Netizen Blog and News

The Netizen team sharing expertise, insights and useful information in cybersecurity, compliance, and software assurance.

recent posts

about

  • Netizen Cybersecurity Bulletin (June 26th, 2025)

    Netizen Cybersecurity Bulletin (June 26th, 2025)

    Overview:

    • Phish Tale of the Week
    • Iranian Hackers Maintain Long-Term Access to Middle East CNI via VPN Exploits and Malware
    • Citrix Bleed 2 and SAP GUI Flaws: Critical Vulnerabilities Expose Sensitive Data
    • How can Netizen help?

    Phish Tale of the Week

    Often times phishing campaigns, created by malicious actors, target users by utilizing social engineering. For example, in this email, the actors are appearing as an unnamed company. They’re sending us a text message, telling us that our Coinbase account was logged in from Belgium, and we need to call support. It seems both urgent and genuine, so why shouldn’t we? Luckily, there’s plenty of reasons that point to this being a scam.

    Here’s how we can tell not to fall for this phish:

    1. The first warning sign for this SMS is the context in which it was sent. When I recieved this SMS, I immediately knew not to click on the link due to the fact that I do not have a Coinbase account. On top of that, it’s very apparent that this message was blasted out to random numbers: the message doesn’t even include my name or attempt to provide any level of familiarity.
    2. The second warning signs in this email is the messaging. This message tries to create a sense of urgency in order to get you to take action by using language such as “logging in from Belgium.” Phishing and smishing scams commonly attempt to create a sense of urgency/confusion in their messages in order to get you to click their link without thinking about it first. Always be sure to thoroughly inspect the style and tone of all texts before following a link or other attachment sent through SMS.
    3. The final warning sign for this email is the wording; in our case the smisher suggests we call a random number, something that Coinbase support would never do. All of these factors point to the above being a smishing text, and a very unsophisticated one at that.


    General Recommendations:

    A phishing attack will typically direct the user to click on a link where they will then be prompted to update personal information, such as a password, credit card, social security, or bank account information. A legitimate company already has this sensitive information and would not ask for it again, especially via your text messages. 

    1. Scrutinize your messages before clicking anything. Have you ordered anything recently? Does this order number match the one I already have? Did the message come from a store you don’t usually order supplies from or a service you don’t use? If so, it’s probably a phishing attempt.
    2. Verify that the sender is actually from the company sending the message.
    3. Did you receive a message from someone you don’t recognize? Are they asking you to sign into a website to give Personally Identifiable Information (PII) such as credit card numbers, social security number, etc. A legitimate company will never ask for PII via instant message or email.
    4. Do not give out personal or company information over the internet.
    5. Do not click on unrecognized links or attachments. If you do proceed, verify that the URL is the correct one for the company/service and it has the proper security in place, such as HTTPS.

    Many phishing messages pose a sense of urgency or even aggressiveness to prompt a form of intimidation. Any email requesting immediate action should be vetted thoroughly to determine whether or not it is a scam. Also, beware of messages that seek to tempt users into opening an attachment or visiting a link. For example, an attachment titled “Fix your account now” may draw the question “What is wrong with my account?” and prompt you to click a suspicious link.

    Cybersecurity Brief

    In this month’s Cybersecurity Brief:

    Iranian Hackers Maintain Long-Term Access to Middle East CNI via VPN Exploits and Malware

    In a report published on May 3, 2025, FortiGuard Incident Response (FGIR) team detailed a significant cyberattack campaign attributed to an Iranian state-sponsored hacker group. This campaign targeted a Middle Eastern Critical National Infrastructure (CNI) entity over a two-year period, from at least May 2023 to February 2025. The attack was marked by extensive espionage and strategic network prepositioning, often used to secure persistent access for future operations.

    The threat actor behind the breach has been linked to the Iranian state-sponsored hacking group Lemon Sandstorm (also known as Rubidium, Parisite, Pioneer Kitten, and UNC757). This group has been active since at least 2017 and has targeted multiple sectors across the globe, including aerospace, oil and gas, water, and electricity infrastructure in the U.S., Europe, the Middle East, and Australia. The group’s modus operandi involves exploiting vulnerabilities in VPN technologies and deploying a variety of malware to maintain long-term access.

    The cyberattack campaign made use of known vulnerabilities in popular VPN systems, including Fortinet, Pulse Secure, and Palo Alto Networks, to gain initial access to the target’s network. Once inside, the attackers deployed a series of backdoors and malware to maintain persistent access. According to the report, the attack unfolded in multiple stages:

    1. Stage 1 (May 2023 – April 2024): The attackers established their foothold by using stolen login credentials to access the victim’s SSL VPN system. They dropped web shells on public-facing servers and deployed three backdoors—Havoc, HanifNet, and HXLibrary—for long-term access.
    2. Stage 2 (April 2024 – November 2024): The attackers consolidated their access by planting more web shells and deploying an additional backdoor, NeoExpressRAT. The attackers used tools such as Plink and Ngrok to move deeper into the network, exfiltrating sensitive emails and conducting lateral movements to the virtualization infrastructure.
    3. Stage 3 (November 2024 – December 2024): After the victim took containment measures, the attackers responded by deploying additional web shells and backdoors, including MeshCentral Agent and SystemBC.
    4. Stage 4 (December 2024 – Present): The attackers attempted to infiltrate the network again by exploiting vulnerabilities in ZKTeco BioTime devices (CVE-2023-38950, CVE-2023-38951, and CVE-2023-38952). They also launched spear-phishing attacks targeting 11 employees to harvest Microsoft 365 credentials after the organization successfully removed the adversary’s access.

    The attackers used several malware families throughout the intrusion, including both open-source tools and custom-built malware. Notable among them were:

    • Havoc: A C2 backdoor written in C++ and Golang that was injected into a newly created “cmd.exe” process. Havoc supports various commands to control compromised hosts and uses HTTP, HTTPS, and SMB protocols for communication with the C2 server.
    • HanifNet: A .NET executable used to retrieve and execute commands from the C2 server. First deployed in August 2023, it helped maintain control over compromised systems.
    • HXLibrary: A malicious IIS module that retrieves text files from Google Docs to connect to the C2 server. Deployed in October 2023, it was used to execute commands on the infected systems.
    • NeoExpressRAT: A backdoor deployed in August 2024 that retrieves a configuration from the C2 server, likely using Discord for follow-on communications.
    • MeshCentral Agent and SystemBC: Deployed as additional backdoors after initial containment efforts, used to maintain access and perform lateral movements within the network.

    Other tools included CredInterceptor (for harvesting credentials), RemoteInjector (for loading next-stage payloads), and RecShell (a web shell used for reconnaissance).

    A significant aspect of the attack was the targeting of the victim’s restricted Operational Technology (OT) network. While there is no evidence to suggest the OT network was breached, the adversary’s extensive reconnaissance indicates that it was a primary target. The threat actors’ careful, multi-stage exploitation of the network suggests a focused attempt to disrupt OT-adjacent systems that could have led to more severe impacts on the CNI infrastructure.

