Oktacron - Cyber Security RSS Feeds History

The Cyber Express Weekly Roundup: Space Security, Malware & Regulatory Alerts

cyberexpress Feb 27, 2026 Firewall Daily

In this week’s edition of The Cyber Express weekly roundup, some interesting news and cybersecurity stories share an interesting shift in the cyber domain. Critical developments span space cybersecurity, AI vulnerabilities, mobile malware, and global regulatory enforcement, highlighting how digital threats are show more ...

becoming more sophisticated and interconnected. From government-led initiatives to strengthen national defense, to high-profile breaches impacting multinational enterprises, and the rise of AI-augmented attacks, this cybersecurity news digest provides a detailed snapshot of the challenges facing organizations, agencies, and individual users worldwide. This weekly roundup from The Cyber Express emphasizes the urgent need for stakeholders across all sectors to stay informed, adapt strategies in real time, and anticipate new cyber threats before they escalate. The Cyber Express Weekly Roundup India Strengthens Space Cybersecurity India has unveiled new space cybersecurity guidelines developed jointly by the Indian Computer Emergency Response Team (CERT-In) and SatCom Industry Association India (SIA-India). Announced at the DefSat Conference & Expo 2026 in New Delhi, the framework introduces risk-based, secure-by-design practices for satellites, ground systems, and supply chains. Read more... Apple Devices Certified for NATO Restricted Data Apple Inc. has become the first consumer device maker approved to handle NATO “restricted” classified information on standard iPhone and iPad devices running iOS 26 and iPadOS 26. Certification, granted following testing by Germany’s Federal Office for Information Security, allows personnel across NATO member states to use commercial devices without specialized security software. Read more... OpenClaw Vulnerability Threatens Local AI Agents Security researchers have discovered a critical flaw in the open-source AI agent OpenClaw, allowing any malicious website visited by a developer to hijack the locally running agent. The vulnerability, present in OpenClaw’s local WebSocket gateway, permitted password brute-forcing and administrative access without plugins or user interaction. Read more... Cisco SD-WAN Zero-Day Exploitation Spans Three Years Cisco Systems’ Catalyst SD-WAN controllers were compromised via a critical zero-day flaw (CVE-2026-20127) for at least three years, according to Cisco Talos. Threat actors exploited the authentication bypass to gain administrative access and insert rogue peers, chaining the exploit with an older vulnerability (CVE-2022-20775) to escalate privileges while avoiding detection. Read more... U.S. Sanctions Russian Zero-Day Broker The U.S. Department of State sanctioned Operation Zero, a Russia-linked cyber brokerage network, targeting Russian national Sergey Sergeyevich Zelenyuk and associated entities. Authorities allege Australian national Peter Williams stole eight classified exploits from a U.S. defense contractor between 2022 and 2025, selling them for $1.3 million in cryptocurrency. Read more... X Appeals €120M EU Fine Social media platform X has filed an appeal against a €120 million penalty under the EU Digital Services Act, challenging enforcement related to its paid verification system, advertising disclosures, and public data access for researchers. X claims procedural errors and misinterpretation of obligations, framing the case as a precedent-setting test for platform accountability, user trust, and regulatory compliance. Read more... Weekly Takeaway This week’s The Cyber Express weekly roundup highlights how cybersecurity risks are advancing across sectors, from national space programs to AI agents, mobile malware, and critical infrastructure. Organizations and regulators must adapt in real time, balancing innovation with governance, monitoring, and incident preparedness. As this cybersecurity news highlights, proactive measures remain essential in a complex digital environment.

India Strengthens Space Cyber Security with New CERT-In and SIA-India Framework

cyberexpress Feb 27, 2026 Policy Updates

India’s rapidly expanding space sector has received a major policy push with the release of new space cyber security guidelines aimed at strengthening protection across satellite and ground infrastructure. The framework, jointly developed by the Indian Computer Emergency Response Team (CERT-In) and SatCom Industry show more ...

