user databases, embed hidden malware within the website infrastructure, or alter site content after obtaining such access.

Consequently, the consequences of privilege escalation are particularly severe within the WordPress permission framework, in which administrator accounts are granted unrestricted access to virtually all website functionality. Those who gain access to this level of the system can modify themes and plugins, modify PHP code, alter security settings, and even remove legitimate administrators.

In practical terms, a compromised website can become a controlled asset that can be used for further malicious activities, such as malware distribution or unauthorized data harvesting from registered users or visitors. After the vulnerability was publicly disclosed, Defiant researchers, the company behind the widely used Wordfence security plugin, reported observing attempts to exploit the vulnerability. 

Over two hundred malicious requests attempting to exploit CVE-2026-1492 were blocked within a 24-hour period by monitoring across protected environments, indicating that the flaw has been rapidly incorporated into automated attacks. As a result of the vulnerability, all versions of the plugin up to version 5.1.2. are vulnerable. 

Developers have since released a fix to address the issue, first in version 5.1.3 and then in version 5.1.4. This version also has additional stability and security improvements. Consequently, administrators are strongly advised to upgrade as soon as possible to the latest version, or temporarily disable the plugin if patch deployment cannot be completed promptly. 

It has been reported by Wordfence that CVE-2026-1492 is the most severe vulnerability to date in the plugin. Additionally, this incident reflects an ongoing trend in which attackers systematically scan the WordPress ecosystem for exploitable plugin vulnerabilities. In addition to distributing malware and hosting phishing campaigns, compromised websites are frequently used to operate command-and-control infrastructure, proxy malicious traffic, or store data stolen from others. 

Similar patterns were observed earlier in January 2026 when threat actors exploited another critical vulnerability, CVE-2026-23550, affecting the Modular DS WordPress plugin and allowing remote authentication bypass with administrator access. 

In incidents such as these, security risks remain prevalent in platforms powered by plugins such as WordPress, where a single mistake in access control can result in the compromise of thousands of websites. Since the vulnerability is so severe and exploitation attempts have already surfaced so quickly, security experts emphasize the importance of taking immediate defensive action.

Website operators are advised to review installed plugins, apply available security updates as soon as possible, and implement monitoring mechanisms that will detect any suspicious administrative activity or unauthorized account creation. By conducting regular security audits, following the principle of least privilege, and employing reputable security plugins, similar threats can be significantly reduced. 

In general, the incident illustrates the importance of maintaining continuous vigilance, timely patch management, and disciplined configuration practices to ensure that widely used plugins do not become entry points into large-scale attacks. It is crucial that the operational convenience offered by extensible platforms like WordPress is balanced with continuous vigilance and timely patch management.
Read more »
fault-tolerant quantum computing
Computing Cryptography cryptography risk Cyber Security Cyberattacks fault-tolerant quantum computing

Quantum Cybersecurity Risks Rise as Organizations Prepare for Post-Quantum Cryptography

 

Security experts often trust encrypted data since today's cryptography aims to block unapproved users. Still, some warn new forms of computation might one day weaken common encryption techniques. Even now, as quantum machines advance, potential threats are starting to shape strategies for what comes after today’s security models. 

A rising worry for some cybersecurity professionals involves what they call "harvest now, decrypt later." Rather than cracking secure transmissions at once, attackers save encoded information today, waiting until conditions improve. When machines powered by quantum computing reach sufficient strength, old ciphers may unravel overnight. Data believed safe could then spill into view years after being taken. Such delays in threats make preparation harder to justify before damage appears. 

This threat weighs heavily on institutions tasked with protecting sensitive records over long durations. Finance, public administration, health services, and digital infrastructure sectors routinely manage details requiring protection across many years. When coded messages get captured today and kept aside, future advances in quantum machines might unlock them later. What worries experts is how current encryption often depends on math challenges too tough for regular computers to crack quickly. Built around this idea are systems like RSA and elliptic curve cryptography. 

Yet quantum machines might handle specific intricate computations much faster than conventional ones. That speed could erode the security these common encryption methods now provide. Facing new risks, experts in cybersecurity now push forward with post-quantum methods. Security built on these models holds up under extreme computing strength - like that of quantum machines. A growing favorite? Hybrid setups appear more often, linking older ciphers alongside fresh defenses ready for future attacks. With hybrid cryptography, companies boost protection without abandoning older tech setups. 