    The attacker’s persistence and ability to avoid detection were notable. The report reveals that throughout the intrusion, the group used multiple proxies and custom implants to bypass network segmentation, a strategy commonly employed to ensure continued access to sensitive systems. In later stages of the attack, the attackers chained together several proxy tools to access internal network segments, demonstrating sophisticated techniques for maintaining long-term access.

    In a follow-up report published on June 23, 2025, Fortinet provided additional details about the Havoc C2 framework. This backdoor, written in C++ and Golang, has a modular design that allows for the flexible execution of multiple commands. It supports a variety of functionalities, including process enumeration, lateral movement, and token manipulation. Havoc also enables attackers to inject shellcode into the memory of compromised systems, further enhancing its ability to control infected devices remotely.

    To read more about this article, click here.

    Citrix Bleed 2 and SAP GUI Flaws: Critical Vulnerabilities Expose Sensitive Data

    Oct 15, 2019 Santa Clara / CA / USA – Citrix offices in Silicon Valley; Citrix Systems, Inc. is an American software company that provides virtualization, networking, SaaS and cloud computing services

    Two recently disclosed vulnerabilities—Citrix Bleed 2 and SAP GUI input history flaws—have raised alarms across the cybersecurity industry, putting sensitive data at risk.

    Citrix has patched a critical vulnerability in its NetScaler ADC (Application Delivery Controller) and NetScaler Gateway, tracked as CVE-2025-5777. This flaw, rated CVSS 9.3, allows attackers to bypass authentication protections and potentially steal valid session tokens from memory through malformed requests. This vulnerability affects appliances configured as a Gateway or AAA virtual server.

    Discovered by security researcher Kevin Beaumont, this flaw shares similarities with CVE-2023-4966, a high-profile vulnerability that resulted in widespread exploitation two years ago. Citrix has already issued patches for affected versions of NetScaler ADC and NetScaler Gateway, with the updates being available for versions 14.1-43.56 and later. The vulnerability also impacts older NetScaler ADC versions (13.1 and 12.1).

    To mitigate the risks, Citrix recommends running commands to terminate all active ICA and PCoIP sessions after the patches have been applied. Additionally, users of unsupported versions (12.1 and 13.0) are urged to upgrade to a supported version, as these versions are now end-of-life (EOL) and no longer receive official support.

    While there is no evidence that this vulnerability has been weaponized, Benjamin Harris, CEO at watchTowr, emphasized its severity, comparing it to Citrix Bleed, a vulnerability that caused significant damage in previous years. Harris noted that changes in the CVE description suggest that the vulnerability is more critical than initially understood.

    In another cybersecurity alert, vulnerabilities discovered in SAP GUI for both Windows and Java have exposed sensitive information stored locally on devices. Tracked as CVE-2025-0055 and CVE-2025-0056, these vulnerabilities involve the insecure storage of SAP GUI input history. This feature, intended to enhance user efficiency by storing past inputs, inadvertently saved sensitive data, such as usernames, social security numbers, bank account numbers, and internal SAP table names, in an insecure manner.

    The flaw exists because SAP GUI for Windows uses weak XOR encryption to store input history in SAPHistory.db files, making it easily decryptable. Meanwhile, SAP GUI for Java stores this information unencrypted as Java serialized objects. Both cases present significant risks, as an attacker with access to the victim’s directory could easily retrieve the sensitive data stored in these files.

    The vulnerability is particularly dangerous for environments where attackers can gain administrative privileges or access the user directory, allowing them to exfiltrate valuable data. Pathlock researcher Jonathan Stross warned that data exfiltration can occur through USB Rubber Ducky (HID injection attacks) or phishing tactics.

    In response, SAP issued patches in its January 2025 updates, addressing the flaws and recommending that organizations disable input history functionality and delete the historical data files to mitigate potential risks.

    For Citrix users, upgrading to the latest supported versions is crucial, as CVE-2025-5777 poses a significant risk of session hijacking. Administrators should also follow Citrix’s recommendations to terminate existing sessions as part of the remediation process. For SAP GUI users, securing local machines and deleting unencrypted input history files is necessary to protect sensitive data from unauthorized access.

    For detailed guidance on mitigating these vulnerabilities, organizations should consult Citrix and SAP’s official advisories and consider engaging in regular penetration testing and vulnerability scanning to identify and address security gaps in their infrastructure.

    To read more about this article, click here.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

  • DHS Issues Cybersecurity Alert as Iranian Cyber Actors Target U.S. Networks Following Strikes on Nuclear Sites

    DHS Issues Cybersecurity Alert as Iranian Cyber Actors Target U.S. Networks Following Strikes on Nuclear Sites

    The Department of Homeland Security issued a National Terrorism Advisory Bulletin (NTAS) on June 22, 2025, warning about cyberattack risks related to recent tensions between the US and Iran. This alert follows U.S. airstrikes on June 21, 2025, which targeted key Iranian nuclear facilities, Fordow, Natanz, and Isfahan, under President Donald Trump’s orders, in an attempt to neutralize what he’s called “the nuclear threat posed by the world’s No. 1 state sponsor of terror.”

    The DHS bulletin, set to expire on September 22, 2025, flagged the increased likelihood of low-level cyberattacks against U.S. networks by pro-Iranian hacktivists and potential actions from Iranian government-affiliated actors. “Low-level cyber attacks against U.S. networks by pro-Iranian hacktivists are likely, and cyber actors affiliated with the Iranian government may conduct attacks against U.S. networks,” the alert stated.

    Iran’s Longstanding Cyber Strategy

    The DHS alert emphasized that Iranian-affiliated groups have a long history of targeting poorly secured U.S. networks and internet-connected devices for disruptive cyberattacks, primarily through DDoS attacks. Brian Harrell, former DHS assistant secretary, has also pointed out the increase in Iran’s capabilities. “Iran’s cyber strategy is likely [in] cooperation with Russia, which, given current tensions, could be a real possibility,” Harrell noted, referencing the 2012 Shamoon virus that crippled over 30,000 computers in major energy companies.

    In 2024, Iranian-backed cyber actors breached U.S. water infrastructure in response to Israel’s military actions against Iran. The bulletin warned that similar tactics might be used to retaliate against U.S. airstrikes on Iran’s nuclear sites.

    Growing Use of Social Engineering

    The DHS bulletin also noted Iran’s increasing use of social engineering tactics. Shortly after the U.S. airstrikes, an Iranian hacker group claimed responsibility for a DDoS attack on Trump’s social media platform, Truth Social. This attack, which briefly took the platform offline, followed Trump’s announcement of the strikes on Iran’s nuclear facilities.

    Additionally, Iranian-backed groups have utilized artificial intelligence tools for spreading disinformation, as explained in a previous OpenAI blog. The report detailed how Iranian actors used fake news websites to influence U.S. voters during the 2024 election cycle. Although the campaign failed to gain significant traction, it demonstrated the persistence of Iranian information warfare tactics.