Association India (SIA-India), signals a growing recognition that cyber resilience is now as critical to space missions as launch capability itself. The guidelines were unveiled during the DefSat Conference & Expo 2026 held in New Delhi, India, at a time when satellite communication systems are increasingly becoming the backbone of connectivity, navigation, defense operations, and disaster management across the country. Space Cyber Security Moves from Technical Layer to Strategic Priority India’s space ecosystem is no longer limited to government-led missions. The rapid rise of private satellite operators, ground station providers, and space-tech startups has significantly expanded the attack surface. As satellite communication networks support everything from banking connectivity in remote regions to military operations, the importance of space cyber security has moved beyond technical discussions into national strategic planning. The new framework acknowledges this shift by outlining security controls across the entire satellite lifecycle, from space assets and ground stations to supply chains and user terminals. It also highlights emerging risks such as signal spoofing, unauthorized command uplinks, firmware manipulation, and ground infrastructure compromise. [caption id="attachment_109838" align="aligncenter" width="602"] Image Source: PIB[/caption] These space cyber security guidelines are advisory in nature but provide a structured baseline for organizations to assess and improve their cyber posture. Importantly, the document pushes stakeholders to adopt risk-based governance rather than reactive compliance. A Collaborative Model for Space Sector Cyber Resilience According to Sanjay Bahl, Director General of CERT-In, “CERT-In remains steadfast in strengthening the cyber resilience of all sectors across Bharat. Recognizing the strategic importance of space systems, including satellite communication networks, to India’s technological sovereignty and future growth, these comprehensive guidelines establish a unified and forward-looking framework by considering defense in depth, breadth and height to safeguard satellite networks, ground infrastructure, space related supply chains and space assets against the rapidly evolving and increasingly sophisticated cyber threat landscape.” The emphasis on layered defense reflects a broader industry realization—traditional IT security models are insufficient for space systems, where physical assets in orbit cannot be easily patched or replaced. Subba Rao Pavuluri, President of SIA-India, highlighted the importance of public-private collaboration: “Public Private Partnership and the considered views of industry are fundamental to strengthening cyber resilience across any sector. This joint guideline document issued by CERT-In and SIA India reflect a holistic and collaborative approach, integrating industry perspectives with the deep cyber security expertise of CERT-In. Together, they mark a significant step forward in advancing the cyber security posture of India’s space sector and reinforcing its preparedness against emerging digital threats.” The collaborative approach is particularly relevant as private players now design, launch, and operate critical satellite services. Rising Threat Landscape Forces a Shift in Security Thinking The urgency behind strengthening space cyber security becomes clearer when viewed against recent threat activity. Anil Prakash, Director General, SIA-India, highlighted the scale of the challenge, emphasizing that India’s expanding space ecosystem can no longer treat cybersecurity as a technical afterthought. “India’s expanding space ecosystem now requires cybersecurity to evolve from a technical afterthought into a core pillar of mission assurance. The joint framework developed with CERT-In institutionalizes resilience across satellites, ground infrastructure, and supply chains—particularly significant at a time when over 1.5 million cyberattack attempts were recorded during Operation Sindoor and attacks on government networks surged nearly sevenfold,” he said. He further explained, “In this evolving threat landscape, critical infrastructure and industry are equally vulnerable. Importantly, these cyber guidelines are based on an adaptive model and will be periodically refined through structured industry consultation to remain responsive to emerging threats and technological advancements.” Concluding with a call to action for the industry, Prakash noted, “For industry, this is a clear call to adopt secure-by-design architectures and align innovation with national security imperatives.” Why the Space Cyber Security Framework Matters Now The release of these space cyber security guidelines marks an important shift in how India approaches digital risk in space. Instead of reacting to incidents, the framework promotes proactive controls such as threat intelligence sharing, supply chain security validation, and governance mechanisms including the appointment of CISOs for satellite operations. More importantly, the framework positions space cyber security as a continuous process rather than a one-time compliance exercise. As satellite constellations grow and commercial launches accelerate, cyber resilience will increasingly determine operational reliability. India’s space ambitions are expanding rapidly—but without secure communication layers, innovation alone cannot sustain trust. The CERT-In and SIA-India framework is a timely reminder that the future of space is not just about reaching orbit—it is about securing it.

