Skills Overtaking Security, Disney Getting Stung, When Tools Are Not What They Seem, Not-So-Secure Cloud Storage, Banshee The Great Pretender, and Dancing The Espionage Waltz. It's CISO Intelligence for Wednesday 15th January!

Today we're looking at the dangers of free-roaming corporate resources, protecting data from internal mischief, when tools are not what they appear to be, holes in cloud buckets, playing the imitation game, and smooth intelligence-gathering operators.

💡

"Gives me everything I need to be informed about a topic" - __UK.Gov__

Table of Contents

1. Bringing Shadow Admins Out of the Shadows

2. Mickey's Misstep: Allergy Warning with a Hack Job

3. LDAPNightmare: A Bug with a Hidden Bite

4. Ransomware Hijinks: When AWS Features Turn Against You

5. Banshee Howls at the Mac: The Stealer That “Borrowed” from XProtect

6. Double-Tap's Diplomatic Dance: Espionage in Central Asia

Sign up for CISO Intelligence.

21st century industry insights for the modern CISO

It won't hurt, I promise.

Email sent! Check your inbox to complete your signup.

No spam. Unsubscribe anytime.

Bringing Shadow Admins Out of the Shadows

_Invisible puppeteers or just techies revolting against red tape? Shadow Admins play in the grey zone between innovation and chaos._

What You Need to Know

Shadow IT admins are individuals within your organization with technical prowess who execute IT functions without formal recognition or compliance with governance, risk, and compliance (GRC) standards. Their actions, driven by the need for innovation, speed, and autonomy, pose substantial risks if not managed properly, potentially impacting critical business operations. Executives must recognize the potential security and compliance vulnerabilities posed by these unsanctioned IT activities and implement measures to integrate them into the organization’s official IT framework.

CISO Focus: Identity and Access Management

Sentiment: Negative

Time to Impact: Immediate to Short term (3-18 months)

*

Introduction

For subscribers receiving this insightful peek into the shadowy underbelly of corporate IT, brace yourselves for a curious exploration of covert innovation unwittingly steering organizations towards potential cyber landmines. Learn how "shadow admins" are shaping—and sometimes shaking—organizational security landscapes.

Overview

Shadow IT administrators—a clandestine clan of unsanctioned tech operators—navigate a universe without governance oversight, driven by frustrations with established systems. Their penchant for swift decision-making and agility might save a moment but could severely compromise the organization’s security posture.

Shadow IT Admins - Who are They?

Shadow IT admins are typically professionals with substantial technical or functional know-how. Despite their often noble intentions of addressing pressing business needs swiftly, they inadvertently bypass the organization's long-term management protocols and GRC requirements. In their shadowy operations, they could be unwittingly managing systems containing sensitive data or critical business processes, creating substantial risks.

Why Shadow Admins Exist

The shadow incursion into IT realms primarily emanates from:

Slow IT Response: When the official IT apparatus is bogged down with sluggish approval processes or overloaded with queues, shadow admins rise to fill the void.

Lack of Resources: Overstretched IT departments often leave crucial needs unmet, compelling business units to devise unofficial solutions.

Unmet Needs: Deeply frustrating unmet needs drive business units to rely on shadow admins to implement services that appear more suited to their requirements than official systems.

Innovation and Agility: Shadow IT admins often emerge from a culture of innovation. By taking unsanctioned control of new tools and technologies, they cloak their creations from the structure, a combustible mix of ingenuity and risk.

Risks and Implications

The high-risk landscape within which shadow admins operate can lead to:

Data Breaches: Lack of proper security protocols and oversight can result in vulnerabilities that are easy pickings for cyber threats.

Compliance Issues: Breaching regulatory GRC mandates becomes an unavoidable consequence of shadow operations, leading to potential legal ramifications.

Operational Disruption: Critical system functions managed without formal recognition can result in systemic failures that disrupt business continuity.

Integrating Shadow IT into Mainstream IT

The challenge lies in transforming shadow IT’s potential from perilous to purposeful by:

Fostering Communication: Establish open channels between official IT and shadow admins. Acknowledging and addressing their concerns fosters a cooperative rather than adversarial relationship.

Implementing Governance Frameworks: Develop governance models that incorporate flexibility to embrace grassroots innovation within established guidelines.

Training and Awareness: Educate all stakeholders on GRC policies and the impacts of shadow admin activities, creating a culture of informed decision-making.

