Oktacron - Cyber Security RSS Feeds History

Cyber Monday 2025: How Shoppers Are Being Fooled by ‘Too Good to Be True’ Deals

cyberexpress Dec 01, 2025 Cyber Essentials

fCyber Monday scams in 2025 are increasing at a time when phishing, credential theft, and financial cybercrime are already at some of the highest levels seen this year. Attackers know shoppers are distracted by discounts and rushed checkout decisions, and they are using this moment to launch more convincing scams than show more ...

ever. In November, the National Cyber Security Centre (NCSC) warned that phishing emails are becoming extremely realistic. One recent example involved emails pretending to be from the Canton of Zurich. The messages copied the government’s logo, layout, and tone, pressuring people to update information for “new cryptocurrency tax rules.” Victims were taken to a fake website that looked exactly like the real portal. After entering personal and financial details, they were redirected to the genuine website, so nothing felt suspicious. This pattern isn’t limited to Europe. Microsoft’s Digital Defense Report 2025 found that 52% of cyberattacks are now financially motivated, while only 4% relate to espionage. The report shows attackers are more focused on quick money, data theft, and extortion than anything else. Japan has also seen a spike. The Financial Services Agency reported nearly USD 700 million in unauthorized trades since March, after cybercriminals stole login details from fake securities websites and infostealer malware. Attackers then sent follow-up phishing emails pretending to be regulators to lure victims again, showing how far they go to keep the scam going. With these global trends already in motion, Cyber Monday scams in 2025 are expected to hit even harder, using fake deals, phishing emails, and fraudulent apps to trick shoppers during the busiest online shopping week of the year. Fake Deals: The Most Common Cyber Monday Scam Fake deals continue to be one of the biggest Cyber Monday scams. Criminals create websites that look identical to popular shopping platforms. These fake pages advertise impossible discounts and use professional product images to appear genuine. This year, attackers are using: Paid ads to push fake “Cyber Monday” offers AI-generated product photos Fake customer support chatboxes Websites designed to collect card details and passwords Many of these sites even send fake confirmation emails to make the purchase look real. Phishing Emails Designed for Holiday Shoppers Phishing emails increase sharply during Cyber Monday week because shoppers expect order updates, delivery alerts, and discount codes. Attackers take advantage of this by sending emails that look like they’re from Amazon, courier services, or major retailers. Common tactics include: “Your order has been delayed” links Payment failure warnings Early-access Cyber Monday discounts QR codes leading to fake login pages These messages often use the correct logos and a domain name that looks almost identical to the real brand, making them harder to notice. Fake Mobile Apps Posing as Shopping Tools Another growing Cyber Monday scam involves fake mobile apps disguised as coupon apps, cashback tools, or sale trackers. Once installed, these apps can access personal details and intercept OTPs. Some harmful apps can: Read text messages Capture saved card information Monitor keystrokes Send fake push notifications Security researchers have also found fake apps pretending to be BNPL (Buy Now Pay Later) services, which become very active during Cyber Monday sales. AI-Powered Social Media Scams Social media is now one of the biggest sources of Cyber Monday scams. Attackers use AI to create fake influencer posts, discount videos, and promotional codes that link to malicious websites. These scams spread quickly because criminals use thousands of fake likes and comments to make the posts look trustworthy. Even after Cyber Monday ends, the impact continues. Stolen passwords and card details are used for: Account takeovers Unauthorized purchases Reward points theft Identity fraud Cybercriminals also test stolen password combinations across multiple websites, knowing many people reuse the same credentials. How Shoppers Can Stay Safe Following are the recommendations to avoid Cyber Monday scams in 2025. These easy habits help reduce risk during the holiday shopping rush. Double-check website URLs Avoid deals sent only through social media DMs Download apps only from official stores Turn on two-factor authentication Be careful with QR codes in emails Never enter card details on unfamiliar sites Cyber Monday scams in 2025 are becoming harder to spot as criminals use fake deals, phishing emails, and fraudulent apps to target busy shoppers. With global phishing incidents rising and financial cybercrime at record highs, staying alert is the best way to shop safely this season.