    Risk of Retaliatory Violence

    The DHS alert also addressed the risk of physical violence in the U.S., noting that Iranian supporters and extremist groups might mobilize in response to the ongoing conflict. The alert warned that the threat of hate crimes or attacks against individuals perceived as Jewish, pro-Israel, or linked to the U.S. government or military could increase.

    “The conflict could also motivate violent extremists and hate crime perpetrators seeking to attack targets perceived to be Jewish, pro-Israel or linked to the U.S. government or military in the homeland,” the DHS added.

    Preventative Measures and Public Awareness

    Given the increased risks from Iranian-linked cyber actors, DHS advises U.S. businesses, government agencies, and individuals to follow cybersecurity best practices and stay vigilant. The department recommends employing DDoS mitigation strategies and monitoring for signs of data exfiltration or any unauthorized access attempts. Organizations are encouraged to report suspicious activities to local law enforcement, or the FBI through the National Suspicious Activity Reporting Initiative.

    Comments on Ceasefire Talks

    Meanwhile, on June 24, 2025, President Trump publicly voiced his frustration with the ongoing conflict between Iran and Israel in spite of initiatives to broker a ceasefire. “These guys got to calm down. Ridiculous,” Trump remarked after a missile attack from Iran targeted Israel, escalating tensions. Trump had earlier brokered a ceasefire between the two nations, but the violence continued, with Israel confirming a missile strike that killed four people in Israel.

    The rising tensions between Israel and Iran have already contributed to heightened threat assessments across global security environments. The DHS alert also noted that if Iranian leadership issues a religious ruling calling for retaliatory violence, there could be an increase in extremist actions within the U.S.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • Netizen: Monday Security Brief (6/23/2024)

    Netizen: Monday Security Brief (6/23/2024)

    Today’s Topics:

    • Google Strengthens GenAI Security with Multi-Layered Defenses to Combat Prompt Injection Attacks
    • Scattered Spider Behind Cyberattacks on M&S and Co-op, Causing Up to $592M in Damages
    • How can Netizen help?

    Google Strengthens GenAI Security with Multi-Layered Defenses to Combat Prompt Injection Attacks

    In response to the growing threat of prompt injection attacks, Google has unveiled a series of robust security measures designed to safeguard its generative AI models, particularly Gemini, from evolving exploitation techniques. The latest vulnerabilities—referred to as indirect prompt injections—pose significant risks as malicious actors exploit external data sources, like emails and calendar invites, to manipulate AI systems into performing dangerous or unauthorized actions. These attacks circumvent traditional defense mechanisms by embedding harmful instructions within trusted data sources, tricking the AI into executing them.

    To mitigate these risks, Google has implemented a layered defense strategy aimed at raising the difficulty and cost of launching successful attacks. These defenses include prompt injection content classifiers to filter out harmful instructions, the reinforcement of security through special markers placed in untrusted data, and markdown sanitization to block external malicious URLs. Additionally, the company has introduced a user confirmation framework, requiring approval before risky actions are executed, and integrated end-user notifications to alert users about potential prompt injections.

    Despite these improvements, Google acknowledged that the threat landscape is shifting. Malicious actors are increasingly utilizing adaptive attacks, deploying automated red-teaming tools to circumvent these defenses. The vulnerability underscores the challenges AI models face in distinguishing between legitimate user instructions and manipulative commands embedded within data. According to Google DeepMind, addressing these issues will require continuous advancements in AI system security, incorporating defenses at each layer—from the model’s core understanding to the application and hardware infrastructure.

    Researchers from institutions like ETH Zurich and Carnegie Mellon University, along with Google’s own DeepMind, have highlighted the dangers posed by AI systems vulnerable to prompt injections. These models are capable of generating harmful content, including weapon instructions, phishing schemes, and even polymorphic malware. As AI agents continue to evolve, their ability to unlock new attack vectors for adversaries, such as extracting personally identifiable information (PII) or launching tailored attacks, becomes increasingly alarming.

    The insights gathered from ongoing stress tests and red-teaming benchmarks indicate that while AI models excel at prompt injection attacks, they still struggle with system exploitation and model inversion tasks. However, the efficiency with which AI agents solve challenges compared to human operators emphasizes the transformative potential these systems have in improving security workflows.

    Scattered Spider Behind Cyberattacks on M&S and Co-op, Causing Up to $592M in Damages

    In April 2025, a series of cyberattacks targeted two of the U.K.’s most prominent retailers, Marks & Spencer (M&S) and Co-op, causing significant disruption and financial damage. According to the Cyber Monitoring Centre (CMC), these attacks have been classified as a “single combined cyber event” due to the timing, similar tactics, and a threat actor’s claim of responsibility for both incidents.

    The breach, which has been classified as a “Category 2 systemic event,” is estimated to have cost between £270 million ($363 million) and £440 million ($592 million). The security breach, which focused on IT help desks through advanced social engineering tactics, has caused a deep impact on the two companies and their partners. CMC continues its attribution efforts but strongly suspects the notorious cybercrime group, Scattered Spider (also known as UNC3944), is behind the attacks.

    The group, previously affiliated with The Com, is known for its advanced social engineering techniques, particularly in impersonating IT staff to gain unauthorized access. The consequences of this breach extend beyond M&S and Co-op, with ripple effects for their suppliers, partners, and service providers.

    In addition, Scattered Spider’s attacks are no longer limited to the retail sector. The Google Threat Intelligence Group (GTIG) has recently warned that the group has shifted its focus to U.S. insurance companies, using similar social engineering tactics to target help desks and call centers. This shift in targets highlights the growing concern surrounding Scattered Spider’s evolving strategies and growing impact.

    While Marks & Spencer’s supplier Tata Consultancy Services (TCS) has publicly confirmed that its systems were not compromised in the attack, internal investigations continue to explore the possibility of TCS’s systems being used as a stepping stone for the breach.

    The increase in attacks from groups like Scattered Spider, combined with the shift toward more sophisticated techniques like those seen in Qilin ransomware operations, has prompted heightened alertness across critical industries. These developments underscore the escalating threats posed by cybercriminals targeting high-profile sectors, making it imperative for organizations to reinforce their cybersecurity defenses.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

  • How does MFA (Multi-Factor Authentication) Work?

    How does MFA (Multi-Factor Authentication) Work?

    Multi-Factor Authentication (MFA) has become an essential security measure in protecting sensitive data and ensuring that only authorized individuals gain access to digital assets. While a password alone may have once been sufficient to grant access, it’s no longer enough in today’s increasingly complex cyber threat landscape. MFA introduces an additional layer of protection by requiring users to provide two or more verification factors before accessing their accounts or systems. This article explores how MFA works, why it is so important, and the various methods used to implement it.

    What is Multi-Factor Authentication (MFA)?

    MFA is a security process that requires users to provide multiple forms of verification when logging into an account or system. The idea behind MFA is simple: even if an attacker successfully obtains a user’s password, they would still need additional forms of identification to gain access. These forms of identification are categorized into three primary factors: something you know, something you have, and something you are. Combining these factors makes it exponentially harder for attackers to impersonate legitimate users, adding layers of defense against unauthorized access.

