Archive for July, 2026

Park Place Technologies Expands Global Services for AI-Accelerated Servers

Posted in Commentary with tags on July 28, 2026 by itnerd

Park Place Technologies is expanding its comprehensive global third-party maintenance and support capabilities for GPU-powered servers, helping enterprises accelerate AI adoption, deploy infrastructure faster, maintain performance, reduce risk, and gain greater flexibility as AI-driven infrastructure rapidly evolves.

Park Place Technologies now delivers enterprise-grade, global third-party support for mission-critical GPU-enabled servers across data centers, edge locations, and hybrid environments. Its services are designed to support organizations running AI and machine learning training and inference platforms, high-performance computing clusters, virtualized GPU environments, and data analytics and simulation workloads — helping organizations move AI initiatives from pilot to production without being slowed down by infrastructure support gaps.

GPU-based systems introduce unique operational demands compared with traditional computing environments, including higher thermal density, increased power requirements, BIOS and driver interoperability considerations, and multi-GPU system complexity. Park Place has invested in GPU-specific engineering expertise to support these environments and accelerate AI infrastructure readiness, including:

  • GPU-dense server architectures
  • Tensor Processing Unit (TPU) circuits
  • Advanced cooling and power configurations
  • BIOS and driver interoperability
  • AI accelerator-focused systems

In customer deployment environments spanning more than 60 data centers globally, Park Place has supported infrastructure at significant scale, including more than 24,000 servers and over 76,000 GPUs to date. Combined with post-deployment support and hardware maintenance services, Park Place enables organizations to simplify lifecycle management and accelerate AI infrastructure outcomes for high-performance computing and AI initiatives worldwide.

Park Place Technologies differentiates its GPU support offering through:

  • Proven global delivery at scale
  • OEM-agnostic, third-party independence
  • Expertise aligned to modern GPU workloads and AI acceleration needs
  • Predictable costs and flexible contracts
  • Enterprise governance, reporting, and compliance

As GPU infrastructure continues to evolve, Park Place Technologies is committed to evolving with it, providing organizations with the support, expertise, and operational flexibility needed to accelerate AI initiatives and keep critical environments running at peak performance.

To learn more, visit ParkPlaceTechnologies.com.

Recast has some new research that has just come out

Posted in Commentary with tags on July 28, 2026 by itnerd

There’ new research from Recast called “The State of Intune in 2026”.

The report explores how organizations are navigating the transition from Microsoft Configuration Manager to Intune, revealing that while Intune is well regarded, many IT teams continue to struggle with manual application management, third-party patching, and the realities of operating hybrid environments. 

You can read the research here.

ZuriQ raises $25.5 million to scale new groundbreaking 2D quantum architecture

Posted in Commentary with tags on July 28, 2026 by itnerd

ZuriQ, a Swiss quantum computing company spun out of ETH Zürich, today announced it has raised $25.5 million in seed funding to scale its trapped-ion quantum processors. The round builds on the company’s $4.2 million pre-seed round in 2025 and is led by Quantonation, with participation from Forward.one, Extantia, Firgun Ventures, and all previous round investors. ZuriQ will use the new capital to expand its team alongside research and development efforts as it works to significantly increase the number of qubits its architecture can support.

Most trapped-ion quantum computers are built on an architecture first proposed more than two decades ago, in which ions are held in essentially one-dimensional chains stitched together into larger grids using complex junction structures. ZuriQ has taken a fundamentally different route with processors that are natively two-dimensional. Using Penning micro-traps, the company uses a static magnetic field in place of the rapidly oscillating fields most legacy architectures rely on, replaces the oscillating fields of conventional designs with a static magnetic field, allowing ions to move freely in any direction without the junctions that constrain reconfiguration.

ZuriQ is proving out its native two-dimensional architecture with a working demonstrator – successfully developed in just 18 months. The demonstrator comprises a 3×3 array of nine individually controlled ions, the largest two-dimensional array of its kind demonstrated to date, built in collaboration with researchers at ETH Zürich. The chips behind it were fabricated with ZuriQ’s manufacturing partner, Infineon, showing the design can be produced with established industry processes.

With the architecture and its manufacturing route established, the company’s focus now turns to scale: rapidly increasing the number of ions on a chip to enable powerful, commercially useful machines. Since its last investment, ZuriQ has grown from four people to eighteen. The company has attracted world-class talent with backgrounds from leading quantum and photonics organizations, including IonQ, Xanadu, and Hamamatsu. The new capital will go toward further hiring, expanding the company’s research program, and scaling up chip fabrication – the groundwork for putting hundreds of qubits on a chip.

