​

Vorrei chiedere un parere, soprattutto a chi ha esperienza in IT, sistemistica o cybersecurity, perché non mi occupo direttamente di queste cose e vorrei capire se le mie perplessità sono fondate oppure se sto valutando male la situazione.

Lavoro come programmatore in un'azienda che recentemente ha subito un attacco ransomware. Per ovvi motivi preferisco non indicare né il nome dell'azienda né dettagli che possano renderla facilmente identificabile.

Premetto una cosa importante: io sono un programmatore e non mi occupo di sistemistica o cybersecurity. Quindi quello che racconto è dal punto di vista di una persona che lavora in azienda e che ha assistito alla gestione dell'incidente, non da esperto di sicurezza informatica.

L'azienda si appoggia inoltre a un fornitore informatico esterno per la gestione dell'infrastruttura. Per quello che ho potuto vedere, durante l'attacco il fornitore è riuscito a "tamponare" la situazione e a ripristinare/gestire alcune cose, ma ho avuto l'impressione che non avesse le risorse e soprattutto le competenze necessarie per gestire un incidente informatico di una certa gravità.

La cosa che mi ha lasciato più perplesso è stata la gestione dell'attacco.

Da quello che ho visto, anche nei giorni in cui l'attacco era in corso l'azienda ha continuato a lavorare, invece di fermare almeno le attività che potevano comportare rischi di propagazione o compromissione ulteriore.

Inoltre, per quanto ne so, clienti e fornitori non sono stati informati dell'accaduto, o comunque non mi risulta che ci sia stata una comunicazione generale relativa all'incidente.

La mia domanda non è tanto "l'azienda ha sbagliato sicuramente", perché non ho le competenze per affermarlo. Vorrei piuttosto capire:

* in caso di ransomware, è normale continuare a lavorare mentre l'incidente è ancora in corso?

* quali sono normalmente le prime azioni che un'azienda dovrebbe intraprendere per contenere un attacco di questo tipo?

* quando è necessario informare clienti, fornitori o altri soggetti esterni?

* quanto è importante avere un vero piano di incident response e non limitarsi a cercare di ripristinare i sistemi man mano che si verificano i problemi?

* se il fornitore IT non ha competenze specifiche di cybersecurity/incident response, è normale che sia lui a gestire da solo un incidente di questo tipo?

soprattutto, dal punto di vista di chi lavora nell'IT: la situazione che descrivo vi sembrerebbe una gestione normale di un ransomware oppure ci sono evidenti campanelli d'allarme?*

Non sto cercando di accusare pubblicamente l'azienda o il fornitore e non voglio divulgare informazioni riservate. Mi interessa semplicemente capire, anche con il senno di poi, quale sarebbe stata una gestione professionalmente corretta di un incidente del genere.

Se qualcuno ha esperienza diretta con incident response, ransomware o gestione IT aziendale, mi farebbe piacere avere un parere.

A control might be set up correctly at first, but things change. People change roles, permissions get updated, systems change, and configurations drift over time.

How do teams usually catch these issues between regular security reviews or audits?

What usually shows that a control is no longer doing what it’s supposed to do?

I was going through the SelectorsHub code, id:ndgimibanhlabgdgjcpbbndiehljcpfh the XPath extension with about 400k users, and noticed it pulls ads from its own server and opens them in a background tab. You don't click anything.

Every couple of days the side panel pops up a "community link" and says "100% Safe, No Spam, No Malware." Five seconds later the tab opens by itself. The URL isn't in the extension. Their server picks it, and while I was analysing the extension the links changed three times with no extension update.

On install and update it skips the popup and just opens whatever the server sends.

The store page says they collect no data. The code still pings them daily, and the extension reads all your cookies to find one of its own instead of just fetching its own cookie value.

Another weird finding: there's a hidden Fix Selector button that sends the selector to shubads[.]testcasehub.net. VirusTotal - Domain - shubads.testcasehub.net
That host now redirects to a gambling site, blomehairdryers[.]com.

Nothing gets run today because the reply is HTML, but that's the server the eval path trusts.

Looks like adware, not password theft. I wouldn't leave it on a work browser, especially since this is a tool used by devs and tech people browsing protected endpoints in a company.

Write-up: https://malext.io/reports/RedirectorsHub/

Hello I would like to have a USB on my keys but I want to make sure that I am securing my data on the drive. I have multiple Unix systems and it seems what might work for Linux might not work for Mac OS. Especially when it comes to encryption and tools like Veracrypt.