OpenClaw Vulnerability Exposes How an Open-Source AI Agent Can Be Hijacked

cyberexpress Feb 27, 2026 Firewall Daily

When the open-source AI agent for OpenClaw burst onto the scene, it did so with astonishing speed. In just five days, the project surpassed 100,000 stars on GitHub, becoming one of the fastest-growing open-source AI tools in history. Developers quickly embraced it as a personal assistant that could run locally, plug show more ...

into calendars and messaging platforms, execute system commands, and autonomously manage workflows. But beneath that meteoric rise, researchers uncovered the OpenClaw vulnerability, a weakness that allowed any website a developer visited to quietly seize control of the agent. Security researchers at Oasis Security identified what they describe as a complete vulnerability chain within OpenClaw’s core architecture. The chain enabled a malicious website to take over a developer’s AI agent without requiring plugins, browser extensions, or any form of user interaction. After receiving the disclosure, the OpenClaw team classified the issue as “High” severity and released a patch within 24 hours. Decoding the OpenClaw Vulnerability Originally launched under the names Clawdbot and later MoltBot, OpenClaw rapidly evolved into a defining example of modern open-source AI innovation. Its explosive popularity even drew attention from OpenAI. On February 15, OpenAI CEO Sam Altman announced that OpenClaw’s creator, Peter Steinberger, had joined the company, calling him “a genius with a lot of amazing ideas about the future of very smart agents.” The tool’s appeal lies in its autonomy. Through a web dashboard or terminal interface, users can prompt OpenClaw to send messages, manage workflows across platforms, execute commands, and even participate in what some described as an emergent AI social network. It runs as a self-hosted agent, placing powerful capabilities directly on developers’ laptops. Yet that power has already attracted abuse. Earlier in the month, researchers uncovered more than 1,000 malicious “skills” in OpenClaw’s community marketplace, ClawHub. These fake plugins posed as cryptocurrency utilities or productivity integrations but instead delivered info-stealing malware and backdoors. That episode was a classic supply-chain problem; malicious community contributions poisoning an otherwise legitimate ecosystem. The OpenClaw vulnerability, however, was different. It did not rely on third-party plugins or marketplace downloads. Instead, the vulnerability chain lived in the bare OpenClaw gateway itself, operating exactly as documented. No user-installed extensions were required. No marketplace interaction was necessary. The flaw was embedded in the core system. For many organizations, this incident highlights a broader issue: shadow AI. Tools like OpenClaw are frequently adopted directly by developers without formal IT oversight. They often run with deep access to local systems, credentials, messaging histories, and API keys, but without centralized governance or visibility. How the Vulnerability Chain Enabled a Silent Website-to-Local Takeover At the heart of OpenClaw’s architecture is the gateway, a local WebSocket server that functions as the system’s brain. The gateway manages authentication, chat sessions, configuration storage, and orchestration of the AI agent. Connected to it are “nodes,” which may include a macOS companion app, an iOS device, or other machines. These nodes register with the gateway and expose capabilities such as executing shell commands, accessing cameras, or reading contacts. The gateway can dispatch instructions to any connected node. Authentication is handled via either a long token string or a password. By default, the gateway binds to localhost, operating under the assumption that local access is inherently trusted. That assumption proved to be the weak link in the vulnerability chain behind the OpenClaw vulnerability. The attack