    In today’s world, a single password is no longer enough to secure accounts. Commonly used passwords are vulnerable to attacks such as brute-force cracking, phishing, and credential stuffing. By introducing additional authentication methods, MFA significantly reduces the chances of an attacker bypassing security measures. Whether for personal use or for enterprises handling sensitive data, MFA has become a must-have for securing accounts and protecting information.

    The Three Factors of MFA

    The three factors used in MFA are designed to authenticate users by leveraging different aspects of their identity. The first factor, something you know, refers to knowledge-based authentication, such as a password or PIN. This is the most familiar factor, and it remains a critical piece of the MFA puzzle. However, relying solely on a password is no longer enough due to the frequency with which passwords are compromised.

    The second factor, something you have, involves physical items like a mobile device, hardware token, or smartcard. This factor helps to secure access by ensuring that even if an attacker knows the password, they would still need to possess the physical item used for authentication. For example, if a user has a smartphone with an authentication app, they will need to enter a code generated by the app in addition to their password. This significantly raises the bar for attackers.

    Finally, the third factor, something you are, pertains to biometric authentication, which uses unique characteristics of the user to verify their identity. Examples of biometric authentication include fingerprint scans, facial recognition, and iris scanning. Because these traits are unique to the individual, they are extremely difficult for attackers to replicate, making them an incredibly secure form of authentication.

    How MFA Works: Step-by-Step Process

    MFA works by adding a second or third step in the process of logging into an account or system. Once the user enters their password (the first factor), they will be prompted to provide one or more additional factors. This could be a temporary code sent via SMS, generated by an app, or a biometric scan. Once all factors are successfully verified, the user is granted access.

    For example, a user may enter their username and password as usual. Once this information is verified, they will be prompted to input a one-time passcode (OTP) generated by an authenticator app or sent via SMS. Only after entering the correct passcode is the user allowed to proceed. In some cases, a biometric scan, such as a fingerprint or facial recognition, may also be required. This multi-step process makes it much harder for attackers to impersonate legitimate users, even if they have obtained the user’s password.

    Types of MFA Methods

    MFA can be implemented in a variety of ways, depending on the level of security required and the preferences of the organization or user. One of the most common methods is SMS-based authentication, where a user receives a one-time passcode (OTP) on their phone via text message. Although this method is widely used, it is vulnerable to attacks such as SIM swapping and interception of messages. As such, it is considered less secure than other forms of MFA.

    A more secure method involves the use of authenticator apps like Google Authenticator or Authy. These apps generate time-sensitive codes that are valid for a short period, typically around 30 seconds. Unlike SMS-based authentication, these codes are not susceptible to interception, making them a more reliable option. Authenticator apps can be used across various platforms, from email accounts to online banking systems, providing added flexibility.

    Another popular form of MFA is push notifications. With this method, a user receives a prompt on their mobile device asking them to approve or deny a login attempt. This method is user-friendly and quick, as it does not require the user to manually enter a code. However, it still provides an additional layer of security by confirming that the user is in control of the device.

    For those seeking the highest level of security, hardware tokens are an ideal option. Devices such as YubiKeys generate one-time passcodes or require physical interaction (e.g., tapping the device) to authenticate. These tokens are highly secure because they are not vulnerable to remote attacks and require physical access to the device. This makes them particularly effective for high-risk environments, such as financial institutions or government agencies.

    Why MFA Matters

    In today’s modern landscape, MFA provides critical protection against a wide range of attacks. Phishing, for example, remains one of the most common attack methods used by cybercriminals. With MFA in place, even if an attacker successfully obtains a user’s password through phishing, they would still need to bypass the additional authentication factors to gain access. Similarly, brute-force attacks and credential stuffing are made much more difficult when MFA is used, as attackers would need to obtain multiple factors to successfully authenticate.

    Moreover, MFA plays a key role in regulatory compliance. Many industries, such as healthcare and finance, require organizations to implement MFA to protect sensitive data and meet compliance standards like HIPAA, PCI DSS, and GDPR. By using MFA, organizations can ensure that they are taking the necessary steps to safeguard their data and meet legal requirements.

    Challenges of MFA

    While MFA significantly enhances security, it is not without its challenges. One of the main hurdles is user resistance. Some users may find MFA inconvenient, especially if it requires them to use multiple devices or take extra steps during the login process. This is particularly true for methods that involve entering time-sensitive codes or using hardware tokens, which may seem cumbersome compared to traditional password-based logins.

    Another challenge is implementation costs. While MFA solutions are becoming more affordable, organizations must still invest in the necessary infrastructure to support them. This includes purchasing hardware tokens, implementing software for authenticator apps, or integrating MFA into existing authentication systems.

    Finally, there is the issue of backup methods. Users who lose access to their MFA device—whether through a lost phone or hardware token—may struggle to regain access to their accounts. Organizations need to have effective recovery processes in place to ensure that users can recover their accounts without compromising security.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • EASM vs. Vulnerability Management: Key Differences

    EASM vs. Vulnerability Management: Key Differences

    For years, vulnerability management has been a cornerstone of an organization’s cybersecurity posture. However, despite regular patching and continuous monitoring, vulnerabilities still exist. The reason is often simple: attackers target security gaps that are overlooked or unknown. External Attack Surface Management (EASM) is one of the latest solutions designed to help close these gaps and extend the capabilities of traditional vulnerability management.

    What Is Vulnerability Management?

    Vulnerability management is the process of identifying, assessing, and remediating security flaws within an organization’s IT infrastructure. This process is generally centered around scanning known assets—whether they are physical servers, virtual machines, cloud services, or software applications—for known vulnerabilities. These vulnerabilities are typically cataloged in public databases like CVE (Common Vulnerabilities and Exposures), which helps security teams prioritize the remediation of the most critical flaws.

    Vulnerability management is crucial, as it helps security teams continuously patch and address flaws in software, hardware, and network configurations. However, it is limited by what is already known. If assets aren’t properly documented or if systems slip through the cracks, they become blind spots in the organization’s cybersecurity posture.

    EASM: Extending Beyond Vulnerability Management

    External Attack Surface Management (EASM) goes beyond traditional vulnerability management by identifying risks and exposures that may be hidden from view. EASM tools continuously scan for internet-facing assets, including shadow IT, and provide organizations with visibility into assets that security teams may not even know exist. EASM solutions are designed to be proactive, helping organizations identify external vulnerabilities before they become critical threats.

    While vulnerability management primarily operates within known environments and asset inventories, EASM actively seeks out unknown or mismanaged resources. It doesn’t just scan for vulnerabilities within known systems—it uncovers blind spots by providing a comprehensive view of the external attack surface.

