PRESS RELEASE

7th January 2025 – Zivver, a leader in secure communications, has published its latest report, shedding light on critical gaps in email security practices and their alignment with increasing regulatory requirements. The findings from Email Security Trends 2025: The Widening Disconnect Between Email Security and Risk Management highlight the often-overlooked threats in email security, and the scrutiny of regulatory demands on organisations. 

Landmark directives such as NIS2, DORA, and GDPR demand rigorous risk management, information classification, and data leak prevention, with email firmly in the compliance spotlight. Email is a cornerstone of business communication, with 93% of employees ranking it as “important” or “very important” for their daily work. Yet, as the sophistication of cyber threats increases and compliance requirements evolve, the risks tied to email usage have become a pressing concern for organisations worldwide.  

According to the report, which surveyed 400 IT decision-makers and 2,000 employees across the US, UK, Netherlands, France, Germany, and Belgium, over two-thirds of IT leaders report that vendors are not innovating quickly enough to address emerging risks, and 60% of employees admit to using workarounds to bypass email security policies. Additionally, only 24% of IT leaders feel their security spending is very well-aligned with actual risks, leaving organisations vulnerable to both inbound and outbound threats. 

Other key findings from the report include:  

*   While 47% of IT leaders prioritise phishing and inbound threats, two-thirds admit that outbound email mistakes—such as misaddressed emails or improper encryption—cause more significant data losses. 
    

*   Over 50% of employees admit to email-related mistakes every few months, and 60% report using workarounds to bypass policies, indicating a need for better tools and training. 
    

*   While 73% of employees are aware of the security policies pertaining to email, only 52% adhere to them 
    

*   Only 34% of email incidents are formally reported, leaving IT teams unaware of the full scope of security breaches. 
    

*   54% of employees say they are more likely to make email mistakes when they are busy or overwhelmed, highlighting the need for supportive tools.
    

Rick Goud, Co-Founder and CIO at of Zivver said: “Compliance requirements today demand that organisations take a comprehensive view of email security, integrating robust solutions that address both inbound and outbound risks. By embedding security measures into existing workflows and ensuring they align with evolving regulations, businesses can create a safer and more compliant environment for employees. This report offers actionable insights to help organisations align their security measures with today’s challenges while maintaining the trust and productivity that email enables.” 

To read the full report you can download a copy here. 

About Zivver  

Zivver is a leading provider of solutions for secure communications and data leak prevention, with a focus on protecting sensitive information. With more than 11,000 organisations as customers, Zivver is the market leader in the Dutch healthcare, municipal, government, and legal sectors. Zivver has been recognised by Gartner for several years as one of the four leading global providers of email data security.  

https://www.zivver.com/ 

You May Also Like

Zivver Report Reveals Critical Challenges in Email Security for 2025

PRESS RELEASE

PRINCETON, N.J., Jan. 6, 2025 /PRNewswire/ -- Palindrome Technologies has been conditionally approved as a Cybersecurity Label Administrator (CLA) for the Federal Communications Commission's (FCC) voluntary Internet of Things (IoT) Cybersecurity Labeling Program.

As a CLA, Palindrome will evaluate and certify IoT products that meet FCC cybersecurity standards.  
Qualified products will bear the "U.S. Cyber Trust Mark" label.  
This program is designed to incentivize manufacturers to meet higher cybersecurity standards and differentiate trustworthy products in the marketplace, and most importantly, help consumers make informed decisions about the products they use in their homes.

Peter Thermos, Palindrome CEO, stated, "We are honored to support the FCC's efforts in strengthening IoT security and building consumer trust. Our expertise in security assurance testing of network devices and products positions us well for this role."

Palindrome will provide manufacturers with:

*   Streamlined application review and management for FCC IoT Label usage authorization
    
*   Assistance with preparation for certification
    
*   Guidance throughout the certification process
    
*   Testing and certification of IoT products
    

The program offers benefits to manufacturers, connected infrastructure, and consumers by raising cybersecurity standards and providing clear information about device security.

For more information, visit the Palindrome Technologies website.

About Palindrome Technologies:  
Since 2005, Palindrome Technologies has been a trusted cybersecurity partner to Fortune 500 companies and growing organizations that want to engineer cyber resilience in emerging threat environments. With a focus on excellence, curiosity, and integrity, Palindrome helps clients defend against cyberattacks across all attack surfaces, including hardware, software, network-to-cloud, people, and emerging technologies.

Palindrome Technologies Approved as Cybersecurity Label Administrator for FCC's IoT Program

Cyberattackers injected the NFL Wild Card team's online Pro Shop with malicious code to steal credit card data from 8,500 fans.

Source: Cal Sport Media via Alamy Stock Photo

Fans of the Green Bay Packers football franchise have been tackled by a payment-card skimmer; people who bought merch at the Packers Pro Shop website last fall may have had their personal data harvested.

