Ever wonder what happens when attackers don’t break the rules—they just follow them better than we do? When systems work exactly as they’re built to, but that “by design” behavior quietly opens the door to risk?
This week brings stories that make you stop and rethink what’s truly under control. It’s not always about a broken firewall or missed patch—it’s about the small choices, default settings, and shortcuts that feel harmless until they’re not.
The real surprise? Sometimes the threat doesn’t come from outside—it’s baked right into how things are set up. Dive in to see what’s quietly shaping today’s security challenges.
⚡ Threat of the Week
FBI Warns of Scattered Spider’s on Airlines — The U.S. Federal Bureau of Investigation (FBI) has warned of a new set of attacks mounted by the notorious cybercrime group Scattered Spider targeting the airline sector using sophisticated social engineering techniques to obtain initial access. Cybersecurity vendors Palo Alto Networks Unit 42 and Google Mandiant have also issued similar alerts, urging organizations to be on alert and apply necessary mitigations, including strong authentication, segregation of identities, and enforcing rigorous identity controls for password resets and multi-factor authentication (MFA) registration, to harden their environments to protect against tactics utilized by the threat actor.
🔔 Top News
- LapDogs ORB Network Compromised Over 1,000 SOHO Devices — A China-linked APT has built an operational relay box (ORB) network called LapDogs comprising over 1,000 backdoored routers for espionage purposes. The digital break-ins began no later than September 2023 and have expanded ever since. The campaign mostly targets end-of-life routers, IoT devices, internet-connected security cameras, virtual servers, and other small office/home office (SOHO) devices, with the goal of building an Operational Relay Box (ORB) network. Five geographic regions — the US (352 victims), Japan (256 victims), South Korea (226 victims), Taiwan (80 victims), and Hong Kong (37 victims) — make up about 90% of the entire ORB network. The attacks leverage known security flaws in Linux-based devices to drop a backdoor called ShortLeash. The purpose of the malware itself is not known, although it has been found to share similarities with another malware sample used by UAT-5918. It’s suspected that the devices are being gradually, but steadily, compromised as part of methodical and small-scale efforts across the world to gain long-term access to networks.
- Iranian Hacking Group Targets Israeli Cybersecurity Experts — APT35, an Iranian state-sponsored hacking group associated with the Islamic Revolutionary Guard Corps (IRGC) has been linked to a spear-phishing campaign targeting journalists, high-profile cyber security experts, and computer science professors in Israel that seeks to redirect them to bogus phishing pages that are capable of harvesting their Google account credentials. The attacks, which take place via emails and WhatsApp messages, leverage fake Gmail login pages or Google Meet invitations to harvest their credentials. The development comes amid geopolitical tensions between Iran and Israel, which has also led to a spike in hacktivist activity in the region. “There are about 170 hacker groups attacking Israel, with about 1,345 cyber attacks on Israel, including about 447 cyber attacks launched against Israel after the conflict broke out,” NSFOCUS said in a report published last week. “The number of hacker groups attacking Iran reached about 55, and the number of cyber attacks on Iran reached about 155, of which about 20 were launched against Iran after the conflict broke out.”
- Citrix Patches Actively Exploited 0-Day — Citrix has released security updates to address a critical flaw affecting NetScaler ADC that it said has been exploited in the wild. The vulnerability, tracked as CVE-2025-6543 (CVSS score: 9.2), is a memory overflow bug that could result in unintended control flow and denial-of-service. It’s currently not known how the vulnerability is being exploited in the wild. The exploitation of CVE-2025-6543 coincides with reports that another critical security vulnerability in NetScaler ADC (CVE-2025-5777, CVSS score: 9.3) is also being weaponized in real-world attacks post public-disclosure.
- U.S. House Bans WhatsApp Use in Government Devices — The U.S. House of Representatives has formally banned congressional staff members from using WhatsApp on government-issued devices, citing security concerns. According to the House Chief Administrative Officer (CAO), the decision was taken based on a lack of transparency in how WhatsApp protects user data, the absence of stored data encryption, and potential security risks. WhatsApp has rejected these concerns, stating messages are end-to-end encrypted by default, and that it offers a “higher level” of security than other apps.
