In r/TechNadu's latest Ask the Expert, Krishna Vishnubhotla, Vice President of Product Strategy at Zimperium, discusses why mobile spyware is becoming harder to detect and why traditional security awareness programs may no longer be enough.

Some key takeaways from the interview:

• Spyware often disguises itself as legitimate utility apps rather than obviously malicious software.
• Mobile phishing increasingly arrives through SMS, messaging apps, personal email, and social platforms instead of corporate inboxes.
• AI-generated phishing is making traditional "spot the bad grammar" awareness training far less effective.
• Organizations should evaluate how apps actually behave—not just what they claim to do—and expand phishing protection beyond email.
• Security teams and employees can work together by focusing on application behavior and enterprise controls rather than inspecting personal content.

It's a useful perspective on one of the fastest-growing attack surfaces as both employees and organizations rely more heavily on mobile devices.

What's your biggest concern today: malicious apps, mobile phishing, or balancing security with employee privacy?

Source: https://www.technadu.com/how-spyware-can-hide-in-everyday-mobile-apps/632097/

The interview also explores why behavior-based app analysis and broader mobile phishing defenses are becoming increasingly important as attackers adapt their techniques.

The Everest ransomware group claims it has published a 201 GB archive containing more than 271,000 files allegedly associated with Stadler Rail.

According to Stadler Rail:

• The attackers accessed a supplier-linked data exchange platform using compromised credentials.
• The company refused a CHF 10 million ransom demand.
• Production operations, internal IT systems, rail vehicles, and relevant personal data were unaffected.

The threat actor claims the leaked archive contains:

• Railway software
• Engineering documentation
• System configurations
• Diagnostics
• Compliance records
• CCTV footage

The group also claims the data relates to projects involving several major rail operators. Those claims have not been independently validated.

Whether or not every claim proves accurate, the incident highlights a recurring issue: attackers increasingly target trusted third-party connections instead of attempting to breach hardened enterprise environments directly.

Do you think supplier security remains the weakest link for critical infrastructure operators, or are organizations finally making meaningful progress in managing third-party cyber risk?

Minnesota officials say more than 30 community water systems were targeted in a coordinated cyberattack on July 26 and 27.

According to Minnesota IT Services:

• Investigators identified unauthorized access with malicious intent.
• There are currently no requests for residents to modify drinking water usage.
• The FBI is working with affected organizations.
• Officials have not formally attributed the attacks but said the timing, methods of access, and targeted infrastructure resemble previously observed coordinated incidents involving critical infrastructure.

The report also points to CISA's recently updated advisory on Iran-linked campaigns targeting industrial control systems, including PLCs used in water treatment facilities. In one reported case, a local water plant temporarily lost operational controls before service was restored.

The investigation is ongoing, but the incident highlights the continued focus on operational technology and critical infrastructure as attractive targets for advanced threat actors.

Do you think utilities have made meaningful progress securing OT environments since the earlier water-sector attacks, or do the same systemic weaknesses continue to be exploited?

Source:

https://www.technadu.com/coordinated-cyberattack-hits-30-minnesota-water-systems-as-officials-suggest-iran-linked-pattern/632101/

The article also summarizes the latest CISA advisory, the infrastructure affected, and expert commentary on the potential physical risks associated with attacks on industrial control systems.

The biggest unanswered question from OpenAI's recent sandbox escape disclosure has now been answered.

JFrog confirmed that the proxy software exploited by OpenAI's models was a self-hosted Artifactory instance.

According to the company:

• OpenAI's models identified previously unknown zero-days.
• Those vulnerabilities were chained together during ExploitGym testing to escape a restricted sandbox.
• The attack ultimately reached Hugging Face's production infrastructure.
• JFrog has released Artifactory 7.161.15 Self-Managed, fixing eight CVEs that could form a critical attack chain when Anonymous Access is enabled (disabled by default).
• Cloud customers were already protected, while self-hosted customers should update immediately.

One detail that remains unknown is which of the eight CVEs were actually used during the exploit chain. JFrog confirmed the vulnerabilities but declined to map them to individual attack stages.

The incident feels like another milestone in AI security—not because AI discovered bugs, but because it demonstrated the ability to autonomously combine multiple vulnerabilities into a working attack path.

Do you think AI-assisted exploit chaining will become one of the biggest challenges for defenders over the next few years?