    Key Differences

    • Scope: Vulnerability management focuses on known assets, continuously scanning for recognized threats and vulnerabilities within an established inventory. EASM, on the other hand, takes a broader approach by scanning for all internet-facing assets, including shadow IT and unregistered systems, providing visibility into unknown and unmanaged assets.
    • Continuous Discovery: One of the critical features of EASM is continuous discovery. While vulnerability management tools typically scan on a periodic basis (weekly, monthly, etc.), EASM tools continuously scan environments in real time. This ensures that organizations always have up-to-date information on their external attack surface, even as it changes over time.
    • Visibility of Unmanaged Assets: Traditional vulnerability management relies on what is known and documented, leaving out unmanaged assets or those that are overlooked. EASM, however, identifies assets that may have been forgotten, misclassified, or never registered in the first place. This gives security teams a fuller picture of the organization’s potential risks.
    • Contextual Prioritization: EASM solutions provide contextual prioritization of vulnerabilities based on asset criticality, traffic patterns, and exposure. This means organizations can focus on securing their most sensitive or high-value assets. Vulnerability management tools, on the other hand, tend to prioritize based solely on the severity of known vulnerabilities, without factoring in contextual risk factors like asset exposure.
    • Integration with Other Security Tools: EASM solutions work seamlessly with existing security stacks, including vulnerability management platforms. By feeding new findings into the vulnerability remediation workflow, EASM ensures that previously unrecognized risks are addressed and that security teams are better equipped to handle evolving threats.

    Why EASM Is Necessary

    As organizations continue to expand and move more resources to the cloud, security teams face increasing complexity in managing their attack surface. Many companies today operate in multi-cloud environments, with assets scattered across different cloud providers. In such environments, asset mismanagement or oversight can easily lead to security vulnerabilities. EASM helps mitigate this risk by offering a unified and automated approach to continuous discovery, visibility, and risk identification.

    The increasing prevalence of shadow IT—where employees use unsanctioned cloud services or devices—further compounds the problem. In fact, Gartner reports that shadow IT accounts for 30-40% of IT spending in large organizations, with many employees intentionally bypassing security measures. EASM solutions help detect and mitigate these threats, providing real-time insights and preventing these systems from becoming potential entry points for attackers.

    The Shortcomings of Vulnerability Management

    Vulnerability management is a critical component of an organization’s security posture, but it has inherent limitations. As previously mentioned, vulnerability management operates within the boundaries of a known asset inventory. If an asset isn’t registered or is misclassified, it becomes a blind spot, which is exactly what attackers are looking for. Many organizations rely on internal Configuration Management Databases (CMDBs) to track assets, but human error, process drift, and rapid infrastructure changes can lead to missing or outdated entries.

    This lack of visibility often leads to gaps in security, where systems are left unpatched, orphaned, and vulnerable. A known vulnerability could be left unaddressed simply because the system was not included in the asset inventory.

    How EASM Fills the Gaps

    EASM provides a more complete view of an organization’s attack surface, helping to identify the assets that may have slipped through the cracks. Some of the key features of EASM include:

    • Continuous Discovery: EASM tools continuously monitor and map out the organization’s entire internet-facing infrastructure, ensuring no asset is left unseen.
    • Real-Time Alerts: As soon as a vulnerability is identified, EASM tools send alerts to security teams, ensuring immediate action can be taken.
    • Simulated Attack Scenarios: EASM solutions simulate real-world attack scenarios to uncover potential risks and expose assets that may be vulnerable to exploitation.
    • External Validation: EASM solutions validate which discovered assets are actually vulnerable by simulating attacker reconnaissance. This helps security teams to better prioritize remediation efforts.

    Five Key Use Cases for EASM

    • Continuous Monitoring: Unlike periodic penetration tests, which are resource-intensive and disruptive, EASM tools automatically scan continuously, giving security teams constant visibility.
    • Asset Reconciliation: EASM solutions can reconcile CMDBs and IT asset inventories by discovering assets that are missed or misclassified in traditional systems, creating a comprehensive view of the environment.
    • Prioritizing Critical Assets: By analyzing asset exposure and risk, EASM helps security teams focus on high-value or critical assets that are most at risk.
    • Closing the Loop on Vulnerability Management: By integrating with vulnerability management systems, EASM ensures that newly discovered vulnerabilities are added to the remediation process, closing the loop on security efforts.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • What is Cloud Security Posture Management (CSPM) and Why is it Necessary?

    What is Cloud Security Posture Management (CSPM) and Why is it Necessary?

    Cloud Security Posture Management (CSPM) is an automated software tool designed to scan cloud deployments for security misconfigurations, potential vulnerabilities, and compliance violations that can lead to data breaches. It acts as a security system inspector, scanning a cloud infrastructure—whether it is Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS), Infrastructure-as-a-Service (IaaS), containers, or serverless systems—for weaknesses and risks. CSPM tools provide organizations with a comprehensive view of their cloud security, helping to identify and address security gaps that can result in exposure or unauthorized access.

    Why CSPM is Necessary

    The cloud offers numerous advantages but also introduces new risks, especially due to its direct connection to the internet, making cloud infrastructure vulnerable to a broad range of threats. Unlike traditional networks, cloud infrastructure is often complex and distributed across various services and remote data centers. This complexity makes it difficult for organizations to ensure security, especially when certain components of the cloud service, like security configurations, are not directly managed by the service provider.

    CSPM tools are built to address these challenges by automating the process of identifying and managing security misconfigurations, reducing the manual effort involved in securing cloud deployments.

    How CSPM Works

    CSPM tools continuously scan cloud environments, searching for misconfigurations, compliance violations, and vulnerabilities. They provide real-time alerts and generate reports detailing security risks, enabling security teams to take immediate action. The system also maps an organization’s entire cloud infrastructure to expose previously unknown risks. CSPM solutions help teams stay on top of security issues, offering a clear overview of the cloud ecosystem to prevent exposure and unauthorized access.

    What is a Cloud Security Misconfiguration?

    A cloud security misconfiguration refers to an error or flaw in the configuration of cloud services that leaves data exposed or vulnerable to attack. Misconfigurations often occur during the initial setup phase of cloud services. For example, leaving an AWS S3 storage bucket publicly accessible can lead to significant data breaches. CSPM tools automatically detect such issues and help organizations fix them before they become a serious problem.

    How CSPM Helps with Regulatory Compliance

    CSPM tools also assist with regulatory compliance, which is increasingly important for organizations operating in industries like healthcare, finance, and retail. Many regulations, such as HIPAA, GDPR, and the CCPA, require organizations to ensure that sensitive data is properly protected and access to it is strictly controlled. CSPM tools automatically detect potential compliance violations—such as excessive access rights or missing encryption—and alert organizations to take corrective action.

    By automating compliance checks, CSPM reduces the burden on security teams and helps ensure that the organization remains in compliance with industry regulations.

    How CSPM Provides Visibility of Cloud Infrastructure

    As organizations expand their cloud environments, visibility becomes a major challenge. Assets may be misconfigured or left unsecured during migration between cloud providers, and shadow IT (unauthorized use of cloud services by employees) may further complicate visibility. CSPM tools provide a centralized view of all cloud assets, ensuring that security teams can monitor the entire infrastructure effectively. They also help ensure that teams don’t lose track of critical assets, preventing potential security gaps in the organization’s attack surface.

