Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Picture this: You’re in the middle of dinner with friends when your work phone buzzes. It’s the fraud supervisor with alarming news: Low-value transactions are suddenly flooding your servers. Your gut tightens as you hastily excuse yourself and head straight to the office to help secure your customers’ accounts against what turns out to be a Bank Identification Number (BIN) attack.

A threat actor once again proved the importance of enforcing strict password management practices by torpedoing a 158-year-old UK transportation company by hacking a password and then effectively shutting it down with ransomware. According to published reports, the threat group Akira gained access to KNP's system in June when it was able to determine a single employee's password. Once access was gained, Akira injected ransomware, which shut down the network and encrypted access to its files and backups.

Top tips is a weekly column where we highlight what’s trending in the tech world and list ways to explore these trends. This week, we will explore ways on how to strengthen any company's first line of defense against cyberattacks. No matter how advanced your cybersecurity tools are, they’re only as strong as the people using them. Phishing scams, social engineering, and weak passwords are threats that often succeed not because systems fail but because humans do.

The frontlines of cybersecurity have long included the financial services sector, but today’s battlefield is increasingly asymmetric. Threat actors aren’t just going after the big-name banks with sprawling infrastructure and billion-dollar balance sheets. They’re targeting credit unions, wealth management firms, fintech startups, and insurance providers with the same determination and ferocity. What do these entities have that cybercriminals want? Plenty.

The Arctic Wolf Labs team has identified a new campaign by cyber-espionage group Dropping Elephant targeting Turkish defense contractors, specifically a manufacturer of precision-guided missile systems. The campaign employs a five-stage execution chain delivered via malicious LNK files disguised as conference invitations sent to targets interested in learning more about unmanned vehicle systems.

Recently, five popular NPM (Node Package Manager) packages were compromised and modified to deliver a malicious DLL, dubbed “Scavenger”. The malware pushed via these compromised NPM packages executes in two stages: an initial first-stage loader, followed by a second-stage infostealer. NPM is the package manager for the Node.js JavaScript platform, which allows developers to share and manage JavaScript libraries and tools.

Starting on July 19th, 2025, an npm supply chain security incident has been attacking maintainers of popular open-source npm packages on the npm registry.

Companies face increasingly complex challenges every day, including cybersecurity threats aimed at disrupting their digital operations. One of the most frequent and damaging is the DDoS attack, which can take websites, applications, and critical services offline. Understanding what is a ddos attack is essential to identify risks, prevent attacks, and protect your organization’s digital infrastructure. In recent years, there have been attacks that marked a turning point in cybersecurity.

Compliance today isn’t just about ticking boxes or avoiding penalties, it’s a direct reflection of your organization’s security maturity. Many modern compliance frameworks now mandate regular testing for network vulnerabilities, which remain one of the leading causes of security breaches. In fact, in 2024, nearly 70% of reported incidents were linked to high-impact vulnerabilities that organizations failed to identify or prioritize.

Windows Server 2025 introduced delegated managed service accounts (dMSAs) to improve security by linking service authentication to device identities. But attackers have already found a way to twist this new feature into a dangerous privilege escalation technique. The BadSuccessor attack lets adversaries impersonate any user — even domain admins — without triggering traditional alerts. Here’s how it works, why it’s so stealthy, and what you can do to stay ahead of it.

Beginning on July 18, 2025, at approximately 0700 UTC, CrowdStrike Falcon Complete Next-Gen MDR and CrowdStrike Falcon Adversary OverWatch identified a wave of Microsoft SharePoint exploitation attempts by an unknown adversary. Two distinct zero-day vulnerabilities were made publicly available: a critical remote code execution vulnerability (CVE-2025-53770) and a server spoofing vulnerability (CVE-2025-53771).

In the ever-evolving world of retail, cyber threats are no longer a distant concern, they’re a daily reality. Over the past year, around 612,000 UK businesses reported experiencing a cyber breach or attack. Phishing remains the most common and disruptive method, targeting 85% of those affected. The retail sector, in particular, sits on a goldmine of customer data, credit card details, email addresses, and purchase histories, all of which are highly attractive to cybercriminals.

Cybercriminals don’t need to be sophisticated. They just need the opportunity—and in Ireland, there’s still too much low-hanging fruit. Many of the vulnerabilities being exploited across Irish networks today aren’t new. They’re years old. Attackers are taking advantage of outdated systems that haven’t been patched, relying on free, off-the-shelf tools to scan for weaknesses—and finding them far too easily. This isn’t a theoretical risk.