Instead of full system swaps, new quantum-resistant codes mix into present-day encryption layers. Slow shifts like these ease strain on operations yet build stronger shields for future threats. One of the recent additions to digital security is ML-KEM, built to withstand threats posed by future quantum machines. Though still emerging, this method works alongside existing encryption instead of replacing it outright. As processing power grows, blending such tools into current systems helps maintain protection over time. Progress here does not erase older methods but layers new defenses on top. Even now, early adoption supports long-term resilience without requiring immediate overhaul. 

One step at a time, security specialists stress the need for methodical planning ahead of the quantum shift. What often gets overlooked is which data must stay secure over many years, so mapping sensitive information comes first. After that, reviewing existing encryption methods across IT environments helps reveal gaps. Where needed, combining classical and post-quantum algorithms slowly becomes part of the solution. Tracking all crypto tools in use supports better oversight down the line. Staying aligned with new regulations isn’t optional - it’s built into the process from the start. 

Even while stronger encryption matters, defenses cannot rely on math alone. To stay ahead, teams need ways to examine encrypted data streams without weakening protection. Watching for risks demands consistent oversight within tangled network setups. Because trust is never assumed today, systems built around verification help sustain both access checks and threat spotting. Such designs make sure safeguards work even when connections are hidden. 

When companies start tackling these issues, advice from specialists often highlights realistic steps for adapting to quantum-safe protections. Because insights spread through training programs, conversations among engineers emerge that clarify risk assessment methods. While joint efforts across sectors continue growing, approaches to safeguarding critical data gradually take shape in response. 

A clearer path forward forms where knowledge exchange meets real-world testing. Expectations grow around how quantum computing might shift cybersecurity in the years ahead. Those who prepare sooner, using methods resistant to quantum risks, stand a better chance at safeguarding information. Staying secure means adjusting before changes arrive, not after they disrupt. Progress in technology demands constant review of protection strategies. Forward-thinking steps today could define resilience tomorrow.
Read more »
Rui-Siang Lin Pharoah
Cyber Security Dark Web dark web drug market FBI informant investigation fentanyl overdose crisis Incognito Market Rui-Siang Lin Pharoah

FBI Informant Allegedly Ran Most Operations on Incognito Market While Fentanyl-Laced Drugs Caused Overdose Deaths

 

An FBI informant reportedly handled the majority of activity on Incognito Market—one of the largest drug marketplaces on the dark web—for nearly two years, even as fentanyl-laced pills linked to the platform caused fatal overdoses across the United States. Court documents indicate that the unnamed confidential source managed roughly 95% of transactions on the site between 2022 and 2024, effectively helping operate the $100 million marketplace.

According to filings, the informant approved vendor listings, mediated disputes among users, and oversaw cryptocurrency payments on the platform. These activities allegedly continued even after buyers warned about near-fatal overdoses connected to certain suppliers.

Taiwanese national Rui-Siang Lin, who used the alias “Pharoah,” created Incognito Market and ran it from October 2020 until March 2024. The Tor-based platform hosted nearly 1,800 vendors who sold drugs such as cocaine, methamphetamine, MDMA, and opioids to hundreds of thousands of buyers worldwide.

In October, Judge Colleen McMahon sentenced Lin to 30 years in federal prison and ordered him to forfeit $105 million. The judge described him as a “drug kingpin,” despite the defense raising serious questions about the extent of FBI involvement in the operation.

During sentencing in Manhattan federal court, Arkansas physician David Churchill spoke about the death of his son Reed in September 2022. The 22-year-old died after taking fentanyl-laced oxycodone pills purchased through Incognito Market. The drugs were supplied by a vendor known as RedLightLabs, whose operators—Michael Ta and Raj Srinivasan—later pleaded guilty to charges tied to five overdose deaths.

Churchill asked Lin to remember his son’s face while serving his sentence. However, the revelation that the FBI’s own confidential asset was moderating the marketplace at the time of Reed’s death added another troubling dimension to the case.

When Law Enforcement Becomes the Accomplice

Lin’s defense team argued that the FBI informant functioned more like a partner than an undercover observer. According to defense filings, the government’s source did more than infiltrate the marketplace—it played a central operational role.

Documents suggest the informant approved vendors, handled user complaints, and processed transactions while allegedly overlooking warnings about fentanyl contamination in certain drug listings.

In November 2023, users reported severe overdoses and hospitalizations tied to a particular vendor who nevertheless continued fulfilling more than 1,000 orders. Court records also show the informant debated Lin about maintaining bans on fentanyl, reportedly advocating for “free markets” before Lin conducted a user poll—later described as rigged—that maintained the prohibition.