- New Tool to Neutralize Cryptomining Botnets — Akamai has proposed a novel mechanism to defang cryptomining botnets using XMRogue, a proof-of-concept (PoC) tool that lets defenders stop miners’ proxy servers from using compromised endpoints for illicit mining purposes. In cases where a mining proxy is not used, the approach uses a script to send more than 1,000 simultaneous login requests using the attacker’s wallet, which will force the pool to temporarily ban the wallet. That said, it’s worth noting that these methods don’t necessarily remove the malicious code from the systems as it’s just a way to disable the mining infrastructure.
️🔥 Trending CVEs
Hackers are quick to jump on newly discovered software flaws—sometimes within hours. Whether it’s a missed update or a hidden bug, even one unpatched CVE can open the door to serious damage. Below are this week’s high-risk vulnerabilities making waves. Review the list, patch fast, and stay a step ahead.
This week’s list includes — CVE-2025-49825 (Teleport), CVE-2025-6218 (WinRAR), CVE-2025-49144 (Notepad++), CVE-2025-27387 (OPPO ColorOS), CVE-2025-2171, CVE-2025-2172 (Aviatrix Controller), CVE-2025-52562 (ConvoyPanel), CVE-2025-27915 (Zimbra Classic Web Client), CVE-2025-48703 (CentOS Web Panel), CVE-2025-23264, CVE-2025-23265 (NVIDIA Megatron LM), CVE-2025-36537 (TeamViewer), CVE-2025-4563 (Kubernetes), CVE-2025-2135 (Kibana), CVE-2025-3509 (GitHub), CVE-2025-36004 (IBM i), CVE-2025-49853 (ControlID iDSecure), CVE-2025-37101 (HPE OneView for VMware vCenter), CVE-2025-3699 (Mitsubishi Electric), CVE-2025-6709 (MongoDB), CVE-2025-1533, CVE-2025-3464 (ASUS Armoury Crate), and an unpatched flaw affecting Kerio Control.
📰 Around the Cyber World
- Security Flaws Affect 100s of Printers and Scanners — Eight security vulnerabilities have been disclosed in multifunction printers (MFP) from Brother Industries, Ltd, that affect 742 models across 4 vendors, including FUJIFILM Business Innovation, Ricoh, Toshiba Tec Corporation, and Konica Minolta. “Some or all of these vulnerabilities have been identified as affecting 689 models across Brother’s range of printer, scanner, and label maker devices,” Rapid7 said. “Additionally, 46 printer models from FUJIFILM Business Innovation, 5 printer models from Ricoh, and 2 printer models from Toshiba Tec Corporation are affected by some or all of these vulnerabilities.” The most severe of the flaws is CVE-2024-51978 (CVSS score: 9.8), a critical bug that allows remote unauthenticated attackers to leak the target device’s serial number by chaining it with CVE-2024-51977 (CVSS score: 5.3), and generate the target device’s default administrator password. Having the admin password enables an attacker to reconfigure the device or abuse functionality intended for authenticated users.
- French Police Reportedly Arrest BreachForums Admins — French authorities have arrested five high-ranking members of BreachForums, a notorious online hub that specializes in selling stolen data and cybercriminal tools. This included forum users ShinyHunters, Hollow, Noct, and Depressed. A fifth suspect is said to have been apprehended by French police officials in February 2025. He went by the pseudonym IntelBroker (aka Kyle Northern), who has now been identified as a 25-year-old British man named Kai West. The latest iteration of BreachForums is currently offline. According to the U.S. Department of Justice (DoJ), West’s real-world identity was exposed after undercover Federal Bureau of Investigation (FBI) agents purchased a stolen API key that granted illicit access to one victim’s website, and traced the Bitcoin wallet’s address back to him. West has been charged with conspiracy to commit computer intrusions, conspiracy to commit wire fraud, accessing a protected computer to obtain information, and wire fraud. In total, he faces up to 50 years in prison. “Kai West, an alleged serial hacker, is charged for a nefarious, years-long scheme to steal victim’s [sic] data and sell it for millions in illicit funds, causing more than $25 million in damages worldwide,” said FBI Assistant Director in Charge Christopher G. Raia. The U.S. is seeking his extradition.
