Oktacron - Cyber Security RSS Feeds History

634 Targets, 6 Million Records at Stake—Inside the UAE’s Cybersecurity Showdown

cyberexpress Mar 27, 2025 Cyber News

In a major cybersecurity operation, the UAE government successfully prevented attacks on 634 government and private entities, preventing what could have been a large-scale UAE cyberattack or data leak affecting critical sectors. Dr. Mohamed Al Kuwaiti, Head of Cybersecurity for the UAE Government, confirmed that a show more ...

hacker known as "rose87168" has claimed responsibility for the breach. The attacker alleges to have compromised Oracle Cloud’s SSO and LDAP systems, potentially exposing approximately six million customer records worldwide—including sensitive password data. If verified, this would rank among the most severe cybersecurity breaches in recent history. Beyond national borders, estimates suggest that around 140,000 entities worldwide may have been impacted, including 634 in the UAE—30 of which are government agencies, along with key private sector organizations. To explore the broader implications, The Cyber Express team spoke with industry experts to analyze what this large-scale cyberattack signifies for the future of cybersecurity in the UAE. Why the UAE Remains a Prime Target of Cybercriminals The latest cyberattack on the UAE was far from a mere digital nuisance—it was a full-scale attack, emphasizing the growing nature of cyber threats. No longer limited to website damages or temporary disruptions, these attacks now pose a direct risk to national security, economic stability, and public trust. In response, the UAE Cybersecurity Council swiftly activated emergency defense measures in coordination with relevant authorities. However, cybersecurity experts warn that this incident is just a glimpse of a larger, ongoing battle. Carmen Marsh, President & CEO at United Cybersecurity Alliance, emphasized the persistent nature of cyber threats. “This is not the first time the UAE has faced a massive cyberattack. Its strategic position and rapid digital transformation make it an attractive target for cybercriminals. This reality underscores the need for organizations within the region to understand that cyber threats are not isolated incidents but ongoing risks requiring constant vigilance and proactive strategies,” she asserts. Echoing this concern, Eng. Dina AlSalamen, Cybersecurity Director of Cyber and Information Security, pointed to the UAE’s technological advancements as a double-edged sword. “As the UAE continues to advance technologically, especially in areas such as smart cities, IoT, and digital governance, it is becoming a more attractive target for cybercriminals. The attempted breach of 634 entities underscores a broader trend where adversaries are increasingly adopting multi-pronged and coordinated attack strategies,” she explains. These evolving threats aren’t limited to one sector. Experts highlight how cybercriminals are deploying advanced persistent threats (APTs), ransomware, and data exfiltration tactics to infiltrate critical infrastructure and steal sensitive information. “This incident serves as a reminder that the UAE’s strategic economic sectors must be ever-vigilant as they evolve and integrate new technologies,” AlSalamen adds. Media organizations are among the most frequently targeted entities. Anoop Paudval, Head of Information Security and GRC at Gulf News, revealed the alarming frequency of attacks. “Media organizations in the UAE face an average of 20,000 attacks per day. The UAE Cybersecurity Council recently reported that cyberattacks targeting strategic sectors in the country have surpassed 200,000 daily. Cross-border, nation-sponsored cyberattacks—often orchestrated by cyberterrorist groups—are on the rise, leveraging sophisticated AI-driven attack mechanisms,” he states. AI-Driven Cybersecurity: The UAE’s Strategic Defense Against Emerging Threats [caption id="attachment_101664" align="aligncenter" width="1024"] Source: Freepik[/caption] As the UAE sets its position as a global technology hub, cyber threats continue to increase in difficulty and scale. With cybercriminals refining their tactics, experts emphasize the need for proactive defense strategies, AI-driven threat detection, and cross-sector collaboration to counter evolving cyber risks. The UAE Cybersecurity Council has urged organizations nationwide to strengthen their security postures, enhance cyber readiness, and report any suspicious activity immediately. “The continuous awareness by