In a data-breach notification letter to the 8,514 "cheeseheads" affected, the NFL juggernaut noted that its security staff was alerted to the code on Oct. 23, just as the team was gearing up to play the Jacksonville Jaguars in Week 8 of the 2024 season.

"We were alerted to the presence of malicious code inserted on the Pro Shop website by a third-party threat actor," reads the notice, which added that the team immediately asked the outside vendor that hosts the store to take the e-commerce site offline. "The malicious code may have allowed an unauthorized third party to view or acquire certain customer information entered at the checkout that used a limited set of payment options on the Pro Shop website."

Fortunately, the skimmer was active in only two windows: Between Sept. 23-24, and Oct. 3-23, 2024. And, fans who used a gift card, a Pro Shop website account, PayPal, or Amazon Pay weren't exposed.

Cybercriminals were able to score on everyone else though, collecting names, addresses (billing and shipping), emails, and full payment-card information, according to the notice.

Related:Hacking Group 'Silk Typhoon' Linked to US Treasury Breach

According to an analysis from Sansec, a Dutch e-commerce security company that notified Green Bay about the attack, the threat actors abused a JSONP callback and YouTube's oEmbed feature, which allows users to embed content from one website into another website. Ultimately, the skimmers were able to bypass the Content Security Policy (CSP) for the Pro Shop website, and "a script was injected from https://js-stats.com/getInjector. This script harvested data from input, select, and text area fields on the site, exfiltrating the captured information."

**A Pick 6 for Magecart & Other Cybercrime Carders?**

While there's no public attribution available for the incident, the cyberattack has all the hallmarks of a classic "Magecart" attack. Magecart is an umbrella term for a loose confederation of groups that steal credit cards by exploiting a vulnerability within a website to inject a malicious piece of code, which simply exfiltrates any data the users put into checkout pages on e-commerce sites.

Lately, these types of attacks have been on the rise, with scores of groups beyond classic Magecart actors running skimmer plays, researchers warn; the Packers are just the latest victim in the pass rush of maliciousness.

Related:Ransomware Targeting Infrastructure Hits Telecom Namibia

"There's no solid theory about why there's been an uptick in skimmer attacks,” says Javvad Malik, lead security awareness advocate at KnowBe4. "It could be a case of low-hanging fruit, a lot of e-commerce transactions over the holiday period when people are searching for deals, and also the ease through which some third parties can be compromised without triggering alarms."

According to the Recorded Future Payment Fraud Intelligence group, digital e-skimming will remain a top threat to e-commerce going forward, with bad actors relying on easy-to-use skimmer kits and persistent CMS security vulnerabilities. Plus, smaller security organizations (including those used by many sports franchises) are at particular risk.

"Payment Card Industry Data Security Standard (PCI DSS) requirements will continue aiming to improve security, but the impact will remain limited as many small and medium-sized retailers fail to adhere," said Boris Ivanov, principal malware researcher at Recorded Future, via email. "This gap will worsen the already serious problem of attackers exploiting vulnerable platforms and compromising payment data."

Meanwhile, Malik notes that sports teams might be in the cybercrime sites as a top target in part due to fan exuberance.

Related:CISA: Third-Party Data Breach Limited to Treasury Dept.

"Technically, sports organizations probably don't have any different challenges than others," he says. "What makes them attractive to criminals though is the fact that they have a loyal fan base that is willing to spend money on tickets and merchandise. Often during busy periods when tickets are released, there is a rush, so people will often ignore any security warnings in a bid to complete their purchase."

**The Payment-Skimmer Ground Game Is Hard to Defend Against**

Skimmers are also having a moment because the back-end complexity of the code running e-stores is on the rise, which offers cover for malware infestation and makes defense more porous.

"These are difficult to detect by nature, especially when these attacks take place by compromising third-party components, which can end up in organizations' blind spots," explains Malik. "Complexity and the reliance on many third parties is perhaps the biggest challenge to keep modern Web applications secure."

In the Packers' case, the Pro Shop is hosted by a third party, which complicates things even further.

"In the case of organizations outsourcing many components and hosting, security responsibility cannot be outsourced, so many organizations end up with a lack of skilled resources within the organization to keep an eye over the end-to-end security — something that is often fueled by budget constraints," Malik notes.

Ultimately, e-commerce organizations of all stripes, including those catering to Wisconsin NFL fans, need to balance security with business agility and the user experience, which creates a series of challenges. Technical complexity, resource constraints, skills shortages, and organizational culture can all affect how organizations approach Web security, Malik cautions.

"It's about embedding security into the very fabric of the business, rather than treating it as an afterthought," he says. "Some of the things you can do include implementing robust content security policies, undertaking regular security audits and penetration testing, employing real-time monitoring that can detect unusual code or behavior patterns, and finally, educating staff and fostering a culture of cybersecurity."

Dane Sherrets, staff innovation architect at HackerOne, notes that, from a coding standpoint, user input should be considered suspect until proven otherwise.