- Canada Orders Hikvision to Close its Canadian Operations — Canada’s government has ordered Chinese CCTV systems vendor Hikvision to cease all its operations in the country and shut down its Canadian business following a national security review. “The government has determined that Hikvision Canada Ic.’s continued operations in Canada would be injurious to Canada’s national security,” according to a statement released by Mélanie Joly, Canada’s Minister of Industry. “This determination is the result of a multi-step review that assessed information and evidence provided by Canada’s security and intelligence community.” In addition, the order prohibits the purchase or use of Hikvision products in government departments, agencies, and crown corporations. Hikvision called the allegations “unfounded” and that the decision “lacks a factual basis, procedural fairness, and transparency.”
- U.K. NCSC Details “Authentic Antics” Malware — The National Cyber Security Centre (NCSC) is calling attention to a new malware it calls Authentic Antics that runs within the Microsoft Outlook process, displaying periodic malicious login prompts to steal credentials and OAuth 2.0 tokens in an attempt to gain unauthorized access to victim email accounts. “The stolen credential and token data is then exfiltrated by authenticating to the victim’s Outlook on the web account via the Outlook web API, with the freshly stolen token, to send an email to an actor-controlled email address,” the NCSC said. “The emails will not show in the victim’s sent folder.”
- Microsoft Wants to Avoid Another CrowdStrike-like Outage — Microsoft said it’s planning to deliver a private preview of the Windows endpoint security platform to select endpoint security partners, including Bitdefender, CrowdStrike, ESET, SentinelOne, Trellix, Trend Micro, and WithSecure, that will allow them to build their anti-malware solutions to run outside the Windows kernel and in the user mode, just as other regular applications. “This means security products like anti-virus and endpoint protection solutions can run in user mode just as apps do,” Microsoft said. “This change will help security developers provide a high level of reliability and easier recovery resulting in less impact on Windows devices in the event of unexpected issues.” The change, first announced in November 2024, comes nearly a year after a faulty CrowdStrike update took down 8.5 million Windows-based machines around the world. In tandem, Microsoft said it’s also giving Blue Screen of Death (BSoD) a big visual makeover nearly 40 years after its debut in Windows, turning it black and listing the stop code and faulty system driver behind the crash in an attempt to give more clarity.
- Noyb Accuses Bumble of Violating E.U. GDPR — Bumble’s partnership with OpenAI for its Bumble for Friends feature violates Europe’s General Data Protection Regulation, according to a complaint from Austrian privacy non-profit noyb. “Powered by OpenAI’s ChatGPT, the feature is designed to help you start a conversation by providing an AI-generated message,” noyb said. “In order to do this, your personal profile information is fed into the AI system without Bumble ever obtaining your consent. Although the company repeatedly shows you a banner designed to nudge you into clicking ‘Okay,’ which suggests that it relies on user consent, it actually claims to have a so-called ‘legitimate interest’ to use data.” Noyb said the “Okay” option gives users a false sense of control over their data, when it claims to have a legitimate interest in sending user data to OpenAI.
- Jitter-Trap Turns Evasion into Detection — Cybersecurity researchers have designed a clever new technique called Jitter-Trap that aims to detect post-exploitation and command-and-control (C2) communication stemming from the use of red teaming frameworks like Cobalt Strike, Sliver, Empire, Mythic, and Havoc that are often adopted by threat actors in cyber attacks to maintain access, execute commands, move laterally, and exfiltrate data, while simultaneously evading detection. These tools are known to employ a parameter called “sleep” that defines how often the beacon communicates with its operator (i.e., the C2 server). One obfuscation method used to cloak this periodic beaconing activity action is “jitter,” which adds a little bit of randomness to the communication pattern to ensure that it remains undetected. “The jitter property for sleep-time between requests exists to create light randomness with the intent to look natural and like real traffic caused by users,” Varonis said. Jitter-Trap demonstrates how patterns of randomness can be leveraged by defenders to determine if such traffic exists in the first place, effectively turning attackers’ own tactics against them.