India Enforces Mandatory SIM-Binding for Messaging Apps Under New DoT Rules

cyberexpress Dec 01, 2025 Firewall Daily

India’s Department of Telecommunications (DoT) has introduced a shift in the way messaging platforms operate in the country, mandating the adoption of SIM-binding as a core security requirement. Under the Telecommunication Cybersecurity Amendment Rules, 2025, all major messaging services, including Telegram, and show more ...

regional platforms such as Arattai, must ensure that their applications remain continuously linked to an active SIM card on the user’s device. The mandate is part of the government’s intensified efforts to combat cyber fraud and strengthen nationwide cybersecurity compliance. The directive requires App-Based Communication Service providers to implement persistent SIM-linking within 90 days and submit detailed cybersecurity compliance reports within 120 days. The move seeks to eliminate longstanding gaps in identity verification systems that have enabled malicious actors to misuse Indian mobile numbers from outside the country. New Rules for SIM-Binding Communication According to the new requirements, messaging services must operate only when the user’s active SIM card matches the credentials stored by the app. If a SIM card is removed, replaced, or deactivated, the corresponding app session must immediately cease to function. The rules also extend to web-based interfaces: platforms must automatically log users out at least every six hours, requiring a QR-based reauthentication that is tied to the same active SIM. These changes aim to reduce the misuse of Indian telecom identifiers, which authorities say have been exploited for spoofing, impersonation, and other forms of cyber fraud. By enforcing strict SIM-binding, the DoT intends to establish a clearer traceability chain between the user, their device, and their telecom credentials. Why Stricter Controls Were Needed Government observations revealed that many communication apps continued functioning even after the linked SIM card was removed. This allowed foreign-based actors to operate accounts associated with Indian mobile numbers without proper authentication. The ability to hijack accounts or mask locations contributed directly to an uptick in cybercrimes, often involving financial scams or identity theft. Industry groups had previously flagged this vulnerability as well. The Cellular Operators Association of India (COAI), for instance, noted that authentication typically occurs only once, during initial setup, which leaves apps operational even if the SIM is no longer present. By requiring ongoing SIM-binding, authorities aim to close this loophole and establish reliable verification pathways essential for cybersecurity compliance. The new mandate draws support from multiple regulatory frameworks, including the Telecommunications Act, 2023, and subsequent cybersecurity rules issued in 2024 and 2025. Platforms that fail to comply could face penalties, service restrictions, or other legal consequences under India’s telecom and cybersecurity laws. Impact on Platforms and Users Messaging platforms must redesign parts of their infrastructure to support real-time SIM authentication and implement secure logout mechanisms for multi-device access. They are also expected to maintain detailed logs and participate in audits to demonstrate cybersecurity compliance. For users, the changes may introduce constraints. Accessing a messaging app without the original active SIM will no longer be possible. Cross-device flexibility, particularly through desktop or browser-based interfaces, may also be reduced due to the six-hour logout requirement. However, policymakers argue that these inconveniences are offset by a reduced risk of cyber fraud. India’s focus on SIM-binding aligns with practices already common in financial services. Banking and UPI applications, for example, require an active SIM for verification to minimize fraud. Other regulators have taken similar steps: earlier in 2025, the Securities and Exchange Board of India (SEBI) proposed linking trading accounts to specific SIM cards and incorporating biometric checks to prevent unauthorized transactions. India Mandates Pre-Installed Cybersecurity App on Smartphones In a parallel move to strengthen digital security, India’s telecom ministry has ordered all major smartphone manufacturers, including Apple, Samsung, Vivo, Oppo, and Xiaomi, to pre-install its cybersecurity app Sanchar Saathi on all new devices within 90 days, and push it via updates to existing devices. The app must be installed in a way that users cannot disable or delete it. Launched in January, Sanchar Saathi has already helped recover over 700,000 lost phones, blocked 3.7 million stolen devices, terminated 30 million fraudulent connections, and assists in tracking devices and preventing counterfeit phones. The app verifies IMEI numbers, blocks stolen devices, and combats scams involving duplicate or spoofed IMEIs. The move is aimed at strengthening India’s telecom cybersecurity but may face resistance from Apple and privacy advocates, as Apple traditionally opposes pre-installation of government or third-party apps. Industry officials have expressed concerns over privacy, user choice, and operational feasibility, while the government emphasizes the app’s role in digital safety and fraud prevention.