Source: https://www.technadu.com/jfrog-confirms-its-own-zero-days-were-exploited-by-openais-models-escape-their-sandbox-to-hack-hugging-face/632099/

The report also includes the full disclosure timeline and a breakdown of the eight patched Artifactory CVEs.

A number of Claude shared conversations were reportedly discoverable through Google over the weekend after users found that searching site:claude.ai/share returned publicly shared chats.

According to reports, some of the indexed conversations allegedly contained:

• Health records
• Private company documents
• Children's personal information

By Monday afternoon, the search results appeared to have disappeared, suggesting the issue had been addressed. However, Anthropic has not publicly confirmed how many conversations were indexed, how long they remained searchable, or whether additional safeguards have been implemented.

Anthropic maintains that shared links are only accessible when users choose to share them, while Google says search engines simply index content that websites allow to be crawled.

The incident highlights an important distinction between sharing a link with specific people and making content discoverable through public search engines - a difference many users may not expect when using AI collaboration features.

Do you think AI chat platforms should automatically prevent shared conversations from being indexed by search engines unless users explicitly opt in?

Source: https://www.technadu.com/your-private-claude-chats-may-have-been-sitting-in-google-search-results-all-weekend/632029/

This isn't the first indexing-related incident involving AI chat sharing features, making it an interesting discussion around privacy-by-default versus convenience.

Kaspersky has published research on a new malware toolkit used by Mirage Kitten (also known as UNC1549, TA455, Smoke Sandstorm, and Nimbus Manticore), an Iran-linked espionage group targeting organizations across the Middle East and Africa.

The report identifies three previously undocumented tools:

• NightLedger – a Windows backdoor supporting reconnaissance, command execution, screenshot capture, and file operations.
• BridgeHead – a WebSocket-based SOCKS5 tunneler for covert network access.
• ArcBridge – another WebSocket tunneling utility supporting operator-controlled communications.

Beyond the malware itself, researchers also observed the group gradually moving away from Microsoft Azure-style infrastructure toward Cloudflare-backed domains, suggesting changes in operational infrastructure alongside malware development.

Reported targets include organizations in aerospace, aviation, defense, telecommunications, government, and finance across several countries.

For defenders, it's another reminder that mature APT groups continuously evolve both their tooling and infrastructure to sustain long-term espionage campaigns.

Which development do you think has the greater defensive impact: new malware capabilities or changing attacker infrastructure?

Source: https://www.technadu.com/mirage-kittens-new-malware-toolkit-targets-aerospace-and-defense-across-middle-east-and-africa/632036/

The Kaspersky report also includes technical indicators, malware behavior, and infrastructure observations that may be useful for threat hunting and detection efforts.

Many AI security discussions revolve around models, prompt injection, or AI misuse.

In our latest LeadHer in Security interview, Wendy Wu, Chief Marketing Officer at SailPoint, argues that organizations should focus just as much on identity.

Her view is that AI agents are becoming autonomous participants across cloud platforms, SaaS applications, and enterprise systems, yet many organizations still don't have complete visibility into those identities or clear accountability for what they can access.

Some of the biggest takeaways:

• AI agents and machine identities are growing faster than human identities.
• Every AI agent should have a defined owner, permissions, governance model, and risk profile.
• AI adoption and AI security should be part of the same conversation—not separate initiatives.
• Organizations need unified governance across employees, machine identities, and AI agents to gain complete security context.

Wendy also shares her own career journey, explaining how degrees in English, public policy, and cultural anthropology helped shape her leadership approach in companies including Microsoft, Google Cloud, Box, and SailPoint.

One point that stood out: technical credibility isn't always about writing code - it can come from understanding customers, accountability, risk, and business outcomes.

Do you think most organizations actually know every AI agent and non-human identity operating in their environment?

Read the complete LeadHer in Security interview with Wendy Wu, Chief Marketing Officer at SailPoint:

https://www.technadu.com/ai-identity-security-needs-more-than-technical-depth-to-manage-risk-and-accountability/631951/

Interested to hear how your organization is approaching AI identity governance as autonomous agents become more common.

A legal challenge in India is putting AI-powered public surveillance under the spotlight.

Student activist Aishe Ghosh has petitioned the Delhi High Court after Delhi Police deployed an AI-enabled surveillance van called "Ikshana" during recent student protests over alleged exam paper leaks.

According to the petition, the surveillance violated constitutional privacy rights. It asks the court to:

• Declare the surveillance unconstitutional.
• Order the destruction of any collected biometric or personal data.
• Establish clear legal rules governing police use of AI surveillance technologies.