    Other CSPM Capabilities

    In addition to misconfiguration detection, many CSPM solutions offer other essential capabilities:

    • Vulnerability identification: Identifying flaws in cloud software that could be exploited by attackers.
    • Incident response: Some CSPM tools can fix issues automatically or provide remediation steps for security teams.

    As cloud security continues to evolve, CSPM remains a crucial component of any cloud security strategy, enabling organizations to maintain a strong security posture in complex, dynamic environments.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • CISA Alerts to Active Exploitation of TP-Link Router Vulnerability CVE-2023-33538

    CISA Alerts to Active Exploitation of TP-Link Router Vulnerability CVE-2023-33538

    A high-severity security vulnerability in TP-Link routers, tracked as CVE-2023-33538, has been added to the CISA Known Exploited Vulnerabilities catalog following reports of active exploitation. This vulnerability, with a CVSS score of 8.8, enables attackers to execute arbitrary system commands on affected devices, particularly on models like TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2.

    Details of the Vulnerability

    The flaw exists within the /userRpm/WlanNetworkRpm component, which processes the ssid1 parameter in specially crafted HTTP GET requests. Attackers exploiting this command injection vulnerability can manipulate the routers, potentially gaining unauthorized access, modifying system configurations, and disrupting services.

    Security Risks and Potential Exploits

    Exploiting this flaw allows attackers to gain administrative control over vulnerable routers, leading to a wide range of malicious activities, including botnet attacks and data exfiltration. The widespread use of TP-Link routers in home and small-business environments significantly amplifies the potential impact of this vulnerability, especially as attackers could use compromised routers to launch additional attacks or access sensitive information.

    Impact on End-of-Life Devices

    CISA has warned that many of the affected TP-Link products may be end-of-life (EoL) or end-of-service (EoS), meaning they no longer receive official support or security updates. This significantly increases the risk of exploitation for these devices, as they may not be patched or secured. Users are urged to either disconnect vulnerable devices from their networks or apply mitigations if still supported.

    Link to Prior Threat Activity

    Though specific exploit details remain sparse, Palo Alto Networks’ Unit 42 previously identified a connection between the vulnerable TP-Link routers and the FrostyGoop malware (aka BUSTLEBERM), which was used in an OT-centric attack. This malware was reportedly used to access control devices via the affected TP-Link router. While no conclusive evidence links this malware to CVE-2023-33538, the potential risk remains high.

    CISA’s Mandate and Recommended Actions

    CISA has mandated remediation by July 7, 2025 for federal agencies and strongly recommends that all organizations, especially those in critical sectors, apply available patches or disconnect affected devices from their networks immediately. Given the high risk of exploitation, prompt action is necessary to prevent unauthorized access and protect sensitive infrastructure from compromise.

    New Exploitation Attempts Targeting Zyxel Firewalls (CVE-2023-28771)

    In addition to the TP-Link flaw, GreyNoise reports ongoing exploit attempts targeting CVE-2023-28771, a critical vulnerability in Zyxel firewalls (CVSS: 9.8). The vulnerability, an OS command injection flaw, allows unauthenticated attackers to execute commands on vulnerable devices. This critical bug has been linked to an uptick in DDoS botnet creation, particularly using Mirai botnet variants. Although Zyxel released a patch in April 2023, GreyNoise has observed increased exploitation activity as recently as June 16, 2025.

    The attacks, which have targeted 244 unique IP addresses across the United States, United Kingdom, Spain, Germany, and India, are part of a large-scale effort to exploit the flaw in order to add devices to botnets for launching distributed denial-of-service (DDoS) attacks. The exploitation of this vulnerability involves sending crafted requests to vulnerable devices, allowing attackers to gain control and use the devices for further malicious actions. It is likely that the attackers are building large-scale botnets to conduct high-volume DDoS attacks on targeted websites or infrastructure.

    The Mirai botnet is notorious for its ability to rapidly escalate attacks, and its connection to CVE-2023-28771 could make these efforts even more potent. The fact that 244 unique IP addresses have been used for such attacks within a short timeframe is indicative of the significant threat posed by this vulnerability, underscoring the need for immediate mitigation.

    In response to these ongoing threats, users of Zyxel devices are strongly encouraged to update to the latest firmware, which patches CVE-2023-28771, and to monitor for any anomalous activity that might indicate a compromise. Furthermore, users are advised to limit exposure of vulnerable devices and employ network-level defenses, such as firewalls and intrusion detection systems, to reduce the risk of attack. Organizations should also consider implementing two-factor authentication (2FA) and segmenting networks to prevent lateral movement in the event of a breach.

    Cybersecurity experts continue to warn of the dangers of exposed devices and the rapid evolution of botnet threats. With botnet attacks increasing in scale and sophistication, these types of vulnerabilities pose a grave risk to businesses, individuals, and government networks alike.

    By applying the recommended patches and ensuring their devices are secured, organizations can mitigate the risk of exploitation and help protect their infrastructure from becoming part of a larger malicious network.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • Netizen: Monday Security Brief (6/16/2024)

    Netizen: Monday Security Brief (6/16/2024)

    Today’s Topics:

    • Over 46,000 Vulnerable Grafana Instances Still Awaiting Critical Patch
    • Anubis Ransomware Adds Destructive Wiper to Files, Making Recovery Impossible
    • How can Netizen help?

    Over 46,000 Vulnerable Grafana Instances Still Awaiting Critical Patch

    A critical security vulnerability has been identified in Grafana, a widely used open-source platform for monitoring and visualizing infrastructure and application metrics. The flaw, tracked as CVE-2025-4123, poses a significant risk to over 46,000 Grafana instances that remain exposed to account takeover attacks. Despite a security patch being released in May 2025, a substantial number of vulnerable instances have not yet been updated, leaving these systems at risk of malicious exploitation.

    The vulnerability stems from a client-side open redirect issue within Grafana, which allows attackers to execute malicious plugins via manipulated URLs. Discovered by security researcher Alvaro Balada, the flaw enables attackers to leverage path traversal and open redirect techniques to load malicious plugins from a site under their control. When users click on specially crafted links, the exploit can trigger arbitrary JavaScript execution within the user’s browser.

    This type of attack is particularly dangerous because it does not require elevated privileges or even authentication. Once exploited, attackers can hijack active user sessions, change account credentials, and, in some cases, carry out server-side request forgery (SSRF) attacks that allow unauthorized access to internal resources. Additionally, the vulnerability can be used to modify user email addresses, facilitating further account hijacking via password resets.

    The flaw affects Grafana instances running versions prior to the fixed releases, and the attack requires user interaction — the victim must click on a malicious link while logged into Grafana. This makes the attack dependent on phishing or social engineering tactics to get users to click on the malicious link.

    The security firm OX Security, which conducted an in-depth analysis of the vulnerability, found that more than 46,000 instances of Grafana remain exposed to this critical bug. The researchers estimate that approximately 36% of all internet-facing Grafana instances are still vulnerable. This widespread exposure highlights the scale of the problem and the urgent need for administrators to update their systems.