Road to Above-Board Operations

Organizations can pave the way to legitimacy for aspiring shadow IT admins by:

Offering Support Tools: Simplifying access to official resources and providing clear pathways to integrate shadow initiatives into the mainstream IT roadmap.

Encouraging Innovation: Champions of change can be given official forums to propose solutions while adhering to organizational risk and compliance requirements.

Vendor Diligence Questions

1. How does the vendor's solution integrate with current IT frameworks to prevent shadow IT practices?

2. What controls and measures do they provide to monitor and manage unauthorized admin activities?

3. Does the vendor offer tools that can foster collaboration between official IT departments and shadow IT operatives?

Action Plan

1. Identification: Conduct an audit to identify existing shadow IT practices within the organization.

2. Integration Strategy: Develop a strategy to integrate beneficial shadow IT activities into the formal IT framework securely.

3. Ongoing Monitoring: Establish ongoing monitoring processes to detect and manage shadow IT activities effectively.

*

Source: Proofpoint Article

*

Mickey's Misstep: Allergy Warning with a Hack Job

_Some people can't handle cheese, but they sure can twist the system!_

What You Need to Know

The latest cybersecurity incident involves a former Disney employee reportedly hacking into the company's menu system to alter allergy information. This breach not only reflects a malicious insider threat but also highlights vulnerabilities in Disney’s data management protocols. For executives, immediate action is needed to address potential risks and tighten security around sensitive information systems.

CISO focus: Insider Threats & Data Integrity

Sentiment: Strong Negative

Time to Impact: Immediate

*

Disney's Menu Goes from Magical to Malicious: A Lesson in Insider Threats

In a tale as curious as any Disney story, a former employee at the entertainment giant infiltrated their menu systems to change allergy warnings. This breach, seemingly mischievous in intent, exposes a worrying vulnerability in Disney's cybersecurity framework. But this isn’t merely a story of corporate misconduct; it underscores a significant insider threat issue that all organizations need to address urgently.

**The Breach: How it Happened**

According to reports from Disney's internal investigation, the former employee exploited existing credentials to access the menu system. Once inside, they altered allergy information across several dining outlets, potentially endangering guests with serious food allergies—a risk with life-threatening consequences.

* Insider Threat: The perpetrator was not a remote hacker but someone with intimate knowledge of Disney's operations, highlighting dangers posed by staff with access to critical systems.

* Vulnerabilities Uncovered: Limited controls were in place to monitor or flag unauthorized changes within the system, which could have mitigated the risk of insider tampering.

**The Impact: Risks Beyond the Magic Kingdom**

The immediate concern was the health risk posed to Disney’s visitors. But there’s more at stake:

* Brand and Legal Repercussions: Altered dietary information could lead to severe health incidents, exposing Disney to massive legal liabilities and damaging its brand reputation.

* Data Integrity Issue: This case underlines the challenges in maintaining data integrity, especially when systems can be manipulated by insiders without immediate detection.

**Implications for Cybersecurity Best Practices**

This incident serves as a powerful wake-up call for organizations, reminding them of the necessity to reformulate their cybersecurity strategies, particularly concerning:

1. Robust Access Management: Ensuring that access controls are stringent and that staff only have permissions necessary for their roles.

2. Regular Auditing: Implementing continuous and automated monitoring systems to detect unusual activities in real-time.

3. Staff Training: Developing comprehensive training programs for staff to recognize and report suspicious activities.

**From Fantasy to Reality: Implementing Change**

While the situation at Disney is unprecedented in its peculiar danger, it showcases real steps businesses must take to protect their data:

* Enhanced Monitoring Systems: Installing systems capable of flagging unauthorized changes swiftly to prevent data manipulation.

* Zero Trust Policies: Moving towards a zero-trust security model where no user is automatically trusted can be instrumental in preventing such insider threats.

The Great Mouse Detective: Wrapping Up

As insider threats grow more advanced, it’s imperative that companies look beyond external attackers to safeguard their data effectively. Disney’s culinary caper might seem like a storybook narrative, but it's an urgent reminder that cybersecurity policies must be more robust and discerning. While they managed to avert major disaster this round, the real magic will be in preventing future breaches with stronger safeguards and employee vigilance.

*

Vendor Diligence

Questions

1. How does the vendor ensure continuous monitoring of unauthorized access attempts by employees within sensitive databases?