Defense attorney Noam Biale described the situation as a joint operation, saying: “The government had the ability to mitigate the harm—and didn’t do it.”

Judge McMahon also questioned the length of the investigation, asking why authorities allowed the marketplace to remain active for such an extended period after gaining access.

Prosecutors, however, argued that the informant was simply following Lin’s instructions as part of a broader strategy to identify “Pharaoh.” Authorities ultimately traced Lin through blockchain analysis and seized servers tied to the marketplace.

While Lin’s 30-year sentence remains in place, his planned appeal and the debate surrounding the informant’s role indicate that the legal and ethical questions surrounding the Incognito Market investigation are far from resolved.
Read more »
iPhone
Apple Cyber Security Data Theft iOS Devices iPhone

Coruna Exploit Kit Targets iPhones With 23 Vulnerabilities Across Multiple iOS Versions

 

Security researchers have identified a powerful exploit framework targeting Apple iPhones running older versions of the iOS operating system. 

The toolkit, called Coruna and also known as CryptoWaters, includes multiple exploit chains capable of targeting devices running iOS versions from 13.0 through 17.2.1, according to researchers from Google’s Threat Intelligence Group. 

The framework contains five full exploit chains and a total of 23 vulnerabilities. Researchers said the exploit kit is not effective against the most recent versions of iOS. 

“The core technical value of this exploit kit lies in its comprehensive collection of iOS exploits, with the most advanced ones using non public exploitation techniques and mitigation bypasses,” Google researchers said. 

They added that the infrastructure supporting the kit is carefully designed and integrates several exploit components into a unified framework. 

“The framework surrounding the exploit kit is extremely well engineered. The exploit pieces are all connected naturally and combined together using common utility and exploitation frameworks.” 

According to researchers, the exploit kit has circulated among several types of threat actors since early 2025. 

The toolkit first appeared in a commercial surveillance operation before being used by a government backed attacker. 

By late 2025, it had reached a financially motivated threat group operating from China. Investigators say the movement of the exploit kit between groups suggests a growing underground market where previously developed zero day tools are resold and reused. 

Security firm iVerify said the spread of Coruna demonstrates how advanced surveillance tools can move beyond their original operators. 

“Coruna is one of the most significant examples we’ve observed of sophisticated spyware grade capabilities proliferating from commercial surveillance vendors into the hands of nation state actors and ultimately mass scale criminal operations,” the company said. 

Researchers first detected elements of the exploit chain in early 2025 when a surveillance customer used it within a JavaScript framework that had not been previously documented. 

The framework gathers information about the targeted device including the model and the iOS version running on it. Based on this fingerprinting data, the framework delivers a suitable WebKit remote code execution exploit. 

One of the vulnerabilities used in the chain was CVE-2024-23222, a type confusion flaw in Apple’s WebKit browser engine that was patched in January 2024. 

The framework appeared again in July 2025 when it was discovered on a domain used to deliver malicious content through hidden iframes on compromised websites in Ukraine. 

These sites included pages related to industrial tools, retail services and e commerce platforms. 

Researchers believe a suspected Russian espionage group tracked as UNC6353 was responsible for that activity. The exploit framework was delivered only to certain users based on their geographic location and device characteristics. 

A third wave of activity was identified in December 2025. In that campaign, attackers used a network of fake Chinese websites related to financial topics to distribute the exploit kit. 

Visitors were encouraged to access the sites from iPhones or iPads for a better browsing experience. Once accessed from an Apple device, the websites inserted a hidden iframe that triggered the Coruna exploit kit. This campaign has been linked to a threat cluster tracked as UNC6691. 

Further investigation uncovered a debug version of the exploit kit along with several exploit samples spanning five complete attack chains. 

Researchers said the kit includes vulnerabilities affecting several generations of iOS. These include exploits targeting iOS 13 through iOS 17.2.1 using vulnerabilities such as CVE-2020-27932, CVE-2022-48503, CVE-2023-32409 and CVE-2024-23222. 

Some of the vulnerabilities in the toolkit had previously been used as zero day exploits in earlier operations. 

“Photon and Gallium are exploiting vulnerabilities that were also used as zero days as part of Operation Triangulation,” Google researchers said. 

Once a device is compromised, attackers can deploy additional malware components. In the case of the UNC6691 campaign, the exploit chain delivered a stager called PlasmaLoader. 

The program is designed to decode QR codes embedded in images and retrieve additional modules from external servers. These modules can then collect sensitive data from cryptocurrency wallet applications including Base, Bitget Wallet, Exodus and MetaMask. 