- REvil Members Released in Russia — Four members of the REvil ransomware group, Andrey Bessonov, Mikhail Golovachuk, Roman Muromsky, and Dmitry Korotayev, have been found guilty in Russia of financial fraud and cybercrimes, and were sentenced to five years in prison, but were ultimately released after a court determined that their sentence would amount to time already served while awaiting trial. This amounts to less than three years in detention. It’s worth noting that they were arrested in early 2022 on charges relating to trafficking stolen payment data and using malicious software to commit carding fraud. Other members of the crew, Daniil Puzyrevsky, Ruslan Khansvyarov, Aleksey Malozemov, and Artem Zayets, were jailed for four-and-a-half to six years in October 2024. Another REvil member, Yaroslav Vasinksyi, was arrested in 2021 at the Polish border and extradited to the US a year later. Last year, he was sentenced in May 2024 to almost 14 years in prison and ordered to return $16 million to his various victims. It is uncommon for Russia to prosecute its own hackers. In April 2022, Russia said the U.S. had unilaterally shut down communication channels with Russia on cybersecurity and withdrawn the negotiation process regarding the REvil gang.
- Malicious Python Package Shuts Down Windows Systems — A malicious Python package named psslib has been detected in the Python Package Index (PyPI) repository masquerading as a password security utility since November 2018, quietly attracting over 3,700 downloads to date. The package is a typosquat of the legitimate passlib library and is capable of immediately shutting down Windows systems when users enter a password that does not match the value set by the package’s developer. The library also incorporates the ability to invoke a system reboot without warning or consent. The discovery comes as two “protestware” packages with hidden functionality have been flagged in the npm registry. The packages (@link-loom/ui-sdk and @link-loom-react-sdk) specifically target Russian-language users visiting Russian or Belarusian domains (.ru, .su, and .by) in a web browser, blocking mouse-based interaction on the web page and indefinitely playing the Ukrainian anthem on a loop. That said, the attack ensures that only repeat visitors to the sites are targeted, meaning it’s triggered only when the target visits the websites more than once.
- Tudou Guarantee Takes Lead After HuiOne Shutdown — An illicit Telegram marketplace called Tudou Guarantee has emerged as the main winner following the closure of HuiOne Guarantee last month. The latest findings show that it’s business as usual for Chinese-language black markets in the wake of Telegram’s takedown of the two biggest of those bazaars, HuiOne Guarantee and Xinbi Guarantee. Both the services are estimated to have enabled a staggering $35 billion in transactions. Blockchain intelligence firm Elliptic said it’s tracking more than thirty highly-active guarantee markets. “Most notably, Tudou Guarantee has seen users more than double – and cryptocurrency inflows are now approximately equal to those seen for HuiOne Guarantee prior to its shutdown,” the company said. “Many of the merchants operating on Tudou are the same ones that previously sold through HuiOne Guarantee, offering stolen data, money laundering services and other products needed by scammers.” The shift is also significant in light of the fact that HuiOne Guarantee is a major shareholder in Tudou Guarantee. It acquired a 30% stake in December 2024. “These scammers have inflicted misery on millions of victims around the world, stealing billions of dollars. Unless these marketplaces are actively pursued, they will continue to flourish,” Elliptic’s Tom Robinson was quoted as saying to WIRED.