UAE CSC coordinated Private-Public collaborations, all of the attacks been tracked, identified, and their attack sites pinpointed with precision and effectively countered using the latest global methods in this field,” said Paudval. He further informed that the Council has revealed that cyberterrorist attacks primarily targeted the government sector (30%), followed by financial and banking (7%), education (7%), and technology, aviation, and healthcare sectors (4% each), with 44% impacting other critical sectors. These attacks focused on data exfiltration and operations sabotage by locking digital systems for ransom. Marsh highlighted the UAE’s rapid response capabilities, stating, “Thanks to the UAE Cyber Security Council's robust cybersecurity framework, emergency protocols were promptly activated to safeguard the nation’s cyberspace, averting a potential cyber disaster.” With the UAE’s ambition to become a global leader in AI development, she emphasized that AI will play a pivotal role in strengthening its cybersecurity capabilities, particularly against AI-driven cyberattacks. While AI poses risks in the hands of malicious actors, it also serves as a formidable tool in cybersecurity defense. By leveraging AI, organizations can automate threat detection, analyze vast datasets in real time, and enhance incident response. “A Zero Trust model, coupled with AI-driven threat detection, can significantly reduce unauthorized access and limit the lateral movement of attackers,” Marsh explained. As cyber threats evolve, the UAE’s commitment to integrating AI with its cybersecurity infrastructure will be crucial in fortifying national defenses and ensuring digital resilience. Lessons from UAE Cyberattack: Cybersecurity Strategies to Adopt While the UAE Cybersecurity Council plays an important role in national cyber defense, organizations must take ownership of their security strategies to keep pace with evolving threats. “The message is clear: adopting global best practices is no longer optional—it is a necessity,” stresses Paudval. Experts highlight several key measures that businesses and government entities should implement to enhance cybersecurity resilience. Zero Trust Architecture is a critical strategy that assumes every access request is a potential threat, requiring strict authentication and continuous monitoring. “Adopting a Zero Trust model, which ensures that no entity (inside or outside the network) is trusted by default, helps mitigate the risk of lateral movement in case an attacker breaches initial defenses,” explains Eng. Dina AlSalamen. Strengthening access controls through Multi-Factor Authentication (MFA), keeping systems updated with proactive patching, and leveraging AI-driven threat detection are also vital steps. “Incorporating AI into cybersecurity ecosystems can bolster defenses against evolving threats, including those driven by AI and quantum computing advancements,” adds Marsh. However, technology alone is not enough—organizations must prioritize cyber awareness training to reduce human error, a leading cause of cyber incidents. “Since human error remains one of the primary entry points for cyberattacks, continuous training on phishing prevention and safe online practices is vital,” emphasizes AlSalamen. Additionally, securing sensitive data through encryption and regular backups ensures quick recovery from ransomware attacks. What Future Holds The successful containment of this UAE cyberattack emphasizes the UAE’s strong commitment to cybersecurity, but experts warn that the threat landscape will only continue to evolve. “Massive cyberattacks like this serve as critical learning opportunities,” notes Marsh. “Organizations must prioritize Zero Trust frameworks and allocate substantial resources to AI-driven cybersecurity programs. Proactive investment in these measures is essential to staying ahead of ever-evolving cyber threats.” This incident highlights the growing complexity of modern cyberattacks and the need for a multi-layered, proactive defense strategy across all sectors. As cybercriminals refine their tactics, businesses and government entities must strengthen their security posture through continuous threat intelligence sharing, advanced detection systems, and rigorous security training. While the UAE has demonstrated its resilience, this attack serves as a reminder that cybersecurity is an ongoing battle. The question is no longer if another attack will occur, but when—and whether organizations will be prepared to withstand it.