Australian Man Gets 7 Years for ‘Evil Twin’ WiFi Attacks

cyberexpress Dec 01, 2025 Cyber News

An Australian man has been sentenced to more than seven years in jail on charges that he created ‘evil twin’ WiFi networks to hack into women’s online accounts to steal intimate photos and videos. The Australian Federal Police (AFP) didn’t name the man in announcing the sentencing, but several Australian news show more ...

outlets identified him as Michael Clapsis, 44, of Perth, an IT professional who allegedly used his skills to carry out the attacks. He was sentenced to seven years and four months in Perth District Court on November 28, and will be eligible for parole after serving half that time, according to the Sydney Morning Herald. The AFP said Clapsis pled guilty to 15 charges, ranging from unauthorised access or modification of restricted data to unauthorised impairment of electronic communication, failure to comply with an order, and attempted destruction of evidence, among other charges. ‘Evil Twin’ WiFi Network Detected on Australian Domestic Flight The AFP investigation began in April 2024, when an airline reported that its employees had identified a suspicious WiFi network mimicking a legitimate access point – known as an “evil twin” – during a domestic flight. On April 19, 2024, AFP investigators searched the man’s luggage when he arrived at Perth Airport , where they seized a portable wireless access device, a laptop and a mobile phone. They later executed a search warrant “at a Palmyra home.” Forensic analysis of data and seized devices “identified thousands of intimate images and videos, personal credentials belonging to other people, and records of fraudulent WiFi pages,” the AFP said. The day after the search warrant, the man deleted more than 1,700 items from his account on a data storage application and “unsuccessfully tried to remotely wipe his mobile phone,” the AFP said. Between April 22 and 23, 2024, the AFP said the man “used a computer software tool to gain access to his employer’s laptop to access confidential online meetings between his employer and the AFP regarding the investigation.” The man allegedly used a portable wireless access device, called a “WiFi Pineapple,” to detect device probe requests and instantly create a network with the same name. A device would then connect to the evil twin network automatically. The network took people to a webpage and prompted them to log in using an email or social media account, where their credentials were then captured. AFP said its cybercrime investigators identified data related to use of the fraudulent WiFi pages at airports in Perth, Melbourne and Adelaide, as well as on domestic flights, “while the man also used his IT privileges to access restricted and personal data from his previous employment.” “The man unlawfully accessed social media and other online accounts linked to multiple unsuspecting women to monitor their communications and steal private and intimate images and videos,” the AFP said. Victims of Evil Twin WiFi Attack Enter Statements At the sentencing, a prosecutor read from emotional impact statements from the man’s victims, detailing the distress they suffered and the enduring feelings of shame and loss of privacy. One said, “I feel like I have eyes on me 24/7,” according to the Morning Herald. Another said, “Thoughts of hatred, disgust and shame have impacted me severely. Even though they were only pictures, they were mine not yours.” The paper said Clapsis’ attorney told the court that “He’s sought to seek help, to seek insight, to seek understanding and address his way of thinking.” The case highlights the importance of avoiding free public WiFi when possible – and not accessing sensitive websites or applications if one must be used. Any network that requests personal details should be avoided. “If you do want to use public WiFi, ensure your devices are equipped with a reputable virtual private network (VPN) to encrypt and secure your data,” the AFP said. “Disable file sharing, don’t use things like online banking while connected to public WiFi and, once you disconnect, change your device settings to ‘forget network’.”

Cryptocurrency Mixing Service, Millions in Bitcoin Seized by Law Enforcement

cyberexpress Dec 01, 2025 Cyber News

European law enforcement agencies have taken down an illegal cryptocurrency mixing service that they say has been used to facilitate cybercrime and money laundering. The operation to take down the cryptocurrency mixing service ‘Cryptomixer’ was conducted between November 24 and 28 and was announced today by show more ...

