Archive for June 10, 2025

« Older Entries

FIN6 Hackers Impersonate Job Seekers to Phish Recruiters

Posted in Commentary with tags on June 10, 2025 by itnerd

Researchers have uncovered a novel twist to employment scams in which hackers, in this case FIN6 (aka “Skeleton Spider”), impersonate job seekers with fake resumes to lure recruiters rather than posing as recruiters to lure job applicants.

By posing as job seekers and initiating conversations through platforms like LinkedIn and Indeed, the group builds rapport with recruiters before delivering phishing messages that lead to malware. More details can be found here:

 https://dti.domaintools.com/Skeleton-Spider-Trusted-Cloud-Malware-Delivery/

Erich Kron, security awareness advocate at KnowBe4, commented:

“This is an interesting twist to the common recruiting scam and is especially dangerous because the attackers take time to build a rapport with the recruiter before springing the trap. It’s wise to be suspicious of email or text messages that are unsolicited or unexpected, but in this case, the recruiters do expect to receive correspondence and documents, and the back-and-forth conversation builds the trust the attackers need to execute the malware.

“In any organization, there are going to be departments that deal with outside communications, and these departments should be trained and educated about how to handle potentially dangerous attachments or links. It’s also good to remind employees not to let their guard down as they get comfortable in a conversation.”

Threat actors are getting more and more crafty. That means you have to get more and more suspicious of anything and everything that hits your inbox to avoid something really bad happening to you.

Leave a comment »

OVHcloud confirms its ambitions in quantum computing with the first QPU-As-A-Service available in September 2025

Posted in Commentary with tags on June 10, 2025 by itnerd

At France Quantum, an annual event dedicated to the quantum computing ecosystem, OVHcloud announces that it has been awarded the AQUILA call for expressions of interest, which aims to stimulate the emergence of a French ecosystem of users and developers for high-impact quantum computing solutions.

The Group confirms its roadmap with the availability of two new emulators: Qleo from Quobly and Mimiq from Qperfect. Eight quantum emulators are now available on OVHcloud’s infrastructure.

From September 2025, the Group will deploy the Pasqal Orion Beta QPU, with a capacity of 100 Qubits (neutral atoms) available for users. This offer, usable in QaaS (Quantum As A Service) mode, will pave the way for other quantum computers. OVHcloud’s Quantum Cloud platform aims to provide access, as they become available, to real quantum computers in addition to emulators. By the end of 2025, three QPUs are expected to be available, and by the end of 2027, at least 8 QPUs, including 7 European ones, will be offered to QaaS customers in a pay-as-you-go model.

OVHcloud also confirms the upcoming deployment of security certificates whose purpose is to encrypt the connection between a computer and a website. These SSL certificates will benefit from quantum entropy, significantly enhancing security. Finally, the Group’s research and development department is already working on post-quantum cryptography (PQC) to improve resistance to quantum attacks, following recommendations from ANSSI, the French Cybersecurity Agency, as well as working on QKD.

OVHcloud is a true driver for the creation of a quantum ecosystem at a European level and is a major player in democratizing access to quantum computing. The Group is supporting 17 quantum startups through its Startup Program and provides various resources and support to them. OVHcloud has acquired a photonic quantum computer, MosaiQ, from Quandela that is being used by its research and development department and is available to students as part of a close collaboration with the academic world.

Leave a comment »

GuidePoint Security Launches New Incident Response Maturity Assessment

Posted in Commentary with tags on June 10, 2025 by itnerd

GuidePoint Security, a cybersecurity solutions leader enabling organizations to make smarter decisions and minimize risk, announced today the launch of its new Incident Response Maturity Assessment (IRMA), designed to help organizations evaluate, strengthen and mature their cybersecurity incident response capabilities.