"Firstly, it's important to remind everyone never to explicitly trust user input and to treat all such inputs as potentially malicious," he says. "The Green Bay Packers incident, in particular, highlights the threat of exploiting a loophole in the site's CSP."

The Green Bay Packers did not immediately return a request for comment.

**About the Author**

Tara Seals has 20+ years of experience as a journalist, analyst and editor in the cybersecurity, communications and technology space. Prior to Dark Reading, Tara was Editor in Chief at Threatpost, and prior to that, the North American news lead for Infosecurity Magazine. She also spent 13 years working for Informa (formerly Virgo Publishing), as executive editor and editor-in-chief at publications focused on both the service provider and the enterprise arenas. A Texas native, she holds a B.A. from Columbia University, lives in Western Massachusetts with her family and is on a never-ending quest for good Mexican food in the Northeast.

Green Bay Packers' Online Pro Shop Sacked by Payment Skimmer

"Where Warlocks Stay Up Late" project speaks to hackers who have played pivotal roles in shaping the field of cybersecurity. The video interviews are complemented by an encyclopedia and an anthropological map.

Nathan Sportsman, the CEO of offensive security company Praetorian, had a grim epiphany in the summer of 2023: We're beginning to lose some of the hackers and visionaries who laid the foundation of the cybersecurity industry.

"When Kevin Mitnick passed, I realized that he would never be able to tell his story again," Sportsman says. "We're running out of time to tell these stories."

So he decided to document the history of hackers and preserve the stories of those early trailblazers and their groundbreaking contributions. The title of his docuseries project, "Where Warlocks Stay Up Late," pays homage to Katie Hafner and Matthew Lyon's 1996 book, Where Wizards Stay Up Late, which chronicles the origins of the Internet and spotlights the stories of the pioneers responsible for shaping it.

Each month, two long-form video interviews will be released on the Warlocks project's YouTube channel, featuring candid conversations in which cybersecurity pioneers share their technical achievements, as well as their personal journeys, challenges, and ethical dilemmas they faced along the way.

Sportsman and his team — Emmy-winning producer Matthew Wallis, filmmaker Tyson Culver, anthropologist Gabriella Coleman, and historian Matt Goerzen — plan to capture the stories of over 200 cybersecurity pioneers who helped shape the hacking scene of the 1980s and 1990s. These were the hackers who testified before the US Congress in 1998 and claimed they could take down the Internet in 30 minutes. They also exposed vulnerabilities in early wireless networks and were early advocates for encryption. Some of their stories have never been told before, Sportsman says.

Related:Black Hat 2024: Praetorian CEO Teases 'Warlock' Series on Cyber Pioneers

"This is going to be a three- to five-year commitment," Sportsman notes.

The list features prominent groups like L0pht Heavy Industries, Germany's Chaos Computer Club, w00w00, and the Legion of Doom. Smaller yet interesting groups, such as TESO and ADM, will also be represented. Some of the hackers from these groups went on to build successful careers in cybersecurity, becoming CISOs or CEOs, while others found roles in policymaking or intelligence.

Each interviewee is encouraged to bring along a historical artifact that represents their journey or contributions to hacking culture.

"It could be anything," Sportsman says. "It could be an old version of Phrack magazine. It could be a floppy disk, a motherboard."

The goal is to donate the artifacts to a physical museum at some point, maybe the Smithsonian, he says.

"Maybe they create a cyber wing where these stories can be held and all these artifacts can be kept," Sportsman adds.

**Mapping Hacking Groups**

The overall goal of the Warlocks project is to create a 360-degree view on the origins of the cybersecurity industry. The video interviews will be supplemented by an encyclopedia, which will provide context, and an anthropological map, which will offer a visual representation of the underground groups and the connections among them. By selecting a hacker's name, viewers will be able to access a wealth of information, including biographical details and contributions to the field.

Coleman, a professor in the Department of Anthropology at Harvard University, was "instantly drawn to the Warlocks, like a moth to flame," she says, because the project complements her focus on the politics and cultures of hacking and online activism. Over the years, she has studied distinct hacker communities, such as Anonymous.

"Combining visual data \[maps, videos, and pictures\] with written and oral histories allows us to make more sturdy, sound, or compelling arguments," Coleman says.

To capture the full picture of the hacking scene, the team plans to talk to all kinds of pioneers "from the no-malicious yet unorthodox underground scene," as Coleman puts it, regardless of where they are located.

"Those studying hackers know there were important waypoints in the transition from underground hacking to professional security, but the full stories of their members still need to be charted," Coleman adds.

Although she has studied hacker communities for over two decades, Coleman admits that some of the names that appear on the anthropological map were initially unfamiliar to her — a reflection of the secrecy that has long shrouded the scene.

"This terra incognita reminds us of the power and importance of what some philosophers call 'epistemic humility,'" she says. "This map both charts known territory and reveals what still needs to be studied."