Europol, which assisted Swiss and German law enforcement agencies in the action. The operation resulted in the seizure of three servers in Switzerland, 12 terabytes of data, €25 million in Bitcoin, and the cryptomixer[.]io domain. Law enforcement placed a seizure banner on the website after the takeover. “Mixing services such as Cryptomixer offer their clients anonymity and are often used before criminals redirect their laundered assets to cryptocurrency exchanges,” Europol said. “This allows ‘cleaned’ cryptocurrency to be exchanged for other cryptocurrencies or for FIAT currency through cash machines or bank accounts.” Cryptocurrency Mixing ‘A Service to Obfuscate the Origin of Criminal Funds’ Europol called Cryptomixer “A service to obfuscate the origin of criminal funds.” “Cryptomixer was a hybrid mixing service accessible via both the clear web and the dark web,” the European law enforcement agency stated. “It facilitated the obfuscation of criminal funds for ransomware groups, underground economy forums and dark web markets. Its software blocked the traceability of funds on the blockchain, making it the platform of choice for cybercriminals seeking to launder illegal proceeds from a variety of criminal activities, such as drug trafficking, weapons trafficking, ransomware attacks, and payment card fraud.” Since its launch in 2016, Europol says that more than €1.3 billion in Bitcoin were mixed through the service. Deposited funds from users were pooled “for a long and randomised period” before they were redistributed to their destination addresses. “As many digital currencies provide a public ledger of all transactions, mixing services make it difficult to trace specific coins, thus concealing the origin of cryptocurrency,” the agency said. Action Follows ChipMixer Takedown in 2023 Europol was also involved in the multi-national takedown of the crypto mixing service “ChipMixer” in 2023, an operation that involved four European countries and the U.S. ChipMixer was considered the largest mixing service of its time, and was suspected to have facilitated the laundering of 152,000 Bitcoins, worth an estimated €2.73 billion at the time. The joint law enforcement operations in both cases was part of EMPACT, the European Multidisciplinary Platform Against Criminal Threats, which aims to address the most important threats posed by organized and international crime affecting the EU.

Linux Kernel 6.18 Launches With Big Architectural Upgrades and Bcachefs Removal

cyberexpress Dec 01, 2025 Firewall Daily

The Linux Kernel project reached another milestone with the official release of version 6.18, announced by Linus Torvalds. This update introduces a wide array of architectural changes, hardware enablement improvements, and feature adjustments, while also signaling a notable shift in how certain subsystems are show more ...

maintained. Although the release is immediately available from kernel.org or Torvalds’ public git tree, users are generally advised to wait for their distributions to publish the update in their stable repositories. Major Subsystem Changes and the Removal of Bcachefs One of the most consequential shifts in Linux 6.18 is the complete removal of native support for the Bcachefs file system from the mainline kernel. Bcachefs will now only be obtainable as a DKMS module, marking the first time a kernel release has fully detached it from the core codebase. Alongside this change, Linux 6.18 introduces the Rust Binder driver and a new dm-pcache device-mapper target, enabling persistent memory to serve as a caching layer for slower block devices. Administrators on x86 platforms gain a new microcode= command-line option, offering greater flexibility in controlling microcode-loading behavior. File system updates extend across multiple components. The kernel adds support for file handles within kernel namespaces and introduces initial block-size-greater-than-page-size handling for Btrfs. LoongArch KVM now includes PTW feature detection on newer hardware, while the kernel gains support for running as a guest under FreeBSD’s Bhyve hypervisor. Networking, Virtualization, and Performance Improvements Linux 6.18 brings a variety of enhancements to networking and virtualization capabilities. These include PSP encryption support for TCP connections, mixed CQE size support in shared ring buffers, additional Alder Lake-S SoC compatibility, AMD Secure AVIC guest support, and BPF arenas for the PowerPC architecture. Performance-oriented improvements include better swap behavior and improved scaling for NFS servers, complemented by higher UDP receive performance. A new “sheaves” feature aims to optimize kernel memory allocation, while User-mode Linux gains support for sparse interrupts. The EXT4 file system now supports 32-bit reserved user and group IDs and features a new ioctl() interface for querying and adjusting superblock parameters. The TCP stack receives early support for Accurate Explicit Congestion Notification (AccECN), and OverlayFS now provides case-folding functionality. KVM has been updated to support control-flow enforcement technology (CET) on both Intel and AMD processors. Additional enhancements include SEV-SNP CipherText Hiding for x86 hosts and preserved vmalloc allocations through Kexec HandOver (KHO). Security updates range from multi-LSM support within the audit subsystem to the ability to sign BPF programs. The TPM feature TPM2_TCG_HMAC is now disabled by default. Hardware Enablement and Future Outlook for Linux Kernel Linux 6.18 expands hardware coverage with new and updated drivers. These include an EDAC driver for AMD VersalNET memory controllers, which reports hardware issues from several IP blocks using IPC-style transport, and an EDAC driver for ADM Cortex-A72 cores to report L1 and L2 cache errors. Additional device-related improvements include a virtio SPI driver allowing SPI devices to operate within virtual machines, support for the DualSense controller’s audio jacks, extended HID handling for haptic touchpads, and enablement for Apple’s M2 Pro, M2 Max, and M2 Ultra SoCs. With Linux 6.18 finalized, attention shifts to Linux 6.19. The first release candidate is scheduled for December 14, and the full release is expected in early February 2026. Because 6.18 is the final kernel release of the year, it stands as a strong contender to become the next LTS Kernel Series, though official confirmation awaits input from long-standing maintainer Greg Kroah-Hartman.