scenario is deceptively simple. A developer has OpenClaw running locally, protected by a password and bound to localhost. While browsing the web, they land on a malicious or compromised site. That alone is enough to trigger the attack. Because WebSocket connections to localhost are not blocked by standard browser cross-origin policies, JavaScript running on any visited webpage can open a WebSocket connection directly to the OpenClaw gateway. Unlike traditional HTTP requests, these cross-origin WebSocket connections proceed silently. The user sees no warnings. Once connected, the malicious script exploits another flaw in the vulnerability chain: the gateway exempts localhost connections from rate limiting. Failed password attempts from localhost are neither throttled nor logged. In laboratory testing, researchers achieved hundreds of password guesses per second using only browser-based JavaScript. A list of common passwords could be exhausted in under a second. Even a large dictionary would fall within minutes. Human-chosen passwords offered little resistance. After guessing the password, the attacker gains a fully authenticated session with administrative privileges. From there, the possibilities expand dramatically. The attacker can register as a trusted device, automatically approved because the gateway silently authorizes pairings from localhost. They can interact with the AI agent directly, dump configuration data, enumerate all connected nodes (including device platforms and IP addresses), and read application logs. In practical terms, this means a malicious website could instruct the AI agent to comb through Slack conversations for API keys, extract private messages, exfiltrate sensitive files, or execute arbitrary shell commands on any connected device. For a typical developer heavily integrated with messaging platforms and AI provider APIs, exploitation of the OpenClaw vulnerability could amount to full workstation compromise, all initiated from a single browser tab. Governing Open-Source AI After the OpenClaw Vulnerability Researchers reported the issue with comprehensive technical documentation, root cause analysis, and proof-of-concept code. The OpenClaw team responded rapidly, issuing a fix in version 2026.2.25 and later within 24 hours, an impressive turnaround for a volunteer-driven open-source AI project. Still, the broader lesson extends beyond a single patch. The rapid adoption of open-source AI tools means many organizations already have OpenClaw instances running on developer machines, sometimes without IT awareness. Security experts recommend four immediate steps. First, gain visibility into AI tooling across the organization. Inventory of which agents and local AI servers are operating within the developer fleet. Second, update OpenClaw installations immediately to version 2026.2.25 or later, treating the OpenClaw vulnerability with the urgency of any critical security patch. Third, audit the credentials and permissions granted to AI agents, revoking unnecessary API keys and system capabilities. Finally, establish governance for non-human identities. AI agents authenticate, store credentials, and take autonomous actions; they must be managed with the same rigor as human accounts and service identities. This includes implementing intent analysis before actions occur, deterministic guardrails for sensitive operations, just-in-time scoped access, and full audit trails linking human intent to agent activity. The researchers note that its Agentic Access Management platform was designed specifically to address this emerging challenge. As open-source AI agents like OpenClaw become embedded in everyday developer workflows, the OpenClaw vulnerability serves as a cautionary tale. The future may indeed belong to autonomous agents, but without proper governance and oversight, a single overlooked vulnerability chain can turn groundbreaking open-source AI innovation into a serious enterprise risk.