**A (Digital) Museum of Hackers**

One of Sportsman's first interviews for the Warlocks project was with Mike Schiffman, editor-in-chief of hacker e-zine Phrack. During the taping, Schiffman and Sportsman reminisced about the early days of IRC channels where hackers hung out to share ideas and cutting-edge research. They discussed how hacker culture has evolved over the years.

"Back then, \[Shiffman\] would just kick/ban me out of the channel because I was a kid and I was annoying, but I looked up to him because of everything he had already done to that point," Sportsman says.

Schiffman recalls a bizarre incident from his youth, when his phone switch was hijacked and all of his calls were forwarded to a bridge. Anyone trying to reach him was told he had died. While doing some research for the project, Schiffman was able to identify the exact person who hacked his phone switch 25 years ago.

"I'll be interviewing him for Warlocks in February," Schiffman says.

For Schiffman, working on the Warlocks project has been both nostalgic and thought-provoking. He serves as a producer, interviewer, and planner, making sure the project authentically captures the "rich cultural history of the hacking scene."

The motivation to talk about the old days is deeply personal.

"I want my children to know my story," Schiffman says. "They're currently quite young, and I expect them to get different things from this as they watch it at different ages."

**More Than Just Hacker Nostalgia**

The stories hackers will share on camera offer glimpses into their personal journeys, but they also weave together a collective narrative that will help the next generation understand how everything started.

"There's not a single person in this industry that achieved any type of long-term success without the help of others," says cybersecurity expert Ralph Logan, an adviser to the project.

The desire to tap into the collective memory of the cybersecurity community and capture the stories for the new generation of people entering the cybersecurity workforce is deep-seated. In the past few years, a number of projects have been developed to tell the background stories of major cybersecurity events — an oral history of L0pht and a book on the Cult of the Dead Cow, to name a few. The Computer History Museum and the International Spy Museum also have exhibits highlighting cybersecurity researchers and stories.

The collective aspect of the narrative resonates deeply with Harvard's Coleman, who views hackers as collaborative individuals who embrace partnerships that further their goals. This is why their stories should be told in a way that highlights the intricate web of interactions, collaborations, and shared ambitions that define the community, she says.

"While many industry histories, like those of Walter Isaacson, elevate individual 'tech heroes,' this project showcases how diverse, interconnected hacker collectives worldwide transformed security from an afterthought into a critical priority," Coleman says.

The anthropologist hopes the project will also serve as a template for other areas of technology, including hacktivism, a topic she holds close to her heart. By applying the same methods, researchers could one day uncover groundbreaking insights into the inner workings, cultural dynamics, and broader impacts of groups like the Cult of the Dead Cow, the Electronic Disturbance Theater, or the Xnet collective.

"Like the underground, much material connected to hacktivist circles has either remained historically hidden, is hard to access, or is precariously stored," Coleman says, noting that this is an ideal time for projects like this. "Many \[hackers\] are seeking and willing to publicize their past. Many have expressed interest in ensuring this history does not get lost to time, while we still have access to firsthand accounts."

New Docuseries Spotlights Hackers Who Shaped Cybersecurity

Attackers are abusing a Microsoft 365 feature to send payment requests to users, tricking them into logging in to their accounts so attackers can seize control over them.

Source: Robert Wilkinson via Alamy Stock Photo

An unconventional phishing campaign convincingly impersonates online payments service PayPal to try to trick users into logging in to their accounts to make a payment; in reality, the login allows attackers to take over an account. The novel part of the attack is the abuse of a legitimate feature within Microsoft 365 to create a test domain, which then allows the attackers to create an email distribution list that makes the payment-request messages appear to be legitimately sent from PayPal.

Carl Windsor, CISO for Fortinet Labs, discovered the campaign when he himself was targeted by it, he revealed in a blog post published today.

Windsor received a request in his inbox from a sender with a nonspoofed PayPal email address seeking a payment of $2,185.96. The person requesting the money was someone called Brian Oistad, and aside from the "to" address not being Windsor's email address —  it was addressed to Billingdepartments1\[@\]gkjyryfjy876.onmicrosoft.com —  there were few obvious signs it was not a genuine email, he said.

"What's interesting about this attack is that it doesn’t use traditional phishing methods," Windsor wrote. "The email, the URLs, and everything else are perfectly valid."

That validity might persuade an average email user to click on the link in the email, which redirects them to a PayPal login page showing a request for payment.

Related:PhishWP Plug-in Hijacks WordPress E-Commerce Checkouts

At this point, "some folks might be tempted to log in with their account details, however, this would be extremely dangerous," he wrote. That's because the login page links the target's PayPal account address with the address it was sent to — Billingdepartments1\[@\]gkjyryfjy876.onmicrosoft.com, controlled by the attacker — not their own email address.

**Abusing Microsoft 365 Test Domains for Cybercrime**

The campaign works because the scammer appears to have registered a Microsoft 365 test domain — which is free for three months — and then created a distribution list containing target emails. This allows any messages sent from the domain to bypass standard email security checks, Windsor explained in the post.

Then, "on the PayPal Web portal, they simply request the money and add the distribution list as the address," he wrote.