2. What measures are in place to alert the security team about unauthorized configuration changes within the system?

3. How frequently does the vendor update its access management protocols in response to the latest cybersecurity threats?

Action Plan

1. Immediate System Audit: Conduct an urgent audit of existing access controls and authorization logs.

2. Incident Response Team Activation: Deploy a dedicated team to assess and manage the incident consequences while coordinating with legal and PR departments.

3. Staff Discretionary Access Review: Implement a thorough review of all discretionary access privileges to ensure adherence to least privilege principles.

4. Enhance Security Awareness: Roll out updated training modules focused on insider threat identification for all employees.

*

Source: Former Disney Employee Admits to Hacking Menu System to Change Allergy Information

*

LDAPNightmare: A Bug with a Hidden Bite

_"Remember, not every free meal is worth the indigestion."_

What You Need to Know

Recent cyber incidents have highlighted a growing threat exploiting Microsoft’s LDAP vulnerabilities. A malicious proof-of-concept (PoC) for CVE-2024-49113, named LDAPNightmare, is being used as bait to install information-stealing malware. Your organization's immediate task is to ensure that all LDAP-related patches from Microsoft's December 2024 release are applied across all systems. Additionally, teams should be wary of downloading PoCs from unverified sources. Coordinated efforts with IT and cybersecurity personnel will help mitigate this ongoing threat.

CISO Focus: Vulnerability Management & Threat Intelligence

Sentiment: Strong negative

Time to Impact: Immediate

*

A Cautionary Tale for Cybersecurity Enthusiasts

In an unfortunate twist of digital deception, a malicious tool posing as a proof-of-concept (PoC) exploit under the moniker LDAPNightmare is targeting unsuspecting cybersecurity researchers and professionals. This exploit is riding the wave of concern surrounding two critical vulnerabilities—CVE-2024-49112 and CVE-2024-49113—recently addressed in Microsoft’s December 2024 Patch Tuesday.

The Exploit in Disguise

The exploit in question masquerades as a demonstration of a denial-of-service (DoS) attack linked to CVE-2024-49113, which particularly affects Microsoft’s Lightweight Directory Access Protocol (LDAP) implementation. This protocol, crucial for accessing and maintaining distributed directory information services over an IP network, is an attractive target due to its widespread use. The crafted exploit is, however, a ruse to implant an information-stealing malware, rather than demonstrating any vulnerability patch.

CVE-2024-49112: This is a serious remote code execution (RCE) flaw allowing attackers to remotely execute arbitrary commands.

CVE-2024-49113: Known as a DoS vulnerability, could enable malicious actors to crash the LDAP service, leading to disruptions.

While the tactic of disguising malware delivery mechanisms as PoCs is not novel, the choice of a trending, actively discussed vulnerability magnifies potential impact. Organizations and individuals mindful of such threats tend to inadvertently focus efforts on securing PoCs.

Actionable Measures

Immediate action is required to avert potential breaches. Here’s what should be on every IT and security professional's checklist:

Patch Promptly: Ensure all systems are up-to-date with the latest patches for all known vulnerabilities.

Verify Sources: Only download PoCs and other security research from trusted and verified sources.

Educate Teams: Raise awareness among teams about phishing and social engineering tactics, especially those involving security research components.

Organizations must stay vigilant, avoiding complacency despite the complexities involved in dealing with zero-day exploits and sophisticated cyber exploits.

The Broader Threat Landscape

In the current cybersecurity ecosystem riddled with quicksand traps masquerading as legitimate research aids, the distinction between legitimate and malicious PoCs is becoming increasingly blurred. The rise of vulnerabilities like LDAPNightmare highlights the necessity for more robust security postures.

The knowledge surrounding these exploits, when shared within trusted communities, helps organizations bolster defenses. Cross-industry collaboration, frequent updates, and shared intelligence are pivotal for mitigating risks.

In summary, LDAPNightmare is not just a bleak moniker for a vulnerability, but a real-time reminder of the vigilance required in cybersecurity landscapes. Robust defenses are increasingly about common sense blended with state-of-the-art systems.

Oh Look, Another Exploitable Mystery

When we delve deeper into these security challenges, it becomes imperative to remember that not every exploit needs to be explored, especially when linked with suspicious trailheads.

*

Vendor Diligence Questions

1. Are you regularly updating your threat intelligence feeds with the latest information about PoC exploits masquerading as malware?