As digital threats continue to grow in complexity and frequency, many organizations are struggling to build and maintain effective incident response programs, leaving them vulnerable to cyber attacks and regulatory risk. GuidePoint’s IRMA offering addresses these challenges head-on by providing a comprehensive, tailored assessment that benchmarks current incident response capabilities against industry standards,  provides actionable recommendations for improvement and sets an actionable roadmap for future development.

As digital threats continue to grow in complexity and frequency, many organizations are struggling to build and maintain effective incident response programs, leaving them vulnerable to cyber attacks and regulatory risk. GuidePoint’s IRMA offering addresses these challenges head-on by providing a comprehensive, tailored assessment that benchmarks current incident response capabilities against industry standards,  provides actionable recommendations for improvement and sets an actionable roadmap for future development.

“Too often, organizations don’t realize their response processes are fragmented, outdated, or insufficient until they’re in the middle of a serious incident,” said Mark Lance, Vice President, DFIR and Threat Intelligence at GuidePoint Security. “IRMA gives security teams a clear view of their posture, along with practical steps to build a more mature, effective and resilient response program over time.”


GuidePoint Security’s new IRMA offering includes: 

  • Risk Evaluation: Assess your organization’s inherent risk and align it with your unique incident response capabilities. 
  • Control Domain Assessment: Evaluate incident response across six critical lifecycle phases—preparation, detection, containment, eradication, recovery and post-incident activity. 
  • Maturity Evaluation: Analyze your current maturity level and define a clear, measurable path to a stronger future state.
  • Custom Reporting: Receive a detailed report highlighting strengths, weaknesses, and actionable recommendations—prioritized to address the most pressing risks and capability gaps.
  • Debrief and Recommendations: Participate in a post-assessment debrief to review findings and define next steps.

Unlike generic security assessments, IRMA is specifically designed for incident response and uses a custom control framework built around industry standard sources like NIST and SANS. The offering also evaluates both the strategic and operational aspects of response programs for a holistic evaluation—ensuring a thorough, accurate assessment that touches on policies, tools, team readiness and real-world application.

For more information on the new Incident Response Maturity Assessment:

Leave a comment »

Guest Post: Office Vulnerabilities Raise Quiet Alarm

Posted in Commentary with tags on June 10, 2025 by itnerd

By: Tyler Reguly, Associate Director, Security R&D, Fortra

Boring. That’s the first word that came to mind when I saw the June patch drop. It’s a relatively small one with just 66 CVEs and nothing jumps when you look at the release notes. With only one vulnerability listed as Exploit Detected and only one CVSS Base Score above 9.0, it feels like a quiet month… but sometimes quiet months can be quite scary.

When you dig in deeper, you find that Microsoft has labelled 10 of these vulnerabilities as Critical using their severity system. A couple of those are remote but require large numbers of messages or winning a race condition and Microsoft has indicated we’re less likely to see an exploit for these.

The scary part of our quiet Patch Tuesday is a set of 4 vulnerabilities impacting Office. These vulnerabilities (CVE-2025-47167, CVE-2025-47164, CVE-2025-47162, and CVE-2025-47953) are one of the most concerning aspects of this month’s patch drop. The patches for Microsoft 365 for Office are not currently available and the preview pane is an attack vector. It is always important to take note of Microsoft’s Preview Pane FAQ entry as that is likely to indicate that the vulnerability can be exploited without user interaction, simply by receiving an email. Additionally, 3 of the 4 were listed as Exploitation More Likely in Microsoft’s exploitability assessment.

The other items worth discussing this month are the single vulnerability that has been seen in active exploitation, CVE-2025-33053, and the single CVSS Critical, CVE-2025-47966.

With our actively exploited vulnerability, users need to click on a link or visit a malicious website in order to visit the malicious WebDAV server. Given the active exploitation of this vulnerability, this is the update that should be prioritized this month. It is important to note that there may be multiple updates to install on older versions of Windows.

As for that Critical CVSS vulnerability, the CVE was released as part of Microsoft’s efforts towards transparency with cloud vulnerabilities. In this case, there’s nothing for Microsoft users to do except be aware that it exists.