This money request is then distributed to the targeted victims, and the Microsoft 365 Sender Rewrite Scheme (SRS) rewrites the sender to, for example, "bounces+SRS=onDJv=S6\[@\]5ln7g7.onmicrosoft.com, which will pass the SPF/DKIM/DMARC check," Windsor added.

"Once the panicking victim logs in to see what is going on, the scammer’s account (Billingdepartments1\[@\]gkjyryfjy876.onmicrosoft.com) gets linked to the victim’s account," he wrote. "The scammer can then take control of the victim's PayPal account — a neat trick … \[that\] would sneak past even PayPal’s own phishing check instructions."

Related:Thousands of BeyondTrust Systems Remain Exposed

Indeed, abusing a vendor feature to deliver the phishing message does give the attackers a stealthy advantage when it comes to bypassing typical email security, a security expert notes.

"The emails are sent from a verified source and follow an identical template to legitimate messages, such as a standard PayPal payment request," says Elad Luz, head of research at Oasis Security, a provider of non-human identity management. "This makes them difficult for mailbox providers to distinguish from genuine communications."

**Cyber Defense: Create a "Human Firewall" Against Phishing**

Because the attack appears to be a genuine email, the best solution to avoid falling prey to it is what Windsor calls the "human firewall," or "someone who has been trained to be aware and cautious of any unsolicited email, regardless of how genuine it may look," he wrote in the post.

"This, of course, highlights the need to ensure your workforce is receiving the training they need to spot threats like this to keep themselves — and your organization — safe," Windsor noted.

Related:Recorded Future: Russia's 'Undesirable' Designation Is a Compliment

It is also possible to create a rule within email security scanners to "look for multiple conditions that indicate that this email is being sent via a distribution list," to help detect a campaign that uses this vector, he added.

Another potential mitigation is to use artificial intelligence (AI)-based security tools that use neural networks to analyze social graph patterns, among other techniques, "to help spot these hidden interactions by analyzing user behaviors more deeply than static filters," Stephen Kowski, field chief technology officer (CTO) at SlashNext Email Security+, tells Dark Reading.

"That kind of proactive detection engine recognizes unusual group messaging patterns or requests that slip through basic checks," he says. "A thorough inspection of user interaction metadata will catch even this sneaky approach."

**About the Author**

Elizabeth Montalbano is a freelance writer, journalist, and therapeutic writing mentor with more than 25 years of professional experience. Her areas of expertise include technology, business, and culture. Elizabeth previously lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City; she currently resides in a village on the southwest coast of Portugal. In her free time, she enjoys surfing, hiking with her dogs, traveling, playing music, yoga, and cooking.

Unconventional Cyberattacks Aim to Take Over PayPal Accounts

Low-code/no-code (LCNC) and robotic process automation (RPA) technologies allow companies to speed up development processes and reduce costs, but security is often overlooked. When this happens, the risks can outweigh the benefits.

Source: Igor Stevanovic via Alamy Stock Photo

COMMENTARY

Technologies such as low-code/no-code (LCNC) and robotic process automation (RPA) have become fundamental in the digital transformation of companies. They continue to evolve and redefine software development, providing new possibilities for different organizations. This allows users with no programming experience — often called citizen developers — to create applications and automate processes, simplifying complex tasks and optimizing business operations.

Application platforms for these technologies offer intuitive visual interfaces. This allows anyone from a business professional to an IT employee to develop customized applications and automate repetitive processes quickly and efficiently.

Despite their advantages, the use of these technologies has challenges, especially regarding information security. These platforms, which aim to simplify and speed up development, can introduce risks related to controlling and protecting corporate data. The agility these tools provide tends to reduce development time and costs compared with traditional models significantly. However, the lack of centralized control, especially in environments where non-technical teams are free to create applications, can generate vulnerabilities and ultimately lead to higher costs.

After conducting several penetration tests and risk assessments in environments using LCNC, RPA, or other forms of automation, I thought it crucial to offer more detailed security considerations for these technologies. Companies must understand the potential risks and impacts that adopting these solutions can bring, ensuring that the benefits of automation do not compromise security and regulatory compliance.

**Data Collection Through Scraping**

A common use of LCNC and RPA is related to automating data retrieval processes, a technique known as scraping. In many of the instances, I have observed these tools scraping data from both internal environments (such as corporate databases) and external ones (API sites, among others). Based on this data, the automated "robot" makes decisions, following the configured workflow, such as carrying out new searches, saving information in files or databases, sending emails, generating alerts, etc. Although scraping is a widely used data collection practice, it can have legal implications, so I recommend that companies consult their legal or risk management department.