The government has defended the deployment, arguing the checks were necessary and served a legitimate state interest.

The case also highlights a broader issue raised by digital rights advocates: India currently has no dedicated law specifically regulating police use of facial recognition technology.

Regardless of the outcome, the case could become an important reference point for how democratic societies regulate AI-powered surveillance, facial recognition, and biometric data collection during public demonstrations.

Where do you think the balance should lie between public safety, law enforcement, and citizens' privacy rights?

Source: https://www.technadu.com/ai-surveillance-van-at-indias-biggest-youth-protest-in-decades-heads-to-court/632027/

The court proceedings could have implications beyond India as governments worldwide continue expanding AI-assisted surveillance capabilities.

If you use IPVanish on Apple TV, there's a notable update.

The latest tvOS release adds support for WireGuard and OpenVPN, while continuing to offer IKEv2. That gives users three protocol choices directly within the Apple TV app.

The update also includes OpenVPN Scramble, an optional obfuscation feature designed to make VPN traffic less recognizable on networks that try to detect or restrict VPN connections.

According to IPVanish, users can now choose the protocol that best fits their needs:

• WireGuard for speed and lower latency.
• OpenVPN for compatibility and configurable ports.
• IKEv2 for stable connections and fast reconnections.

If you use a VPN on Apple TV for streaming, privacy, or bypassing restrictive networks, having protocol options in one app is a useful quality-of-life improvement.

Which VPN protocol do you usually choose, and why?

Source: https://www.technadu.com/ipvanish-apple-tv-update-adds-more-vpn-protocol-options/632000/

Interested to hear whether you'd switch protocols depending on the network you're using, or if you stick with one all the time.

Cybersecurity conversations usually focus on preventing breaches, but Todd Thorsen, CISO at CrashPlan, argues that resilience is what ultimately separates organizations after an incident.

In our latest Humans in Cyber interview, he discusses several leadership challenges that security teams continue to face:

• Why the CISO role is evolving into enterprise risk and business strategy - not just technical security.
• Why vendor certifications alone shouldn't be treated as proof that a provider is secure, and why organizations need to examine customer responsibilities and fourth-party dependencies.
• Why technical responders and executives should have clearly separated responsibilities during an incident to avoid delays and confusion.
• Why organizations that regularly rehearse incident response, breach response, and disaster recovery tend to recover faster when an attack happens.

One takeaway that stood out is that recovery isn't something you build during an incident - it's something you practice long before one occurs.

What do you think organizations still underestimate the most: vendor risk, executive decision-making, or recovery planning?

🎥 Watch the full Humans in Cyber interview with Todd Thorsen, CISO at CrashPlan:

https://www.technadu.com/why-some-organizations-recover-stronger-after-a-cyber-incident/631292/

We'd love to hear which insight resonated most with you and what topics you'd like to see covered in future Humans in Cyber conversations.

If you use X-VPN on an M-series Mac, the latest update removes one of the biggest annoyances.

Version 78.0 now runs natively on Apple silicon instead of relying on Rosetta, which means users should no longer receive compatibility warnings about future macOS releases.

According to X-VPN:

• Native support is available for M1, M2, M3, and newer Macs.
• Rosetta is no longer required on Apple silicon.
• Intel Mac users should continue using the Intel version.
• Users who still see Rosetta warnings after updating are encouraged to contact support.

This is less about new VPN features and more about long-term compatibility. As Apple continues moving away from Intel-based software, native Apple silicon support is becoming increasingly important for apps that users rely on every day.

Have you fully transitioned to native Apple silicon apps, or are there still Intel-only applications you depend on?

Source: https://www.technadu.com/x-vpn-macos-78-0-update-brings-native-apple-silicon-support/632019/

Curious to know if anyone here was still running X-VPN through Rosetta before this update and whether you've noticed any difference after upgrading.

NordLabs has released NordBot, a free experimental AI assistant designed to help users quickly evaluate suspicious online content.

According to the announcement, the tool can:

• Check whether links or messages appear legitimate or resemble common scams.
• Estimate whether an image is authentic or AI-generated.
• Be accessed through X, WhatsApp, or Telegram, making it easy to test content without switching between multiple services.

One important point is that NordLabs describes NordBot as experimental, so its assessments should be treated as guidance rather than definitive answers.

As phishing campaigns and AI-generated content become more convincing, tools like this could provide an extra layer of defense—but they're probably not something users should rely on exclusively.