National Cyber Security Bill and NIS2: Senior Management’s Compliance Guide

cyberexpress Feb 27, 2026 Firewall Daily

Cybersecurity governance is moving to the highest levels of organizational leadership, a shift highlighted by the European Union’s NIS2 Directive and Ireland’s forthcoming National Cyber Security Bill. At a recent conference hosted by Ireland’s National Cyber Security Centre, attendees were asked: “Where are show more ...

cybersecurity risks managed in your organization?” Results showed roughly half of organizations assign cyber risk oversight to the management board, while the remainder delegate responsibility to CIOs, CISOs, or IT managers. This distinction has become legally significant. The NIS2 Directive (Directive 2022/2555) places accountability for cybersecurity squarely on senior management. Article 20 of NIS2, as transposed into national legislation across EU member states, mandates that management boards approve, oversee, and ultimately take responsibility for their organization’s cybersecurity risk measures. Failure to comply can result in personal liability, regulatory sanctions, and administrative fines. Ireland’s National Cyber Security Bill and NIS2 Implementation Ireland plans to transpose NIS2 into national law via the National Cyber Security Bill. While the draft legislation has yet to be published, the government has released the General Scheme of the National Cyber Security Bill 2024, which includes Article 20 obligations under Head 28. Under this framework, senior management may face consequences for noncompliance, including temporary bans, fines, and potential personal liability. For legal and compliance teams, ensuring management boards are fully briefed on NIS2 and the National Cyber Security Bill is critical. Boards must understand not only organizational obligations but also their individual responsibilities under the legislation. Identifying the Management Board A foundational step for organizations is determining which individuals fall within the scope of Article 20 under NIS2. While the Directive references “management bodies,” the General Scheme defines the term “management board” as a group vested with authority for oversight, direction, and control of the entity. This includes boards of directors and key executives, though in practice, other senior managers with delegated authority may also be encompassed. Proper scoping requires reviewing corporate governance documents, board minutes, organizational charts, role descriptions, and risk resolutions. Multinational organizations face added complexity because corporate structures vary across jurisdictions, and global cyber strategy may not be determined locally. Documenting the rationale for board membership and revisiting it regularly is essential to maintaining compliance with NIS2 obligations. Educating Boards on Cybersecurity Risk Management Management boards are expected to possess sufficient knowledge to assess cybersecurity risk. Under the National Cyber Security Bill and NIS2, boards will need to participate in ongoing cybersecurity training and encourage employee training. Organizations should ensure boards understand: The impact of NIS2 on the organization. Obligations of both the organization and the management board. Third-party dependencies. Adopted cybersecurity frameworks, such as ISO 27001, NIST Cybersecurity Framework, or Cyber Fundamentals (CyFun), which the National Cyber Security Centre recommends as a preferred method to demonstrate NIS2 compliance. Documentation of training and regular briefings on cyber threats will support boards in meeting regulatory expectations. Understanding Regulatory Consequences Management boards must also recognize the potential consequences of NIS2 noncompliance. Administrative fines under Ireland’s draft National Cyber Security Bill are substantial: up to €10 million or 2% of global turnover for essential entities, and up to €7 million or 1.4% of turnover for important entities. The draft legislation also includes personal liability provisions under Head 43, holding directors or senior officers responsible for breaches resulting from wilful neglect or consent. Although the term “gross negligence” appears only in explanatory notes, it further signals that personal accountability for cybersecurity failures is a central focus of both NIS2 and Ireland’s National Cyber Security Bill. To mitigate personal liability risks, some boards may consider contractual solutions, such as indemnities or updated employment contracts, though the legal effectiveness of these measures must be carefully evaluated. Organizations should also prepare for potential supervisory engagement from competent authorities, ranging from information requests to formal audits, ensuring all approvals and decisions are properly documented. Looking Ahead The National Cyber Security Bill is expected to be introduced to the Irish Parliament in 2026, amid pressure to comply with the EU’s NIS2 transposition timeline. Ireland received a formal notice from the European Commission for missing the original October 2024 deadline, with the possibility of referral to the Court of Justice of the EU for noncompliance. Even before formal enactment, regulatory bodies such as the Commission for Communications Regulation have begun informal engagement with organizations likely in scope. Management boards are advised to familiarize themselves with NIS2 requirements and current Irish regulatory guidance to prepare for compliance, governance responsibilities, and potential inspections. By proactively identifying board members, educating them on cybersecurity risks, and documenting compliance efforts, organizations can reduce legal exposure under the National Cyber Security Bill while aligning with the broader obligations of the NIS2 Directive.

