Following the death of Pope Francis, the Vatican is preparing to organize a new conclave in less than 20 days. This is how they’ll tamp down on leaks.

In 2005, cell phones were banned for the first time during the conclave, the process by which the Catholic Church elects its new pope. Twenty years later, after the death of Pope Francis, the election process is underway again. Authorities have two priorities: to protect the integrity of those attending the meeting, and to ensure that it proceeds in strict secrecy (under penalty of excommunication and imprisonment) until the final decision is made.

By 2025, the Gendarmerie corps guarding Vatican City faces unprecedented technological challenges compared to other conclaves. Among them are artificial intelligence systems, drones, military satellites, microscopic microphones, a misinformation epidemic, and a world permanently connected and informed through social media.

The conclave is scheduled to take place approximately 20 days after the pope's death. The Vatican and the Holy See are preparing for the arrival of the cardinals who will vote for the next leader of the Catholic faith. Emergency and control bodies are also working on it with state-of-the-art technology. So far, they have not shared details about their security arrangements, but they are not inexperienced in the task of safeguarding the integrity of high-profile figures in the face of today's technological risks.

In fact, the election in 2013 of Jorge Mario Bergoglio—the real name of Pope Francis—as supreme pontiff gives some indications of the rigorous security strategies that will be presented in the next conclave.

**Signal Jammers and Device Checks**

The Vatican has internet access, but within the areas where the cardinals will reside and vote for the new pope, there will be signal jammers. The technology prevents two devices from communicating with each other through radio frequency interference. The headquarters becomes an electronic bunker. Thus, if someone were to manage to introduce a microphone, telephone, or computer, they would be unable to transmit information.

However, the possibility of administrative staff or the cardinals themselves introducing technology is remote. Authorities inspect the building for days in search of unauthorized microphones or cameras, check every permitted attendee, and double-check participants.

**Privacy Film in the Windows**

Contemporary satellites are capable of taking pictures of people's faces from space, while AI can interpret lip movements. However, since there's currently no technology to see through walls with such high resolution, the best strategy against espionage in the conclave is to close doors and windows.

During meetings and in the sleeping quarters, voters are not allowed to look outside. In addition, before the cardinals arrive, Vatican staff place opaque film over windows so that no journalist, satellite, or drone can take pictures of the interior.

**Locked-Down Vatican**

The Vatican covers only 0.44 square kilometer in area. It is the smallest nation in the world. Until 2018, it had 650 cameras monitoring its streets from an underground command center. In addition, the Vatican City Gendarmerie, which functions as a conventional police force, and the Pontifical Swiss Guard, which acts as an army, are located within the territory. While in photographs they appear to be wearing antique costumes and carrying halberds, the latter group has highly trained personnel with heavy weapons, such as machine guns, rifles, and explosives.

An estimated 200,000 people are expected to be present in the small city-state once the conclave has determined the name of Pope Francis' successor.

_This story originally appeared on_ WIRED _en Español_ _and has been translated from Spanish._

The Tech That Safeguards the Conclave’s Secrecy

Terrance, United States / California, 22nd April 2025, CyberNewsWire

**Terrance, United States / California, April 22nd, 2025, CyberNewsWire**

**Joining Criminal IP at Booth S-634 | South Expo, Moscone Center | April 28 – May 1, 2025**

Criminal IP, the global cybersecurity platform specializing in AI-powered threat intelligence and OSINT-based data analytics, will exhibit at RSAC 2025 Conference, held from April 28 to May 1 at the Moscone Center in San Francisco. The company will welcome attendees at Booth S-634 in the South Expo Hall.

**Strengthening Its Global Presence Through Proven Success**

Following its impactful debut at RSAC 2023, Criminal IP has continued to expand its international footprint, establishing partnerships with over 40 global cybersecurity leaders, including Cisco, Tenable, Fortinet, VirusTotal, and Snowflake. Returning to RSAC 2025, the company will further strengthen its position in the global security market by showcasing its latest innovations in Attack Surface Management (ASM) and Cyber Threat Intelligence (CTI).