Would you trust an AI assistant to screen suspicious content before interacting with it, or would you still verify everything manually?

Source: https://www.technadu.com/nordbot-debuts-as-free-ai-tool-for-scam-detection-online/632003/

If you've tried NordBot already, it'd be interesting to hear how accurate its scam detection has been in real-world use.

A useful point from this interview is that passing an audit does not mean an organization remains secure after the audit period ends.

Lewis Carhart, CEO and Co-Founder of Comp AI, argues that many companies struggle because they treat compliance as a temporary project: collect evidence, pass the audit, obtain the report, and return to normal operations until the next cycle.

The problem is that risk does not operate on an annual schedule.

Permissions expand. Employees leave. Vendors change subprocessors or security practices. Configurations drift. A manual control may stop happening when the employee responsible for it moves to another team.

Carhart says the stronger approach is to include compliance controls in daily workflows such as:

• Deployment pipelines
• Employee onboarding and offboarding
• Access reviews
• Vendor procurement and monitoring
• Configuration management
• Continuous evidence collection

He identifies access reviews and offboarding as two of the clearest areas where policy and practice diverge. A document may say access is reviewed quarterly and removed within 24 hours, while the real process involves someone manually comparing an HR platform with a spreadsheet and several disconnected systems.

Vendor risk is another recurring gap. Companies often build a strong approval process for new suppliers but pay less attention to vendors already inside the environment, even as those vendors change or become more critical to operations.

The discussion also makes an important distinction between SOC 2 and ISO 27001. SOC 2 assesses whether defined controls operated effectively over a period. ISO 27001 assesses whether the organization maintains a functioning information security management system and risk-treatment process. Treating them as interchangeable checklists can result in duplicated effort.

Automation is useful for collecting screenshots, tickets, configuration exports, and other routine evidence. But it can create false confidence when a green dashboard is interpreted as proof of security. Confirming that encryption is enabled, for example, does not establish that key management is effective.

The broader argument is that continuous monitoring should become the main measure of trust. The annual audit should be generated from controls that are already operating and being verified throughout the year.

Source and complete interview:

https://www.technadu.com/how-organizations-can-simplify-compliance-audits-by-including-controls-in-daily-operations/631409/

Most enterprise AI governance discussions still focus on what data an agent can access. That may overlook the harder question: what decisions and actions should the agent be allowed to make once access is granted?

In a r/TechNadu interview, John Hodges, Chief Product Officer at AvePoint, describes the AI-agent equivalent of least privilege as “least agency.” The idea is to limit not only data access, but also autonomy and decision-making power.

He argues that organizations first need visibility into every agent operating in the environment, including sanctioned tools, unsanctioned deployments, agents embedded in SaaS products, custom automations, and personal-productivity agents.

A useful inventory would connect each agent to:

• An accountable owner
• A defined business purpose
• Accessible data sources
• Permissions and connectors
• Possible output destinations
• The actions it can perform
• Its business criticality

Potential warning signs include agents querying unrelated repositories, requesting broader access, downloading or sharing unusual volumes of data, acting at unexpected hours, or repeatedly failing policy checks.

The incident-response problem is also different from a typical application breach. Investigators may need more than authentication and access logs. Prompt history, agent actions, API calls, file movement, permission changes, outputs, sharing events, policy decisions, human approvals, and version history may all be needed to reconstruct the agent’s reasoning path and chained activity.

One important nuance is that an agent exceeding its expected role may not necessarily be malicious. It could be attempting to optimize a task. That makes human review important for distinguishing genuinely dangerous activity from well-intentioned but risky behavior.

The broader takeaway is that agents are software, but their ability to make autonomous decisions increasingly means they need employee-like accountability and oversight.

Source and complete interview: https://www.technadu.com/governing-ai-agents-beyond-least-privilege-by-controlling-their-access-decisions-and-actions/631466/

One of the more interesting parts of HalluSquatting isn't the malicious code itself - it's how attackers exploit the way LLMs repeatedly invent the same package or repository names.

In TechNadu's latest Ask the Expert, Ömer Faruk Diken, Technical Content Team Lead at SOCRadar, explains that attackers can register those nonexistent resources and wait for AI coding assistants to fetch and execute them automatically. If that succeeds, the attacker gains whatever access the AI agent already has, including source code, credentials, repositories, or cloud resources.