MedusaHVNC hijacks browser sessions, bypasses MFA protections

Posted in Commentary with tags on July 28, 2026 by itnerd

In new research, BlackFog’s Darren Williams details how MedusaHVNC gives attackers covert access to live, logged-in browser sessions by opening a legitimate browser on a hidden Windows desktop. Because the activity occurs on the victim’s own device using its existing profile, cookies and session state, the malware can exploit authenticated accounts while remaining invisible to the user.

Jacob Krell, Senior Director, Secure AI Solutions & Cybersecurity, Suzu Labs had this to say:

“MedusaHVNC doesn’t need to steal credentials. It launches a real browser inside a hidden Windows desktop using the victim’s existing profile, so the attacker’s session arrives pre-loaded with every cookie, saved password, and active authentication token the victim already has. Multi-factor authentication (MFA), passkeys, hardware tokens, all of them authenticated that browser before the attacker showed up.

“Most organizations are investing in authentication hardening right now, phishing-resistant MFA, passkey rollouts, conditional access. All of it protects the login. MedusaHVNC operates entirely after the login, where the attacker’s session looks identical to the victim’s, same machine, same IP, same browser fingerprint, same cookies. Token binding and continuous session validation are what cover that gap.

“Hidden Virtual Network Computing (HVNC) used to be one of the hardest malware features to build. MalwareTech documented in 2015 that it essentially required writing your own window manager. MedusaHVNC now sells that capability through a dedicated website and Telegram channel, with an operator panel where you pick a browser from a dropdown and adjust the frame rate. That’s the industrialization of cybercrime compressed into a single feature’s history, a capability that once required deep Windows internals expertise is now a product with customer support.

“The infection chain is a living-off-the-land sequence, wscript.exe to AutoIt to charmap.exe, every binary signed and trusted until the final payload drops. In my experience, living-off-the-land chains evade detection better than custom malware because endpoint detection and response (EDR) flags unknown executables, not trusted ones behaving slightly wrong. Application allowlisting breaks this chain at the first stage. If a workstation doesn’t need wscript.exe or AutoIt, disable them. ‘Ships with Windows’ and ‘needed on this host’ are different questions, and attack surface reduction is how you stop living-off-the-land chains before they reach the payload.”

John Strand, Owner, Black Hills Information Security, Inc. follows with this:

“Browser-based persistence is becoming one of the next major frontiers in cybersecurity. For years, we’ve focused on securing the endpoint, but once malicious activity moves into the browser, visibility becomes much more difficult. Many security vendors intentionally take a hands-off approach to browser activity because of legitimate privacy concerns. A lot of organizations aren’t fully decrypting TLS traffic, let alone inspecting exactly what’s happening inside a user’s browser.

“The reality is that the browser has become the new endpoint. Nearly every business application and cloud service runs through it. Browser-focused attack frameworks have existed for years, but this latest campaign shows they’re becoming more sophisticated. Attackers are shifting away from techniques that target only the operating system and are investing in methods that are harder to detect and much more resilient.”

Organizations need to look at their security in an holistic way. Because only focusing on one area will guarantee that you get pwned.

What Nvidia’s Open Secure AI Alliance means for enterprise security

Posted in Commentary with tags on July 28, 2026 by itnerd

First, if you’re not up to date on Nvidia’s Open Secure AI Alliance, this will help:Industry Leaders Join Open Secure AI Alliance for AI Safety and Security | NVIDIA Blog

The consensus from experts in the industry is that this is a meaningful step for the industry, but it’s only the beginning. The real challenge now is helping enterprises secure AI agents in the real world, with better identity, visibility, governance, and even hardware security. Their comments dig into what the announcement means beyond the headlines and where organizations still have the most work to do.

John Strand, Black Hills (https://www.linkedin.com/in/john-strand-a1b4b62)

“I think we’re going to see a lot more stories like this because there’s real anxiety in the AI industry right now. Part of it is financial. Many organizations are struggling to demonstrate a meaningful return on investment from their AI initiatives. The other part is security. As researchers continue to show AI systems escaping their intended boundaries or interacting with other systems in unexpected ways, concerns about AI safety are growing. That’s why you’re seeing so many new AI security initiatives. In many cases, they’re trying to establish industry standards before governments step in with legislation or regulation. Whether those efforts are enough remains to be seen.”