**Elevating Threat Intelligence with ASM at RSAC**

With a presence in over 150 countries, Criminal IP has positioned itself as a trusted leader in Attack Surface Management (ASM) and Cyber Threat Intelligence (CTI). At RSAC 2025, the company will highlight how its platform empowers security teams with real-time, actionable insights to proactively detect and respond to today’s most advanced cyber threats.

**Live Demonstrations & Strategic Dialogues**

Throughout the event, Criminal IP will host live demos and interactive sessions led by the CEO, senior developers, and global product experts. Visitors will gain exclusive insights into:

*   Real-world applications of ASM for enterprise security
*   Emerging threat trends and response tactics
*   Enhancing CTI workflows with AI and automation

Attendees will experience firsthand how Criminal IP uncovers exposed assets, detects abnormal behaviors, and delivers complete visibility across digital infrastructures.

**Connecting with the Criminal IP Team**

Attendees can arrange 1:1 meetings directly at Booth S-634 or pre-book sessions in advance through the Knowledge Hub > Conference section of the Criminal IP website. The team will be available to discuss how the platform can be tailored to support diverse cybersecurity goals.

The booth will also feature exclusive giveaways and a roulette-style prize draw for all on-site attendees.

> “RSAC continues to be a vital platform for exchanging ideas around proactive security,” said Byungtak Kang, CEO of AI SPERA. “We look forward to showcasing how our ASM-powered threat intelligence helps global organizations safeguard their external attack surfaces.”

**About Criminal IP**

Criminal IP is an all-in-one AI-driven threat intelligence platform that enables organizations to detect, assess, and respond to cyber threats in real time. Powered by massive-scale OSINT data and machine learning, the platform provides complete visibility into exposed assets, suspicious behaviors, and indicators of compromise.

**Contact**

**Michael Sena**  
**AI SPERA**  
**\[email protected\]**

Criminal IP to Showcase Advanced Threat Intelligence at RSAC™ 2025

All Google accounts could end up compromised by a clever replay attack on Gmail users that abuses Google infrastructure.

Cybercriminals are abusing Google’s infrastructure, creating emails that appear to come from Google in order to persuade people into handing over their Google account credentials.

This attack, first flagged by Nick Johnson, the lead developer of the Ethereum Name Service (ENS), a blockchain equivalent of the popular internet naming convention known as the Domain Name System (DNS).

Nick received a very official looking security alert about a subpoena allegedly issued to Google by law enforcement to information contained in Nick’s Google account. A URL in the email pointed Nick to a sites.google.com page that looked like an exact copy of the official Google support portal.

> Recently I was targeted by an extremely sophisticated phishing attack, and I want to highlight it here. It exploits a vulnerability in Google's infrastructure, and given their refusal to fix it, we're likely to see it a lot more. Here's the email I got: pic.twitter.com/tScmxj3um6
> 
> — nick.eth (@nicksdjohnson) April 16, 2025

As a computer savvy person, Nick spotted that the official site should have been hosted on accounts.google.com and not sites.google.com. The difference is that anyone with a Google account can create a website on sites.google.com. And that is exactly what the cybercriminals did.

Attackers increasingly use Google Sites to host phishing pages because the domain appears trustworthy to most users and can bypass many security filters. One of those filters is DKIM (DomainKeys Identified Mail), an email authentication protocol that allows the sending server to attach a digital signature to an email.

If the target clicked either “Upload additional documents” or “View case”, they were redirected to an exact copy of the Google sign-in page designed to steal their login credentials.

Your Google credentials are coveted prey, because they give access to core Google services like Gmail, Google Drive, Google Photos, Google Calendar, Google Contacts, Google Maps, Google Play, and YouTube, but also any third-party apps and services you have chosen to log in with your Google account.

The signs to recognize this scam are the pages hosted at sites.google.com which should have been support.google.com and accounts.google.com and the sender address in the email header. Although it was signed by accounts.google.com, it was emailed by another address. If a person had all these accounts compromised in one go, this could easily lead to identity theft.