Multiple CVEs Found in Ingress-NGINX—Patch Now to Prevent Cluster Compromise

cyberexpress Mar 27, 2025 Cyber News

A set of vulnerabilities have been identified in Ingress-NGINX Controller for Kubernetes, posing a risk to organizations relying on the affected versions. These vulnerabilities impact versions prior to NGINX Controller 1.12.1 and 1.11.5, and could allow unauthorized remote code execution and potential full cluster show more ...

takeover. Technical users leveraging Kubernetes for containerized workloads should immediately patch their systems to the latest version to mitigate these risks. Ingress-NGINX Controller Background: What Has Happened? The Australian Cyber Security Centre has released an advisory detailing multiple vulnerabilities affecting Ingress-NGINX Controller. The flaws stem from improper handling of ingress annotations and attacker-provided data, leading to arbitrary code execution and secret disclosures. Below are the key vulnerabilities identified: 1. CVE-2025-1097: Auth-TLS-Match-CN Ingress Annotation Vulnerability A security issue exists where the auth-tls-match-cn Ingress annotation can be exploited to inject unauthorized configurations into NGINX. Impact: Enables arbitrary code execution in the context of the Ingress-NGINX controller. Risk: Unauthorized access to all Secrets across namespaces, compromising the cluster’s security. 2. CVE-2025-1098: Mirror-Target and Mirror-Host Annotations Vulnerability The mirror-target and mirror-host Ingress annotations can be misused to insert arbitrary configurations into NGINX. Impact: Remote execution of malicious code within the Ingress-NGINX controller. Risk: Exposes sensitive cluster-wide Secrets, leading to potential system compromise. 3. CVE-2025-1974: Unauthenticated Access to Pod Network Under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution. Impact: Compromised controller integrity. Risk: Attackers can extract Secrets from the cluster and potentially gain full control. 4. CVE-2025-24513: Directory Traversal via Ingress-NGINX Admission Controller A vulnerability in the Ingress-NGINX Admission Controller allows attacker-provided data to be included in filenames, leading to directory traversal within the container. Impact: Can result in Denial of Service (DoS). Risk: In some cases, can expose Secret objects within the cluster. 5. CVE-2025-24514: Auth-URL Ingress Annotation Exploit The auth-url Ingress annotation can be used to inject malicious configurations into NGINX. Impact: Allows attackers to remotely execute code within the controller. Risk: Grants unauthorized access to Secrets across namespaces. Why This Matters Ingress-NGINX Controller plays a critical role in routing external traffic to services within a Kubernetes cluster. Exploiting these vulnerabilities can lead to: Remote Code Execution (RCE): Attackers can execute arbitrary commands on the Ingress controller. Cluster-Wide Secrets Exposure: Sensitive credentials, API keys, and other secrets can be compromised. Complete Cluster Takeover: Unauthorized access could lead to a total compromise of Kubernetes infrastructure. Mitigation: How to Stay Secure To protect against these vulnerabilities, the Australian Signals Directorate’s (ASD) Australian Cyber Security Centre (ACSC) recommends the following measures: Upgrade to the Latest Version Immediately update Ingress-NGINX Controller to version 1.12.1 or 1.11.5 to patch these security issues. Review Kubernetes Security Guidance Regularly monitor updates from the official Ingress-NGINX GitHub Repository to stay informed about security patches and advisories. Disable External Access to the Admission Webhook Endpoint Ensure the admission webhook endpoint is not publicly accessible to prevent external attackers from exploiting it. Addressing CVE-2025-1974 Due to the severity of this vulnerability, validation of the generated NGINX configuration has been disabled during Ingress resource validation. While the system still performs checks before actual loading, invalid Ingress resources may prevent NGINX from updating its configuration. Recommended Actions: Enable annotation validation. Disable snippet annotations to minimize risks. Monitor Ingress-NGINX logs for errors, particularly lines preceded by Error. The Ingress-NGINX vulnerabilities present a serious risk to Kubernetes clusters, with potential consequences including unauthorized remote execution, credential leaks, and cluster-wide compromise. Organizations using affected versions should immediately upgrade to secure their environments. By staying informed and following best practices, technical teams can minimize the attack surface and prevent exploitation of these critical flaws.

SnapCenter Security Flaw Rated Critical—NetApp Urges Immediate Patch

cyberexpress Mar 27, 2025 Firewall Daily

A serious security vulnerability has recently been identified in NetApp’s SnapCenter software, a widely used enterprise solution for managing data protection. This flaw, tracked as CVE-2025-26512, could allow attackers to escalate privileges and gain unauthorized administrative access to systems. The flaw, which show more ...

