Security. In focus.

Prohibited practices under the AI Act: Answered and unanswered questions in the Commission’s guidelines | Data Protection Report

The EU AI Act’s prohibitions, effective February 2, 2025, carry fines for non-compliance. Commission guidelines, published February 4, 2025, provide clarity on the complex provisions.

YouTube Premium Lite: Ad-Free Viewing for $7.99/Month - YouTube Blog

YouTube Premium Lite, a new, more affordable ad-free viewing option, is expanding to the US and other countries. The expansion comes as YouTube Music and Premium reaches over 125 million subscribers.

Scammers take over social media - Help Net Security

Cyber threats on social media reached unprecedented levels in Q4 2024, with Facebook being the biggest target. Malvertising, e-shop scams, and phishing were the top threats, while Telegram saw a disproportionate number of scams despite its smaller user base.

Polyglot files used to spread new backdoor | CSO Online

A threat actor is using polyglot files in a spear-phishing campaign targeting critical infrastructure firms in the UAE, particularly in the aviation, satellite communications, and transportation sectors. The campaign, which leverages a compromised Indian electronics company’s email account, employs sophisticated tactics including polyglot files and a new backdoor called Sosano. CISOs are advised to be vigilant, as this tactic and backdoor may spread to other regions.

VMware fixed three actively exploited zero-days in ESX products

Broadcom released security updates for three actively exploited zero-day vulnerabilities in VMware ESX products. The vulnerabilities, CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, allow attackers with privileged access to escape the sandbox within the virtual machine. VMware confirmed exploitation in the wild but did not disclose specific attack details.

Jamf Buys Identity Automation, Expands IAM Capabilities

Jamf, an MDM provider, is acquiring Identity Automation, a cloud-based IAM platform, for $215 million. The acquisition aims to combine identity and device access into a single platform, addressing the growing need for robust identity security in enterprises. This convergence of identity and device management reflects a broader trend towards more comprehensive and contextually driven security solutions.

New polyglot malware hits aviation, satellite communication firms www.bleepingcomputer.com/news/secu…

A previously undocumented polyglot malware is being deployed in attacks against aviation, satellite communication, and critical transportation organizations in the United Arab Emirates.

The malware delivers a backdoor called Sosano, which establishes persistence on the infected devices and allows the attackers to execute commands remotely.

The activity was discovered by Proofpoint in October 2024, which states that the attacks are linked to a threat actor named ‘UNK_CraftyCamel.’ While the campaign is still small, the researchers report that it is still advanced and dangerous to targeted companies.

Proofpoint’s researchers noted that the attacks bear similarities with operations from Iranian-aligned groups TA451 and TA455. However, the latest campaign is distinct, having a strong cyber-espionage focus.

Polyglot threat Polyglot malware consists of specially crafted files that contain multiple file formats, allowing them to be interpreted differently by various applications.

For example, a single file could be structured as both a valid MSI (Windows installer) and a JAR (Java archive), causing Windows to recognize it as an MSI while the Java runtime interprets it as a JAR.

This technique enables attackers to stealthily deliver malicious payloads by evading security software, which typically analyzes files based on a single format.

New Microsoft 365 outage impacts Teams, causes call failures

Microsoft is investigating a new outage affecting Microsoft 365, specifically Teams, causing call failures and authentication problems. Users are also reporting issues with Outlook, OneDrive, and Exchange.

Researchers Link CACTUS Ransomware Tactics to Former Black Basta Affiliates

Threat actors deploying Black Basta and CACTUS ransomware are using the same BackConnect module for persistent control over infected hosts, suggesting a possible transition of former Black Basta affiliates to CACTUS. This convergence of tactics, including email bombing and data exfiltration, is significant given recent Black Basta chat log leaks revealing shared credentials and other initial access points.

Mozilla security advisory (AV25-115) - Canadian Centre for Cyber Security

CISA issues warning against Qilin ransomware group - Cybersecurity Insiders

CISA clarified that the US government continues to monitor Russian cyber activities, contradicting misinterpretations of Defense Secretary Hegseth’s remarks. The Pentagon is actively monitoring the Qilin Ransomware Group, a Russian-speaking cybercriminal syndicate linked to high-profile cyberattacks, including the encryption of hospital databases in London and the disruption of operations at Lee Enterprises. The Qilin group has also expanded its operations internationally, targeting the Utsunomiya Central Clinic in Japan and stealing approximately 135GB of data.

VMware Security Flaws Exploited in the Wild—Broadcom Releases Urgent Patches

Broadcom released security updates for VMware ESXi, Workstation, and Fusion products to address three actively exploited vulnerabilities. The vulnerabilities, discovered by Microsoft Threat Intelligence Center, could lead to code execution, information disclosure, and sandbox escapes. Users are advised to apply the latest patches for optimal protection.