South Korea’s Coupang Hit by Massive Data Breach Affecting Nearly 34 Million Customers

cyberexpress Dec 01, 2025 Cyber News

South Korean e-commerce giant Coupang has confirmed a massive data breach that exposed personal information belonging to nearly 33.7 million customers, making it one of the country’s largest cybersecurity incidents in recent years. The company publicly apologised over the weekend, acknowledging that the Coupang data show more ...

breach stemmed from unauthorised access that may have continued undetected for months. Park Dae-jun, CEO of Coupang, issued a statement on the company’s website saying, “We sincerely apologise once again for causing our customers inconvenience.” The firm, often referred to as the “Amazon of South Korea,” said it is cooperating with law enforcement and regulatory authorities as investigations continue. Coupang Data Breach Went Undetected for Months According to Coupang, the unauthorised access began on June 24 through overseas servers but was only discovered on November 18. The company initially believed only about 4,500 accounts were affected. However, further analysis revealed that 33.7 million users had some form of delivery-related personal information exposed. The leaked data includes customer names, phone numbers, email addresses, shipping addresses, and certain order histories. Coupang stressed that no payment card information, financial data, or login credentials were compromised. The company has 24.7 million active commercial users as of the third quarter, which means the Coupang data breach covers almost its entire user base. Former Employee Identified as Main Suspect South Korean police confirmed that they have secured the IP address used in the attack and have identified the suspect behind the breach. Investigators say the individual is a former Coupang employee, a Chinese national who has already left South Korea. “We are analysing server logs submitted by Coupang. We have secured the IP used by the suspect and are tracking them down,” an official at the Seoul Metropolitan Police said. Authorities are also verifying whether the individual is linked to an email sent to Coupang threatening to reveal the stolen information. Government Steps In as Public Concern Rises The Ministry of Science and ICT held an emergency meeting on Sunday to review the scale of the incident and assess whether Coupang violated any personal information protection rules. Minister Bae Kyung-hoon said regulators are closely monitoring the company’s handling of the breach. The Korea Internet & Security Agency (KISA) issued a public advisory warning users to remain alert for phishing attempts or scam messages pretending to be from Coupang. So far, police have not received reports of smishing or voice phishing linked to the breach, but authorities say preparations are in place in case the situation escalates. The Coupang data breach adds to growing frustration among South Korean consumers, who have witnessed a series of major data leaks this year. SK Telecom and other large companies have faced similar cybersecurity incidents, increasing pressure on businesses to strengthen internal security controls. Coupang Issues Customer Guidance The company has started notifying impacted customers through email and text messages. In an FAQ shared with users, Coupang clarified what information was exposed and what steps customers should take. The company reiterated that payment, card details, and passwords were not affected. Coupang also explained that it notified authorities immediately after confirming the issue and is committed to updating customers as the investigation progresses. For now, the company says users do not need to take additional action beyond remaining cautious of unsolicited calls, links or messages claiming to be from Coupang. Police are verifying the suspect’s identity, travel history, and potential motives. They are also examining whether the individual acted alone or was linked to a wider scheme. The case has now moved from an internal inquiry to a full-scale criminal investigation. As authorities continue to analyse server logs and cross-border activity, concerns remain that the scale or impact of the Coupang data breach could grow. For now, officials say there is no evidence of financial misuse, but investigations are still in early stages.