affects SnapCenter versions prior to 6.0.1P1 and 6.1P1, has been rated as critical, with a CVSS score of 9.9 out of a maximum of 10. NetApp’s SnapCenter is a comprehensive data management tool designed for enterprise environments. It enables users to manage data protection across a range of applications, databases, virtual machines, and file systems. SnapCenter provides essential features such as backup, restore, and cloning of data resources, making it a vital component of many organizations’ IT infrastructures. The NetApp Vulnerability: CVE-2025-26512 [caption id="attachment_101681" align="alignnone" width="1237"] CVE-2025-2651 Vulnerability (Source: NetApp)[/caption] The vulnerability in SnapCenter stems from a privilege escalation issue that affects versions of SnapCenter before 6.0.1P1 and 6.1P1. According to NetApp’s advisory, an authenticated SnapCenter Server user could potentially exploit this flaw to gain administrative privileges on a remote system where a SnapCenter plug-in has been installed. This could result in unauthorized control over systems. The vulnerability can be exploited by attackers who already have authenticated access to the SnapCenter Server. By leveraging this vulnerability, attackers could escalate their privileges to gain full control over remote systems. This type of privilege escalation could lead to data breaches, unauthorized system access, and overall compromise of the organization’s IT environment. Impact of the Vulnerability The successful exploitation of the vulnerability could have severe consequences for affected organizations. With unauthorized administrative access, attackers could: Modify or delete sensitive data Disrupt system operations by altering configurations Potentially cause widespread damage to the organization’s IT infrastructure Vulnerability Scoring and Details The SnapCenter vulnerability has received a CVSS score of 9.9 (Critical), the second-highest possible rating for security flaws. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating that it is remotely exploitable and can have a high impact on confidentiality, integrity, and availability. NetApp has issued an advisory identifying the impacted versions as those prior to 6.0.1P1 and 6.1P1. Organizations using these versions are strongly advised to upgrade to the latest patches to mitigate the risk of exploitation. As of now, NetApp has not detected any public exploitation of the SnapCenter vulnerability. However, given the critical nature of the flaw and the potential for widespread damage, it is highly recommended that organizations act quickly to protect their systems. NetApp has made it clear in their advisory that they are continuing to monitor the situation and will provide updates as necessary. The company has also emphasized that this advisory should be considered the definitive source for accurate and up-to-date information regarding the vulnerability in SnapCenter. Conclusion To mitigate the risks associated with the vulnerability in SnapCenter, NetApp strongly advises users to upgrade to the patched versions, SnapCenter 6.0.1P1 and 6.1P1. This critical flaw, which allows for privilege escalation and unauthorized access, highlights the importance of promptly addressing security vulnerabilities to protect sensitive data.

AI technologies in Kaspersky SIEM | Kaspersky official blog

kaspersky Mar 27, 2025 Business

Its a rare company these days that doesnt boast about using artificial intelligence (AI). And often no explanation is forthcoming as to why AI is needed or, more importantly, how its implemented — just the mere presence of AI, it seems, is enough to make a product more valuable, innovative and high-tech. Kaspersky show more ...

advocates a different approach: we dont just say we use AI, but explain exactly how we deploy machine learning (ML) and AI technologies in our solutions. Itd take too long to list all our AI technologies in a single post given that we have an entire expertise center — Kaspersky AI Technology Research — that deals with all aspects of AI. So my sole focus here will be on those technologies that make life easier for SIEM analysts working with the Kaspersky Unified Monitoring and Analysis Platform. SIEM AI Asset Risk Scoring In traditional systems, one of the most resource-intensive tasks of the SIEM analyst is prioritizing alerts — especially if the system has just been installed and works out of the box with default correlation rules not yet fine-tuned to the infrastructure of a specific company. Big data analytics and AI systems can help here. Armed with SIEM AI Asset Risk Scoring, monitoring and response teams can prioritize alerts and prevent potential damage. The module assesses asset risks by analyzing historical data and prioritizing incoming alerts, allowing to speed up triage and generate hypotheses that can be used for proactive searches. Based on information about activated correlation rule chains, SIEM AI Asset Risk Scoring lets you build patterns of normal activity on endpoints. Then, by comparing daily activity with these patterns, the module identifies anomalies (for example, sudden traffic spikes or multiple service requests) that may signal a real incident and prompt the analyst to take a deeper look into these alerts. This way, the problem is detected early, before any damage is done. AI-Powered OSINT IoCs Analysts working with the Kaspersky Unified Monitoring and Analysis Platform also have the option to use additional contextual information from open sources through the Kaspersky Threat Intelligence Portal. After the latest update, the portal now provides access to threat intelligence collected using a generative AI model. It works as follows: lets say youve found a suspicious file during a threat hunt. You can take this files hash and look it up on the site, and if someone else has already encountered it during an incident investigation and published something about it, the technology will instantly show you indicators of compromise (IoC) and key facts about the threat. Without such an automation system, it can take the analyst many hours to find and review this information — especially if there are lots of materials and theyre written in different languages. Our system, built on an internal LLM model, can automate this process: it analyzes all reports and mentions of the threat whatever the language, extracts the essence, and presents a summary: the nature of the threat, the date it was detected first, cybercriminal groups associated with it, industries most often targeted using the file, and so on. This saves the analyst an enormous amount of time on searching and researching. Whats more, the analyst has access to other Kaspersky Threat Intelligence data, including information generated using AI technologies and big data analytics. Our threat intelligence databases are continuously updated with the results of manual APT research, live data from the darknet, information from the Kaspersky Security Network, and regular analysis of new malware. All of these technologies help users minimize the potential damage from cyber-incidents and reduce the Mean Time to Respond (MTTR) and the Mean Time to Detect (MTTD). Â We continue to improve the usability and performance of our SIEM system, with a focus on deploying AI to free information security employees from even more routine tasks. Follow updates of the Kaspersky Unified Monitoring and Analysis Platform on the official product page.