As you can imagine, this external dependence can become an absolute nightmare, especially when the organization has no direct control over these services. If the way the data is made available changes unexpectedly, whether the data host alters the addressing, data format, or presentation, or removes the data completely, the automation can become vulnerable to critical failures. This external dependency makes the problem even worse if the automation process is based on this data — unavailability can generate errors and allow the "robot" to continue executing the process with incorrect data in a more critical scenario. This can result in damaging actions, such as wrong decisions in sensitive financial or operational processes, potentially severely affecting the organization. Mishandled failures in the automation can also lead to organizational decisions being made with outdated data, or the loss of data by overwriting good records with bad ones.

Therefore, solutions developed with automation must be designed to deal robustly with data unavailability. Automation must be able to detect and handle these scenarios, including the appropriate use of exception and error handling. This will ensure that even when data sources fail, the system can behave safely and predictably, preventing further damage.

**Best Practices for Internal Policies**

Another crucial point, especially in organizations where the developers of LCNC solutions often lack formal programming experience, is the need to establish internal policies that guarantee the auditing and traceability of automated processes. A best practice is to implement detailed logs of all automation steps. Recording this information will not only allow the IT team or those responsible for security to investigate and correct any faults, but will also be essential in resolving future problems, guaranteeing greater transparency and control over automated processes.

By default, automation processes are run by a specific user account, meaning they are directly linked to the permissions and privileges associated with that account. This is a critical point and must be constantly monitored to avoid risks. In this context, the recommendation to adopt the principle of least privilege is fundamental: to grant the user only the minimum level of permissions necessary to carry out their task. This limits access privileges and helps mitigate the impact if the account is compromised.

I recognize that automation processes involving scripts and command execution, such as CMD, Python, VBScript, or PowerShell can be indispensable for organizations in some situations, however the recommendation is to reconsider using these technologies whenever possible, as they increase the overall risk considerably. A malicious user could exploit this capability to create harmful scripts and efficiently carry out malicious activities quickly. A good practice is implementing strict access controls in the infrastructure, limiting access to these functionalities, and constantly monitoring their use.

As always, I can't stress enough the importance of security training for users and developers of LCNC platforms and other automation processes, such as RPA. In addition to basic information security training, companies must include secure coding practices and emphasize adherence to general security best practices. This ensures that everyone involved in developing and operating automated solutions understands the risks and how to mitigate vulnerabilities.

Consider LCNC platforms as a potential insider threat vector in your network. Historical experience shows that many cyberattacks begin with the introduction of malicious agents inside corporate networks. These attack vectors can exploit vulnerabilities in internal systems, which happens often enough that you should exercise due care in the design and implementation of any system that handles sensitive data. It is, therefore, prudent to assume that any internal automation, especially those handling confidential information, should always be viewed with the same security caution applied to internal threats.

As mentioned, although LCNC and RPA technologies allow many companies to speed up their development processes and reduce costs, it is essential to remember that security is often overlooked. When this happens, the risks can outweigh the benefits. Organizations must adopt robust and continuous security measures to protect these solutions, preventing security costs from rising exponentially and risks from becoming irremediable.

**About the Author**

Senior Security Consultant, Secure Ideas

Jordan Bonagura is senior security consultant for Secure Ideas. With more than 20 years of experience in information security, Jordan is passionate about helping companies and clients protect their data and applications from threats and vulnerabilities. As a principal security researcher, he led teams conducting vulnerability management, risk assessments, penetration tests, and boundary-setting to comply with standards for companies in different segments.

Jordan contributed to significant projects, such as developing an integrated GNSS positioning system and an encryption communication protocol between ground and satellite at the Brazilian National Institute of Space Research. He also had the opportunity to speak at some of the most important security conferences around the globe, be a college professor and course coordinator, and consult for the Brazilian police in crime solving.

Best Practices &amp; Risks Considerations in LCNC and RPA Automation

The southern African telco is the latest entity on the continent to have its critical infrastructure hacked, and attackers release sensitive info online when Telecom Namibia refuses to negotiate.

Source: Golden Dayz via Shutterstock

The telecommunications provider for the African nation of Namibia suffered a significant ransomware attack late last year, becoming a visible symbol of the merging of two trends in the region: increasing attacks on critical infrastructure and the growing threat of ransomware.

Last month, Telecom Namibia alerted customers that a successful attack by the ransomware-as-a-service (RaaS) group Hunters International led to users' information being leaked online. The company is working with law enforcement agencies and third-party incident responders to uncover additional details, CEO Stanley Shanapinda said in a Dec. 16 statement.

"Initially, it appeared that no sensitive information was compromised, but recent analyses confirmed that some customer data was compromised," he said. "The threat was contained about three weeks ago and further attacks on our systems and third parties were prevented, \[but the exposed information\] was leaked on the dark web ... after we refused to negotiate to pay any ransom that may have been demanded."

Namibia is not alone in becoming a target for cyberattackers focused on profiting off of compromised infrastructure systems. In June, South Africa's National Health Laboratory Service (NHLS) suffered a ransomware attack that disrupted systems, deleted backups, and took weeks for the government-run network of healthcare testing laboratories to recover. In July, Hunters International exfiltrated more than 18GB of data from the Kenyan Urban Roads Authority (KURA). The same month, the Nigerian Computer Emergency Response Team (ngCERT) warned that the Phobos RaaS group had targeted critical cloud services serving the country's organizations, with at least one successful compromise.