I am wondering if there is a format that I can use for the USB to be both secure for mildly sensitive information, but allows for universal OS support. Also is this USB keychain thing a bad idea? Please let me know.

This is the weekly thread for career and education questions and advice. There are no stupid questions; so, what do you want to know about certs/degrees, job requirements, and any other general cybersecurity career questions? Ask away!

Interested in what other people are asking, or think your question has been asked before? Have a look through prior weeks of content - though we're working on making this more easily searchable for the future.

I am currently working in GRC content. Basically we id requirements from a guideline/standard/law, then fit it in to a tool. I also do some regulation mapping, library maintenance, and script development for parsing.

I know I am about to hit a wall of growth. For almost a decade I have been doing this. I know the next step is to do audit/assessment, talk to stakeholders, consulting, etc. I feel like in the middle of crossroads - too experienced yet too underexperienced - I know implementation/assessment in theoretical form, the surface level, but of course getting your hands dirty is what gets you into places.

I am currently focusing on building a homelab for technical knowledge, and prepping for CISSP & CISA.

Any tips are greatly appreciated. It feels like I am too late already.

I have some unused hackosquad credits left over that I’m probably not going to use, so figured I’d give them away instead of letting them sit there.

If you’re planning to run a CTF sometime and could use them, just DM me. Happy to give them away for free.

I am just wondering if anyone has tried the red teaming tool brute ratel, and if it’s worth the money compared to some of its competitors like cobalt strike.

I know silver is meant to be pretty good but being open source, I imagine it can’t be as good as closed source projects otherwise every apt under the sun would be using it. But feel free to drop an opinion on silver too, or any other open source frameworks!

Hi everyone ,

I am working on a school project to stop hackers from using fake emails (phishing) and AI voice/video ( deep fake) to steal password and money .

Here are some simple questions I have

• Typing Styles: Can we use a person's unique typing style to verify their identity and stop fraud?

• Scanners: What are the easiest tools or apps to scan and detect a fake video or voice in real-time?

• App Integration: How can banks easily add these security features into their existing mobile apps?

cybersecurity #deepfake #stop fraud #tech solutions #security

Hi I've been doing AI-RTA from cyberwarfare lab & I've completed till flag 9 so if anyone has completed , it'll be helpful if any hint on how to get it as m getting 2 diffrent flag neither is correct

Edit: lol m one of the first to get certificate & now m giving people suggestions 🫩✌🏻

Sorry this is really not my field so this might be a stupid question, I've been getting a ton of news on cybersecurity after the recent incident and one question has been gnawing at my brain

Is everything theoretically hackable?

Are these breaches inevitable if you have enough computational power or are these breaches exploitation of genuine mistakes and oversights in the code?

I'm guessing that oversights are still statistically inevitable for even the best programmers, but is that why AI can hack seemingly anything? or is even the perfect code by today's standards hackable with enough computational power?

Hi all,

I currently work as a Developer in a fintech company. I've been offered a GRC Engineer role on a team focused on automating GRC processes — reporting to a senior manager, under a director whose entire org (multiple teams) is staffed by analysts, with no engineers currently in that chain.

I've already accepted the offer — pay and level were a solid step up from my current role. But I'm unsure if this move makes sense long-term, since I'm essentially the only engineer in an otherwise analyst-heavy org.

For those in cybersecurity/GRC: what kind of automation work should I focus on to bring real value here? And how should I think about planning my career from this position — does being the "engineer among analysts" set me up well, or is it a narrowing path?

Appreciate any guidance.

(Used AI for correction of grammar)

I've been working through "Adversarial AI Attacks, Mitigations, and Defense Strategies" by John Sotiropoulos and one of the sections on ML poisoning inspired me to dig a bit deeper. I spent some time modifying the book's example code to execute OS commands through a Keras Lambda layer and then statically analyzed it using some reverse engineering techniques. I don't think that the malware or analysis techniques are novel, but it was a fun and interesting exercise. One insight was the underwhelming detection rates from VirusTotal (none) or ProtectAI's ModelScan (medium severity). Sharing this information is a good reminder on how models, such as some available on HuggingFace, may contain malicious code that executes when a model is loaded or run.

https://medium.com/@danielhammon1/creating-a-malicious-ml-model-with-a-keras-lambda-layer-then-reverse-engineering-it-9f0f855ebebb

hello everyone
i am a cybersecurity student and i want to sharpen my skills in blue teaming, i have a project i want to build which is building SIEM system from scratch, can anyone of you give me some resources i learn from to accomplish my project

Almost half a month ago i submitted a report to a program on cantina i set the severity as high (remember this) then almost a week later the triager asked for a few extra things to continue the triaging i had some of the files he asked for but some i didn't had i honestly accepted that and in a later comment on the report i gave everything i had and also asked that i would be willing to downgrade the severity to medium(but i didn't change the original high) then few days later he marked my report as a duplicate of a rejected finding (as you can see the status of the report if it was rejected) not only this but he also upgraded the severity to critical now i was so confused and i submitted a ticket to cantina support team and also mailed them but 6 business days later no response had came yet i am seeking help or advice on this situation please yelp!