- South Korea Targeted by MeshAgent and SuperShell — Windows and Linux servers in South Korea are being targeted by Chinese-speaking threat actors to drop web shells like SuperShell and remote desktop software such as MeshAgent to establish persistent access and install additional payloads. The IP address used to stage the payloads has also been found to include WogRAT (short for “WingsOfGod”), a backdoor that can collect system information and execute arbitrary commands issued by a remote server. The exact initial access vector used in the attacks is unknown, according to AhnLab. “The attacker seems to target not only Windows but also Linux, attempting to take control of the network where the infected system belongs by moving from the initial penetration phase to the lateral movement phase,” the cybersecurity company said. “While the ultimate goal is unknown, the attacker may steal sensitive information or infect the network with ransomware if they successfully take control of the organization’s network.”
- AndroxGh0st Malware Evolves to Add New Flaws — The threat actors behind the AndroxGh0st malware have been found leveraging compromised websites associated with the University of California, San Diego, and an unnamed Jamaican events aggregator platform for C2 purposes. Attacks mounted by the Python-based cloud attack tool are known to leverage a wide range of known security flaws, including those affecting Apache Struts, Apache Shiro, FasterXML, Lantronix PremierWave, Popup Maker WordPress plugin, and Spring Framework, to obtain initial access and drop the malware. “The botnet exploits popular platforms (e.g., Apache Shiro, Spring framework, WordPress) and IoT devices (Lantronix), enabling remote code execution, sensitive data theft, and cryptomining,” CloudSEK said.
- Phishing Campaign Leverages CapCut Lures — A new phasing campaign is employing fake CapCut invoice lures to trick recipients into clicking on bogus links that mimic Apple account login pages and prompt them to enter their financial information to receive a refund. However, the attack is designed to stealthily hoover their credentials and credit card details to an external server. “As CapCut continues to dominate the short-form video editing scene, cybercriminals are seizing the opportunity to exploit its popularity,” Cofense said.
- Dutch Police Contact 126 Individuals in Connection with Cracked.io — Dutch police have identified and contacted 126 individuals who held accounts on the Cracked.io hacking forum. Authorities filed criminal cases against eight suspects and warned the remaining individuals against engaging in further criminal activity. The youngest person contacted by authorities was 11 years old. Law enforcement agencies from the U.S. and Europe seized Cracked and Nulled earlier this January. Prior to the takedown, the forum had more than 4.7 million users and was known for selling hacking services, stolen data, and malware.
- Vulnerabilities in Airoha SoCs — Cybersecurity researchers have discovered three flaws in devices that incorporate Airoha Systems on a Chip (SoCs) that could be weaponized to take over susceptible products without requiring any authentication or pairing, and on certain phones, even eavesdrop on conversations and extract call history and stored contacts. “Any vulnerable device can be compromised if the attacker is in Bluetooth range,” the researchers said. The vulnerabilities, assigned the CVE identifiers CVE-2025-20700, CVE-2025-20701, and CVE-2025-20702, relate to missing authentication for GATT Services, missing authentication for Bluetooth BR/EDR, and an unspecified vulnerability in a custom protocol that allows for manipulating the device. The Bluetooth chipset, according to cybersecurity company ERNW, is used in headsets, earbuds, dongles, speakers, and wireless microphones. “Some vendors are not even aware that they are using an Airoha SoC,” ERNW noted. “They have outsourced parts of the development of their device, such as the Bluetooth module.”
- Operation Overload Uses API to Amplify Pro-Russian Propaganda — A Russian disinformation operation known as Operation Overload has adopted artificial intelligence (AI) to generate Russian propaganda and spread it across Telegram, X, BlueSky, and TikTok. The activity involves AI-generated or deceptively edited content, often impersonating journalists, public figures, and respected institutions, to interfere with the political discourse in Ukraine, France, Germany, Poland, Moldova, and the United States. “While anti-Ukrainian narratives continue to dominate, election interference stands out as a prominent theme,” CheckFirst said.