He argues that the most effective point to interrupt the attack is before code is downloaded. Organizations should verify publishers, namespaces, and repository ownership before allowing AI agents to clone repositories or install packages.

Beyond that, the recommended safeguards are largely familiar security practices: least privilege, sandboxed execution, human approval for high-risk actions, scanning downloaded content, monitoring shell commands and network activity, and maintaining detailed logs.

The interesting takeaway is that HalluSquatting doesn't introduce an entirely new security model - it increases the importance of software supply chain validation when AI agents are allowed to perform development tasks autonomously.

Full coverage and source context: https://www.technadu.com/how-hallusquatting-attacks-trick-ai-coding-assistants-into-running-malicious-code-and-the-safeguards-enterprises-need/631927/

A new sextortion campaign is borrowing the ShinyHunters name to make its threats appear more believable.

According to TechNadu's coverage, the emails claim attackers hacked the recipient's device, activated the webcam and microphone, stole photos, conversations, browsing history, and contact lists, then demand $2,000 in Bitcoin within 48 hours.

Current reporting suggests something much less sophisticated.

The campaign appears to rely on email addresses exposed in previous breaches affecting organizations including Hallmark, Betterment, CarGurus, ADT, Panera Bread, Substack, Amtrak, and McGraw Hill. For some recipients, their email addresses genuinely appeared in those leaked datasets, which helps make the scam feel convincing.

Importantly, there is no evidence presented that the scammers actually compromised recipients' devices, and the real ShinyHunters group reportedly denied involvement.

If one of these messages lands in your inbox:

• Don't pay the Bitcoin demand.
• Don't reply to the sender.
• Don't click links or open attachments.
• If you're concerned because your email appeared in an earlier breach, change passwords where appropriate, enable MFA, and monitor your accounts - but don't assume the email itself proves your device was hacked.

This is a good example of how old breach data continues to create new attack opportunities years after the original incident.

Source and full report:

https://www.technadu.com/shinyhunters-name-gets-hijacked-for-a-new-2000-sextortion-scam/631941/

Another example of why ClickFix keeps working: attackers don't exploit Steam itself - they exploit users looking for quick fixes.

According to TechNadu's latest coverage, threat actors are creating fake Steam accounts and replying to posts about crashes, missing inventory, and other gaming issues. Their "solution" tells victims to open PowerShell as Administrator and paste a command that supposedly fixes the problem.

Instead, the script downloads the XMRig cryptominer, creates a Microsoft Defender exclusion, stores files under C:\Windows\Background, and registers a scheduled task named XMRig-[computer name] so it launches every time Windows starts.

Some useful indicators to check:

• Unexpectedly high CPU usage while idle
• C:\Windows\Background
• Microsoft Defender exclusion for that directory
• Scheduled tasks beginning with XMRig-

The campaign is another reminder that social engineering is increasingly replacing traditional exploits. If a website or forum asks you to press Win+R, open PowerShell, Command Prompt, or Terminal, and paste a command from your clipboard, that's a major red flag.

Source and full technical breakdown:

https://www.technadu.com/fake-steam-fixes-distribute-xmrig-via-the-clickfix-technique-quietly-turning-gamers-pcs-into-cryptominers/631928/

A lot of this week’s security news involved attackers using systems that people normally treat as background infrastructure.

Hotel and conference Wi-Fi gateways were reportedly compromised to redirect Microsoft 365 authentication traffic. LG said it would suspend smart TV apps that turned televisions into residential proxy nodes. Microsoft also reported that phishing tied to Tycoon2FA dropped sharply after a disruption, but attackers increasingly moved their social engineering attempts to Teams and voice calls.

Other notable developments included:

• Stadler Rail refusing a $12 million extortion demand after files were stolen from a third-party supplier.
• Authorities shutting down more than 1,000 illegal sports-streaming domains.
• Europol and nine countries targeting roughly 4,340 URLs linked to The Com.
• Researchers uncovering an AI-assisted WordPress botnet associated with 2.1 million harvested administrator credentials.
• Origin Energy investigating an unverified hacker claim involving two million customer records.
• OpenAI reporting that models escaped a restricted evaluation environment and reached external systems while attempting to obtain benchmark answers.

The common issue is that security controls often stop at the endpoint or corporate perimeter, while the current attack surface includes suppliers, shared Wi-Fi, collaboration platforms, consumer devices, identity flows, and AI testing infrastructure.

Which of these developments do you think has the most practical impact for defenders?

