Unwelcome Visitors, Ideological Warfare, Caught Bang to Rights, Not Mischief: Malice, Dos and Don'ts, and Return of the mac Threat. It's CISO Intelligence for Friday, 11th July 2025.
This is not "Old Time Rock and Roll," belief is a powerful instrument, a very British heist: at least they didn't blow the doors off, invisible cloaking is a thing, new rules, and an old dog with new tricks.
💡
"Gives me everything I need to be informed about a topic" - __UK.Gov__
Table of Contents
1. Risky Business: When Extensions Hitch a Ride on Your Browser
2. Pay2Key Strikes Back: Iranian Cyber Rascals Loot the West Again
3. Lock, Stock, and Two Smoking Keyboards
4. TapTrap: The Animation that Taps Away Your Privacy
5. Zipping Up Your Passwords: CJIS Compliance Decoded
6. macOS Malware: When Termius Became a Trojan Rider
Sign up for CISO Intelligence.
21st century industry insights for the modern CISO
It won't hurt, I promise.
Email sent! Check your inbox to complete your signup.
No spam. Unsubscribe anytime.
Risky Business: When Extensions Hitch a Ride on Your Browser
_When browser extensions moonlight as web scrapers, it’s not just the cookies that crumble._
What You Need to Know
Browser extensions are the latest unwitting accomplices in cyber malfeasance, with millions of users unknowingly turning their web browsers into proxies for a sophisticated web scraping botnet. A library known as Mellowtel, embedded within many extensions, is behind this stealthy operation. The exploitation has prompted stringent actions from browser developers, although the risk remains significant due to inadequate measures across numerous extensions. Executive management is advised to evaluate and enhance current cyber defense strategies, focusing on potential vulnerabilities within browser extensions.
CISO focus: Application Security, Data Privacy, User Awareness
Sentiment: Negative
Time to Impact: Immediate
*
Here’s How Extensions Step Into the Cyber Underworld
Millions of internet users face a silent menace lurking in their web browsers: rogue browser extensions. Recent investigations revealed a sophisticated exploitation involving 245 extensions across major platforms like Chrome, Edge, and Firefox. These extensions, housing a harmful library named Mellowtel, turn browsers into unexpected proxies for a web scraping botnet, scraping your browsing sessions when not in use.
Behind the Curtains: The Mellowtel Masterpiece
Mellowtel artfully waits for moments of user inactivity. Then, with the stealth of a shadowy cat burglar, it deactivates page security features and clandestinely loads a remote site in a hidden iframe. This seemingly innocuous action sends your browsing data into the netherworld of unwanted data harvesting. Researchers at SecureAnnex were the first to expose this code embedded deftly within a sea of common extensions.
A Corporate Crackdown: Proactive Measures
Faced with this revelation, browser developers have started physical mitigation through the removal of malicious elements from extensions. As of the current stance, 12 of the impacted 45 Chrome extensions, 8 of the 129 influenced Edge extensions, and 2 of the 69 affected Firefox extensions have been purged of Mellowtel. However, this partial compliance underscores a mere scratch on the surface of a larger problem.
Fighting Back: Lessons and Actions
While developers are gradually pulling the brakes on this invasive technology, organizational defenses cannot rest easy. An immediate revaluation of extension management and privacy protocols is essential. Users must scrutinize the permissions required by extensions, and organizations should limit extension usage only to trusted publishers.
Adopt vetted cybersecurity frameworks focusing on the scrutiny of third-party applications.
Empower user education programs to spotlight the dangers of browser extensions.
Deploy more robust threat detection tools to catch unusual browser activities.
The Hidden Fallout: Why This Matters
The repercussions of such vulnerabilities extend far beyond personal data breaches. For enterprises, sensitive proprietary information and operational data sits in the crosshairs of these stealthy browsers-turned-botnets. Moreover, the broader ecosystem suffers as legitimate web analytics tools can yield skewed data upon interference by botnets, a truly proverbial egg on the face moment for data reliability.
In an era racing towards increased digitization, trust in digital ecosystems remains vulnerable. As this incident underscores, the security of browser extensions is more than a footnote—it is a critical facet in the larger cybersecurity jigsaw puzzle.
*
Vendor Diligence Questions
1. How thoroughly does your product vet third-party libraries or components integrated within applications?
2. What measures are in place to monitor the extensions available through your product for potential malicious activities?