With any luck, the lower CVE counts the past few months have relieved security teams of a bit of the patch fatigue they are likely accustomed to feeling. This could be a good month for a CSO to ride along with their IT team to see what they deal with when Microsoft patches are released. Sometimes, it is easier to forget what individual contributors are dealing with month over month and seeing it first hand, especially at a time when the pressure is reduced a little, can be a great way to identify process or tooling improvements that could really benefit your security team.

Leave a comment »

#PSA: Apple Plans To Kill Time Capsule Support In macOS

Posted in Commentary with tags on June 10, 2025 by itnerd

I have to admit that the Apple Time Capsule was brilliant as when used with Apple’s Time Machine backup utility, it gave users a very easy way to back up their Macs. However, Apple killed the Time Machine product in 2018. After that Apple very recently deprecated the venerable Apple Filing Protocol that Time Machine relied upon. Though it was still present in macOS. Now it seems the final nail in Time Capsule support has been driven in based on this:

So the way that I interpret this, whatever major version of macOS that ships after Tahoe will not support Time Capsule or any other backup solution that supports either Apple Filing Protocol or Server Message Block version 1. Likely because Apple is removing support for both in macOS. That may be a problem for some users who still rely on these solutions for backup as the path forward is to move towards using a Network Attached Storage device or NAS from a brand like Synology or QNAP that supports Server Message Block version 2 or 3. Ideally version 3 as that is way more secure that version 2.

Here’s the first problem with this. Since migration from a Time Capsule to a NAS isn’t exactly an straightforward process for the average user, many users may have to abandon their backups on their Time Capsules and start fresh on a NAS.

That’s not going to be cool for some.

Another thing to consider is that Apple broke Time Machine in macOS Sequoia and as I type this still hasn’t fixed it completely. So that’s a bigger problem for users of Time Machine might have to deal with if Apple hasn’t addressed this by the time they kill Apple Filing Protocol. Though in theory, they have a year to get that sorted.

Now in farness, Apple has dropped a ton of hints about this scenario over the years. But the thing is the only people who listen to those hints are people who are deeply in the tech space like I am. Or people who read sites like this one. Those people would have migrated off Time Capsule devices, or if you use a NAS like I do, turned off Apple Filing Protocol support and moved to Server Message Block version 3 ages ago. However Joe Average user is going to be shocked when they hear about this and won’t know how next to proceed. Thus someone like me will get a phone call, or these people will visit their local Apple Store hoping that someone can answer their question. Thus the next year or two might be very interesting for Apple as they navigate this.

Leave a comment »

If You’re An Apple Developer, You Should Know That Two Years From Now Will Be The End Of Rosetta 2 Support

Posted in Commentary with tags on June 10, 2025 by itnerd

When Apple Silicon launched in 2020, Apple included a way for Intel apps to still work on Apple Silicon. That was was Rosetta 2. And it was a godsend for developers as they could take their time to make their apps compatible with Apple Silicon. However the side effect of that is that some developers didn’t make their apps compatible for whatever reason. Instead they relied on Rosetta to allow their apps to work.

Well, those developers may have to get their butts into gear to change that. I say that because Apple announced via their Platforms State of the Union that developers have until macOS 28 to get their apps running natively on Apple Silicon. That’s a two year deadline. And to be frank, I am surprised that this deadline is that long. Apple Silicon has been a runaway success for Apple. Thus I expected Apple to try and kill off Intel support as early as next year. But I guess they must be concerned that there would be backlash from this. Regardless, this combined with this announcement that macOS Tahoe won’t support Intel Macs at all means that the end is near for Intel Macs.

Leave a comment »

BREAKING: ChatGPT Is Having Issues

Posted in Commentary with tags on June 10, 2025 by itnerd

Down Detector is reporting that Open AI’s ChatGPT has issues:

Going to the Open AI status page shows that there are elevated error rates. But according to Open AI things are recovering. How long it takes before things are normal again is anyone’s guess. But if you rely on ChatGPT, you should expect to have problems today.

