Evangelos Mourikis

🔍 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗔𝘄𝗮𝗿𝗲𝗻𝗲𝘀𝘀: 𝗖𝗮𝗻 𝘆𝗼𝘂 𝘀𝗽𝗼𝘁 𝘁𝗵𝗲 𝗱𝗶𝗳𝗳𝗲𝗿𝗲𝗻𝗰𝗲 𝗯𝗲𝘁𝘄𝗲𝗲𝗻 𝘁𝗵𝗲𝘀𝗲 𝘁𝘄𝗼 𝗨𝗥𝗟𝘀? ✅ maybank2u.com ❌ maybank2u.com (looks identical, right?) This is a real phishing trick using homoglyph attacks — replacing characters with lookalike letters from other alphabets like Cyrillic, making malicious links seem legitimate. 💡 𝗘𝘅𝗮𝗺𝗽𝗹𝗲: The letter “а” (Cyrillic) looks like “a” (Latin), but it leads to a completely different domain. 🔐 𝗪𝗵𝘆 𝗶𝘁 𝗺𝗮𝘁𝘁𝗲𝗿𝘀: Many users unknowingly click these links in emails or texts, giving hackers access to sensitive info like banking credentials or personal data. 🛡️ 𝗛𝗼𝘄 𝘁𝗼 𝘀𝘁𝗮𝘆 𝘀𝗮𝗳𝗲: • Never click suspicious or unexpected links. • Always manually type trusted URLs. • Use browser extensions that detect homograph attacks. • Hover over links to preview real destinations. • Enable 2FA where possible. 👁️‍🗨️ 𝗜𝗳 𝗶𝘁 𝗹𝗼𝗼𝗸𝘀 𝘀𝘂𝘀𝗽𝗶𝗰𝗶𝗼𝘂𝘀, 𝗶𝘁 𝗽𝗿𝗼𝗯𝗮𝗯𝗹𝘆 𝗶𝘀. Let’s help our network stay cyber-aware. Share this with someone who needs to see it. 🧠💻 #CyberSecurity #PhishingAwareness #SocialEngineering #InfoSec #CyberAwareness #LinkedInLearning #StaySafeOnline #EmailSecurity For More Security Updates, Follow: Kaaviya Balaji

4,054

170 Comments

Fraud and Cyber Are Inseparable. In recent years, we’ve been developing the Group-IB #FraudMatrix — an integral part of our Fraud Protection solution. Inspired by the MITRE ATT&CK framework, which offers structured matrices for Enterprise, Mobile, and ICS threats, we’ve applied a similar methodology to the world of fraud. Group-IB Threat Intelligence brings together the systematic approach of MITRE ATT&CK with the deep domain knowledge of our FraudMatrix to offer a unified view of cyber and fraud threats. Threat actors who carry out cyberattacks are often closely linked to fraud operations. Their tactics, techniques, and procedures (TTPs) span both domains, making it essential to analyze them using a shared framework. Until now, this intersection was a blind spot—fraud and cyber were often treated separately, making it difficult to fully understand and respond to attackers' behavior. With the FraudMatrix, we now have a common language to map and explain how these actors operate across both vectors—closing the gap and enabling better defense. A big thank you to our clients and partners who have contributed to advancing the FraudMatrix and helping transform it into a universal language for describing fraudsters’ tactics and techniques. Together, we’ll continue shaping the future of threat intelligence.

132

4 Comments

🧱 LARGEST LEAK OF INTERNAL DOCUMENTS from Great Firewall of China (GFW) 🧱 Over 500 GB of source code, work logs, and internal communication records were leaked, revealing details of the GFW’s research, development, and operations. Source in the comments #cyber #news #firewall #leak

108

6 Comments

New Sigma release r2025-07-08 is available for download. 🌟43 New Rules 🛡️34 Rule updates 🔬27 Rule Fixes Explore the full release -> https://lnkd.in/eWG6VJgD This release introduces a bunch of new rules including detections for - Katz Stealer - MeshAgent usage - CVE-2025-33053 and CVE-2025-49144 (Notepad++) - Kerberos Coercion Via DNS SPN Spoofing And much more. We've also introduced a new Github action to automate the generation of MITRE heatmaps every month. A special thanks to the many contributors that helped shape this release, specifically 0xFustang, Alfie Champion Ariel Otilibili Anieli Milad Cheraghi Daniel Degasperi david-syk, egycondor, _ezlucky_, frack113, Grégory Wychowaniec, GrepItAll, hashdr1ft, Josh Nickels Cameron Roberts, David Faiß, Gameel Ali Nik Stuckenbrock, norbert791 Christian B. Swachchhanda Shrawan Poudel, unicornofhunt, vx3r, wieso-itzi Mohamed Ashraf Gábor Lázár