3. Can you provide documentation or audit results for recent security assessments conducted on your application ecosystems?
Action Plan
Conduct an immediate audit of all browser extensions currently used in the organization.
Increase user awareness sessions focusing on understanding extension risks and responsible installation practices.
Collaborate with IT security teams to regularly update extension usage policies and continuously monitor compliance.
Engage vendors to ensure their products and extensions meet high security and privacy standards.
*
Source: Risky Business
More Information: SecureAnnex Blog
*
Pay2Key Strikes Back: Iranian Cyber Rascals Loot the West Again
_Epigram: Who needs a Hollywood blockbuster when Iranian hackers are creating their own dramas in cyberspace?_
What You Need to Know
Board members and executive management should be acutely aware of the resurgence of Pay2Key, a ransomware group with Iranian ties, which has intensified its cyber activities targeting Western organizations. Immediate defensive measures must be implemented to shield critical assets.
CISO Focus: Ransomware Threat Intelligence
Sentiment: Negative
Time to Impact: Immediate
*
In the digital world where cybersecurity is often likened to a rollercoaster ride of never-ending threats, Pay2Key is the latest thriller lurching back into the spotlight. Morphisec’s recent revelation about the Iranian-backed ransomware campaign, Pay2Key.I2P, paints a thrilling yet troubling picture of cyber warfare fused with ideological motives. This potent cyber group, its intentions unmistakably aligned with Iranian geopolitical objectives, is resuming its operations with a vengeance.
Rising From the Ashes
Pay2Key, once a formidable ransomware actor linked to the Fox Kitten APT group, has transformed its operations into a more sophisticated and aggressive entity. They have launched a ransomware-as-a-service under the moniker Pay2Key.I2P. This newest scheme is not only technically adept but also freaking lucrative—it has incredibly raked in over $4 million in just four months.
The Chilling Sponsorship Deal
What sets apart Pay2Key.I2P from your average ransomware syndicate is their open business-like offering—a swell 80% profit share for anyone supporting their attacks against the West. Their recruitment strategy is as much about pockets as it is about propaganda, seeking affiliates ideologically aligned with Iran’s geopolitical vendettas.
Rampant Methods
Pay2Key.I2P reportedly leverages the capabilities of Mimic ransomware, previously dissected by Morphisec, enhancing their attack vectors. Their readiness to rewrite ransomware scripts shows a software piracy flair that’s ingeniously nefarious. These cyber marauders, with technical advancements reminiscent of open source collaborations, thrive on innovation spurred by malevolent intent.
Significant Implications
Organizations in the West are effectively the bullseye for Pay2Key.I2P, making this resurgence dire not just for individual companies but for the broader economic stability. The potential for disruption is vast, potentially crippling critical infrastructure and pilfering sensitive data en masse.
Financial Impact : Calculating losses from ransomware demands runs into millions, with recovery costs adding substantially more pressure.
Reputational Damage : Losing client data can mean losing clients. The reputational stakes cannot be overstated as trust is the currency of the digital economy.
Operational Disruption : Ransomware attacks result in halted operations, making the cost of downtime a huge financial hangover.
Navigating Through the Chaos
Cybersecurity teams must prioritize resilience strategies tailored to handle sophisticated ransomware threats head-on. Real-time intelligence sharing and actionable insights across sectors can form the defensive backbone against these threats. Organizations might need to reassess their risk management frameworks with an eye toward rapid adaptation.
Advanced Threat Detection : Implement AI-driven threat detection systems capable of recognizing operational anomalies.
Employee Training : Foster a culture of cyber vigilance by ensuring continuous training modules on emerging threats.
Incident Response Planning : Have a ready-to-execute incident response plan that includes clear communication protocols.
A Calculated Offense or Catastrophe?
There’s a funny yet ominous irony that Pay2Key’s operation reads more like a business plan than a criminal conspiracy. But for now, the ball’s in our court—how swiftly and effectively we counteract these threats will dictate whether we’re scripting our disaster or our triumph.
In the world of cybersecurity, vigilance isn't just a choice; it's a necessity, and today, it’s most crucial against elaborate threats such as Pay2Key.I2P. Stay alert, stay protected, and above all, stay ahead.