**How to avoid scams like this**

*   Don’t follow links in unsolicited emails or on unexpected websites
*   Carefully look at the email headers when you receive an unexpected mail
*   Verify the legitimacy of such emails through another, independent method
*   Don’t use your Google account (or Facebook for that matter) to log in at other sites and services. Instead create an account on the service itself.

**Technical details**

Analyzing the URL used in the attack on Nick, (https://sites.google.com[/]u/17918456/d/1W4M_jFajsC8YKeRJn6tt_b1Ja9Puh6_v/edit) where /u/17918456/ is a user or account identifier and /d/1W4M_jFajsC8YKeRJn6tt_b1Ja9Puh6_v/ identifies the exact page, the /edit part stands out like a sore thumb.

DKIM-signed messages keep the signature during replays as long as the body remains unchanged. So if a malicious actor gets access to a previously legitimate DKIM-signed email, they can resend that exact message at any time, and it will still pass authentication.

So, what the cybercriminals did was:

*   Set up a Gmail account starting with me@ so the visible email would look as if it was addressed to “me.”
*   Register an OAuth app and set the app name to match the phishing link
*   Grant the OAuth app access to their Google account which triggers a legitimate security warning from no-reply@accounts.google.com
*   This alert has a valid DKIM signature, with the content of the phishing email embedded in the body as the app name.
*   Forward the message untouched which keeps the DKIM signature valid.

Creating the application containing the entire text of the phishing message for its name, and preparing the landing page and fake login site may seem a lot of work. But once the criminals have completed the initial work, the procedure is easy enough to repeat once a page gets reported, which is not easy on sites.google.com.

Nick submitted a bug report to Google about this. Google originally closed the report as ‘Working as Intended,’ but later Google got back to him and said it had reconsidered the matter and it will fix the OAuth bug.

**We don’t just report on threats – we help safeguard your entire digital identity**

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

 All Gmail users at risk from clever replay attack 

Artificial intelligence is transforming industries, but its adoption also raises ethical and cybersecurity concerns, especially in the regulated…

Artificial intelligence is transforming industries, but its adoption also raises ethical and cybersecurity concerns, especially in the regulated financial sector. Balancing innovation with responsibility is important as organizations harness AI’s potential while protecting data, ensuring fairness, and mitigating risks. 

Navigating this intersection of AI ethics, cybersecurity, and finance requires careful strategy.

****AI in Financial Systems****

AI has revolutionized financial systems by enhancing decision-making processes, optimizing resource allocation, and improving fraud detection capabilities. One prominent area where AI thrives is in trading and market analysis. Algorithms powered by AI can analyze massive datasets in real time, identifying trends and making predictions with remarkable accuracy. 

For example, traders often ask, Can you short futures effectively use AI? The answer lies in leveraging sophisticated machine learning models that evaluate market conditions, predict price movements, and execute trades with precision. 

However, employing AI in such high-stakes environments also brings ethical considerations, such as ensuring transparency in algorithmic decisions and addressing the potential for systemic risks caused by automation. Balancing these advancements with robust governance is essential to maintaining trust and stability in the financial sector.

****Why AI Ethics Matters****

AI Ethics emphasizes fairness, accountability, and transparency in developing and using artificial intelligence systems. It prompts questions like, “Is this decision fair?” or “What are the risks if this algorithm fails?” 

These issues are especially critical in finance, where AI-driven decisions can directly impact people’s financial well-being. Financial tools affect nearly every part of life from securing loans to managing investments making ethical practices essential. 

Financial platforms must ensure their AI systems don’t discriminate based on factors like ethnicity, gender, or socioeconomic status. For instance, algorithms used to determine creditworthiness or loan approvals should be carefully designed and tested to prevent bias. Accountability is just as important; companies need systems to evaluate their AI’s impact and correct mistakes. 

Transparency is another cornerstone of AI Ethics. Consumers should know how their data is collected, used, and analyzed. They also deserve clarity on AI-driven decisions and the reasoning behind them. By prioritizing fairness, accountability, and transparency, companies can build trust and ensure their tools serve users responsibly and equitably.