- Crypto Drainer Scam Impersonates Tax Authorities — A new phishing campaign dubbed Declaration Trap has been observed targeting cryptocurrency users by impersonating European tax authorities, specifically Dutch agencies Belastingdienst and MijnOverheid. In these attacks, prospective victims are lured via email messages to phishing sites that harvest personal information and run crypto drainer phishing kits to siphon seed phrases, and perform unauthorized withdrawals by sending malicious transaction signing requests. “The victim’s journey begins with an email that appears to come from Belastingdienst or MijnOverheid and tells the recipient they need to complete a special declaration form for their crypto assets due to new tax regulations introduced in 2025,” Group-IB said. “Scammers use pressure tactics: they set short deadlines for completing the form and threaten victims with fines if they don’t comply.” The disclosure comes as IBM X-Force detailed a phishing campaign that’s targeting financial institutions across the world with weaponized Scalable Vector Graphics (SVG) files embedded with JavaScript to steal credentials and drop remote access trojans (RATs). “When executed, the SVG-embedded JavaScript drops a ZIP archive containing a JavaScript file that is used to download a Java-based loader,” IBM said. “If Java is present, it deploys modular malware including Blue Banana RAT, SambaSpy, and SessionBot.”
- Hive0131 Campaign Delivers DCRat in Colombia — In a new phishing campaign detected in early May 2025, the threat actor tracked as Hive0131 targeted users in Colombia with bogus notifications about criminal proceedings to initiate an attack chain that ultimately delivered the modular DCRat malware to harvest files, keystrokes, and audio and video recordings. “Hive0131 is a financially motivated group likely originating from South America that routinely conducts campaigns largely in Latin America (LATAM) to deliver a wide array of commodity payloads,” IBM X-Force said. “The current campaigns imitate official correspondence and contain either an embedded link or a PDF lure with an embedded link. Clicking on the embedded link will initiate the infection chain to execute the banking trojan ‘DCRat’ in memory.” The attacks, which have also been found to either contain a PDF lure with a link to a TinyURL or an embedded link to a Google Docs location, are characterized by the use of an obfuscated .NET loader dubbed VMDetectLoader that’s used to download and execute DCRat.
- CISA and NSA Call for Adoption of Memory-Safe Languages — The U.S. Cybersecurity and Infrastructure Security Agency, along with the National Security Agency (NSA), issued guidance on adopting memory-safe languages (MSLs) such as Rust to mitigate memory-related vulnerabilities in software. MSLs offer built-in mechanisms such as bounds checking, memory management, data race prevention, and runtime safety checks to protect against memory bugs. “Achieving better memory safety demands language-level protections, library support, robust tooling, and developer training,” the agencies said. “MSLs offer built-in safeguards that shift safety burdens from developers to the language and the development environment. By integrating safety mechanisms directly at the language level, MSLs enhance security outcomes and reduce reliance on after-the-fact analysis tools.” However, the report also points out the challenges with adopting MSLs due to legacy systems and tightly coupled code, performance overhead, and the availability (or lack thereof) of tools and libraries available for an MSL.
- New SmartAttack Technique Uses Smartwatches to Steal Air-Gapped Data — A new side-channel attack dubbed SmartAttack has demonstrated the use of smartwatches as receivers for ultrasonic covert communication in air-gapped environments. The approach, according to Dr. Mordechai Guri, the head of the Offensive Cyber Research Lab in the Department of Software and Information Systems Engineering at the Ben Gurion University of the Negev in Israel, utilizes the built-in microphones of smartwatches to capture covert signals in real-time within the ultrasonic frequency range of 18-22 kHz. As with other attacks of this kind, the threat model presupposes that the attacker has already infiltrated the air-gapped system and implanted malware that operates stealthily, transmitting information using the infected machine’s speakers in a frequency range that’s inaudible to humans. On the other end, the attack also requires the threat actor to compromise the smartwatch of an individual with access to the secured environment, and deploy malware capable of receiving the covert ultrasonic communication, decoding it, reconstructing it, and forwarding it to the attacker’s infrastructure. In an experimental setup, SmartAttack can be used to transmit data through ultrasonic signals over distances of more than 6 meters, with data rates of up to 50 bits per second. Dr. Guri, who disclosed RAMBO and PIXHELL attacks last year to exfiltrate data from air-gapped systems, said the findings highlight the “security risks posed by smartwatches in high-security environments.” Possible mitigations include prohibiting smartwatches and similar audio-capable wearables when entering secure environments, deploying ultrasonic monitoring systems to identify unauthorized transmissions, deploying ultrasonic jammers, and physically removing or disabling audio hardware components.