When Getting Phished Puts You in Mortal Danger

krebsonsecurity Mar 27, 2025 A Little Sunshine

Many successful phishing attacks result in a financial loss or malware infection. But falling for some phishing scams, like those currently targeting Russians searching online for organizations that are fighting the Kremlin war machine, can cost you your freedom or your life. The real website of the Ukrainian show more ...

paramilitary group “Freedom of Russia” legion. The text has been machine-translated from Russian. Researchers at the security firm Silent Push mapped a network of several dozen phishing domains that spoof the recruitment websites of Ukrainian paramilitary groups, as well as Ukrainian government intelligence sites. The website legiohliberty[.]army features a carbon copy of the homepage for the Freedom of Russia Legion (a.k.a. “Free Russia Legion”), a three-year-old Ukraine-based paramilitary unit made up of Russian citizens who oppose Vladimir Putin and his invasion of Ukraine. The phony version of that website copies the legitimate site — legionliberty[.]army — providing an interactive Google Form where interested applicants can share their contact and personal details. The form asks visitors to provide their name, gender, age, email address and/or Telegram handle, country, citizenship, experience in the armed forces; political views; motivations for joining; and any bad habits. “Participation in such anti-war actions is considered illegal in the Russian Federation, and participating citizens are regularly charged and arrested,” Silent Push wrote in a report released today. “All observed campaigns had similar traits and shared a common objective: collecting personal information from site-visiting victims. Our team believes it is likely that this campaign is the work of either Russian Intelligence Services or a threat actor with similarly aligned motives.” Silent Push’s Zach Edwards said the fake Legion Liberty site shared multiple connections with rusvolcorps[.]net. That domain mimics the recruitment page for a Ukrainian far-right paramilitary group called the Russian Volunteer Corps (rusvolcorps[.]com), and uses a similar Google Forms page to collect information from would-be members. Other domains Silent Push connected to the phishing scheme include: ciagov[.]icu, which mirrors the content on the official website of the U.S. Central Intelligence Agency; and hochuzhitlife[.]com, which spoofs the Ministry of Defense of Ukraine & General Directorate of Intelligence (whose actual domain is hochuzhit[.]com). According to Edwards, there are no signs that these phishing sites are being advertised via email. Rather, it appears those responsible are promoting them by manipulating the search engine results shown when someone searches for one of these anti-Putin organizations. In August 2024, security researcher Artem Tamoian posted on Twitter/X about how he received startlingly different results when he searched for “Freedom of Russia legion” in Russia’s largest domestic search engine Yandex versus Google.com. The top result returned by Google was the legion’s actual website, while the first result on Yandex was a phishing page targeting the group. “I think at least some of them are surely promoted via search,” Tamoian said of the phishing domains. “My first thread on that accuses Yandex, but apart from Yandex those websites are consistently ranked above legitimate in DuckDuckGo and Bing. Initially, I didn’t realize the scale of it. They keep appearing to this day.” Tamoian, a native Russian who left the country in 2019, is the founder of the cyber investigation platform malfors.com. He recently discovered two other sites impersonating the Ukrainian paramilitary groups — legionliberty[.]world and rusvolcorps[.]ru — and reported both to Cloudflare. When Cloudflare responded by blocking the sites with a phishing warning, the real Internet address of these sites was exposed as belonging to a known “bulletproof hosting” network called Stark Industries Solutions Ltd. Stark Industries Solutions appeared two weeks before Russia invaded Ukraine in February 2022, materializing out of nowhere with hundreds of thousands of Internet addresses in its stable — many of them originally assigned to Russian government organizations. In May 2024, KrebsOnSecurity published a deep dive on Stark, which has repeatedly been used to host infrastructure for distributed denial-of-service (DDoS) attacks, phishing, malware and disinformation campaigns from Russian intelligence agencies and pro-Kremlin hacker groups. In March 2023, Russia’s Supreme Court designated the Freedom of Russia legion as a terrorist organization, meaning that Russians caught communicating with the group could face between 10 and 20 years in prison. Tamoian said those searching online for information about these paramilitary groups have become easy prey for Russian security services. “I started looking into those phishing websites, because I kept stumbling upon news that someone gets arrested for trying to join [the] Ukrainian Army or for trying to help them,” Tamoian told KrebsOnSecurity. “I have also seen reports [of] FSB contacting people impersonating Ukrainian officers, as well as using fake Telegram bots, so I thought fake websites might be an option as well.” Search results showing news articles about people in Russia being sentenced to lengthy prison terms for attempting to aid Ukrainian paramilitary groups. Tamoian said reports surface regularly in Russia about people being arrested for trying carry out an action requested by a “Ukrainian recruiter,” with the courts unfailingly imposing harsh sentences regardless of the defendant’s age. “This keeps happening regularly, but usually there are no details about how exactly the person gets caught,” he said. “All cases related to state treason [and] terrorism are classified, so there are barely any details.” Tamoian said while he has no direct evidence linking any of the reported arrests and convictions to these phishing sites, he is certain the sites are part of a larger campaign by the Russian government. “Considering that they keep them alive and keep spawning more, I assume it might be an efficient thing,” he said. “They are on top of DuckDuckGo and Yandex, so it unfortunately works.” Further reading: Silent Push report, Russian Intelligence Targeting its Citizens and Informants.