2. How do you ensure the authenticity and security of PoC materials shared within your network?

3. What procedures are in place for rapid response if a compromised PoC is inadvertently executed in your environment?

Action Plan

1. Patch Implementation: Confirm all LDAP-related updates from December 2024's Microsoft release are deployed.

2. Awareness Campaigns: Initiate a company-wide awareness program focused on the risks associated with downloading PoCs.

3. Enhanced Monitoring: Increase monitoring for unusual network activity linked to LDAP services.

4. Partner Collaboration: Engage with partners and vendors to increase threat intelligence sharing regarding potential PoC exploits.

*

Source: Trend Micro

*

Ransomware Hijinks: When AWS Features Turn Against You

_Why should hackers and Amazon S3 have all the fun?_

What You Need to Know

Recently, a worrying trend has emerged in the cybersecurity landscape—ransomware operators are exploiting Amazon Web Services (AWS), specifically the S3 buckets, to encrypt data and demand ransoms. This exploitation leverages AWS's own features, making it a sophisticated and alarming threat vector. Executive management and board members need to be aware of the evolving risks associated with cloud storage and the critical need for enhanced security measures. Immediate action is required to evaluate current security protocols and educate teams about cloud vulnerabilities.

CISO focus: Cloud Security and Ransomware Mitigation

Sentiment: Strong Negative

Time to Impact: Immediate

*

The AWS S3 Enigma: A Cloudy Warning

In a world where data is considered the new currency, business operations are increasingly migrating to the cloud, often under the assurance of heightened security and scalability. However, a new threat has emerged, showcasing the vulnerabilities hidden within even the most secure paradigms. Ransomware groups have identified and begun exploiting a feature within Amazon’s ubiquitous S3 buckets, leveraging server-side encryption to lock users out of their own data—a clever yet insidious twist that heightens both risks and stakes.

The Anatomy of an Attack

Here's the break down: attackers are orchestrating breaches by exploiting Amazon's server-side encryption option. Typically utilized to protect data by encrypting it upon storage, this feature is now being weaponized against users. Attackers gain access to S3 management permissions, enabling them to re-encrypt data with keys that remain out of the rightful owner’s reach. This manipulation locks businesses out of their own data unless a ransom is paid. The modus operandi is not just alarming because of its creativity but also because of its profound efficiency, targeting secure infrastructures already trusted by thousands.

The Cloud Caution Paradox

While the move to cloud services such as AWS has been touted as a superior solution for robust data management, this incident reveals a glaring oversight in cloud reliance. Companies that hurriedly adopt cloud architecture without diligent configuration and monitoring expose themselves to substantial threats. The attack vector here is subtle—it does not rely on traditional malware deployment but on exploiting mismanaged permissions and policies.

Potential Impact Areas:

Data encryption vulnerabilities

Insider threats disguised as external attacks

Financial losses due to ransom payouts

Reputational damage and loss of client trust

Fortifying the Digital Fortress

For organizations, understanding this evolving threat is crucial in establishing an offensive defense strategy. Adopting a regimented approach to cloud security policies can mitigate potential breaches. Key preventative measures include:

Regular audits of S3 permissions and access logs to identify potential abuses.

Deployment of third-party security solutions focusing on anomaly detection in cloud environments.

Conducting comprehensive drills that simulate attack vectors similar to those being exploited by ransomware groups.

Furthermore, organizations are urged to engage in proactive dialogues with AWS support—to continuously update on security patches and best practices and to adapt to any newly uncovered vulnerabilities rapidly.

Time to 'Bucket' Down

The AWS feature exploitation is a stern reminder that as infrastructures evolve, so must our protective strategies. Cloud providers regularly update features and best practices guidelines; however, the burden of implementation and meticulous security validation rests with the users. Companies need to reconsider their security blueprint, prioritizing a cloud-specific component that incorporates both technological and personnel training aspects.

*

Vendor Diligence

How will your product prevent unauthorized access and modification of encryption keys in our cloud storage solutions?

Does your service provide real-time monitoring and alert systems for cloud infrastructure anomalies?

What measures are you employing to ensure timely updates against known exploit trends leveraging AWS features?

Action Plan

Conduct immediate security audits focusing heavily on AWS environments.

Train staff on the potential risks of cloud storage features, emphasizing the necessity of cautious permission management.