- Google Adds New Security Feature to Tackle XSS Attacks — Google has added a new security feature to the Chrome browser that automatically escapes “<" and ">” characters inside HTML attributes. The new feature is designed to prevent cross-site scripting attacks that rely on slipping in malicious code inside HTML code. The feature shipped with the stable version of Chrome 138 released on June 24, 2025. “It’s possible that a sanitizer may have a DOM tree it considers safe; however, after re-parsing, this DOM tree will be materially different, resulting in an XSS,” Google’s Michał Bentkowski said. This type of XSS attack is called mutation XSS (mXSS).
🎥 Cybersecurity Webinars
- Designing Identity for Trust at Scale—With Privacy, AI, and Seamless Logins in Mind ➝ In today’s AI-powered world, customer identity is all about trust. This webinar unpacks insights from the Auth0 2025 Trends Report—covering how users react to AI, rising privacy expectations, and the latest identity threats. Whether you’re building login flows or trust strategies, you’ll get clear, practical advice to stay ahead.
- Stop Pip Installing and Praying: Secure Your Python Supply Chain in 2025 ➝ The Python ecosystem in 2025 is under attack—from repo jacking and typosquatting to hidden flaws in common container images. If you’re still “pip installing and hoping,” it’s time to rethink. Join security experts as they unpack real threats, explain tools like CVE, Sigstore, and SLSA, and share how PyPI is responding. Whether you’re using YOLO models or managing production apps, you’ll get clear, practical steps to secure your Python supply chain today.
🔧 Cybersecurity Tools
- RIFT ➝ Microsoft has open-sourced RIFT, a tool that helps analysts spot attacker-written code in complex Rust malware. As Rust becomes more popular among threat actors, malware is getting harder to analyze. RIFT cuts through the noise by using automated signature matching and binary diffing to highlight only the custom code—saving time and improving detection.
Disclaimer: These newly released tools are for educational use only and haven’t been fully audited. Use at your own risk—review the code, test safely, and apply proper safeguards.
🔒 Tip of the Week
Beyond Defaults: Mastering Windows Hardening ➝ Default Windows settings are built for ease, not security. That’s fine for casual use—but if you care about protecting your data, business, or even just your privacy, it’s time to go beyond the basics.
The good news? You don’t need to be a sysadmin to lock down your system. Tools like HardeningKitty, CIS-CAT Lite, and Microsoft’s Security Compliance Toolkit do the heavy lifting for you. They scan your system and tell you exactly what to fix—like disabling outdated protocols (SMBv1, NetBIOS), hardening Office macros, or turning off risky Windows features you don’t even use.
If that sounds a bit much, don’t worry—there are one-click apps too. ConfigureDefender lets you max out Microsoft Defender’s protection (including turning on hidden advanced rules). WPD and O&O ShutUp10++ help you cut Windows tracking, bloatware, and junk settings in minutes. Think of them as the “Privacy + Security” switches Microsoft should’ve given you by default.
Want to get serious? Start with CIS-CAT Lite to see where your system stands, then run HardeningKitty to close the gaps. These aren’t just checkboxes—you’re cutting off real-world attack paths like phishing payloads, document-based malware, and lateral movement across networks.
Bottom line: You don’t have to “just use Windows as it is.” You can make it work for you, not against you—without breaking anything. Small changes, big impact.
Conclusion
It’s easy to get caught up in the technical details, but at the end of the day, it’s about making smart decisions with the tools and time we have. No one can fix everything at once—but knowing where the cracks are is half the battle. Whether it’s a quick configuration check or a deeper policy rethink, small steps add up.
Take a few minutes to scan the highlights and see where your team might need a second look.