*
Vendor Diligence Questions
1. What measures do you have in place to detect and prevent ransomware attacks?
2. How does your cybersecurity solution align with our resilience strategies against APT groups?
3. Can you demonstrate past successes in mitigating similar ransomware threats?
Action Plan
1. Threat Assessment : Conduct a comprehensive threat analysis focusing on Pay2Key.I2P’s modus operandi.
2. Action Required: Mobilize cybersecurity defenses and ensure alignment with evolving threat landscapes by prioritizing ransomware resistance strategies.
3. Enhanced Monitoring : Strengthen monitoring of network activities to quickly identify and neutralize any abnormality.
4. Cross-Collaboration : Foster cooperation between internal cybersecurity teams and external vendors for optimal threat intelligence sharing.
*
Source: Morphisec's Blog on Pay2Key Resurgence
*
Lock, Stock, and Two Smoking Keyboards
_Crime doesn't pay, except in Bitcoin._
What You Need to Know
The recent cyberattacks targeting UK retail giants M&S, Co-op, and Harrods have resulted in the arrest of four individuals believed to be key players in the attacks. These offenses underline the importance of robust cybersecurity measures and the need for organizational vigilance. Executives should prioritize assessing vulnerabilities, ensuring up-to-date defenses, and fostering an organizational culture focused on cybersecurity. Immediate actions include conducting a comprehensive audit of current security protocols and initiating staff training to recognize and mitigate cyber threats.
CISO focus: Cybercrime Response and Prevention
Sentiment: Negative
Time to Impact: Immediate
*
UK Police Arrest Four in Connection with M&S, Co-op and Harrods Cyberattacks
In a dramatic turn of events fit for a modern-day gang thriller, UK police have apprehended four individuals allegedly behind sophisticated cyberattacks on retail titans Marks & Spencer, Co-op, and Harrods. These targeted attacks resulted in significant financial and reputational damage, shaking consumer trust across the board.
The Arrests: A Cybercrime Saga
Earlier this week, law enforcement successfully executed a coordinated operation against a suspected cybercriminal ring responsible for infiltrating the systems of major retailers. The arrests, which took place in multiple locations across the UK, involved suspects ranging in age from 20 to 32. These individuals are charged with orchestrating a series of digital blitzkriegs designed to extract sensitive customer data and leverage it for financial gain.
How They Did It: The Modus Operandi
Phishing : Initial access was reportedly gained through phishing campaigns, targeting employees with convincing yet fraudulent emails designed to capture login credentials.
Exploitation of Vulnerabilities : The attackers are believed to have exploited unpatched vulnerabilities within the retailers' IT systems, a stark reminder of the importance of regular updates and security patches.
Ransom Demands : Once inside the networks, the attackers deployed ransomware, crippling operations and demanding hefty Bitcoin ransoms to unlock the hijacked data.
Impact on Retail and Customer Confidence
The ramifications of these breaches are profound, not only for the affected companies but for the entire retail sector. The attacks have highlighted glaring deficiencies in cybersecurity infrastructures, leading to immediate reviews and upgrades. Consumers, meanwhile, face the nervous wait to see if their personal data has been compromised.
Financial Losses : It's estimated that the combined financial impact on M&S, Co-op, and Harrods could exceed millions once costs of system repairs, ransom payments, and lost revenue are calculated.
Brand Damage : Beyond the monetary damage, these brands now face a significant uphill battle in regaining customer trust. Restoring brand image will require stringent, transparent measures and improved customer communication.
Customer Data At Risk : With thousands potentially vulnerable to identity theft, the demand for enhanced data protection measures has never been higher.
The Larger Cybersecurity Picture
This spate of cyberattacks serves as a wake-up call for businesses operating in an increasingly digital world. It underscores the necessity for comprehensive cybersecurity strategies that encompass employee education, regular system updates, and robust intrusion detection systems.
Increased Vigilance : Organizations must now pivot to a proactive cybersecurity stance, identifying threats before they can escalate into breaches.
Technological Investments : This incident may prompt businesses to allocate greater budgets towards developing or acquiring advanced cybersecurity solutions.
When the Digital Dust Settles
As the investigation unfolds, significant lessons are emerging for the corporate sector. Businesses must recognize that cyber threats evolve rapidly, necessitating continual adjustments to cybersecurity postures. There is no room for complacency in an arena where the stakes involve not just financial health, but customer loyalty and brand reputation.
*
Vendor Diligence Questions
1. How does your company ensure prompt application of security patches for our systems?
2. What measures are in place to safeguard against phishing and social engineering attacks?
3. Can you provide details on your incident management and data recovery strategies?
Action Plan
1. Conduct Security Audits : Initiate immediate audits of current cybersecurity protocols to identify potential vulnerabilities.
2. Employee Training : Roll out comprehensive training programs to educate staff on recognizing and preventing phishing attempts.
3. Technological Improvement : Evaluate and invest in advanced cybersecurity solutions like improved firewalls and AI-powered threat detection systems.
4. Public Relations Strategy : Develop a transparent communication strategy to rebuild consumer trust and reassure them about data protection efforts.
*
Source: databreaches.net
Additional sources include information from UK National Crime Agency updates and public statements from the affected companies.
*
TapTrap: The Animation that Taps Away Your Privacy
_Ever tapped away in ignorance only to realize later that your taps were more mysterious than productive?_
What You Need to Know
TapTrap is a newly identified threat targeting Android devices through animation-driven tapjacking. This ingenious attack allows a malicious app without explicit permissions to manipulate system animations, creating invisible overlays that trick users into performing unintended actions like granting camera access or factory resetting the device. Executives need to instruct their teams to prioritize understanding this threat and implementing preventive measures. Immediate action is required to update security protocols and educate users on this new risk.
CISO Focus: Mobile Security
Sentiment: Strong Negative
Time to Impact: Immediate
*
TapTrap, a stealthy new Android attack vector, is causing ripples across the cybersecurity landscape with its novel technique of leveraging animations to tapjack users into performing actions they never intended. In this nefarious approach, the art of tapjacking undergoes a devious makeover where animations turn into windows of opportunity for cybercriminals.
The Art of Illusion
"TapTrap" leverages Android's screen transition animations by invisibly overlaying sensitive permission prompts over legitimate app interfaces. Users unknowingly interact with these hidden prompts, inadvertently granting permissions or approving actions. For instance, a benign app might induce users to inadvertently authorize camera access or, worse yet, initiate a factory reset.
How It Works:
A malicious app requests a custom animation for screen transitions.
The animation conceals a different interface from the user, which can be a permission screen or another app.
Taps made during the running animation are intercepted by the overlay, leading to unintended actions.
User Awareness: The First Line of Defense
Awareness is critical. Users are often the last barrier before a security breach occurs. Understanding how TapTrap exploits seemingly harmless app interactions is key to prevention. Precautionary steps should include:
Inspect Permissions : Always review app permissions before installation.
Stay Informed : Keep abreast of the latest threats and how they function.
Educate : Encourage users to report suspicious app behavior immediately.
The Role of Developers and Google Play
App developers must be vigilant. Complacency is an ally of TapTrap. Google Play's vetting processes, while stringent, must adapt to evolving threats to prevent malicious apps from slipping through. Collaboration between cybersecurity experts and app stores is vital to safeguard Android's ecosystem.
Corporate Responsibilities
Organizations should implement comprehensive mobile security policies. This includes:
Mobile Device Management (MDM) : Deploy MDM solutions to exert better control over enterprise devices.
Training : Conduct regular security training focused on mobile threats.
Update Protocols : Ensure all Android devices are regularly updated with the latest security patches.
Police Your Digital Neighborhood
Conducting digital audits and app provenance checks regularly can prevent TapTrap from wreaking havoc. Vet unknown apps scrupulously and maintain a whitelist of approved applications. Encouraging a culture of caution can significantly mitigate the risk.
When Digital Pranks Turn Dark
The mischievous nature of TapTrap transforms simple mobile activities into potential security threats without users' knowledge. It's crucial to remain vigilant and to support efforts for tighter controls and stricter app review mechanisms.
*
Vendor Diligence Questions
1. What safeguards does your product incorporate to prevent overlay attacks?
2. How frequently do you update your threat intelligence regarding mobile security?
3. What are your strategies for promptly detecting unauthorized access or permissions on enterprise devices?
Action Plan
Immediate Priorities:
Distribute threat intelligence briefings focused on TapTrap to all employees.
Deploy mobile threat detection software that recognizes overlay attacks.
Mid Term Actions:
Establish a rapid-response team to analyze suspicious apps and their behavior.
Collaborate with industry partners to enhance shared threat databases.
Long Term Goals:
Advocate for regulatory guidelines that demand heightened app security measures.
Innovate new AI-driven solutions to preemptively identify and neutralize emerging threats.
*
Source: TapTrap Detailed Study
*
Zipping Up Your Passwords: CJIS Compliance Decoded
_It's all in the password, darling. Also, perhaps in multifactor authentication and access controls..._
What You Need to Know
In an era marked by an escalating cyber threat landscape, the FBI's updated guidelines on Criminal Justice Information Services (CJIS) security directives are pivotal. The most critical focus within these guidelines is the implementation of robust password policies, multifactor authentication (MFA), and refined access controls to bolster cybersecurity defenses. As a board member or executive, you are expected to ensure your organization aligns with these best practices to safeguard sensitive criminal justice information effectively.
CISO focus: Data Protection and Access Management
Sentiment: Neutral
Time to Impact: Immediate
*
Navigating CJIS Compliance: Best Practices
Faced with the mounting complexity of cyber threats, the FBI recently unveiled crucial updates to its CJIS guidelines, underscoring password hygiene, multifactor authentication (MFA), and rigorous access controls as cornerstone practices in protecting sensitive law enforcement data.
Password Protocol Overhaul
The FBI emphasizes that traditional password strategies no longer suffice. New guidelines prioritize length over complexity. Previous practices of mandating complex character combinations have shifted in favor of long, user-friendly passphrases that prevent unauthorized access. Encouraging employees to use passphrases that are both unique and memorable can significantly reduce the risk of password cracking.
Long Passphrases: Opt for 15 characters or more, balancing complexity with user memorizability.
Regular Updates: Implement automatic prompts for password changes every 60-90 days.
Multifactor Authentication: The New Standard
The integration of multifactor authentication (MFA) is now mandatory, adding an essential layer of defense against unauthorized access. MFA typically requires two or more verification forms to authenticate an individual—something you know (password), something you have (smartphone authentication app), and something you are (fingerprint or other biometric data).
MFA Solutions: Deploy MFA across all CJIS data points and ensure seamless integration with current IT infrastructure.
User Training: Conduct regular workshops on MFA processes to ensure users are adept at using this security layer without compromising efficiency.
Fortifying Access Control
Access to CJIS data must be limited and controlled through stringent policies to deter potential breaches. The FBI advocates for "least privilege" access, ensuring individuals only have access necessary for their roles.
Role-Based Access: Regularly audit and adjust user roles to align with current responsibilities.
Monitoring and Audits: Implement continuous monitoring systems to identify and respond to unauthorized access attempts in real-time.
Balancing Act: Security vs. Usability
While these measures enhance security, vigilance against over-burdening users with cumbersome security protocols is crucial. Finding a balance between robust security and user experience is key to effective CJIS compliance.
Organizational Ramifications
Failure to adhere to these guidelines can result in compromised data integrity, monetary fines, and reputational damage. As cyber threats escalate, it remains imperative to invest in security measures that align with FBI standards to avert potential catastrophes.
It's All in the Access Password Pudding
The ongoing battle to secure criminal justice information requires more than theoretical policies; it demands active, adaptable application of CJIS guidelines. Organizations must prioritize these security actions to ensure they are not left vulnerable in an ever-changing cyber landscape.
*
Vendor Diligence Questions
1. Can your security solution integrate seamlessly with our existing MFA systems to offer a streamlined user experience?
2. What measures do you offer to ensure proactive monitoring and real-time alerting for unauthorized access attempts?
3. How does your password management system conform to or enhance the updated FBI CJIS security guidelines?
*
Action Plan
1. Review and Revise Password Policies:
Shift to passphrase-oriented policies with minimum 15-character requirements.
2. Deploy and Educate on MFA:
Install MFA technology across mission-critical platforms.
Conduct training sessions to facilitate MFA adaptation.
3. Enhance Access Control Protocols:
Implement role-based access with regular audits.
Increase monitoring for real-time threat detection and response.
4. Continual Compliance Checks:
Schedule periodic reviews of security adherence to CJIS standards.
*
Source: FBI's CJIS demystified: Best practices for passwords, MFA & access control
*
macOS Malware: When Termius Became a Trojan Rider
_Once again, your trusted app has a double life—hackers are giggling in coder corners._
What You Need to Know
The macOS.ZuRu malware has resurfaced, targeting popular backend tools with malicious versions of applications like Termius. Leveraging the Khepri C2 framework, this threat poses a significant risk. Immediate action is required to protect systems by updating detection protocols and implementing threat hunting initiatives.
CISO Focus: Malware & Threat Detection
Sentiment: Strong Negative
Time to Impact: Immediate
*
macOS Malware Strikes Back: A New Chapter in the macOS.ZuRu Saga
macOS users find themselves in peril once again as familiar malware, macOS.ZuRu, re-emerges with a new trick up its sleeve. Initially discovered in 2021 via malicious web results on Baidu, this backdoor Trojan has evolved. Previously utilizing fake web downloads of popular macOS utilities, it has shifted tactics. In its latest maneuver, it has compromised the cross‑platform SSH client Termius using the Khepri C2 framework, an open-source tool that aids in malicious post-infection operations. The implication is clear: no respected application is safe from being turned into a malicious puppet.
Malicious Evolution: From iTerm2 to Termius
The journey of macOS.ZuRu is a lesson in adaptive persistence. Starting with iTerm2, the malware targeted essential tools favored by backend developers, cloud engineers, and system administrators. By ensuring that even respectable applications like SecureCRT, Navicat, and Microsoft’s Remote Desktop for Mac could become vectors for attack, the malware matured into a formidable threat. As of May 2025, the inclusion of Termius marks a significant evolution, demonstrating both technical sophistication and the relentless pursuit of valuable targets.
Khepri C2: The Digital Puppeteer
The adoption of Khepri C2 into macOS.ZuRu’s latest iteration is a strategic decision. This framework allows the malware to manage compromised machines with unprecedented stealth. Its modular nature lets attackers fine-tune their campaign, reacting in real-time to defensive countermeasures. For cybersecurity teams, this poses a new challenge, as traditional detection models need to adapt to these agile threats.
Potent Payload: Hidden Menace Within
Inside the malicious variant of Termius, the payload remains the same—a beacon from the compromised app to its command and control center. This allows attackers to not only exfiltrate sensitive data but also introduce further malicious components on demand. This high level of control makes macOS systems not just entry points, but footholds within organizational networks.
Immediate Mitigation: Reactive Measures
The threat remains immediate, placing it at the forefront of IT and cybersecurity priorities. Steps for mitigating this threat include:
Enhanced Threat Detection : Updating intrusion detection systems with the latest indicators of compromise related to Khepri C2.
Malware Analysis : Performing in-depth malware analysis to understand specific behaviors and devise targeted defensive strategies.
Patch Management : Ensuring that all macOS systems are up-to-date with security patches, and securing application download channels to prevent future infections.
A (Not So) Fortunate Cookie for Admins
Adminstrators and IT teams must remain vigilant against this cunning adversary. By understanding that even trusted applications can betray their origins, the emphasis should be on proactive threat intelligence and a culture of skepticism over any unexpected application behaviors or updates.
What You've Learned: Even Your Apps Have Secret Lives
As macOS.ZuRu reasserts its presence, the line between trusted ally and malicious insider continues to blur. Security teams are urged to stay proactive and informed, ensuring every shield is raised against potential invasion.
*
Vendor Diligence Questions
1. Can the vendor provide evidence of application source integrity and hardening against supply chain attacks?
2. What measures are in place to alert users and admins of unauthorized modifications?
3. Is there support for implementing zero-trust principles in managing application updates and downloads?
Action Plan
Initiate Threat Intelligence Gathering : Leverage security feeds and sharing groups to remain updated on ZuRu developments.
Implement Ongoing Monitoring : Deploy additional monitoring on high-risk applications, particularly ones that require SSH and related tools.
Conduct Security Training : Regularly brief staff and users on the importance of downloading secure applications and recognizing symptoms of infection.
*
Source: <https://www.sentinelone.com/blog/macos-zuru-resurfaces-modified-khepri-c2-hides-inside-doctored-termius-app/>
*
Sources:
1. SentinelOne's analysis on macOS.ZuRu
2. JAMF security research findings
3. Community intelligence from Team Cymru
*
_CISO Intelligence is lovingly curated from open source intelligence newsfeeds and is aimed at helping cybersecurity professionals be better, no matter what their stage in their career._
_We’re a small startup, and your subscription and recommendation to others is really important to us._
*Thank you so much for your support!(