Researchers said the malware contains hard coded command and control servers along with a fallback system that generates domain names automatically using a domain generation algorithm seeded with the word lazarus. 

A notable characteristic of the Coruna exploit kit is that it avoids running on devices using Apple’s Lockdown Mode or devices browsing in private mode. Security researchers recommend that iPhone users update their devices to the latest version of iOS and enable Lockdown Mode when additional protection is needed.
Read more »
Reverse Firewall
Cyber Security Data Access Restrictions Digital Governance DNS Blocking Geo Blocking Great Firewall Internet censorship Network Filtering Reverse Firewall

China Tightens Control Over Official Data Available to the Outside World


 

Early in the Internet's history, the global network architecture was widely recognized as an evolving system for transferring government documents, statistical records, and institutional disclosures across jurisdictions a borderless repository of knowledge that enabled government documents to travel freely across jurisdictions. 

A number of scholars, investors, journalists, and policymakers have become accustomed to considering publicly hosted websites as a reliable window into distant government administration. However, recent observations suggest that the assumption of digital openness in China's online ecosystem may be changing quietly. 

There has been a steady decline in the international accessibility of Chinese government portals over the past few years: more and more official websites that once appeared regularly in global search results cannot be accessed when searching outside the country's boundaries. 

In addition to a broader recalibration of information governance, the emerging pattern is interpreted by analysts as a result of an overall pattern rather than isolated technical disruptions. China's institutional data may also be shaped by these practices, not only by managing the flow of foreign content into the country, but also by how much of it remains public.

Over the past few decades, the internet has facilitated unprecedented accessibility to information, dissolving borders that once restricted public records, statistics, and government disclosures. However, new evidence suggests that this openness may be gradually waning in one of the most influential digital ecosystems in the world.

According to researchers who have examined the accessibility of official Chinese government websites, an increasing number of them are no longer accessible from abroad. Despite the pattern, it does not seem to be isolated technical failures, but rather a subtle architectural shift in Chinese information governance that analysts are increasingly describing: a system that restricts not only what citizens of the country are allowed to observe, but also what the outside world can see about China. 

A detailed analysis conducted in February 2025 indicates these interruptions are not simply a consequence of technical inconsistencies, but rather are the result of deliberate policy restrictions. According to researchers, approximately sixty percent of failed connections to Chinese government portals are a consequence of deliberate policy restrictions, while the remaining cases are attributed to network congestion, legacy infrastructure, or fragmented hosting systems. 

It reverses the logic of Chinese domestic internet controls well known to the public. In contrast to the original system, which limited what users were allowed to view abroad, the new configuration appears to be intended to restrict what audiences outside the country may see regarding China's own administrative, economic, and regulatory landscape. These restrictions are unevenly distributed.

As opposed to a uniform nationwide block of geo-filtering, it is more common to detect clusters of it across specific provinces or prefectures. Due to this, certain municipal or regional data portals remain available to overseas users despite neighboring jurisdictions appearing systematically unreachable from overseas. 

As a consequence of this fragmented pattern, it is increasingly challenging for foreign researchers and analysts to construct consistent datasets, since information availability varies greatly according to the level of administration and technology in place to support government websites.

The tightening of external access has also extended beyond government portals into major commercial information services that have long served as research infrastructure for international observers of China’s economy. 

Several commonly used platforms - such as Qichacha, a corporate registry database, the China National Knowledge Infrastructure academic repository, and Wind - were restricted from allowing foreign connectivity in 2022 and 2023. 

A wide range of multinational companies, consulting firms, and academic institutions used these tools to conduct competitor analysis, regulatory monitoring, and market research within China. As a result of their removal from overseas networks, external stakeholders are significantly limited in the number of verifiable public data they can access. 

In May 2024, another similar episode occurred when the National People’s Congress website temporarily implemented geographical restrictions preventing access to its website from outside mainland China, Hong Kong, Macao, and Taiwan. 

Although the restriction was eventually lifted, the incident illustrated how even the highest legislative information portals of the country can be subject to sudden changes in accessibility without prior notice. It was evident by early 2025 that there was a growing access gap within China's own digital ecosystem as well.

For the phrase "government website" in Chinese, autocompletion suggestions increasingly included queries such as "cannot enter government website" and "cannot open government website." According to the trend, it appears that the issue is not just affecting international analysts, but also Chinese citizens living abroad, overseas scholars, and global business teams seeking official information from abroad. 