****The Financial Costs of Cyber Threats****

AI doesn’t just create opportunities; it generates risks too. Cybersecurity is a constant challenge. It’s already critical in finance, but AI raises the stakes further. Imagine someone hacking an AI-driven trading system. This could cause widespread market turmoil in minutes.

The costs don’t stop at financial losses. A data breach can damage a company’s reputation. People lose trust, and rebuilding that trust can take years. Businesses need strong security measures to protect against breaches and ensure their AI systems are strengthened.

****Finding Balance Between Tech and Security****

Innovation and security can often feel at odds. New technologies drive progress but can also create vulnerabilities, as cyber threats evolve just as quickly. Cybersecurity teams must not only respond to threats but also anticipate and address issues before they escalate. 

This challenge becomes even greater with AI-powered systems. While transformative, their complexity makes them prime targets for attacks like data poisoning, adversarial manipulation, or algorithm flaws any of which can have serious consequences. 

To secure these systems, organizations should take a layered approach: regular audits to find vulnerabilities, secure coding to reduce risks, and employee training on handling sensitive data. By acting proactively, businesses can innovate without compromising security.

****The Future of AI Responsibility****

The future of AI is tied to how well we manage its capabilities and risks. Industries must keep asking tough questions. How much control should AI have? How do we hold businesses accountable when things go wrong?

This future depends on a collaborative effort. Governments, businesses, and researchers need to work together. Clear regulations should guide how AI is developed and used. Companies should prioritize ethical practices without cutting corners in pursuit of profits. Transparency, fairness, and strong cybersecurity protocols must remain non-negotiable.

The future of AI is both exciting and daunting. While it holds immense potential to improve our lives, it also poses significant challenges that must be addressed. As we continue to integrate AI into our society, we must do so with caution and responsibility.

We must continue having open discussions about the ethical implications of AI and actively work towards creating regulations and guidelines that prioritize human well-being. We must also hold businesses accountable for their actions and ensure that they uphold ethical practices in the development and use of AI.

(Image by Gerd Altmann from Pixabay)

AI Ethics, Cybersecurity and Finance: Navigating the Intersection

Was your Microsoft Entra ID account locked? Find out about the recent widespread lockouts caused by the new…

Was your Microsoft Entra ID account locked? Find out about the recent widespread lockouts caused by the new MACE Credential Revocation app and a Microsoft error in handling user refresh tokens.

Recently, many companies experienced a problem where their employees suddenly couldn’t log into their Microsoft Entra accounts and expressed concern in a Reddit thread. Microsoft, the company behind Entra ID (previously called Azure Active Directory), has explained what happened.

It seems that a newly introduced component of Microsoft Entra ID called the MACE Credential Revocation app, which is designed to enhance security by identifying compromised credentials, mistakenly flagged many regular users as high risk. This led to widespread account lockouts.

Microsoft has traced the root cause to an internal logging issue with a feature called refresh tokens (how users stay logged), which were being logged within Microsoft’s own systems. Specifically, the standard process is to only log metadata about these short-lived tokens, and the problem arose when a subset of these tokens themselves were being logged internally “for a small percentage of users,” beginning on Friday, April 18th, 2025.

As soon as they realized this mistake on Friday, April 18th, 2025, Microsoft took action to fix it. To keep their customers safe, they decided to make these specific tokens invalid, meaning they would no longer work.

However, this process of making the tokens invalid mistakenly triggered alerts in Entra ID Protection. These alerts, sent out on Sunday, April 20th, 2025, between 4 AM and 9 AM UTC, made it seem like users’ login details might have been stolen.

Microsoft has stated that they don’t have any proof that anyone gained unauthorized access to these tokens. “We have no indication of unauthorized access to these tokens – and if we determine there were any unauthorized access, we will invoke our standard security incident response and communication processes,” the tech giant noted.  