Airbus Nears Completion of A320 Retrofit as Regulators Monitor Largest Emergency Recall in Company History

cyberexpress Dec 01, 2025 Firewall Daily

Airbus has entered the final phase of its unprecedented global retrofit effort, confirming that fewer than 100 A320s in service still require updates after the discovery of a software vulnerability that triggered the largest emergency recall the manufacturer has ever executed. The company disclosed on Monday that show more ...

nearly the entire A320-family fleet, about 6,000 aircraft worldwide, has now received the mandated modification. Origins of the Airbus Recall and Early Regulatory Response The action followed a recent mid-air incident involving a JetBlue A320 in which the aircraft experienced a sudden altitude drop. Investigators later identified that intense solar flares may have compromised data essential to the jet’s flight-control functions, exposing a software vulnerability in the system managing the aircraft’s nose-angle performance. The incident alarmed regulators around the world and quickly led to mandatory retrofit orders across the global fleet of A320s. Airbus moved quickly, implementing what it described as a “precautionary fleet action” and issuing an eight-page safety alert that initiated immediate groundings. The timing created operational chaos for many carriers, particularly in the United States, where the rush to complete the required updates collided with the heavy travel surge over the Thanksgiving weekend. Airlines from Asia to South America were compelled to take aircraft out of service with little warning as the scale of the issue emerged. Sources familiar with the internal decision-making reported that the recall was initiated shortly after engineers drew a potential connection between the JetBlue event and the flawed software logic. The findings pointed to how solar radiation could corrupt flight-control data, prompting Airbus to request urgent repairs before allowing affected aircraft back into rotation. Operational Disruptions Across Airlines Worldwide The consequences were immediate for operators. Avianca, based in Colombia, suspended new bookings until December 8 in order to manage the grounding of its impacted A320s. Finnair and other carriers were forced to inspect their fleets on one aircraft at a time because Airbus’s initial alert did not list specific serial numbers, complicating efforts to determine which jets required urgent attention. Airbus detailed the nature of the issue in a formal statement: “Analysis of a recent event involving an A320 Family aircraft has revealed that intense solar radiation may corrupt data critical to the functioning of flight controls. Airbus has consequently identified a significant number of A320 Family aircraft currently in-service which may be impacted.” The company added that it worked “proactively with the aviation authorities” to implement available software and hardware protections, acknowledging the operational disruptions and apologizing to passengers while emphasizing that safety remains its “number one and overriding priority.” Implementing the Fix and Remaining Challenges The mandated fix itself was relatively straightforward but required precise execution. Technicians reverted affected A320s to an earlier version of the software governing the aircraft’s nose-angle system. This involved uploading the legacy software through a data-loader device brought directly into the cockpit, a measure designed to prevent cyber interference. While the installation process was simple in principle, each aircraft had to be updated individually, creating workload bottlenecks for carriers with large fleets. Airlines also faced an unexpected hurdle: a shortage of data loaders. One industry executive noted privately that some operators had only a handful of these devices on hand, slowing the pace of updates during a period when hundreds of A320s required immediate attention. In addition, an unspecified number of older aircraft will ultimately need full computer replacements rather than software changes, adding another layer of complexity for maintenance teams. Even with these challenges, the majority of the fleet has now been restored to service, marking good progress just days after regulators issued their emergency directives. With fewer than 100 jets awaiting updates, Airbus appears close to closing one of the most disruptive safety events ever to affect the A320 family, an episode that reshaped holiday travel plans worldwide and highlighted the unexpected risks posed by solar radiation on modern aircraft systems.