UK Tightens Government Cyber Security After Cutting Critical Vulnerabilities by 75%

cyberexpress Feb 27, 2026 Cyber News

The UK government is tightening its government cyber security posture with a dual strategy, faster vulnerability remediation and a long-term workforce pipeline. With cyberattacks increasingly targeting public services, the launch of a new vulnerability monitoring service (VMS) alongside the creation of a dedicated show more ...

cyber profession signals a structural shift in how the state plans to defend its digital infrastructure. Public-facing systems used by millions—from the National Health Service to the Legal Aid Agency—have become prime targets for cybercriminals. The government’s latest move acknowledges a simple reality: improving government cyber security is no longer just about tools; it is about speed, coordination, and skilled people. Vulnerability Monitoring Service Accelerates Government Cyber Security Response At the center of the announcement is the new vulnerability monitoring service designed to detect and fix cyber weaknesses significantly faster across public sector systems. According to government data, critical vulnerabilities are now being resolved six times faster than before reducing the average remediation window from nearly 50 days to just eight. The service focuses heavily on Domain Name System (DNS) risks, often overlooked but highly dangerous. DNS weaknesses can allow attackers to redirect users to malicious websites or disrupt essential services entirely. In the context of government cyber security, even small misconfigurations can have widespread consequences. The VMS continuously scans approximately 6,000 public sector organizations and detects around 1,000 different types of vulnerabilities. By automating detection and providing actionable remediation guidance, the government has also cut the backlog of critical unresolved vulnerabilities by 75%. This shift highlights a growing trend in public sector cyber security, automation is becoming essential as threat volumes continue to rise. Cyber Risks Now Directly Impact Public Services Speaking at the Government Cyber Security and Digital Resilience conference, Ian Murray emphasized the real-world consequences of cyber incidents: “Cyber-attacks aren’t abstract threats — they delay NHS appointments, disrupt essential services, and put people’s most sensitive data at risk. When public services struggle it’s families, patients and frontline workers that feel it. The vulnerability monitoring service has transformed how quickly we can spot and fix weaknesses before they’re exploited so we can protect against that." Adding further, he said, "We’ve cut cyber-attack fix times by 84% and reduced the backlog of critical issues by three quarters. And as the service expands to cover more types of cyber threats, fix times are falling there too. But technology alone isn’t enough. Today I’m launching a new government Cyber Profession to attract and develop the talented people we need to stay ahead of increasingly sophisticated threats - making government a destination of choice for cyber professionals who want to protect the services that matter most to people’s lives.” His remarks underline a key insight shaping modern government cyber security strategy—technical fixes must be matched with workforce capability. Building Long-Term Cyber Resilience Through Talent Alongside technical improvements, the government has launched its first dedicated cyber profession program in collaboration with the Department for Science Innovation and Technology and the National Cyber Security Centre. The initiative includes a cyber academy, apprenticeship pathways, and a structured career framework aligned with national professional standards. Manchester is expected to become a central hub, reinforcing the region’s growing digital ecosystem. Richard Horne, CEO of the NCSC, highlighted the broader impact of strengthening UK cyber resilience: “Cyber security is more consequential than ever today with attacks in the headlines showing the profound impacts they can have on people’s everyday lives and livelihoods. As our public services continue to innovate, it is vital that they remain resilient to evolving threats and vulnerabilities are being effectively managed to reduce the chances of disruption. The government Cyber Action Plan is a crucial step in building stronger cyber defences across our public services and the launch of the government Cyber Profession today will help attract and retain the most talented professionals with the top-tier skills needed to keep the UK safe online.” Why Government Cyber Security Is Becoming a Workforce Challenge While the new vulnerability monitoring service improves detection and response speed, the creation of a cyber profession reflects a deeper structural issue—skills shortages remain one of the biggest risks to government cyber security. Recent assessments have consistently warned that public sector organizations struggle to compete with private industry for cyber talent. By formalizing cyber career pathways, the government is attempting to make public service roles more competitive and sustainable. Ultimately, the announcement shows that cyber resilience is no longer treated as an IT function but as a national capability. Faster patching reduces immediate risk, but long-term government cyber security will depend on whether the public sector can successfully attract and retain the people needed to defend increasingly complex digital systems.

Apple Devices Become First Consumer Products Cleared for NATO Classified Data—But Questions Remain

cyberexpress Feb 27, 2026 Cyber Essentials

iPhone and iPad running iOS 26 can now handle restricted NATO information without special software, though security experts warn consumer devices create new attack surfaces. Apple announced Thursday that iPhone and iPad became the first consumer mobile devices approved to handle classified NATO information up to the show more ...