**Telecoms, Critical Infrastructure in the Crosshairs**

Overall, ransomware accounted for a third of successful attacks in the region, including attacks on energy firm Eneo in Cameroon in January 2024 and industrial organizations in Egypt and South Africa throughout the year, according to data from Positive Technologies, a cybersecurity firm that operates in the region.

The telecommunications and manufacturing sectors were also heavily targeted, with each sector accounting for 10% of successful attacks, says Alexey Lukatsky, managing director and cybersecurity business consultant at Positive Technologies.

"These attacks are driven by factors such as rapid digital transformation, geopolitical tensions, and inadequate cybersecurity measures protecting critical infrastructure," he says. "The increasing volume of user data and expanding digital networks make sectors like telecommunications particularly attractive targets for cybercriminals seeking financial gain or engaging in cyber espionage."

The trend will continue in 2025, because the rapid digitization across multiple industries continues to outpace implementation of cybersecurity measures, Lukatsky says. The result: a growing attack surface area that remains vulnerable.

"Sectors such as energy, telecommunications, and manufacturing will continue to be prime targets for cybercriminals and APT groups, motivated by financial gain, data theft, or geopolitical objectives," he says.

**The Age of RaaS**

The rise of ransomware-as-a-service offerings has also accelerated attacks on critical infrastructure, says Avinash Singh, a computer science lecturer and head of the Intelligent Cyber Forensics Lab at the University of Pretoria in South Africa. RaaS has taken off in Africa, partly because some ransomware gangs appear to be using African organizations as testbeds for their latest attacks, according to an October 2024 report.

"The RaaS model allows attackers to focus on high-value targets, such as large corporations or critical infrastructure providers, where the potential ransom payout is significantly higher," Singh says. "Cyberattacks on critical infrastructure remain among the most lucrative for cybercriminals, as these systems provide essential public services, and their disruption can cause significant societal and economic damage."

In addition, ransomware groups are not targeting just African businesses and government agencies, but also those organizations' third-party suppliers, Singh says. Distributing malicious versions of popular software has become a popular way to infect personal and business devices in the region. A March 2024 attack targeting members of a popular Discord community, for example, infected developers with information-stealing malware by compromising a developer's account and poisoning the repository.

Many of the threats affecting African developers are the same as those affecting the global cyber landscape, he says.

"Over the years, threat actors have demonstrated a broad array of tactics, techniques, and procedures, including hijacking GitHub accounts, malicious Python packages, setting up fake Python infrastructures, and employing sophisticated social engineering strategies," Singh adds.

African organizations need to work to improve the cyber awareness of their employees and customers and establish secure practices while pursuing digitization, he recommends. The risks posed by cyberattacks will likely only increase, as the geopolitical tensions rise in the region and worldwide, according to Singh.

"While Africa may not be a prime target compared to other continents," he says, "many geopolitical factors can influence cyber threat activities, particularly when state-sponsored actors are involved."

**About the Author**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Ransomware Targeting Infrastructure Hits Telecom Namibia

The deal will enhance 1Password Extended Access Management offering with capabilities to address challenges around software-as-a-service sprawl and shadow IT.

Source: blickwinkel via Alamy Stock Photo

NEWS BRIEF

1Password on Monday announced that it has acquired software-as-a-service (SaaS) access management provider Trelica. Although terms of the transaction were not disclosed, 1Password said it is the largest acquisition by company revenue in its 18-year history.

1Password provides password management and other online identity-based services. This acquisition will build on 1Password's effort to expand its Extended Access Management offering, a platform that secures, identities, and manages access and permissions applications and devices, the company said. Launched last year, the platform is designed to ensure that employee devices, identities, and apps are trusted before granting access to enterprise resources.

Founded in 2018, UK-based Trelica offers a suite of tools for managing and securing SaaS applications, such as tools for employee onboarding and offboarding, discovering shadow IT deployments, SaaS operations, spend optimization, and access management. With shadow IT and SaaS sprawl increasing the risk of security breaches, security teams rely on automated application discovery tools to identify unmanaged apps, streamline user provisioning and access governance, and enforce security policies.

"Trelica addresses critical challenges that haven't been solved by traditional solutions like single sign-on (SSO), mobile device management (MDM) and SaaS security posture management (SSPM)," wrote 1Password CEO Jeff Shiner in a blog post announcing the deal. "These include provisioning and de-provisioning users, reclaiming unused licenses, monitoring permission drift, and adjusting access during role changes. Trelica prioritizes IT administrators' most time-consuming tasks while maintaining a secure environment."

With Shadow IT discovery capabilities from Trelica, the 1Password Extended Access Management platform will provide organizations with a repeatable framework for bringing unmanaged apps into full compliance under IT and security management, while empowering employees to use the tools that enhance their productivity, 1Password said in a statement.

