CyberSecurity Updates

12 Jun

CISA Releases Cybersecurity Advisory on SimpleHelp RMM Vulnerability

Attacks, Insights, Malware

Today, CISA released Cybersecurity Advisory: Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management to Compromise Utility Billing Software Provider. This advisory is in response to ransomware actors targeting customers of a utility billing software provider through unpatched vulnerabilities in SimpleHelp Remote Monitoring and Management (RMM). This incident is part of a broader trend of ransomware actors exploiting unpatched versions of SimpleHelp RMM since January 2025. SimpleHelp versions 5.5.7 and earlier contain multiple vulnerabilities, including…

Read More
12 Jun

The Impact of Artificial Intelligence on the Cybersecurity Workforce

Insights

Credit: NICE The NICE Workforce Framework for Cybersecurity (NICE Framework) was revised in November 2020 as NIST Special Publication 800-181 rev.1 to enable more effective and rapid updates to the NICE Framework Components, including how the advent of emerging technologies would impact cybersecurity work. NICE has been actively engaging in conversations with: federal departments and agencies; industry; education, training, and certification providers; and international representatives to understand how Artificial Intelligence (AI) might affect the nature…

Read More
10 Jun

Patch Tuesday, June 2025 Edition

Information, Insights

Microsoft today released security updates to fix at least 67 vulnerabilities in its Windows operating systems and software. Redmond warns that one of the flaws is already under active attack, and that software blueprints showing how to exploit a pervasive Windows bug patched this month are now public. The sole zero-day flaw this month is CVE-2025-33053, a remote code execution flaw in the Windows implementation of WebDAV — an HTTP extension that lets users remotely…

Read More
06 Jun

BladedFeline: Whispering in the dark

Information

In 2024, ESET researchers discovered several malicious tools in the systems used by Kurdish and Iraqi government officials. The APT group behind the attacks is BladedFeline, an Iranian threat actor that has been active since at least 2017, when it compromised officials within the Kurdistan Regional Government (KRG). This group develops malware for maintaining and expanding access within organizations in Iraq and the KRG. While this is our first blogpost covering BladedFeline, we discovered the…

Read More
05 Jun

Proxy Services Feast on Ukraine’s IP Address Exodus

Information, Insights

Image: Mark Rademaker, via Shutterstock. Ukraine has seen nearly one-fifth of its Internet space come under Russian control or sold to Internet address brokers since February 2022, a new study finds. The analysis indicates large chunks of Ukrainian Internet address space are now in the hands of shadowy proxy and anonymity services that are nested at some of America’s largest Internet service providers (ISPs). The findings come in a report that examines how the Russian…

Read More
04 Jun

Don’t let dormant accounts become a doorway for cybercriminals

Information

Digital Security Do you have online accounts you haven’t used in years? If so, a bit of digital spring cleaning might be in order. Phil Muncaster 02 Jun 2025  •  , 5 min. read The longer our digital lives, the more online accounts we’re likely to accrue. Can you even remember all the services you’ve signed up to over the years? It could be that free trial you started and never cancelled. Or that app…

Read More
04 Jun

Updated Guidance on Play Ransomware

Attacks, Insights, Malware

CISA, the Federal Bureau of Investigation (FBI), and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) have issued an updated advisory on Play ransomware, also known as Playcrypt. This advisory highlights new tactics, techniques, and procedures used by the Play ransomware group and provides updated indicators of compromise (IOCs) to enhance threat detection. Since June 2022, Playcrypt has targeted diverse businesses and critical infrastructure across North America, South America, and Europe, becoming one of…

Read More
01 Jun

This month in security with Tony Anscombe – May 2025 edition

Information

From a flurry of attacks targeting UK retailers to campaigns corralling end-of-life routers into botnets, it’s a wrap on another month filled with impactful cybersecurity news 30 May 2025 It’s that time of month again when ESET Chief Security Evangelist Tony Anscombe offers his take on some of the most impactful cybersecurity news of the past 30 or so days. Here’s a selection of what stood out to him in May 2025: a warning from…

Read More
29 May

U.S. Sanctions Cloud Provider ‘Funnull’ as Top Source of ‘Pig Butchering’ Scams

Information, Insights

Image: Shutterstock, ArtHead. The U.S. government today imposed economic sanctions on Funnull Technology Inc., a Philippines-based company that provides computer infrastructure for hundreds of thousands of websites involved in virtual currency investment scams known as “pig butchering.” In January 2025, KrebsOnSecurity detailed how Funnull was being used as a content delivery network that catered to cybercriminals seeking to route their traffic through U.S.-based cloud providers. “Americans lose billions of dollars annually to these cyber scams,…

Read More
29 May

Word to the wise: Beware of fake Docusign emails

Information

Cybercriminals impersonate the trusted e-signature brand and send fake Docusign notifications to trick people into giving away their personal or corporate data Phil Muncaster 27 May 2025  •  , 5 min. read Remember when you used to have to print, sign, scan, email and/or even fax every time you wanted to sign and send an official document? Today, much of the hard work is done behind the scenes by cloud app providers like Docusign. But…

Read More