Fake DeepSeek Ads Spread Malware to Google Users

darkreading Mar 27, 2025 Feed

Popularity of the generative AI platform makes it an obvious choice for cybercriminals abusing Google-sponsored search results, according to researchers.

OpenAI Bumps Up Bug Bounty Reward to $100K in Security Update

darkreading Mar 27, 2025 Feed

The artificial intelligence research company previously had its maximum payout set at $20,000 before exponentially raising the reward.

How CISA Cuts Impact Election Security

darkreading Mar 27, 2025 Feed

State and federal security experts weighed in on the impact that budgetary and personnel cuts to CISA will have on election security as a whole.

Student-Powered SOCs Train Security's Next Generation

darkreading Mar 27, 2025 Feed

University security operations centers that hire and train students are a boon to state and local governments while giving much-needed Tier 1 cybersecurity training to undergraduates.

High-Severity Cloud Security Alerts Tripled in 2024

darkreading Mar 27, 2025 Feed

Attackers aren't just spending more time targeting the cloud — they're ruthlessly stealing more sensitive data and accessing more critical systems than ever before.

DoJ Recovers $5M Lost in BEC Fraud Against Workers' Union

darkreading Mar 27, 2025 Feed

The union received a spoofed email that led to the loss of $6.4 million, much of it transferred to other accounts or to a cryptocurrency exchange.

Hoff's Rule: People First

darkreading Mar 27, 2025 Feed

Dark Reading Confidential Episode 5: Christofer Hoff, chief secure technology officer at LastPass, shares the human side of the story of how he led his team through a major cyber incident and built from the ground up a security team and security culture.

British company Advanced fined £3m by privacy regulator over ransomware attack

cyware Mar 27, 2025 Government

A business that provides IT services to numerous healthcare providers in the United Kingdom has been fined about $4 million by the country’s privacy regulator over a ransomware attack in 2022.

Ukraine’s state railway restores online ticket sales after major cyberattack

cyware Mar 27, 2025 Cybercrime

Ukraine’s state railway operator, Ukrzaliznytsia, has resumed online ticket sales after a cyberattack brought down its systems earlier in the week.

European officials increasingly certain Baltic Sea cable breaks are accidental, not sabotage

cyware Mar 27, 2025 Government

Officials from several European countries on the North Sea and Baltic Sea said there is increasing confidence that a series of submarine cable breaks were accidental and not directed by the Kremlin.

Russia arrests three for allegedly creating Mamont malware, tied to over 300 cybercrimes

cyware Mar 27, 2025 Cybercrime

Russian authorities said they arrested three people and seized hardware in an operation against Mamont malware, which specializes in stealing money from Android device users.

Russian media, academia targeted in espionage campaign using Google Chrome zero-day exploit

cyware Mar 27, 2025 Cybercrime

“We have discovered and reported dozens of zero-day exploits actively used in attacks, but this particular exploit is certainly one of the most interesting we’ve encountered,” researchers from Kaspersky said in their analysis published Tuesday.

Two Serbian journalists reportedly targeted with Pegasus spyware

cyware Mar 27, 2025 Cybercrime

Two investigative journalists in Serbia were targeted with advanced commercial spyware last month, Amnesty International said Thursday.