Chinese digital governance has been closely linked to what has become known as the Great Firewall, a layered system of network filtering and regulatory oversight designed to limit domestic access to foreign platforms for much of the modern internet era. 

The framework has made a wide range of international services largely inaccessible to mainland China for a number of years, including major technology platforms and a number of prominent global news outlets. 

Some residents have historically used virtual private networks to circumvent these restrictions; however, authorities have repeatedly moved to tighten regulations pertaining to such tools, framing them as potential threats to national security and information sovereignty, resulting in unauthorized circumvention technologies becoming more prevalent. 

Due to the emerging pattern of restricted access to Chinese government websites, this long-established architecture has been markedly inverted. Rather than focusing exclusively on filtering inbound information, new evidence indicates that outward visibility of Chinese public-sector data could also be limited. 

Lennart Brussee conducted a recent technical assessment, compiled from over 13,000 websites operated by governments at all levels of government, to determine the extent and scope of the phenomenon. Researches conducted by the researcher during November were conducted to evaluate their accessibility from more than a dozen locations outside China, using residential proxy infrastructure to simulate standard user connections. 

Several of these official websites were unable to be accessed from overseas networks, according to the results. Despite some failures appearing consistent with routine connectivity problems, there was a significant share of failures that were consistent with intentional filtering.

Approximately one in ten access attempts encountered mechanisms commonly associated with deliberate blocking. These included server-side restrictions and domain name system filtering, preventing foreign queries from properly resolving. 

The findings together indicate that limitations on external access are not limited to isolated platforms but may also occur on administrative websites of all types. As researchers, investors, and policy analysts utilize public government records to track regulatory developments, demographics, and economic indicators, the increasing opacity of these digital sources presents a challenge in interpreting China's rapidly evolving information environment.

It has already been noticed that such restrictions are likely to have long-term consequences among policy researchers studying the long-term consequences of data opacity. It was argued in 2023 that the limiting international access to publicly available Chinese data would undermine informed policy decisions, according to analysts Dewey Murdick and Owen Daniels of Georgetown University's Centre for Security and Emerging Technology.

The authors cautioned that the continued closure of official datasets would lead to a diminished ability to analyze China's political and economic systems based on evidence. They observed that researchers who cannot verify developments through open information can create speculative narratives and reinforce polarized interpretations as a consequence of the resulting vacuum. 

At a time when geopolitical tensions between China and the United States are already shaping global policy debate, this can be especially problematic. A decline in public data access, they claim, may unintentionally contribute to policy miscalculations, such as poor economic decoupling strategies or protectionist responses that are based primarily on uncertainty rather than verifiable evidence. 

There are broader implications beyond academic research. It has been suggested by Brussee that selective geoblocking of government resources could adversely affect people-to-people exchanges and complicate foreign companies’ attempts to interpret regulatory signals, market conditions, and administrative guidance from official sources. 

As an essential layer of informational infrastructure for international firms operating in or studying the Chinese market, publicly accessible government portals have long been an integral part of this process. In response, reduced accessibility may result in a greater reliance on secondary interpretations rather than direct examination of primary data. 

Nevertheless, the researchers warn against the implication that the phenomenon is unique to Chinese culture. In recent years, governments across several jurisdictions, including the United States and Russia, have explored ways of limiting the exposure of certain domestic information systems to the outside world. In Chinese territory, geo-blocking does not appear to be uniformly distributed. 

The restrictions, however, tend to occur in clusters at the provincial or prefectural administrative level, which suggests that local authorities may be implementing technical controls in response to national policy signals at the same time. 

Consequently, researchers have described the process as a gradual experiment in institutional design. There appears to be a wide range of technical approaches adopted by different agencies and regional governments, potentially evaluating the effectiveness of external access controls before deciding whether to expand them more widely. 

Observers point out that China's approach to digital governance has historically influenced internet management practices beyond its borders, suggesting that such experimentation could suggest the development of a more comprehensive data governance strategy.

The development of network filtering systems by countries such as Russia, Uganda, and Myanmar has often been based on elements of Chinese experience, sometimes accompanied by technical guidance.
Read more »
Meta child safety case
Apple encryption lawsuit CSAM investigation Cyber Security Instagram safety concerns Mark Zuckerberg trial Meta child safety case

Meta and Apple Face Court Scrutiny Over Child Safety, Encryption, and Platform Responsibility

 

The child safety practices of major technology companies are coming under intense legal scrutiny. This week, court proceedings in California, New Mexico, and West Virginia have placed Meta CEO Mark Zuckerberg and Apple CEO Tim Cook at the center of debates surrounding user privacy, free speech, and platform safety—issues that technology firms weigh carefully when launching new features.