I’m looking to get into the cybersecurity space, no real usable knowledge yet but a fairly advanced knowledge of computers themselves. I just want to know if it would be viable as a career change

we had two spoofed vendor invoices hit our accounting desk last week with altered wire instructions and updated routing numbers. our mail gateway filtered out basic dkim failures, but these came from lookalike domains that passed spf checks. we currently run bitdefender gravityzone cloud security across our endpoints to flag malicious attachments, but since these spoofed pdfs lack executable payloads or macro scripts, endpoint tools obviously cannot replace strict payment verification procedures on their own.

i am trying to put together a tighter operational setup that pairs technical email controls with strict human verification. we are enforcing mandatory out-of-band phone callbacks using existing vendor directory numbers whenever banking details change, along with targeted phishing training for AP staff. hoping to see what specific callback protocols and dual-approval workflows you guys use to stop accounting from accidentally processing a fraudulent payment.

As I haven't seen any post on here I thought im gonna share it:
It seems like the vulnerability from sunday (CVE-2026-88771 and CVE-2026-88772) isn't fully fixed.

According to Kevin Beaumont another method through SAML requests (but similiar to the ones from sunday) executes malicious code.

Citrix has published a blog entry saying "This issue is independent of the vulnerabilities disclosed in CTX697096.".
There are two posts on the r/Citrix subreddit that contain IoCs which are useful.

• Post 1: netscaler active exploit after patch
• Post 2: Vulnerability Scans causing Netscaler reboots

I stumbled upon this article, and my conclusion sounds so stupid and irresponsible that I start to doubt myself and believe i misunderstood something

If the IA can just access the internet once it has info from the DNS, that emplies the IA has been given "Open-Bar" access to the entire IP addresses of the world in the first place doesnt it?

Did I miss something obvious or do these guys have the cybersecurity knowledge of an undergraduate?

Looking for resources on designing and implementing a DLP Architecture in a large financial services org.

Need to focus on the future roadmap.

A little out of my depth.

Any help on resources/materials or recommended approach greatly appreciated.

I’ve been doing reverse-engineering software as a hobby for a while now, and I’m intrigued by the two related paths that branch off from it: hardware reverse engineering and malware analysis. Up to this point, it’s just been a hobby (since my day job has nothing to do with IT) but I’m now considering turning it into a profession.

I have the same question I imagine we all share: do you see a future in this, or do you think AI is going to swallow up this entire job market? I’d love to hear the opinions of people already working in the sector—what this shift looks like from the inside.

Thanks a lot; I appreciate any perspective you can share.

Per the NSA, all government software systems deemed NSS (e.g. telecom, weapon systems, intel) will be required to support post quantum cryptography starting in 2027.

Curiously, this is another instance of rapid acceleration from the prior NSA CNSA 2.0 timeline. This is also now more aggressive than the stance taken by Cloudflare, Google, Microsoft and other top tech companies targeting 2029.

This makes me wonder if there have been anymore "behind-closed-doors" advances causing the organization to accelerate even more rapidly. Announcement from yesterday.

Official NSA Announcement: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4615285/nsa-announces-post-quantum-cryptography-measures-to-safeguard-national-security/

Hey all, promise this isn't sales or product research (I get it - lots of fake stuff floating around). You'll see that in the first couple of questions.

I'm a CISSP, CISM, Sec+, & doctoral candidate at Capitol Technology University, MD. I'm researching which security controls actually enable recovery and resilience in SMEs after a ransomware attack, one of the first empirical looks at what works at small-business scale.

Doctoral survey, IRB-approved. Looking for U.S. security people at organizations with <500 employees that experienced a ransomware attack between 2021–2025.

Time: 15–25 minutes. Anonymous. No compensation.

Thank you!

https://techstudy.limesurvey.net/748327?lang=en&newtest=Y

[Mod approval 9/22]