For companies whose users were locked out because they were wrongly marked as high-risk, Microsoft suggests a solution. Administrators can use a feature called Confirm User Safe within Entra ID. This tells the system that even though an alert was raised, the user’s account is actually okay. Microsoft has provided a link to their help documentation that explains how to use this feature and understand the risk alerts. 

Microsoft is still looking into exactly what went wrong and will share a detailed report, called a Post Incident Review (PIR), with all the affected customers and anyone who opened a support ticket.

To be notified when this report is available or to stay updated on any future problems with Azure services, Microsoft recommends setting up Azure Service Health alerts. These alerts can send notifications through email, text messages, and other methods. 

Jim Routh, Chief Trust Officer Saviynt, shared his thoughts on the situation with Hackread.com. He pointed out that even though this caused problems for some Microsoft business customers over the weekend, there were some positive aspects.

“The positive news is that the disruption occurred over the weekend, and today (Monday), customers have the facts along with the fix (corrective actions) necessary for recovery,” he said. ”The vulnerability and the action taken (token invalidation) were ultimately shared by Microsoft in an advisory relatively quickly. This is a sign of health or resilience despite the inconvenience to some enterprise customers over the weekend,” Routh added.

Microsoft Entra ID Lockouts After MACE App Flags Legit Users

Microsoft on Monday announced that it has moved the Microsoft Account (MSA) signing service to Azure confidential virtual machines (VMs) and that it's also in the process of migrating the Entra ID signing service as well.
The disclosure comes about seven months after the tech giant said it completed updates to Microsoft Entra ID and MS for both public and United States government clouds to

Microsoft Secures MSA Signing with Azure Confidential VMs Following Storm-0558 Breach

Morphisec discovers a new malware threat ResolverRAT, that combines advanced methods for running code directly in computer memory,…

Morphisec discovers a new malware threat ResolverRAT, that combines advanced methods for running code directly in computer memory, figuring out necessary system functions and resources as it runs, and employing multiple layers of techniques to avoid detection by security software.

A new and sophisticated piece of malware, dubbed ResolverRAT by Morphisec researchers, has been discovered actively targeting organisations within the healthcare and pharmaceutical sectors, with the most recent wave of attacks occurring around March 10, 2025.

Morphisec’s Threat Labs researchers dubbed it Resolver because of the malware’s high reliance on figuring things out and handling resources dynamically while running, making it much harder for traditional methods to detect it.

According to researchers, ResolverRAT is distributed via phishing emails designed to create a sense of urgency or fear, pressuring recipients to click on a malicious link. Once clicked, the link leads to a file that starts the ResolverRAT infection process.

This is a highly localised phishing attack as the emails are written in the native language of the targeted country and consistently use alarming subjects, such as legal investigations or copyright violations. This multi-language approach suggests a global operation aimed at maximising successful infections through personalised targeting.

Use of native language subject lines (Source: Morphisec)

ResolverRAT infections begin with DLL side-loading, a technique that involves placing a malicious DLL file alongside a legitimate, signed program, identified as ‘hpreader.exe‘ in this case. When ‘hpreader.exe’ is executed, it unknowingly loads the malicious DLL, triggering the malware’s execution.

Interestingly, the same executable was identified by CPR in a recent campaign distributing the Rhadamanthys malware, and Cisco Talos documented similar phishing techniques used to deliver Lumma information-stealing malware. This could suggest that the groups are reusing tools, sharing resources, or part of a coordinated effort or shared network of cybercriminal affiliates.

ResolverRAT employs multiple layers of evasion to avoid detection, including extensive code obfuscation and a custom protocol over standard ports to blend network traffic. It executes malicious code directly in the computer’s memory (in-memory execution) and dynamically identifies and uses necessary system functions as it runs (API resolution).

To stay on an infected system even after a reboot, ResolverRAT creates up to 20 entries in the Windows Registry, spread across various locations, and installs copies of itself in various locations.

Moreover, the malware uses a unique method of certificate validation and ‘.NET Resource Resolver Hijacking’ technique is a key element of its stealth. Additionally, it attempts to fingerprint analysis environments and can alter its behaviour when it detects it’s being examined.