Kaspersky Embedded Systems Security: what's new?

kaspersky Dec 01, 2025 Business

What generates the fastest profit for cybercriminals? Attacking systems that can help them access confidential information or finances directly. Therefore, it’s no surprise that entire groups of cybercriminals specialize in embedded systems: primarily ATMs full of cash, payment systems where transactions can be show more ...

intercepted, medical equipment where personal data is processed and stored, and so on. All these devices often have less than an adequate level of security (both cyber and physical), making them a convenient target for attackers. The classic challenge of protecting embedded systems running Windows is that their hardware typically becomes obsolete much slower than their software. These are often expensive devices that organizations won’t replace simply because the operating system has stopped receiving updates. The result is a high percentage of embedded devices with limited resources due to their narrow specialization, outdated software, and an operating system that’s no longer supported by manufacturer. The end of support for Windows 10 is exacerbating this last issue. A multitude of devices that are perfectly capable of performing their primary functions for years to come will never be able to upgrade to Windows 11 — simply because they lack a TPM module. The situation isn’t much better in the market for embedded Linux devices. Those built on x86 processors generally have newer hardware — but even that becomes outdated over time. Furthermore, many new embedded systems running Linux are based on the ARM architecture, which has its own specific requirements and challenges. Because of these unique characteristics, standard endpoint security solutions are a poor fit. Protecting these devices requires a product equipped with technologies that can effectively counter modern threats targeting embedded systems. At the same time, it must be capable of running not only on modern hardware with the latest OS versions, but also on resource-constrained devices, and should be able to provide ideal stability in “unattended” mode, plus compatibility with specific embedded software. Ideally, it should be manageable from the same console as the rest of owner’s IT infrastructure, and support integration with corporate SIEM systems. As you’ve probably guessed, we’re talking about Kaspersky Embedded Systems Security. How Kaspersky Embedded Systems Security can help We’ve talked repeatedly in this blog about the specific challenges of securing embedded systems, and our take on the same. However, Kaspersky Embedded Systems Security continues to evolve. In late November, we released a sweeping product update that enhances both the Windows and Linux versions. What’s new in Kaspersky Embedded Systems Security for Windows Our experts have overhauled the solution’s codebase, adding a range of advanced threat detection and blocking mechanisms. The cornerstone of this update is a full-fledged behavioral analysis engine, which powers several technologies essential for modern device protection: Our non-invasive Automatic Exploit Prevention technology, already proven in other products, is a reliable tool for blocking the exploitation of known and new vulnerabilities. It’s been instrumental in helping our experts discover numerous zero-day vulnerabilities in past years. Our advanced Anti-Cryptor technology serves as an additional layer of defense against ransomware. Leveraging the behavioral engine, it now more effectively detects and blocks local attempts to encrypt files. Our Remediation Engine is designed to roll back malicious changes made to a device. Even if attackers manage to bypass other security mechanisms and execute malicious code, its activity would be promptly detected, and all changes it made reverted. This is also particularly effective in combating ransomware. Another technology added to the updated Kaspersky Embedded Systems Security for Windows is BadUSB Attack Prevention. In a BadUSB attack, a malicious device that mimics a legitimate input peripheral — most often a keyboard — is connected to the target system. Through this device, the attacker can then cause all sorts of problems: input their own commands, intercept data entered from other devices (such as the login credentials of a service technician), cause denial of service, and more. This threat is especially relevant for embedded systems installed outside a company’s physical security perimeter. A BadUSB device plugged into the port of a standalone ATM in a remote rural area can go unnoticed for months and, unless blocked by a security solution, inflict significant damage. We’ve also added our firewall to the solution. This allows administrators to control network access for specific applications via rules based on predefined trust levels for that software. Since an embedded device typically has a limited set of tasks, it makes sense to only permit network access for the applications that genuinely need it to function properly, while blocking all others. This not only makes life harder for attackers attempting to communicate with command-and-control (C&C) servers or exfiltrate data, but also reduces the risk of the system being used as a platform to attack the rest of the corporate infrastructure. Finally, for administrator convenience, we’ve added a security status indicator, or a “traffic light”. This provides an at-a-glance assessment of how thoroughly each device is configured, showing whether all critical protection technologies are enabled, or if an administrator needs to review the settings and check the device’s security posture. What’s new in Kaspersky Embedded Systems Security for Linux We’ve also significantly enhanced the new Kaspersky Embedded Systems Security for Linux. While most of the improvements boost the effectiveness of existing protection mechanisms, one fundamental change is our revamped application allowlist control system. It now uses certificate-based signing to streamline the process of updating the system and the applications required by the embedded device. Unlike Windows, Linux systems don’t have a universal, ready-made certificate infrastructure that we could simply support. Therefore, at the request of one of our largest customers, we built our own. As a result, there’s no longer a need to regularly create and completely redeploy a full golden system image to every device — though, of course, you can continue to do this if your company needs it for any reason. Now, you simply need to sign a new application with your certificate, and the allowlist system in Kaspersky Embedded Systems Security will accept it and allow it to run without any further issues. Another new technology in Kaspersky Embedded Systems Security for Linux is Web Threat Protection. The average usage model for embedded systems implies that it’s not the most useful feature on a device without a direct user. However, in practice, there are scenarios where embedded systems do use web protocols. For instance, some PoS devices require access to a corporate web-based CRM system, and the medical terminal can communicate in the same way with the internal portal that manages patient data. Such system could be compromised by attackers to perform a watering hole attack — infecting machines that connect to it. Furthermore, this protection is essential when using Kaspersky Embedded Systems Security on a regular computer with an outdated OS and no hope of updating it, rather than on an embedded system. Future development plans for Kaspersky Embedded Systems Security The next major product update is scheduled for the first quarter of 2026. In it, we plan to: Achieve full compatibility between Kaspersky Embedded Systems Security and the Kaspersky Managed Detection and Response This will allow our SOC experts to assist companies that use embedded devices in detecting complex, stealthy threats, and providing recommendations for effective incident mitigation. Integrate the BadUSB attack prevention technology into Kaspersky Embedded Systems Security for Linux, mirroring the capability already available in the Windows version. Add support for the ARM architecture to Kaspersky Embedded Systems Security for Linux, enabling us to provide comprehensive protection for the new energy-efficient embedded systems that are rapidly gaining market share. You can learn more about Kaspersky Embedded Systems Security on the official product page.