    Grafana’s vulnerability is concerning because the exploit does not rely on sophisticated hacking techniques. Instead, attackers can exploit inconsistencies in the way Grafana handles URLs, bypassing modern browser security mechanisms. The default Content Security Policy (CSP) in Grafana provides some protection but is not enough to prevent exploitation due to limitations in client-side enforcement.

    If left unpatched, CVE-2025-4123 could lead to severe consequences for organizations relying on Grafana for data monitoring. Account takeover is a major risk, as attackers can hijack user sessions and modify account details, which could lead to data loss, unauthorized access to sensitive information, and even service disruptions. The vulnerability also exposes Grafana instances to SSRF attacks, which could allow attackers to interact with internal systems and bypass network security controls.

    Given the widespread nature of Grafana’s use in enterprise and cloud environments, the consequences of this vulnerability could be far-reaching. Attackers could exploit this flaw to target high-value data sources, internal networks, or even disrupt critical business operations.

    To mitigate the risks posed by this vulnerability, it is crucial for Grafana administrators to upgrade to the latest patched versions. Grafana Labs released the following security updates on May 21, 2025:

    • Grafana 10.4.18+security-01
    • Grafana 11.2.9+security-01
    • Grafana 11.3.6+security-01
    • Grafana 11.4.4+security-01
    • Grafana 11.5.4+security-01
    • Grafana 11.6.1+security-01
    • Grafana 12.0.0+security-01

    These updates address the critical flaw and provide the necessary patches to secure vulnerable systems. In addition to applying the patch, administrators are advised to review their system configurations to ensure that client-side vulnerabilities like this one are mitigated and that security best practices are in place.

    Grafana users who have not yet updated their systems should prioritize patching as soon as possible to avoid falling victim to this exploit. It is also recommended to monitor Grafana instances for suspicious activity and consider implementing additional security measures such as two-factor authentication (2FA) and user access controls to further reduce the risk of exploitation.

    Anubis Ransomware Adds Destructive Wiper to Files, Making Recovery Impossible

    In a new development, Anubis ransomware has added a dangerous feature to its file-encrypting malware: a wiper module designed to permanently destroy files, making recovery impossible even if the ransom is paid. First observed in December 2024, Anubis ransomware has quickly gained traction, with the ransomware-as-a-service (RaaS) group offering an affiliate program that gives a significant cut to its partners.

    The wiper module, which is activated using a command-line parameter (‘/WIPEMODE’), erases the contents of files, reducing them to 0 KB while keeping their names and file structure intact. This means that while the files remain visible in the directory, their contents are irreversibly destroyed. This addition is believed to increase pressure on victims to pay the ransom quickly, as recovery efforts are effectively thwarted.

    Anubis is known for its sophistication, including the use of ECIES (Elliptic Curve Integrated Encryption Scheme) encryption, which appends the ‘.anubis’ extension to encrypted files. Although the system uses certain precautions to avoid making the system completely unusable, the ransomware removes volume shadow copies and terminates processes that could interfere with the encryption.

    The added wiper feature is expected to escalate the already destructive nature of the attacks, making the consequences of a breach even more devastating for victims.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

  • What is the IoMT and How is it Secured?

    What is the IoMT and How is it Secured?

    The Internet of Medical Things (IoMT) represents a growing network of medical devices and applications connected to healthcare information systems via online networks. With the help of wireless connectivity and data transmission technologies, IoMT devices make it possible for healthcare providers to collect and analyze real-time patient data remotely. As a result, IoMT offers a broad range of benefits such as remote patient monitoring, telemedicine, and more personalized treatment options.

    In this article, we’ll take a deeper dive into what IoMT is, its applications, and how its security is managed to ensure the safety of patient data.

    What is the IoMT?

    The Internet of Medical Things (IoMT) refers to the network of connected medical devices and applications that transmit patient data to healthcare providers through online platforms. These devices communicate with each other, exchanging vital information in real time. From wearable devices that track a patient’s health metrics to advanced equipment used in hospitals and clinics, IoMT devices are revolutionizing the healthcare industry.

    Examples of IoMT Devices

    Some examples of IoMT include:

    • Remote Patient Monitoring (RPM): Devices used to monitor individuals with chronic illnesses, such as heart disease or diabetes, from their home.
    • Wearable Mobile Health Devices: Fitness trackers and medical-grade wearables that track vital signs like heart rate, blood pressure, or glucose levels.
    • Telemedicine Solutions: Devices enabling virtual consultations, eliminating the need for patients to visit healthcare facilities.
    • Emergency Devices: Mobile health apps or alert systems that notify emergency services during a medical crisis.

    These devices often link to cloud platforms where healthcare providers can analyze collected data and track a patient’s progress. Additionally, IoMT helps improve healthcare delivery by enabling faster decision-making, enhancing patient outcomes, and lowering the costs of healthcare services.

    How Does IoMT Affect Healthcare?

    IoMT plays a critical role in transforming the healthcare landscape. It enables faster data collection, improves access to care, and leads to better patient outcomes. Some of the significant benefits of IoMT include:

    • Increased Data Availability: With devices connected to cloud platforms, healthcare providers have access to real-time patient data. This continuous flow of information improves decision-making and allows doctors to take quicker action, especially in emergency situations.
    • Remote Healthcare: During the COVID-19 pandemic, remote healthcare services through IoMT, including telemedicine, gained immense popularity. This allowed patients to receive care without visiting hospitals, easing the burden on healthcare facilities and improving patient access to medical services.
    • Cost Reduction: IoMT helps reduce the need for in-person visits to healthcare providers, saving both patients and healthcare institutions money. Telehealth services, for example, allow for virtual consultations, eliminating transportation costs and reducing time spent in waiting rooms.
    • Improved Patient Experience: IoMT devices provide patients with access to their health data at any time, enabling them to track their health and take more control of their medical journey. Consumer-grade wearables like smartwatches provide users with ongoing health insights, and medical-grade wearables allow doctors to monitor patients remotely, ensuring better care.

    What Are the Challenges of IoMT?

    While IoMT offers numerous advantages, it also introduces a series of challenges that must be addressed to ensure its success. Some of the key challenges include:

    1. Security Risks

    The main concern surrounding IoMT is the security of sensitive health data. Because IoMT devices collect and transmit patient data over the internet, they are vulnerable to cyberattacks. Potential risks include data breaches, hacking, and ransomware attacks, which could compromise the privacy of individuals’ health information. With stricter regulations surrounding health data (like HIPAA in the U.S.), ensuring compliance is a significant challenge.

    2. Interoperability

    Many IoMT devices and systems operate on different platforms and standards, which can lead to challenges in ensuring that they work together seamlessly. Healthcare organizations need to ensure that devices are interoperable with existing systems, such as electronic health records (EHRs) and hospital information systems (HIS), to optimize care delivery.

    3. Data Ownership

    Who owns the data collected by IoMT devices is often unclear. The patient, the healthcare provider, and even the device manufacturer could all have rights to the data. Clear data ownership policies need to be in place to prevent disputes and ensure the protection of patient privacy.