It allows attackers to steal sensitive information like credentials and patient data, breaking large datasets into smaller chunks for easier transmission. ResolverRAT also has remote access capabilities, allowing attackers to execute commands, upload files, take screenshots, capture keystrokes, and potentially deploy further malware.

This sophisticated blend of in-memory execution, advanced evasion techniques, and resilient C2 infrastructure poses a substantial threat to sensitive sectors like healthcare and pharmaceuticals, highlighting the need for organisations to adopt proactive defence strategies to effectively counter these threats.

Native Language Phishing Spreads ResolverRAT to Healthcare

Government-backed hacking groups from North Korea (TA427), Iran (TA450), and Russia (UNK_RemoteRogue, TA422) are now using the ClickFix…

Government-backed hacking groups from North Korea (TA427), Iran (TA450), and Russia (UNK\_RemoteRogue, TA422) are now using the ClickFix technique in their espionage campaigns. Learn about Proofpoint’s insights into this new wave of attacks.

Proofpoint has recently discovered a concerning development related to the ClickFix attack, a dangerous social engineering method. Reportedly, government-backed hacking groups are now using this technique, exploiting users’ trust by presenting fake error messages or security alerts from the operating system or familiar applications.

Users are tricked into downloading and running a code in their computer’s command line interface, believing it is a solution to their problem. However, when run, this code executes malicious commands on the victim’s machine.

Last year, Hackread.com raised an alarm about the rising popularity of the ClickFix attack among cybercriminals starting in March 2024, after groups like TA571 and ClearFake used it. In October 2024, Sekoia observed a rise in ClickFix attacks involving fake Google Meet, Chrome, and Facebook pages tricking users into downloading malware.

The latest wave of ClickFix attacks was observed between July 2024 and early 2025, with North Korea, Iran, and Russia-backed hackers incorporating ClickFix into their usual operations.

Attacks Timeline (Source: Proofpoint)

****North Korea (TA427)****

In early 2025, TA427 (Kimsuky, Emerald Sleet) targeted individuals from 5 organisations in the think tank sector working on North Korea affairs. They used deceptive meeting requests and fake websites to trick them into running PowerShell commands. One successful attack involved impersonating a Japanese diplomat (Ambassador Shigeo Yamada) and led to the installation of QuasarRAT malware.

Malicious email (Source: Proofpoint)

****Iran (TA450)****

In November 2024, TA450 (MuddyWater, Mango Sandstorm) targeted 39 organisations, mainly finance and government sectors, in the Middle East with fake Microsoft security update emails. They used ClickFix to persuade users to run PowerShell commands that installed the Level RMM tool, which the attackers intended to use for espionage and data theft. No further use of ClickFix by this group was observed afterwards.

****Russia (UNK\_RemoteRogue and TA422)****

UNK\_RemoteRogue used ClickFix once in December 2024, targeting individuals in two prominent arms manufacturing firms in the defence industry, sending emails with a link to a fake Microsoft Office page with Russian instructions to copy/paste code that executed JavaScript and then PowerShell linked to the Empire framework.

TA422 (Sofacy, APT28) employed ClickFix in October 2024, targeting Ukrainian entities, sending phishing emails with a link mimicking a Google spreadsheet sent out by CERT-UA that led to a reCAPTCHA, which, upon clicking, provided a PowerShell command to create an SSH tunnel and run Metasploit.

These groups, however, are not completely changing their attack methods. Instead, they are using ClickFix to replace certain steps in how they initially infect a target’s computer and run malicious software. Also, according to Proofpoint’s blog post, they have not observed any Chinese government-backed groups using ClickFix, possibly due to limited visibility into their activities.

Even though ClickFix is not yet a standard tool for state-sponsored actors, its increasing popularity suggests that this technique could become more common in government-backed cyber espionage campaigns in the coming months, researchers conclude.

