Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Threat actors continue to exploit SMS using social engineering, Node.js misuse results in malware and malicious payload delivery, and fake PDF converters help deliver malware.

When I got the assignment to attend KubeCon 1st of April I thought it was an April prank, but as the date got closer I realized—this is for real and I’ll be on the ground in London at the tenth anniversary of cloud native computing. I’ve seen a lot of tech events during my years in the industry while trying not to get replaced by AI and I have to say this one stands out! Image source: CNCF YouTube Channel Here is my recap of KubeCon + CloudNativeCon Europe 2025.

The Digital Operational Resilience Act (DORA) is a critical regulatory framework introduced by the European Union to enhance the digital resilience of the financial sector. It mandates a uniform set of standards for ICT risk management frameworks, digital resilience capabilities, and third-party service oversight. Enforceable by European supervisory authorities, DORA ensures that all covered entities can respond to and recover from major ICT-related incidents, including cyber attacks.

ClickFix is an emerging social engineering technique that has gained traction among both cybercriminals and APT groups due to its effectiveness and low barrier to execution. First observed around October 19, 2023, disguised as Cloudflare anti-bot protection, ClickFix deceives users into taking action to “fix” a non-existent issue, often through fake reCAPTCHA pages, spoofed software updates, or fraudulent security prompts.

Just-in-time (JIT) access isn’t easy. This Reddit thread of cybersecurity pros surfaces many of the most common JIT headaches — and you may be encountering those same challenges yourself. As noted in the thread, no users should be “swimming in access”, especially as standing privileges and over-permissioned accounts continue to be a major source of breaches. The truth is, many JIT models struggle to keep up with today’s fast-moving, cloud-native environments.

Modern infrastructure is already complex, characterized by distributed environments, multi-cloud deployments, and dynamic change. Now add Large Language Models (LLMs) to the mix, and the challenge grows exponentially. Engineering leaders are under pressure to deliver innovation fast, while also safeguarding against breaches, misconfigurations, and human error. That’s why initiatives like eliminating static credentials, enforcing just-in-time access, and reducing SSH key sprawl are gaining traction.

Is your team's favorite new productivity tool also your biggest data leak waiting to happen? Generative AI (GenAI) assistants like ChatGPT, Microsoft Copilot, and Google Gemini have quickly moved from novelty to necessity in many workplaces. These tools use machine learning and advanced algorithms to help employees draft content, analyze data, and even write code faster than ever before.

The best way to understand real-world attacks is to observe them in the wild. Following this principle, our research team set up a decoy Kubernetes workload designed to attract malicious actors – a honeypot in a Kubernetes cluster we named the “Honey-pod.” Inside this pod, we deployed Apache Druid, a popular open-source analytics database known for its scalability and, unfortunately, for a history of exploitable vulnerabilities.

Databases are an integral part of modern IT infrastructure and power almost every modern application. After all, databases store the persistent information that applications run on. That’s why monitoring these databases is crucial: ensuring system health and performance and forming a vital component of any observability practice.

Safepay is a newcomer to the ransomware landscape. Since its first published attack in October 2024, the group has attacked over 50 organizations worldwide. SafePay maintains a dark web blog and a presence on the TON network for victim communications. The group employs the increasingly common double extortion model, combining data encryption with the theft of sensitive information to pressure victims into payment.