    4. User Experience

    Another challenge is ensuring that IoMT devices are user-friendly. Poor design or user interfaces could lead to mistakes, resulting in incorrect data collection or inadequate care. To prevent these issues, IoMT devices must be easy to use and ensure accurate data collection.

    How is IoMT Secured?

    Securing IoMT devices is crucial to maintaining the privacy and integrity of sensitive patient data. There are several key practices used to secure IoMT devices:

    1. Encryption

    Encryption is essential for securing data that is transmitted between IoMT devices and healthcare providers. Encryption protocols such as SSL/TLS ensure that data sent over the internet is unreadable to unauthorized parties. Additionally, encryption is used to protect data stored on devices, ensuring that even if a device is compromised, sensitive data cannot be accessed without the proper decryption key.

    2. Authentication and Access Control

    IoMT devices should require strong authentication mechanisms to ensure only authorized users can access the system. This includes using multi-factor authentication (MFA) and biometric verification. Access controls are also essential in limiting which individuals or devices can access specific types of data, ensuring that users only access the information relevant to them.

    3. Regular Software Updates

    Regular software updates are vital for addressing newly discovered vulnerabilities in IoMT devices. Device manufacturers should provide frequent security patches to address any bugs or weaknesses. Healthcare providers also need to stay vigilant in applying these updates to ensure devices remain secure against evolving threats.

    4. Network Segmentation

    Network segmentation helps isolate IoMT devices from other systems in a healthcare environment. By segmenting the network, healthcare organizations can limit the scope of a potential attack. For example, if a vulnerability in an IoMT device is exploited, attackers would not be able to easily access sensitive systems like EHRs or hospital management systems.

    5. Compliance with Standards

    IoMT devices must comply with industry standards and regulations such as HIPAA in the U.S. or the EU’s GDPR. These regulations require that healthcare organizations implement stringent security measures to protect patient data and ensure that IoMT devices meet specific privacy and security standards.

    Types of IoMT Devices

    There are several categories of IoMT devices, depending on their environment and usage:

    • In-home IoMT: Devices used in a patient’s home, such as personal emergency response systems or RPM devices.
    • Wearable IoMT: Devices worn on the body, including fitness trackers and medical-grade wearables that track health metrics like heart rate and blood pressure.
    • Mobile IoMT: Devices that integrate with smartphones, such as networked glucose monitors or mobile health apps.
    • Public IoMT: Devices placed in public spaces, such as point-of-care kiosks and medical vending machines.
    • In-hospital IoMT: Devices used within hospitals, including infusion pumps and patient tracking systems.

    The Future of IoMT

    The IoMT market is expected to continue growing as the demand for remote healthcare and patient monitoring increases. The integration of 5G networks and AI technologies will further enhance the capabilities of IoMT devices, allowing for faster data transfer, more accurate diagnoses, and improved predictive healthcare.

    The future of IoMT holds great promise for improving healthcare outcomes, but ensuring that these devices remain secure will be crucial in protecting patient data and maintaining trust in this evolving field.

    Conclusion

    The Internet of Medical Things (IoMT) is reshaping healthcare by connecting devices and enabling real-time data sharing. While it offers numerous advantages, including improved patient care, accessibility, and cost control, it also brings significant challenges related to security, interoperability, and data ownership. By implementing best practices such as encryption, strong authentication, and regular updates, healthcare organizations can secure IoMT devices and ensure that they continue to enhance patient care without compromising security.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • How to Create a Strong Password in 2025

    How to Create a Strong Password in 2025

    A strong password remains one of the most fundamental and effective methods of protecting your online accounts from unauthorized access. While the transition toward a passwordless future is gaining momentum, the reality is that passwords continue to play a crucial role in safeguarding sensitive data. Cybercriminals often exploit weak passwords via brute-force attacks, credential stuffing, or by leveraging predictable patterns and personal information. Understanding the core principles of creating a strong password is essential to improving your security posture.

    Defining a Strong Password

    A strong password is one that resists common attack vectors such as brute-force or dictionary attacks. To achieve this, it must be sufficiently long (ideally at least 14 characters) and include a combination of uppercase and lowercase letters, digits, and special symbols. Avoid using easily guessable information such as personal names, birthdates, or dictionary words. To enhance the security of passwords at rest, organizations implement salting. This technique involves appending or prepending a random string of characters (a salt) to the password before hashing. Even if two users have the same password, their salted hashes will differ, thwarting attackers who attempt to exploit common password hashes across systems.

    Best Practices for Crafting Strong Passwords

    Randomly Generated Passwords

    Generating a password composed of random characters, including uppercase and lowercase letters, numbers, and symbols, significantly mitigates the risks associated with common password-guessing techniques. This randomness makes it virtually impossible for attackers to successfully crack the password within a reasonable timeframe.

    Passphrases

    Using a passphrase, comprising several random words strung together, strikes a balance between memorability and security. To maximize strength, passphrases should avoid common sayings, quotes, or related words. The power of a passphrase lies in its length and unpredictability, which makes it much harder to guess than a standard password.

    Password Generators

    For those who find it cumbersome to create complex passwords manually, password generators are an excellent alternative. These tools can create highly secure, random passwords that meet or exceed best practice security standards. When combined with a password manager, these passwords can be securely stored and easily retrieved, eliminating the need to memorize multiple credentials.

    The Role of Password Managers

    Password managers are indispensable in maintaining security hygiene. They automate the generation and storage of unique, complex passwords for each of your online accounts. By reducing the risk of password reuse across different platforms, password managers limit the surface area for attacks. Furthermore, password managers store these credentials in an encrypted vault, using strong encryption algorithms to safeguard sensitive data. Some password managers also support two-factor authentication (2FA), enhancing security by requiring an additional layer of verification for account access.

    Additionally, password managers often include features such as autofill capabilities, allowing users to seamlessly log in to websites without the need to manually input credentials. This convenience comes with the added benefit of minimizing human error, reducing the likelihood of exposing passwords through insecure practices such as writing them down or storing them in plaintext.

    Exploring Alternative Authentication Methods

    For an added layer of security, organizations and users are increasingly adopting alternative authentication methods, such as biometric authentication (e.g., fingerprint or facial recognition) and passkeys. These methods offer a more secure and user-friendly approach by eliminating the need for traditional passwords. Biometric authentication, being inherently tied to the individual, makes it significantly more difficult for attackers to bypass. Passkeys, built on cryptographic standards like FIDO2, provide a seamless, password-free authentication experience that is resistant to phishing and credential stuffing attacks.

    Conclusion

    A strong password is the first line of defense against unauthorized access to sensitive information. To ensure password strength, it is critical to employ best practices such as creating long, complex, and unique passwords that combine a mix of character types. The use of salting and hashing protects passwords in storage, while password managers offer an efficient, secure way to manage multiple passwords. To further enhance security, adopting alternative authentication methods like biometrics or passkeys can offer a more robust, passwordless future. By implementing these strategies, you can significantly reduce the risk of account compromise and bolster your overall cybersecurity posture.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact