Giulio Astori

Microsoft has released the #KB5071546 extended security update to resolve 57 security vulnerabilities, including three #zeroday flaws. If you are running #Windows10 Enterprise LTSC or are enrolled in the ESU program, you can install this update like normal by going into #Settings, clicking on Windows Update, and manually performing a 'Check for Updates.' Source👇🏽👇🏽

13

1 Comment

Detection rules aren’t set-and-forget. Map them to MITRE ATT&CK tactics to track coverage & gaps. Start with crafting, then testing, deploying, and tuning—repeat. It’s a cycle that turns alerts into actionable intel. Stay sharp, stay ahead. 🔍 #CyberDefense #MITREATTACK

1

"CISA is aware of multiple cyber threat actors actively leveraging commercial spyware to target users of mobile messaging applications (apps). These cyber actors use sophisticated targeting and social engineering techniques to deliver spyware and gain unauthorized access to a victim’s messaging app, facilitating the deployment of additional malicious payloads that can further compromise the victim’s mobile device. These cyber actors use tactics such as: - Phishing and malicious device-linking QR codes to compromise victim accounts and link them to actor-controlled devices. - Zero-click exploits, which require no direct action from the device user. - Impersonation of messaging app platforms, such as Signal and WhatsApp. While current targeting remains opportunistic, evidence suggests these cyber actors focus on high-value individuals, such as current and former high-ranking government, military, and political officials,4 as well as civil society organizations (CSOs) and individuals across the United States,5 Middle East,6 and Europe. CISA strongly encourages messaging app users to review the updated Mobile Communications Best Practice Guidance and Mitigating Cyber Threats with Limited Resources: Guidance for Civil Society for steps to protect mobile communications and messaging apps, as well as mitigations against spyware." https://lnkd.in/gS8vEDhw

1

"The threat actor behind the exploitation of vulnerable Craft Content Management System (CMS) instances has shifted its tactics to target Magento CMS and misconfigured Docker instances. The activity has been attributed to a threat actor tracked as Mimo (aka Hezb), which has a long history of leveraging N-day security flaws in various web applications to deploy cryptocurrency miners. "Although Mimo's primary motivation remains financial, through cryptocurrency mining and bandwidth monetization, the sophistication of their recent operations suggests potential preparation for more lucrative criminal activities," Datadog Security Labs said in a report published this week. Mimo's exploitation of CVE-2025-32432, a critical security flaw in Craft CMS, for cryptojacking and proxyjacking was documented by Sekoia in May 2025." https://lnkd.in/d-j33inX

1

As tech evolves, so do the tactics of cybercriminals targeting privileged credentials. Federal agencies are stepping up their game with NIST’s Cybersecurity Framework. Dive into NIST’s Special Publication 800-63 to see how they're managing digital identity risks.

Strategic CISOs are in demand. How does their role differ from that of a Tactical CISO Executive Overview The role of the Chief Information Security Officer (CISO) continues to evolve as organizations face mounting cybersecurity threats, regulatory pressures, and the need to embed security into every aspect of business. Two dominant leadership styles often emerge: the Strategic CISO and the Tactical CISO. A Strategic CISO operates at the board and executive level, aligning security with business strategy and long-term resilience. They focus on risk management, governance, and building organizational trust. By contrast, a Tactical CISO is deeply engaged in operations, managing incidents, vulnerabilities, and technical teams. Their hands-on approach builds credibility with technical staff and ensures compliance and operational control. Link: https://lnkd.in/gFmt2f6u

6

Tell me more about how a real attacker could leverage normal system behavior to create physical, operational, or safety impacts- Welcome to OT Pen-Testing and a new challenge for those requiring CMMC compliance. #OT #OperationalTechnology #IoT #CMMC #LateralMovement #HardwareAbuse #ITNetworks https://lnkd.in/eC5-jZVA

12

1 Comment

Quote from Article: Policy-as-Code is not merely a temporary trend but a fundamental shift in how organizations approach GRC. Soon, federal contracts may require delivery of not only human-readable SSPs but also machine-verifiable compliance packages. Audits may involve running scripts instead of reviewing PDFs. And AI-powered governance engines will cross-check deployments against codified policies in real time. #GRC #Federal #infosec

2

Lock down your Tiger Data services, without the overhead of a VPC. Here’s a quick walkthrough of using IP Allow Lists to control access to just trusted networks.

14