Deploy advanced encryption key management to thwart unauthorized re-encryption actions.

*

Source: Ransomware abuses Amazon AWS feature to encrypt S3 buckets

*

Banshee Howls at the Mac: The Stealer That “Borrowed” from XProtect

_Imitation is not the sincerest form of flattery — especially in cybercrime._

What You Need to Know

Check Point Research has discovered the "Banshee" macOS stealer, a stealthy malware operation linked to Russian-speaking cybercriminals that mimics the string encryption algorithm of Apple's XProtect antivirus. It has operated undetected for over two months before its code leak on cybercrime forums. Banshee targeted both macOS and Windows using malicious repositories and phishing sites. The cyber threat, active since September, remains relevant even after its planned shutdown, indicating a persistent challenge. Executives must tighten cybersecurity protocols, review threat intelligence measures, and safeguard against emerging malware tactics.

CISO Focus: Malware and Threat Intelligence

Sentiment: Strong Negative

Time to Impact: Immediate

*

A Mac's Nightmare: The Banshee Stealer Unleashed

In recent months, a new macOS malware, dubbed "Banshee," has been shrouded in clandestine operations, keeping cybersecurity teams on their toes. Check Point Research unveiled details surrounding this malicious entity that cleverly adopted the encryption tactics of Apple's XProtect. This revelation sends ripples across the cybersecurity sector, particularly for macOS-focused organizations.

Key Features of Banshee

Cunning Methodology : Banshee leverages a string encryption algorithm akin to Apple's native MacOS XProtect antivirus, evading detection for over two months.

Multifaceted Attacks : Using GitHub repositories, Banshee targeted macOS and Windows users, deploying Lumma for Windows and Banshee stealer for MacOS.

Stealer-as-a-Service : Operating on a rent-a-stealer model, Banshee was marketed on Telegram and dark web forums for $3,000.

The Downfall - A Leaked Blueprint

On November 23, 2024, the source code of Banshee was leaked on underground forums, compelling its creator to cease operations abruptly. However, this pause didn’t last long. Persistent threat actors continued dissemination through phishing, underscoring the need for heightened vigilance.

Implications for Enterprises

This incident starkly illustrates that even giants like Apple are not impervious to malware threats. It further emphasizes the necessity for comprehensive threat intelligence systems and proactive defense strategies not just for individuals, but corporations reliant on Apple's infrastructure.

Maintaining Resilience: Corporate Checkpoints

While the Banshee operation officially ceased, cybersecurity experts warn against growing complacency. With its code accessibility, copycat versions and analogs could emerge, persistently aiming at macOS systems:

End-to-End Encryption Measures : Enhance your endpoint security with advanced threat detection solutions capable of identifying unfamiliar encryption techniques.

Threat Intelligence : Incorporate real-time intelligence feeds focusing on macOS-specific threats, targeting the unique attributes of common enterprise structures.

Education & Training: Regularly update staff on common phishing practices and software vulnerabilities to reduce the potential for human error.

Phishing: A Gateway for Banshee's Mischief

The adoption of phishing websites in Banshee’s deployment chain places further scrutiny on end-user education and vigilance. Banshee's continuation beyond its creator’s shutdown displays a shifting tactic among cybercriminals, favoring resilience over fleeting campaigns.

Vendor Diligence

Even as the drama uncovers, enterprises need to hold their security vendors accountable:

1. Are your encryption algorithms vetted for similarities with known malware tactics like XProtect?

2. How frequently are phishing protection systems updated and tested against real-world scenarios?

3. Can you provide case studies or proof of effectiveness for detected Banshee-like activity?

Action Plan

1. Threat Review Meeting : Convene a cross-departmental meeting including IT and cybersecurity to discuss the Banshee development and implications.

2. Security Audit : Conduct immediate audits on all endpoint security protocols, focusing on Apple devices.

3. Phishing Simulation : Roll out internal phishing simulations to measure staff awareness and improve detection rates.

As the cyber landscape continuously evolves, so does the sophistication of attacks like Banshee. Let this serve as a clarion call for enterprises reliant on Apple devices to refine defenses, bridging the gap between known threats and cutting-edge cybersecurity measures.