restricted level, following extensive security testing by Germany's Federal Office for Information Security. The certification enables NATO personnel across all member nations to use standard iOS 26 and iPadOS 26 devices for restricted data without requiring specialized software, containerization or additional security layers—a milestone no other consumer device manufacturer has achieved. Germany's BSI conducted exhaustive technical assessments, comprehensive testing and deep security analysis to verify Apple's built-in platform security capabilities met NATO nations' operational and assurance requirements. The devices now appear on NATO's Information Assurance Product Catalogue, formally recognizing that Apple's hardware-software integration provides adequate protections for restricted classified information. Also read: NATO Faces Escalating Cyberthreats: From Espionage to Disinformation "Secure digital transformation is only successful if information security is considered from the beginning in the development of mobile products," said Claudia Plattner, BSI's president. The certification builds on Apple's previous approval to handle classified German government data using native iOS and iPadOS security measures without third-party modifications. Apple stressed that its security architecture differs fundamentally from traditional approaches requiring bespoke solutions. "Prior to iPhone, secure devices were only available to sophisticated government and enterprise organizations after a massive investment in bespoke security solutions," said Ivan Krstić, Apple's vice president of Security Engineering and Architecture. "Instead, Apple has built the most secure devices in the world for all its users, and those same protections are now uniquely certified under assurance requirements for NATO nations." The certification relies on Apple's integrated security features including hardware-based encryption through the Secure Enclave processor, biometric authentication via Face ID, Memory Integrity Enforcement preventing code injection attacks, and comprehensive device encryption that protects data at rest and in transit. These capabilities operate across Apple's custom silicon, operating system and applications without requiring users to enable special modes or install government-specific software. NATO's "restricted" classification represents the alliance's lowest tier for classified information, covering data requiring protection but not meeting thresholds for confidential, secret or top secret designations. Restricted information typically includes operational planning details, logistics coordination and administrative documents that could aid adversaries if disclosed but would not directly compromise critical security operations. The approval marks a pragmatic shift in how governments balance security requirements against operational flexibility. NATO personnel can now use familiar consumer devices rather than specialized hardened phones that typically cost thousands of dollars per unit, offer limited functionality and create friction in daily workflows. The consumer device approval potentially saves member nations substantial procurement costs while improving user adoption. However, security experts note that consumer devices certified for government use introduce considerations absent from purpose-built secure communications platforms. Unlike specialized government phones designed exclusively for classified communications, iPhones and iPads run consumer applications, connect to public networks and integrate with cloud services creating expanded attack surfaces. A cryptography professor at a known U.S. University, told The Cyber Express that he would still want to be cautious on this since in the past few years, Apple's security architecture has been proven to have consumer threats, including nation-state adversaries targeting NATO countries. "The question isn't whether Apple has good security—they do. It's whether consumer devices designed for billions of users can adequately protect against targeted attacks by adversaries specifically hunting for NATO intelligence," he said. Also read: Apple Patches Actively Exploited iOS Zero-Day CVE-2025-24200 in Emergency Update The certification also raises questions about long-term support and update requirements. Consumer devices receive operating system updates for limited periods before Apple designates them obsolete. Government security requirements typically demand decades-long support commitments that conflict with consumer product lifecycles where devices become outdated within five years. Apple has not disclosed whether NATO members negotiated extended support agreements, how the company will handle security vulnerabilities discovered in iOS 26 after consumer support ends, or whether classified data handling requires organizations to prevent users from installing consumer applications that could introduce risks. The announcement follows Apple's decade-long effort to gain U.S. government security clearances. The U.S. Department of War (formerly know as Department of Defense) approved iPhones for handling certain classified information in 2013-14, though those implementations required mobile device management software and container applications separating classified data from personal use—requirements NATO's certification explicitly eliminates. Despite concerns, the NATO approval represents validation that Apple's security-by-design approach can meet rigorous government standards for protecting sensitive information, potentially encouraging other consumer technology manufacturers to prioritize security architecture capable of government certification rather than relying on post-hoc security layers.

Local KTAE and the IDA Pro plugin | Kaspersky official blog

kaspersky Feb 27, 2026 Business

In a previous post, we walked through a practical example of how threat attribution helps in incident investigations. We also introduced the Kaspersky Threat Attribution Engine (KTAE) — our tool for making an educated guess about which specific APT group a malware sample belongs to. To demonstrate it, we used the show more ...