North Korea, Iran, Russia-Backed Hackers Deploy ClickFix in New Attacks

Dallas, United States, TX, 21st April 2025, CyberNewsWire

**Dallas, United States, TX, April 21st, 2025, CyberNewsWire**

Brings Automated Response to Your Assets, Identity, Vulnerabilities, Alerts, and More to Redefine Risk Prioritization.

For years, security teams have operated in reactive mode, contending with siloed tools, fragmented intelligence, and a never-ending backlog of alerts. Traditional Security Operations platforms were supposed to unify data and streamline response—but they often introduced their own complexity, requiring heavy customization and manual oversight. “Hyper automation” delivered much of the same empty promises, leaving most security teams firefighting today’s incidents with limited bandwidth to proactively manage tomorrow’s risks.

At the 2025 RSA Conference, StrikeReady is introducing its next-generation Security Command Center v2. This AI-powered platform is engineered to go beyond basic alert processing, offering integrated asset and identity visibility, comprehensive vulnerability management, and coordinated automated response capabilities—enabling organizations to address threats with a focus on effective risk resolution.

> “We built StrikeReady to help security teams escape the cycle of perpetual reactivity,” said Alex Lanstein, CTO at StrikeReady. “With our platform, you don’t just see threats faster—you control and reduce risk in real time, closing gaps before they’re exploited. It’s a complete shift from dousing fires to preventing them from igniting.”

**v2 Key Business Outcomes and Metrics**

**1\. Proactive Risk Visibility**

A consolidated risk view across your identities, assets, and vulnerabilities, validated in a single unified interface/command center. Enable informed, strategic planning, rather than being in constant firefighting mode.

**2\. Radical Time Reduction**

Validating risk with threat intelligence, like threat intelligence reports, is cut from four to six hours to four to six minutes.

Alert processing drops from one hour to one minute, freeing analysts to focus on hunting.

All alerts, from any source—high, medium, and low severity—are all processed without differentiation, and at machine speed and accuracy.

**3\. Better, Faster, and More Cost-Effective Deployments**

Automated workflows and capabilities can be live in as little as 60 minutes, unlike traditional automation systems that often require six to 18 months of customization and cost upwards of $1 million.

**4\. Lower Operational Expenses**

One of many examples is phishing alert backlogs cleared in minutes, reducing manual efforts and saving over $180,000 annually.

Analysts spend less time on foundational work, false positives, and repetitive tasks, slashing overhead and burnout.

**5\. Native Case Management, Collaboration, and Real-Time Validation**

Built-in case management means no external ticketing, and zero trust collaboration with any internal or external team, with auto-documentation as standard (auditable).

**6\. Validate Your Security Controls** 

Use prepackaged or custom live attack content across your endpoints, cloud, and network to assess your security posture, resolve risk, and report improvements to your business.

**7\. Moving from Alerts to Strategic Defense**

While many AI-based security solutions focus on short-term alert handling, StrikeReady frames cybersecurity as an end-to-end risk management process. The platform’s proprietary Large Action Model (LAM) goes beyond mere analysis—directly executing defensive actions across the environment based on user prompts. This proactive approach helps organizations:

**Optimize** existing security investments by centralizing management.

**Preemptively** counter sophisticated threats, rather than reacting after the fact.

**Continuously** improve security efficiency through automation and instant control validation.

> “Success in cybersecurity today isn’t about chasing the latest threat—it’s about operationalizing intelligence, standardizing incident resolution, and eliminating friction at every step,” said Adil Mufti, CISO at StrikeReady. “StrikeReady makes this shift possible by consolidating the entire security lifecycle under one roof.”

**Experience StrikeReady at RSA Conference**

At **RSA Conference 2025**, StrikeReady will demonstrate live how the platform unifies risk visibility, orchestrates proactive actions, and frees analysts to make strategic decisions. Attendees can learn how to lower mean time to respond (MTTR), reduce false positives, and transform their SOC from a reactive entity into a proactive defense powerhouse.

**About StrikeReady**

Founded in 2019, StrikeReady introduced the first unified, vendor-agnostic, AI-powered Security Command Center delivering full-spectrum risk visibility, intelligent threat management, and automated response from a single, integrated platform.