Chuck Sobey, General Chair and Co-founder, Chiplet Summit (https://www.linkedin.com/in/chucksobey)

“As the Open Secure AI Alliance focuses on securing the AI ecosystem, one area that deserves greater attention is the security of the underlying hardware powering AI infrastructure. Software security assumes you can trust the silicon it runs on. The coming wave of chiplet-based systems, especially AI accelerators, raises the stakes: more suppliers, more integration points, more attack surfaces. Hardware security has to be part of this conversation from the beginning.”

John Carberry, Solution Sleuth, Xcape Inc. (https://www.linkedin.com/in/john-carberry-1418a622a)

“Accelerating autonomous artificial intelligence adoption creates systemic enterprise exposure when organizations deploy intelligent agents without establishing clear identity boundaries or visibility controls. Bringing industry heavyweights together through the Open Secure AI Alliance provides a much-needed collaborative effort to advance secure design patterns and open-source defensive tooling outside of traditional business competition. While vendor collaboration establishes essential baseline standards for this emerging technology, security leaders cannot treat pre-competitive initiatives as a substitute for internal governance. Organizations frequently fall short by granting artificial intelligence agents excessive API permissions and service account privileges without audit logging, opening direct pathways for indirect prompt injection and unauthorized data exfiltration. Security executives must immediately map all artificial intelligence integrations, enforce least-privilege scoping on agent execution frameworks, and treat agent interactions with external systems as untrusted input requiring strict validation.

“Critical Takeaways

  1. Leverage pre-competitive standards: Use open-source security frameworks from industry alliances to standardize threat modeling for artificial intelligence deployments across enterprise environments.
  2. Scope agent permissions tightly: Restrict autonomous artificial intelligence agents using least-privilege access controls, credential isolation, and strict API scope boundaries.
  3. Treat agent inputs as untrusted: Implement rigorous input validation and comprehensive audit logging for all automated workflows to neutralize indirect prompt injection risks.

“Industry alliances can build safe frameworks outside of business competition, but your security team still has to enforce them inside your corporate network.”

Jacob Krell, Sr. Director: Secure AI Solutions & Cybersecurity, Suzu Labs (https://www.linkedin.com/in/jacob-krell)

“Organizations built identity and access management for people running predictable software. AI agents are neither, and they skip the entire stack.

“Most security teams can’t tell you how many agents are running in their environment right now, or what those agents can access. Developers launch them, ops teams wire them into workflows, and SaaS vendors embed them in products without security ever seeing a ticket. Each agent holds credentials to production systems and behaves non-deterministically, meaning the same agent running the same task can take a different path every time.

“The Hugging Face breach is proof this gap has consequences. OpenAI tested its models’ exploitation capabilities, and those models breached a real company. If OpenAI couldn’t predict what their own models would do in a controlled evaluation, no enterprise should assume they can predict agent behavior in production. When Hugging Face reached for closed frontier models to analyze the attack, safety guardrails blocked them from examining exploit payloads. They ran GLM 5.2, a Chinese open-weight model, on their own infrastructure instead. I’ve hit the same wall. I still run Claude Opus 4.6 for security work because newer models increasingly refuse to process real attack artifacts. If Washington restricts Chinese open-weight models without ensuring equivalent open alternatives from U.S. labs, defenders lose the tool that actually worked when closed models wouldn’t.

“The Open Secure AI Alliance is right that defenders need open, inspectable models they can run on their own infrastructure. HPE’s SPIFFE/SPIRE contribution to the alliance addresses agent identity directly, giving agents cryptographically verifiable identities. Security leaders should be watching that work. Identity for agents is what makes the rest of the defensive stack enforceable.”

Seemant Sehgal, BreachLock (https://www.linkedin.com/in/s-sehgal)

“The gap in most AI deployments right now is not in the model itself. Organizations are running AI agents with access to internal data, external APIs, and automated decision-making workflows, and they have not mapped what those agents can reach or how an adversary would move through that access. Alliance frameworks that standardize how AI systems are evaluated for risk are useful, but the organizations that will benefit from them are the ones that already know what their agents are doing at runtime. Most do not.

SafeBreach and Anvilogic Partner to Connect Attack Simulation, Detection Engineering and Continuous Validation in One AI-Powered, Closed-Loop Workflow

Posted in Commentary with tags on July 28, 2026 by itnerd

SafeBreach today announced a strategic integration with Anvilogic, the leading Agentic SecOps platform. The two-way integration utilizes the real-world attack simulation results from the SafeBreach CTEM Platform to reveal where security controls fall short, while the Anvilogic platform transforms those findings into deployable, tuned detections and hands off to the customer’s existing response tools to close the loop. SafeBreach then continuously validates those detections against the same attack simulations, creating a closed-loop workflow that helps security teams identify security gaps, improve detection quality, and measurably reduce operational risk.