Kaspersky Threat Intelligence Portal — a cloud-based tool that provides access to KTAE as part of our comprehensive Threat Analysis service, alongside a sandbox and a non-attributing similarity-search tool. The advantages of a cloud service are obvious: clients don’t need to invest in hardware, install anything, or manage any software. However, as real-world experience shows, the cloud version of an attribution tool isn’t for everyone… First, some organizations are bound by regulatory restrictions that strictly forbid any data from leaving their internal perimeter. For the security analysts at these firms, uploading files to a third-party service is out of the question. Second, some companies employ hardcore threat hunters who need a more flexible toolkit — one that lets them work with their own proprietary research alongside Kaspersky’s threat intelligence. That’s why KTAE is available in two flavors: a cloud-based version and an on-prem deployment. What are the on-prem KTAE advantages over the cloud version? First off, the local version of KTAE ensures an investigation stays fully confidential. All the analysis takes place right in the organization’s internal network. The threat intelligence source is a database deployed inside the company perimeter; it is packed with the unique indicators and attribution data of every malicious sample known to our experts; and it also contains the characteristics pertaining to legitimate files to exclude false-positive detections. The database gets regular updates, but it operates one-way: no information ever leaves the client’s network. Additionally, the on-prem version of KTAE gives experts the ability to add new threat groups to the database and link them to malware samples they discovered on their own. This means that subsequent attribution of new files will account for the data added by internal researchers. This allows experts to catalog their own unique malware clusters, work with them, and identify similarities. Here’s another handy expert tool: our team has developed a free plugin for IDA Pro, a popular disassembler, for use with the local version of KTAE. What’s the purpose of an attribution plugin for a disassembler? For a SOC analyst on alert triage, attributing a malicious file found in the infrastructure is straightforward: just upload it to KTAE (cloud or on-prem) and get a verdict, like Manuscrypt (83%). That’s sufficient for taking adequate countermeasures against that group’s known toolkit and assessing the overall situation. A threat hunter, however, might not want to take that verdict at face value. Alternatively, they might ask, “Which code fragments are unique across all the malware samples used by this group?” Here an attribution plugin for a disassembler comes in handy. Inside the IDA Pro interface, the plugin highlights the specific disassembled code fragments that triggered the attribution algorithm. This doesn’t just allow for a more expert-level deep dive into new malware samples; it also lets researchers refine attribution rules on the fly. As a result, the algorithm — and KTAE itself — keeps evolving, making attribution more accurate with every run. How to set up the plugin The plugin is a script written in Python. To get it up and running you need IDA Pro. Unfortunately, it won’t work in IDA Free, since it lacks support for Python plugins. If you don’t have Python installed yet, you’d need to grab that, set up the dependencies (check the requirements file in our GitHub repository), and make sure IDA Pro environment variables are pointing to the Python libraries. Next, you’d need to insert the URL for your local KTAE instance into the script body and provide your API token (which is available on a commercial basis) — just like it’s done in the example script described in the KTAE documentation. Then you can simply drop the script into your IDA Pro plugins folder and fire up the disassembler. If you’ve done it right, then, after loading and disassembling a sample, you’ll see the option to launch the Kaspersky Threat Attribution Engine (KTAE) plugin under Edit -> Plugins: How to use the plugin When the plugin is installed, here’s what happens under the hood: the file currently loaded in IDA Pro is sent via API to the locally installed KTAE service, at the URL configured in the script. The service analyzes the file, and the analysis results are piped right back into IDA Pro. On a local network, the script usually finishes its job in a matter of seconds (the duration depends on the connection to the KTAE server and the size of the analyzed file). Once the plugin wraps up, a researcher can start digging into the highlighted code fragments. A double-click leads straight to the relevant section in the assembly or binary code (Hex view) for analysis. These extra data points make it easy to spot shared code blocks and track changes in a malware toolkit. By the way, this isn’t the only IDA Pro plugin the GReAT team has created to make life easier for threat hunters. We also offer another IDA plugin that significantly speeds up and streamlines the reverse-engineering process, and which, incidentally, was a winner in the IDA Plugin Contest 2024. To learn more about the Kaspersky Threat Attribution Engine and how to deploy it, check out the official product documentation. And to arrange a demonstration or piloting project, please fill out the form on the Kaspersky website.

Cities Hosting Major Events Need More Focus on Wireless, Drone Defense

darkreading Feb 27, 2026 Feed

Major events like the FIFA World Cup need to look beyond traditional physical and cyber security to active and passive wireless threats, say experts.

The Case for Why Better Breach Transparency Matters

darkreading Feb 27, 2026 Feed

It's become a standard practice for organizations to disclose the bare minimum about a data breach, or worse — not disclose the incident at all.

Claude Code Security Shows Promise, Not Perfection

darkreading Feb 27, 2026 Feed

Claude Code's introduction rippled across the stock market, but researchers and analysts say its impact was overstated, as they peel back the layers.

Life Mirrors Art: Ransomware Hits Hospitals on TV & IRL

darkreading Feb 27, 2026 Feed

HBO's "The Pitt" is showing audiences what a real Mississippi healthcare system is going through this week, thanks to a ransomware attack.

Flaw-Finding AI Assistants Face Criticism for Speed, Accuracy

darkreading Feb 27, 2026 Feed

Using AI to find security vulnerabilities holds significant promise, but the initial products fall short of the needs of enterprises and software developers, say experts.

Samsung updates ACR privacy practices after Texas sues TV manufacturers

cyware Feb 27, 2026 Government

In December, Texas sued five major smart TV manufacturers — Samsung, Sony, LG, Hisense and TCL Technology — for allegedly collecting ACR data without consumers in the state being fully informed and consenting.

Instagram to start alerting parents when children search for terms relating to self-harm

cyware Feb 27, 2026 Privacy

Parents in the U.S., U.K., Australia and Canada will soon receive alerts if a child repeatedly searches Instagram for content relating to self-harm or suicide.

EU lawmakers propose that youth under 16 be barred from social media without parental consent

cyware Feb 27, 2026 Government

The opinion also states that social media access should not be allowed for children below age 13 under any circumstances.