By unifying identities, assets, vulnerabilities, and advanced simulations in one place, StrikeReady empowers organizations to proactively defend against modern threats and stay ahead of an ever-shifting cyber landscape. Moving beyond conventional AI, StrikeReady leverages its Large Action Model (LAM) to automate actions across the tech stack, creating a force multiplier for security teams seeking truly proactive risk management.

Recognized by Gartner as the only Virtual Security Assistant in its Emerging Technologies report, StrikeReady is dedicated to reshaping the future of cybersecurity.

**For more information users can visit**: https://strikeready.com/

**To schedule a demo at RSA, users can contact:** 

Lee Weyers | \[email protected\] | +1 (702) 588-1131

**Contact**

**Director, Public Relations**  
**Cara Harbor**  
**StrikeReady**  
**\[email protected\]**

Industry First: StrikeReady AI Platform Moves Security Teams Beyond Basic, One-Dimensional AI-Driven Triage Solutions

Kaspersky researchers report the reappearance of MysterySnail RAT, a malware linked to Chinese IronHusky APT, targeting Mongolia and…

Kaspersky researchers report the reappearance of MysterySnail RAT, a malware linked to Chinese IronHusky APT, targeting Mongolia and Russia after years of silence. Learn about its new tactics and modular design.

Cybercriminals are constantly developing new malware for cyberattacks. These malicious tools have varying lifespans; some malware families have been tracked for decades, while others vanish from public awareness relatively quickly. In 2021, Kaspersky researchers discovered one such short-lived implant during their investigation of the CVE-2021-40449 zero-day vulnerability, which they dubbed MysterySnail RAT.

At the time of its discovery, MysterySnail RAT was linked to IronHusky APT, a Chinese-speaking threat group active since at least 2017. After the initial report, no further public details about this malware emerged.

However, recent observations have uncovered attempted deployments of a new version of MysterySnail RAT targeting government entities in Mongolia and Russia. This targeting aligns with previous intelligence indicating IronHusky’s specific interest in these two countries dating back to 2018, suggesting the RAT has been active covertly for several years.

A recent infection began with a malicious MMC script disguised as a document from Mongolia’s National Land Agency (ALAMGAC). This script downloaded a ZIP archive from fileio, which contained a secondary malicious component and a decoy DOCX file. The script would then extract the archive, placing the decoy in %AppData%\Cisco\Plugins\X86\bin\etc\Update, and execute CiscoCollabHost.exe from the archive. For persistence, it configured CiscoCollabHost.exe to run at start-up and opened the decoy document to deceive the user.

While CiscoCollabHost.exe was legitimate, the archive also held a malicious DLL named CiscoSparkLauncher.dll, designed for DLL Sideloading by the legitimate process, acting as a new intermediary backdoor. This backdoor facilitated C2 communication by leveraging the open-source piping-server project.

The new version can execute around 40 commands, enabling various malicious activities like file system management, command execution via cmd.exe process creation and termination, service management, and network resource connection.

Unlike the 2021 samples, the new version uses five additional DLL modules for command execution, a key upgrade from the previous version’s single malicious component.

Moreover, it was configured to establish persistence on infected machines as a service, and the malicious DLL loads a payload encrypted using RC4 and XOR algorithms. Upon decryption, it gets loaded into memory through DLL hollowing, facilitated by code within the run_pe library.

Following the disruption of recent MysterySnail RAT intrusions, the threat actors persisted by deploying a modified, single-component variant named MysteryMonoSnail. This streamlined version communicated with the same C2 servers as the original RAT but utilised the WebSocket protocol instead of HTTP and possessed a reduced set of only 13 basic commands, enabling actions like listing directories, writing files, and launching processes and remote shells.

The return of MysterySnail RAT shows how old malware doesn’t just disappear; they evolve. It’s also a reminder that staying on top of new and resurfacing cybersecurity threats is key to keeping systems secure.

Tag

#mac