As security teams accelerate their adoption of AI-powered SOC capabilities, the challenge they face has evolved: it’s no longer just about creating detections faster, but rather ensuring those detections are working and effective against real threats. Up to now, attack simulations surfaced gaps, detections were built separately, and validation was time-consuming and manual. In an AI-driven SOC where detections are autonomously generated and deployed, the lack of a validation process capable of keeping pace creates a critical blind spot, leading to a security strategy that is based on assumptions rather than proof.

The SafeBreach–Anvilogic integration addresses this challenge directly by providing a closed-loop workflow that seamlessly connects attack simulation, detection engineering, and continuous validation.

How the Integration Works

  1. Validate: The SafeBreach CTEM Platform validates an organization’s production security controls against 33,000+ real attack methods to identify critical gaps in control coverage.
  2. Trigger: The validated findings automatically trigger the Anvilogic Continuous Detection Validation Blueprint—Anvilogic’s agentic automation layer that converts a SafeBreach finding into a high-fidelity production detection.
  3. Review & Confirm Coverage: The Blueprint reviews the finding against Anvilogic’s library of thousands of MITRE ATT&CK–mapped detections, checks which already fire on the technique, and builds new coverage only where a real gap exists.
  4. Create, Test & Tune: Where a gap is real, the Blueprint authors a new detection, tests it, and tunes it against the environment—across an organization’s SIEM, data lake, or a hybrid stack.
  5. Deploy with Approval: The tuned detection is prepared for production behind a human approval gate, so nothing proceeds without an explicit sign-off.
  6. Re-Validate & Close the Loop: The SafeBreach CTEM Platform re-runs the simulations to confirm the control now catches the attacks.

The loop runs daily, providing continuous board-ready, audit-grade evidence that identified gaps are not only closed, but remain so over time. As a result, security teams experience one unified workflow that accelerates detection maturity and measurably reduces risk with:

  • Coverage that is validated, not assumed: Proven against 33,000+ real-world attack methods within the SafeBreach CTEM Platform with an evidence trail tying each gap to its deployed fix.
  • Gaps that are closed, not queued: Findings no longer die in a backlog; the loop runs daily and converts validated gaps into deployed detections.
  • Teams that scale without staffing: The remediation work that previously required additional detection engineers runs as a Blueprint, expanding coverage without adding headcount.

Visit SafeBreach booth #1364 at Black Hat USA from August 1-6, where SafeBreach and Anvilogic product experts will be on hand to demonstrate this integration. Schedule a time to connect at https://www.safebreach.com/black-hat-usa-2026/

U.S. imposes visa restrictions on foreign cyber scammers 

Posted in Commentary with tags on July 27, 2026 by itnerd

The U.S. State Department announced a new visa restriction policy targeting foreign individuals responsible for or complicit in cybercrime and cyber-enabled crimes.

The restrictions may also apply to the immediate family members of those involved and are intended to disrupt overseas criminal networks.

The policy follows President Trump’s March executive order on combating cybercrime and fraud. According to the State Department, cyber scam operations cost Americans an estimated $10 billion in 2024.

John Carberry, Solution Sleuth, Xcape, Inc. had this comment:

   “Deploying diplomatic tools like targeted visa denials raises the personal stakes for transnational cybercrime syndicates, even if it seems odd that a dedicated policy was necessary to keep known criminals out of the country in the first place. By extending travel restrictions to immediate family members under Executive Order 14390, the State Department squeezes the mobility and secondary benefits of operators working from non-extradition jurisdictions. While federal sanctions target overseas infrastructure over time, enterprise security leaders cannot rely on immigration enforcement for threat mitigation. Executives must prioritize immediate technical controls, including strict identity verification, automated transaction monitoring, and robust inbound communication filtering to defeat cyber-enabled fraud at the edge.

   “Critical Takeaways

  • Enforce borderless technical controls: Treat visa restrictions as a secondary diplomatic lever while maintaining strict identity verification, transaction monitoring, and inbound message filtering.
  • Target criminal ecosystems: Recognize that expanding sanctions to immediate family members disrupts the lifestyle mobility that keeps transnational cyber syndicates motivated.
  • Do not rely on state policy for defense: Focus enterprise security budgets on stopping fraud at the network edge rather than expecting federal travel bans to reduce attack volume.

   “While denying visas to transnational scammers is a welcome step, it is remarkable that keeping international criminals out required a new policy in the first place.”