Besides 1Password, Trelica lists over 300 SaaS integrations with SaaS providers, including Adobe, Atlassian, Cisco, Google, HubSpot, JFrog, LastPass, ManageEngine, Marketo, Microsoft, Okta, Pax8, Salesforce, SAP, ServiceNow, Snyk, Sophos, TeamViewer, Workday, Workspace One, and Zoom.

**About the Author**

Contributing Writer

Jeffrey Schwartz is a journalist who has covered information security and all forms of business and enterprise IT, including client computing, data center and cloud infrastructure, and application development for more than 30 years. Jeff is a regular contributor to Channel Futures. Previously, he was editor-in-chief of Redmond magazine and contributed to its sister titles Redmond Channel Partner, Application Development Trends, and Virtualization Review. Earlier, he held editorial roles with CommunicationsWeek, InternetWeek, and VARBusiness. Jeff is based in the New York City suburb of Long Island.

1Password Acquires SaaS Access Management Provider Trelica

Until September 2024, the encrypted messaging service acceded to 14 requests for user data from the US; that number jumped to 900 after its CEO was detained by French authorities in August.

Source: Piotr Adamowicz via Alamy Stock Photo

Before September 2024, policy of encrypted communications provider Telegram stated it would only share user data with law enforcement in instances of terrorism. That was until the company's Russian-born CEO Pavel Durov was arrested in France in late August and released on a $5 million bond.

By late September, Telegram had changed its tune — agreeing to give law enforcement user information, including phone numbers and IP addresses in cases of fraud and other cybercrimes. Telegram also committed to producing transparency reports on the data it released as a result of law enforcement requests. And according to Telegram's latest transparency report, the platform's cooperation with the cops has indeed exploded since September.

According to Telegram, the company only responded to 14 requests from the US government in the first nine months of 2024, affecting a total of 108 users, 404 Media was first to report. By the end of the year, Telegram reported it had met a total of 900 requests from the US, affecting 2,253 users.

The next report is expected from Telegram in April.

**Telegram's Data Sharing Policy Moves Cybercrime Needle?**

At the time of Durov's arrest last year, experts predicted the additional pressure on Telegram would have little effect on its thriving cybercrime operations. In the short term, arrests and fragmenting of certain cybercrime operations will likely produce some benefit for cyber defenders, but ultimately they will find other places to do their illegal business, according to Callie Guenther, senior manager of cyber-threat research for Critical Start.

Related:Pentagon Adds Chinese Gaming Giant Tencent to Federal Ban

"This development is expected to prompt many cybercriminals to migrate to alternative platforms that prioritize privacy or employ decentralized infrastructures," she says. "Platforms such as Signal or Session, as well as services on the darknet, may become the next hubs for illicit activities, but this migration could also create a more fragmented ecosystem, complicating law enforcement efforts and requiring additional resources to monitor new avenues."

In the longer term, Telegram's policy shift represents a wider trend of increased government pressure on technology companies to cooperate with law enforcement activities, Guenther adds, pointing to Durov's arrest as a high-profile example.

"The trade-off between privacy and security remains contentious," Guenther says. "Over time, cybercriminals are likely to adapt to the new landscape, increasing the operational complexity for both investigators and cybersecurity professionals. Balancing these considerations will be essential to addressing the evolving dynamics of online threats without undermining broader privacy protections."

Related:Treasury Dept. Sanctions Chinese Tech Vendor for Complicity

**About the Author**

Dark Reading

Becky Bracken is a veteran multimedia journalist covering cybersecurity for Dark Reading.

Sharing of Telegram User Data Surges After CEO Arrest

The sprawling social media and gaming platform says that being considered a Chinese military business must be a mistake.

Source: Cyberstock via Alamy Stock Photo

NEWS BRIEF

Chinese messaging and gaming giant Tencent has been labeled a Chinese military business by the US Department of Defense (DoD).

The move comes on the heels of the US Department of Treasury sanctioning China-based cybersecurity company Integrity Technology Group for its role in computer-intrusion incidents against US critical infrastructure.

With the designation, Tencent cannot supply the US federal government with technology or services. It joins others like Huawei, and was added to the list known as "Section 1260" as part of a group that includes Contemporary Amperex Technology Company (CATL), China Overseas Shipping (COSCO), Changxin Memory Technologies, and Autel Robotics, a drone manufacturer.

The price of Tencent's shares in the US dropped nearly 10% on Jan. 7 after the announcement, accounting for billions in losses, but unlike a sanctioning, the designation does not mean that the firm can't still operate stateside, only that it can't do business with the federal government. A spokesperson for the company said that putting Tencent on the list was "a mistake" and that it is not a military company or supplier to the US federal government. The company also said that, in the long run, being added to the list will have "no impact" on the business and that it will work with the DoD to address the misunderstanding.

**About the Author**

Skilled writer and editor covering cybersecurity for Dark Reading.

Source

DARKReading