Getting through secure email gateways (SEGs) is simply the cost of doing business for a cybercriminal. Literally, detection at the perimeter by a SEG is the same as falling at the first hurdle. SEGs have been adopted broadly, especially in larger organizations (although this picture has started to change in recent years - more on that below). Even where organizations don’t use a SEG, many native controls in email platforms (like Microsoft Exchange) operate using the same principles.

Digital connectivity is reshaping European manufacturing, driving both efficiency and innovation. However, this shift has also created a complex and vulnerable cyber threat landscape, making manufacturing the most targeted industry for cyberattacks for the past four years. Connected systems and legacy infrastructure are colliding, expanding the attack surface and exposing manufacturers to increased risks.

In June 2025, FBI New York and the U.S. Attorney’s Office for the Southern District of New York announced charges against “IntelBroker,” the online persona of 25-year-old British national Kai Logan West. IntelBroker operated one of the most sophisticated data brokerage operations documented in the recent history of cybercrime.

Welcome to the 22nd edition of the Cloudflare DDoS Threat Report. Published quarterly, this report offers a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network. In this edition, we focus on the second quarter of 2025. June was the busiest month for DDoS attacks in 2025 Q2, accounting for nearly 38% of all observed activity.

Cybersecurity professionals encounter two primary categories of denial-of-service threats: traditional denial of service (DoS) and distributed denial of service (DDoS) variants. DoS attacks stem from a single system, while DDoS campaigns leverage multiple machines to overwhelm the target. The fundamental difference? Scale and coordination complexity. Both DoS and DDoS attacks are a type of malicious attempt to disrupt services.

According to Zoho Workplace, organizations struggle to protect themselves as spam makes up 45% of all emails. These sophisticated threats deliberately exploit human psychology. Attackers convince people to bypass security measures, which leads to unauthorized access to the system. Standard defense mechanisms alone cannot curb these evolving threats. This blog explores how organizations can prevent social engineering using contextual threat intelligence and real-time behavioral analysis.

By now, you’ve likely heard about Magecart attacks — or maybe even experienced one firsthand. Over the last few years, digital skimming has become a go-to tactic for cybercriminals targeting websites and web applications. Major organizations like Macy’s, Ticketmaster, the American Cancer Society, P&G’s First Aid Beauty, British Airways, and Newegg have all made headlines due to these breaches. But most victims don’t make the news.

Loyalty fraud prevention has become a major industry threat, with loyalty-linked accounts having become digital assets of converging value – storing points, payment credentials, and verified identity data. That makes them irresistible targets for attackers with both the motive and means to exploit them. Phishing, credential stuffing, spoofed login portals, and personalized impersonation scams are just the beginning.

You’ve likely invested in traditional security tools that monitor failed logins or privilege requests—but more advanced threats use legitimate credentials to hide. If attackers bypass authentication protocols or hijack stolen tokens, they can roam freely under the radar. That’s why behavioral detection in an XDR solution is crucial. It does not just look at logs — it looks at patterns.

In today’s digital battlefield, distributed denial-of-service (DDoS) attacks remain one of the most disruptive tactics used by threat actors. These attacks are not just about overwhelming servers they’re about business downtime, customer dissatisfaction, and reputation loss. With the increasing complexity of attack vectors, traditional DDoS mitigation strategies are no longer enough. Enterprises must adopt smarter, faster, and more adaptive ways to detect and mitigate DDoS attacks.

Evil Twin attack prevention has become more difficult than ever. With affordable, easy-to-use tools, these attacks are now more accessible and harder to detect, leaving customers vulnerable to sophisticated account takeovers without the usual phishing hallmarks. Tools like the Wi-Fi Pineapple Mark VII ($299) create rogue networks and phishing portals, while the ESP8266 Deauther V4 ($15) disrupts Wi-Fi handshakes to force devices onto less secure networks.

SIM swapping is not a novel cyber threat; it has been a persistent issue for over a decade. This technique exploits vulnerabilities in mobile carrier procedures and identity verification protocols. Attackers employ social engineering tactics to deceive telecom providers into transferring a victim’s phone number to a SIM card under their control.

SCATTERED SPIDER, an eCrime adversary, has recently broadened its target scope to include the aviation sector, in addition to its established focus on the insurance and retail industries, as observed by CrowdStrike Services. Throughout Q2 2025, SCATTERED SPIDER's activities have primarily centered on U.S.-based insurance and retail entities, along with U.K.-based retail entities.

Imagine handing over your house keys to someone who looked trustworthy - only to discover later they were an impostor. Everything that entered or left your home was compromised, and you never saw it coming. That’s what happens in your network when ARP spoofing strikes. The Address Resolution Protocol (ARP) helps devices find each other on a local network by matching IP addresses to MAC addresses.