If courts rule against the companies in these cases, the outcomes could lead to significant product changes that affect billions of users worldwide.

During testimony in a Los Angeles courtroom on Wednesday, Zuckerberg defended his leadership decisions as attorneys questioned him about Instagram’s beauty filters and whether Meta’s push for growth overshadowed concerns about the mental health of younger users.

Documents disclosed in the New Mexico case reveal internal conversations among Meta employees about roughly 7.5 million annual reports related to child sexual abuse material that might no longer be reported after Zuckerberg’s 2019 decision to implement default end-to-end encryption in Facebook Messenger.

These messages were made public through a newly unsealed legal filing submitted by the state of New Mexico earlier this week.

“There goes our CSER [Community Standards Enforcement Report] numbers next year,” an employee wrote in a message dated Dec. 14, 2023, according to the filing. It was the same month that Meta said in a public blog post that it would begin “rolling out default end-to-end encryption for personal messages and calls on Messenger and Facebook.”

The employee added that it was as if the company “put a big rug down to cover the rocks” and said it was sending fewer child exploitation reports, the filing shows.

Addressing concerns during the Los Angeles hearing, Zuckerberg stated, “I care about the wellbeing of teens and kids who are using our services,” when asked about email exchanges he had with Cook.

Meanwhile, West Virginia filed a lawsuit on Thursday accusing Apple of failing to adequately address child sexual abuse material, commonly referred to as CSAM, on its platforms.

The New Mexico case, brought by Attorney General Raúl Torrez, began opening arguments on Feb. 9. Zuckerberg is not expected to take the stand during the trial.

Torrez alleges that Meta did not sufficiently protect platforms like Facebook and Instagram from online predators and misrepresented the overall safety of its services.

“Meta knew that E2EE would make its platforms less safe by preventing it from detecting and reporting child sexual exploitation and the solicitation and distribution of child exploitation images sent in encrypted messages,” lawyers said in the filing. “Meta further knew that its safety mitigations would be inadequate to address the risks.”

E2EE refers to end-to-end encryption.

In response to the unsealed documents, Meta said it continues to build safety features and tools designed to protect users. The company also noted that it can still review encrypted messages when they are reported for child safety issues.

Meta has earlier rejected the allegations from the New Mexico Attorney General, stating it remains “focused on demonstrating our longstanding commitment to supporting young people.”

Court filings from the New Mexico case also reveal internal warnings from company staff about how encryption might affect its ability to detect and report harmful content.

A senior member of Meta’s Global Affairs team wrote in a note dated Feb. 25, 2019, that “Without robust mitigations, E2EE on Messenger will mean we are significantly less able to prevent harm against children.”

Another internal document from June 2019 warned, “We will never find all of the potential harm we do today on Messenger when our security systems can see the messages themselves.”

While privacy advocates have supported encryption as a vital tool that protects private conversations from third-party surveillance, many law enforcement officials argue that it can hinder investigations into certain criminal activities.

After Meta completed its encryption rollout for Facebook Messenger, attorneys involved in the case argued in the filing that “the fears conveyed by law enforcement and even its employees were born out.”

Alphabet-owned YouTube is also named as a defendant in the Los Angeles case. However, TikTok and Snap are no longer part of the proceedings after reaching settlements with a plaintiff before the trial began in January.

Apple is now facing similar scrutiny over encryption and privacy protections.

In the lawsuit filed Thursday, West Virginia Attorney General John “JB” McCuskey accused Apple of not doing enough to stop the storage and sharing of CSAM through iOS devices and iCloud services.

Like the allegations against Meta, the complaint points to Apple’s encryption systems as a potential obstacle for investigators.

“Fundamentally, E2E encryption is a barrier to law enforcement, including the identification and prosecution of CSAM offenders and abusers,” lawyers wrote in the Apple legal filing.

Apple responded by emphasizing that user safety remains a core priority. In a statement, the company said that “protecting the safety and privacy of our users, especially children, is central to what we do.”

The ongoing lawsuits against both companies—and communication between Zuckerberg and Cook regarding child safety—are intensifying debate over the responsibilities that tech companies have toward users and society.

“I thought there were opportunities that our company and Apple could be doing, and I wanted to talk to Tim about that,” Zuckerberg said of his emails with Cook.

As these cases continue through the courts, they are expected to shed more light on decisions made by tech giants that influence billions of people around the world.
Read more »
Subscribe to: Comments (Atom)