Japanese cancer hospital confirms breach; Qilin gang claims responsibility – DataBreaches.Net

The Qilin ransomware group claimed responsibility for a February 10th hack of the Utsunomiya Central Clinic in Japan, exposing sensitive health information of 300,000 patients. The clinic disclosed the breach and the types of data stolen, including patient and personnel information.

New Chinese Zhong Stealer Infects Fintech via Customer Support

A new Chinese malware threat, Zhong Stealer, is targeting fintech companies through customer support chats. The malware uses a scam involving a new, empty support ticket with broken language and a suspicious ZIP file to trick agents into opening it. Once opened, Zhong Stealer downloads additional components, steals credentials and browser extension data, and sends it to a command-and-control server in Hong Kong.

How New AI Agents Will Transform Credential Stuffing Attacks

Credential stuffing attacks, fueled by stolen credentials and infostealer infections, are expected to worsen with the advent of Computer-Using Agents (CUAs). CUAs, like OpenAI’s Operator, enable low-cost automation of web tasks, including credential stuffing, making it easier for attackers to target a broader range of apps. This new technology could enable attackers to leverage password reuse and convert compromised credentials into systemic breaches more efficiently.

Top 10 Free Vulnerability Intelligence Platforms - SOCRadar® Cyber Intelligence Inc.

This article highlights ten free vulnerability intelligence platforms, including NVD, Feedly’s CVE Dashboard, CVE.org, and SOCRadar LABS’ CVE Radar. Each platform offers unique features, such as real-time tracking, AI-driven insights, and detailed risk assessments, catering to different security needs. Organizations can leverage these tools to enhance their security posture without incurring additional costs.

Suspected Iranian Hackers Used Compromised Indian Firm’s Email to Target U.A.E. Aviation Sector

Suspected Iranian hackers, tracked as UNK_CraftyCamel, targeted fewer than five organizations in the United Arab Emirates (U.A.E.) aviation and satellite communications sectors. The attack used a compromised Indian electronics company’s email to deliver a malicious ZIP file containing polyglot files and a Golang backdoor called Sosano. The backdoor, named Sosano, enables remote command execution and file manipulation, highlighting the sophistication of state-aligned actors in evading detection.

Over 4,000 ISP IPs Targeted in Brute-Force Attacks to Deploy Info Stealers and Cryptominers

A mass exploitation campaign targets ISPs in China and the West Coast of the United States, deploying information stealers and cryptocurrency miners. The threat actors use brute-force attacks against over 4,000 ISP IP addresses, primarily originating from Eastern Europe. The campaign involves disabling security features, terminating services, and deploying executables for network scanning, data theft, and cryptocurrency mining.

Open Source Security Risks Continue To Rise

The 2025 Open Source Security and Risk Analysis (OSSRA) report reveals that 86% of commercial codebases contain vulnerabilities, with 81% harboring high-or-critical-risk vulnerabilities. The average number of open-source files in applications has tripled over the past four years, highlighting the massive risk posed by outdated and unmonitored open-source components. The report emphasizes the urgent need for improved transparency, dependency management, and security-first approaches to open-source software usage.

Google’s March 2025 Android Security Update Fixes Two Actively Exploited Vulnerabilities

Google released its March 2025 Android Security Bulletin, addressing 44 vulnerabilities, including two actively exploited flaws. The vulnerabilities, CVE-2024-43093 and CVE-2024-50302, could lead to unauthorized access and memory leaks, respectively.

The New Ransomware Groups Shaking Up 2025 - The Cyber Post

In 2024, ransomware attacks surged, with a 40% increase in active groups and RansomHub emerging as a dominant player. Fog and Lynx are also notable new groups, with Fog targeting U.S. educational networks and Lynx displaying a significant number of victimized companies. Cyberint anticipates further evolution and dominance from these newer groups in 2025.

Ubuntu security advisory (AV25-110) - Canadian Centre for Cyber Security

IBM security advisory (AV25-109) - Canadian Centre for Cyber Security

Dell security advisory (AV25-108) - Canadian Centre for Cyber Security

Judges Are Fed up With Lawyers Using AI That Hallucinate Court Cases

Judges are increasingly frustrated with lawyers using AI tools that generate false citations and case references. Two separate cases highlight this issue, where attorneys were sanctioned for using AI-generated information without verifying its accuracy. While acknowledging the potential benefits of AI in the legal field, judges emphasize the importance of lawyers exercising caution and conducting thorough research to ensure the accuracy of their filings.