153

1 Comment

“PCI SSC has seen comments…” 👀 -Assessor Newsletter, June 2025 A few weeks ago, I raised a flag about FAQ 1597 and the related infographic, where the language suggested that acceptance of lower-risk vulnerabilities wasn’t on the table. That post gained great traction and sparked important conversations in the community. Well, the PCI Security Standards Council has now responded. In their June 2025 Assessor Newsletter, they stated: ✅ Clarification (main bullet points summarized): - “Addressed” ≠ “Resolved.” - Examples of "addressed" where not an exhaustive list. - Low-risk vulnerabilities can be accepted—if justified by a Targeted Risk Analysis (TRA). - Addressing a vulnerability may mean fixing it, compensating for it, disabling it, or accepting the risk. - The TRA must be reviewed annually to ensure it still reflects the environment and risk tolerance. This clarification is welcome—but also tacit acknowledgment that feedback from assessors and the broader community (yes, some of those comments they saw were from you all) helped make it happen. 📌 Next step for the Council: Update FAQ 1597 and the DSS itself at some point to reflect this broader interpretation. The ambiguity in the official text still risks confusion and audit inconsistencies. As of this posting date, the only place this clarification exists is within the assessor newsletter. 🤨 One nitpick I will call out though— the Council called out that their original definition of “addressed” wasn’t all inclusive. However, words matter. For a reminder, this was the definition: Addressed - the entity determines whether to resolve the vulnerability or to mitigate the risk by addressing the vulnerability in another way (e.g., with a compensating control or by disabling a vulnerable service) So to be clear, their definition says resolve OR mitigate. How were we to infer that acceptance is acceptable!?! 🤷‍♂️ If you’re a QSA or manage PCI in your organization, this is a significant development. It gives you back the flexibility to treat low-risk issues rationally, as long as your TRA process is strong. Thank you to Viviana Wesley for letting me know about the publication within the newsletter! #PCIDSS #CyberSecurity #QSA #VulnerabilityManagement #GRC #PCICompliance #InfoSec #AssessorLife

213

19 Comments

The Australian Cyber Security Centre (ACSC), via the Australian Signals Directorate (ASD), has published updated guidance titled “Planning for Post-Quantum Cryptography.” It’s encouraging to see more national security agencies raising awareness and urging organizations to start preparing now. They correctly note that deploying protections against a CRQC may take longer than expected and highlight the risk of "harvest now, decrypt later" - which are all the right reasons to start now, but without panicking. While the ACSC’s push to "start planning for PQC right away" is wise, their recommended timeline (seen in the diagram below) raises some concerns. The guidance mentions, for example, that enterprises should have begun implementing PQC by the end of 2028 and should have completed the transition across the organization by the end of 2030. In other words, the ASD envisions that once an enterprise kicks off its migration (by 2028), it can fully replace or upgrade its cryptography within about two years. For most large enterprises, however, a two-year window to entirely swap out entrenched cryptographic systems is overly optimistic. Migrating to PQC is a massive, multi-year undertaking for a typical large organization. Roadmaps and guidelines from other bodies - such as the Post-Quantum Cryptography Coalition (which includes MITRE, Microsoft, and IBM), Moody’s, U.S. officials, and other security agencies - have estimated much longer timelines that dwarf the ACSC’s suggestion. I just posted on my blog a detailed quantum readiness program plan showing in detail why it’s a 10-year effort (if not more): https://lnkd.in/gds9FTFD. To be fair, the ACSC guidance’s intent is likely to set a bold but clear goal to galvanize action, rather than a hard-and-fast rule. However, when a super-busy CISO sees the diagram below, the risk is that they will only read that they have until 2028 to start and that it can be done in two years, and then put it in the back of their minds. In summary, Australia’s ACSC deserves credit for elevating post-quantum cryptography on the national agenda and providing practical guidance to get started. Their message aligns with global expert opinion: don’t wait for the quantum threat to become imminent; begin your preparations now. At the same time, it’s important to approach the timeline with realism. (Also, why is the risk exposure for "harvest now, decrypt later" data starting only mid 2027 in the diagram?!?) The gudiance: https://lnkd.in/gWCpZasV #PQC #QuantumReadiness #QuantumSecurity #QuantumResilience #QuantumResistance

176

9 Comments

✨ Trust | Transparency | Resilience ✨ On 3rd September 2025, the Cybersecurity and Infrastructure Security Agency (CISA), in partnership with 19 international cybersecurity authorities — including CERT-In — released the Shared Vision of Software Bill of Materials (SBOM) for Cybersecurity - https://lnkd.in/gjUQ3Kqk 🔐 Why SBOM matters: SBOM acts as a digital ingredients list for software, bringing visibility into components, dependencies, and risks. It strengthens supply chain security, supports faster vulnerability management, and builds global resilience against cyber threats. 🇮🇳 India’s leadership: CERT-In co-sealed this global vision, contributing its experience in driving SBOM adoption in India through: • SBOM Technical Guidelines • Expanded BOM Guidelines (QBOM, CBOM, AIBOM, HBOM) — covering Quantum, Cryptography, AI, and Hardware. 💡 As Dr. Sanjay Bahl, DG of CERT-In, emphasized: “Adopting SBOM empowers organisations to identify vulnerabilities, manage risks and build resilience while strengthening the security of our digital ecosystem.” More Statements: https://lnkd.in/gQp4enGv 🌍 Together, let’s build safer and more transparent digital supply chains for the future. Softcell Technologies Global Pvt. Ltd. Rupam Nag Ketan Wadekar Shubham Sonawane Darshan Jogi Uzair Jalali Nilesh Pawar Vinit Tyagi TUKARAM GAONKAR Samir Patani Shivji Bhagat Deepak Fernandes Deepak Chawla Girish Landge Abhishek Solanki Ashutosh Bahuguna #Cybersecurity #SBOM #SupplyChainSecurity #CERTIn #CISA

30

"Our analysis revealed a concerning scenario: threat actors compromised one victim, weaponized their real documents, and then used these compromised documents to attack another victim. This exemplifies a common, yet often underestimated, form of supply chain attack." Source: https://lnkd.in/eap75nPQ

50