Leave a comment »

While You May Want To Install The Latest Apple Betas, You Shouldn’t Do That

Posted in Commentary with tags on June 10, 2025 by itnerd

Apple announced the next versions of all their operating systems yesterday at WWDC. And developer betas are now available. And while it is very tempting to put “the new hotness” on your phone, you’d be best advised not to. Here’s why:

  1. Developer betas are for developers who are investing time and effort to ensure that their apps are good to go when these operating systems get released in the fall. The side effect of that is that these developer betas are often very unstable. But developers are fine with that as they are typically using these on devices that are not their primary device. Meaning that any instability is a non issue for them. That’s not the case for the average user who has and relies on their only iPhone and the apps on it. And if you’re that person, you should steer clear of this beta.
  2. Now if you’re thinking of jumping onto the public beta when that hits the streets in July, you should skip that as well. While that beta is likely to be more refined than the developer beta, it’s still going to be buggy as well. The only way I would ever suggest that anyone install a public beta is if they have a second device that they can use with it. Even then I would still steer clear.

Now if after all of that, you’re insistent on installing a beta, I would strongly recommend that you back up the device that you plan on installing the beta on. That way you can fall back to a known good version of the operating system in question if you need to. But honestly, unless you’re an app developer or something, leave the beta testing to them.

Leave a comment »

Fake WordPress Caching Plugin Used to Steal Admin Credentials

Posted in Commentary with tags on June 10, 2025 by itnerd

A sophisticated malware campaign targeting WordPress administrators has been discovered, utilizing a deceptive caching plugin to steal login credentials and compromise website security. 

Commenting on this is Martin Jartelius, CISO at Outpost24:

“Installing an unknown plugin is always a risk. Markers such as the ones mentioned are also not great to use—a somewhat more engaged attacker would simply fork an open-source project, backdoor that, and include the expected information. The description associated with this “attack” shows both a lack of creativity and enthusiasm with the attacker. The reason we mention this is not to encourage the attackers to try harder, it’s to ensure that administrators are aware that malicious plugins are a real threat, and that they should never expect them to show up with this low level of ambition. Hackers are generally better than this. Think twice, install once.”

I am a WordPress user and I try to stick to known plugins to avoid this scenario. But because it pays to be paranoid, I will be giving my WordPress instance a second look to make sure that I don’t have anything “evil” lurking that I should be concerned about.

Leave a comment »

KnowBe4 Wins Multiple 2025 Top Rated Awards From TrustRadius

Posted in Commentary with tags on June 10, 2025 by itnerd

KnowBe4 today announced that TrustRadius has recognized KnowBe4 with multiple 2025 Top Rated Awards. KnowBe4’s Security Awareness Training won in the Security Awareness Training category, PhishER won in Incident Response, Security Orchestration Automation and Response, and Phishing Detection and Response categories, and for the first time ever, Compliance Plus won in both the eLearning Content and HR Compliance categories.

With a TrustRadius Score of 9.2 out of 10 and over 1108 verified reviews, KnowBe4’s Security Awareness Training is recognized by their customer reviews as a top player in the Security Awareness Training software category for the sixth consecutive time. PhishER has  won in three categories, with an 8.8 out of 10 and over 229 verified reviews. Additionally, Compliance Plus made its debut with a score of 8.3 out of 10. 

Since 2016, the TrustRadius Top Rated Awards have become the B2B’s industry standard for unbiased recognition of excellent technology products. Based entirely on customer feedback, they have never been influenced by analyst opinion or status as a TrustRadius customer. Here is a detailed criteria breakdown of the methodology and scoring that TrustRadius uses to determine TopRated winners.

For more information on KnowBe4, visit www.knowbe4.com.

Leave a comment »

« Older Entries