Tomiris Unleashes 'Havoc' With New Tools, Tactics

darkreading Dec 01, 2025 Feed

The Russian-speaking group is targeting government and diplomatic entities in CIS member states and Central Asia in its latest cyber-espionage campaign.

Shai-hulud 2.0 Variant Threatens Cloud Ecosystem

darkreading Dec 01, 2025 Feed

The latest attack from the self-replicating npm-package poisoning worm can also steal credentials and secrets from AWS, Google Cloud Platform, and Azure.

Police Disrupt 'Cryptomixer,' Seize Millions in Crypto

darkreading Dec 01, 2025 Feed

Multiple European law enforcement agencies recently disrupted Cryptomixer, a service allegedly used by cybercriminals to launder ill-gotten gains from ransomware and other cyber activities.

CodeRED Emergency Alert Platform Shut Down Following Cyberattack

darkreading Dec 01, 2025 Feed

The Inc ransomware gang took responsibility for the attack earlier this month and claimed it stole sensitive subscriber data.

Data breach hits 'South Korea's Amazon,' potentially affecting 65% of country’s population

cyware Dec 01, 2025 Cybercrime

South Korean online retail giant Coupang apologized for a data breach that prompted an emergency meeting by senior government officials.

Cryptomixer platform raided by European police; $29 million in bitcoin seized

cyware Dec 01, 2025 Cybercrime

Police in Switzerland and Germany led an operation to take down Cryptomixer, which handled about $1.5 billion in cryptocurrency since 2016, much of it from illicit sources, Europol said.

Russia limits WhatsApp use, claiming it enables terrorism, crime, espionage

cyware Dec 01, 2025 Nation-state

Russian users of WhatsApp reported disruptions as authorities limited access to the app, which they said enabled fraud, terrorism and possibly a recent leak of diplomatic communications with the U.S.

Officials accuse North Korea’s Lazarus of $30 million theft from crypto exchange

cyware Dec 01, 2025 Cybercrime

Yonhap News Agency reported on Friday that South Korean government officials are involved in the investigation surrounding $30 million worth of cryptocurrency that was stolen from Upbit on Wednesday evening.

Edtech company settles with FTC in wake of data breach

cyware Dec 01, 2025 Government

Wisconsin-based Illuminate Education will implement a data security program and delete unnecessary data under an agreement with the Federal Trade Commission prompted by a 2021 breach of the company's network.