*

Source: Check Point Research Article

*

Sources:

1. Check Point Research

2. XSS Underground Forums

3. Exploit Forums

*

Double-Tap's Diplomatic Dance: Espionage in Central Asia

_If cybersecurity were a dance, the Russians are certainly the Fred Astaire of malicious footwork._

What You Need to Know

A sophisticated cyber espionage campaign, tentatively linked to the Russian-nexus APT group UAC-0063 (possibly APT28), is targeting Central Asia and specifically Kazakhstan’s diplomatic initiatives. This operation, dubbed the "Double-Tap Campaign," leverages weaponized Office documents likely originating from Kazakhstan's Ministry of Foreign Affairs to gather strategic intelligence. The objective appears to be gaining intelligence on Central Asia's diplomatic and economic relations with both Western and Asian powers. Board members and executive management are expected to prioritize diplomatic engagement and deploy immediate cybersecurity reinforcements.

CISO focus: Advanced Persistent Threats (APT) & Espionage

Sentiment: Negative

Time to Impact: Immediate

*

Espionage at the Heart of Diplomacy

Stealth and the slick execution of a ballet—this may very well define the ongoing cyber espionage operation uncovered by Sekoia. As subtle as a pickpocket at a bustling market, this espionage campaign targets Kazakhstan and its regional allies. Analysts have linked the perpetrators, possibly APT28, to Russia, making the operation of significant geopolitical concern amidst global tensions.

The Modus Operandi

The operation exploits legitimate documents from Kazakhstan’s Ministry of Foreign Affairs. These documents are weaponized and redistributed to various governmental and diplomatic entities for information extraction. The campaign strategically aligns its attacks with significant diplomatic events such as President Putin’s state visit, indicating advanced and precise orchestration.

The Cyber Toolkit

The "Double-Tap Campaign" operates through the distribution of emails containing Office documents. Once opened, these documents execute a payload designed to evade traditional security measures and garner strategic intelligence. The sophistication of these exploits suggests a deeply resourced entity leveraging advanced tools and tactics, further implicating state actors.

Why Kazakhstan?

Kazakhstan, a central player in Central Asia, serves as a geopolitical bridge between Russia, China, and the Western bloc. By infiltrating Kazakhstani networks, the perpetrators can obtain sensitive information about international relations, energy agreements, and influences that Russia might want to analyze or thwart.

Broader Implications

This tactical intrusion is an emblematic example of geopolitical cyber warfare. It isn’t merely an isolated event but part of a broader strategy to influence and potentially control diplomatic narratives and decisions. The campaign’s timing and focus raise concerns over future intents and the possible expansion of targets within the region.

CISO's Tactical and Strategic Measures

Immediate Response: Bolster defenses, especially around email gateways and Office document handling.

Threat Intelligence Sharing: Foster collaboration with regional and international cybersecurity bodies to share intelligence and frameworks.

Employee Training: Educate staff on recognizing phishing attempts involving document-based exploits.

Warning: Insights May Cause Paranoia

The implications of the Double-Tap Campaign remind organizations of the intricate tapestry of international relations and cyber warfare. As borders blur in the digital realm, vigilance and strategic cybersecurity planning are pivotal.

*

Vendor Diligence

1. How do we ensure our cybersecurity solutions can recognize and neutralize threats disguised within legitimate documents?

2. What measures does our vendor have in place to adapt to emerging APT tactics similar to those utilized in the Double-Tap Campaign?

3. Can the vendor demonstrate a proven track record of defending against state-sponsored cyber espionage activities?

Action Plan

Vulnerability Assessment: Conduct assessments focusing on potential channels previously exploited, such as document management and email systems.

Monitoring and Alerts: Implement heightened network monitoring for unusual activities, particularly with foreign IP addresses.

Incident Response Drills: Regularly run incident response simulations based on new threat intel to stay prepared for unexpected cyber events.

*

Sources:

[Sekoia Blog on Double-Tap Campaign](https://blog.sekoia.io/double-tap-campaign-russia-nexus-apt-possibly-related-to-apt28-conducts-cyber-espionage-on-central-asia-and-kazakhstan-diplomatic-relations/)

_"Cyber Espionage: The Ultimate Balancing Act."_ Security Affairs, 2024.

_"APT Groups: Now and the Future."_ Journal of Cyber Intelligence, 2023.

_CISO Intelligence is lovingly curated from open source intelligence newsfeeds and is aimed at helping cybersecurity professionals be better, no matter what their stage in their career._

_We’re a small startup, and your subscription and recommendation to others is really important to us._

*Thank you so much for your support!