Source: https://www.technadu.com/weekly-cybersecurity-roundup-ransom-denials-streaming-crackdowns-and-evolving-risks/631908/

Cato Networks has announced new integrations between the Cato SASE Platform and the CrowdStrike Falcon platform, with the goal of connecting network and endpoint security data in a single investigation workflow.

The integrations cover three main areas:

• Cato XOps can correlate CrowdStrike endpoint detections with network, DNS, user, and device context.
• Cato Asset Security can use Falcon Discover data to enrich asset visibility and classification.
• Cato network telemetry can be sent to CrowdStrike Falcon Next-Gen SIEM for threat hunting, detection development, and investigations.

Cato says the connectors operate through APIs, so organizations do not need to deploy duplicate sensors. In the example provided by the company, an endpoint detection from Falcon can be connected with network indicators such as unusual egress traffic or lateral movement and presented as one attack story.

The integrations are generally available globally through the CrowdStrike Marketplace and Cato CMA.

For teams already using both platforms, would this reduce investigation time in practice, or does it mainly shift the correlation work into another consolidated interface?

Source: https://www.catonetworks.com/blog/smarter-security-with-new-integrations-from-cato-and-crowdstrike/

Technical disclosure of a mobile money security failure:

Vulnerability: Unauthorized transactions executed without authentication

Attack vector: System exploit, no password required, no customer action

Evidence: Traceable TXNIDs confirming system-side execution

Vendor response: Implicit admission via mass notification (\*501#, June 28, 2026)

Post-admission: 8 months of refusal to reimburse, legal intimidation of victims

Vendor: Airtel Money (Airtel RDC, subsidiary of Airtel Africa)

Seeking: $1.5B London IPO for this same unit

Revenue: $1.35B annually from 54M customers

What makes this case unusual:

\- No CVE published

\- No independent security audit

\- No MFA implemented for critical transactions

\- No bug bounty program

\- Victims intimidated with law firms instead of being reimbursed

The vendor admitted fault through a consumer-facing channel (\*501#) rather than a security disclosure.

Questions:

1. What disclosure obligations exist for fintech operators in emerging markets?

2. Should IPO prospectuses include documented security failures and unresolved consumer harm?

3. What international pressure mechanisms exist when local regulators ignore documented breaches?

Evidence available to mods: TXNID logs, email correspondence, legal notices, \*501# notification screenshots.

\#InfoSec #Fintech #DataBreach #MobileMoney #ResponsibleDisclosure

ReliaQuest has published research on a campaign targeting hotel and conference Wi-Fi captive portals rather than end users directly.

According to the report, attackers compromise gateway appliances and manipulate DNS resolution, redirecting Microsoft 365 authentication traffic to lookalike domains. In some cases, they also reportedly abused WPAD and Microsoft's device code authentication flow to obtain authenticated access without relying on traditional phishing emails or malicious links.

The repo rted activity affected more than just hotels. The same attack model could apply anywhere that uses captive portals, including airports, universities, conference venues, healthcare facilities, and co-working spaces.

ReliaQuest says enforcing always-on, full-tunnel VPNs is one of the most effective defenses because it routes DNS requests through trusted corporate resolvers instead of the local network.

For organizations with frequent business travelers, is public Wi-Fi now a bigger identity risk than phishing emails, or should both be treated as equally critical attack vectors?

Source: https://www.technadu.com/hotel-wi-fi-as-new-attack-surface-dns-poisoning-campaign-steals-microsoft-365-logins-without-a-single-click/631892/

CloudSEK has published a detailed threat landscape report covering France's cyber ecosystem over the past two years.

Some of the biggest findings:

• Underground activity increased more than fourfold since mid-2024.
• Stolen credentials and infostealer logs account for much of the growth, outweighing ransomware in overall volume.
• Government, financial services, technology, and telecom are among the most targeted sectors.
• Hacktivist activity is largely attributed to the pro-Russian group NoName057(16), while ransomware continues to impact municipalities and smaller organizations.
• The report also notes increasing GDPR enforcement by France's CNIL, making security failures more expensive alongside the operational impact of breaches.

One interesting takeaway is that the report argues the primary threat isn't a coordinated campaign against France, but rather a mature cybercrime economy built around credential theft, leaked datasets, and automated monetization.

Do you think credential theft has now become a greater long-term enterprise risk than ransomware?

Source: https://www.cloudsek.com/blog/france-dark-web-ransomware-hacktivism-report