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs had this to say:

   “The State Department’s new visa restrictions on cybercriminals target people who chose their operating model specifically to avoid US jurisdiction. Scam compound operators in Cambodia, Myanmar, and Laos aren’t applying for US visas. They built fortified facilities in countries with weak governance because distance from Western oversight is the product feature.

   “This is industrialized crime running on franchise economics, shared financial infrastructure, trafficking pipelines, specialized service divisions. Rubio cited $10 billion in US losses for 2024. Regional losses hit $88-114 billion in 2025, tripled from 2023. You don’t get to that number with individual bad actors. You get there with an industry.

   “DOJ’s June seizure of Huione Group assets showed what effective disruption looks like at this scale, going after shared financial architecture that multiple franchises depend on. Visa restrictions are an individual-accountability tool applied to a problem that has outgrown individual accountability. The industry keeps running regardless of which operators can board a flight to JFK.”

This is an important step forward for sure. I for one would love to see it go further. Like arrest people that are involved in cybercrime and arrest their relatives in exchange for the criminals turning themselves in. That way either people don’t get involved in cybercrime, turn in the perpetrators, or distance themselves accordingly letting the authorities know about it. And other countries should follow suit.

Hackers hijack hotel Wi-Fi to steal Microsoft 365 credentials

Posted in Commentary with tags on July 27, 2026 by itnerd

Hackers are compromising DNS settings on hotel and conference center Wi-Fi gateways to redirect guests to fake Microsoft 365 login pages and steal account credentials, according to ReliaQuest.

Once attackers gain administrative access to a gateway, they modify its DNS settings to redirect users attempting to access legitimate Microsoft 365 services to phishing pages designed to capture credentials.

The campaign has been active since at least June and has targeted organizations across the financial services, professional services, legal, healthcare, energy and retail sectors. Researchers identified compromised Wi-Fi gateways in multiple U.S. cities, as well as in India and Saudi Arabia.

Seemant Sehgal, Founder & CEO, BreachLock has this comment:

   “Gaining admin access to a hospitality gateway and rewriting its DNS configuration is not something I’d consider a sophisticated operation. The failure point here is that these gateways were reachable with credentials that could be compromised in the first place, and whatever monitoring existed on them was not watching for configuration changes. Every person who authenticated to Microsoft 365 over that network handed over credentials they will now use on a corporate device, inside a corporate environment, and the organizations they work for have no visibility into that event at all.”

Denis Calderone, CTO, Suzu Labs provided this comment:

   “This is becoming more and more common. This is basically the same playbook as what APT28 did with 18,000 home routers in the FrostArmada campaign back in April. In this case the attacker is targeting legitimate hotel Wi-Fi gateways. The initial access is likely through exposed admin interfaces and the attack is simple enough; they are just reconfiguring DNS settings so all clients connected to the AP get fraudulent DNS responses of their choosing. When a guest’s laptop asks where login.microsoftonline.com is, the gateway sends them to the attacker’s server instead. It’s simple, effective and is sweeping in its scope.

   “The attackers are using two techniques for compromising user accounts. The first is simple enough, it just involves presenting an attacker-controlled fraudulent Microsoft logon page. The other technique is even more concerning. The second technique involves device-code authentication abuse, where the user is redirected to what looks like a normal Microsoft authorization approval prompt, and if the user approves it, it actually authorizes a session the attacker initiated. Microsoft issues a valid OAuth token to the attacker’s client, and that token is already MFA-satisfied. No credentials stolen, no tokens intercepted, MFA completely bypassed. Device-code authentication was designed for input-constrained devices like smart TVs and conference room displays, but it’s enabled by default in Entra ID and many enterprises have never turned it off because they don’t know it’s there. This should be disabled via Conditional Access for all users except the handful of service accounts or device groups that genuinely need it.

   “For the DNS side, the goal is to force managed devices to control their own DNS resolution and ignore whatever the local network hands them via DHCP. The generic advice is encrypted DNS in strict mode, and that’s correct, but how you implement it matters because strict DNS pinning to a public resolver will break most hotel captive portals and can also break on-premises Active Directory domain resolution if you’re running a hybrid environment. If you’re a Cloudflare shop, the WARP agent handles this the cleanest. It has built-in captive portal detection that temporarily allows local unencrypted DNS just long enough for the user to accept the hotel terms, then locks everything down through Cloudflare’s encrypted tunnel.

   “If you’re running Cisco, the Umbrella roaming client does the same thing, binding to the network stack and tunneling DNS to Cisco’s resolvers regardless of what DHCP says. If you’re a Microsoft house, you can push encrypted DNS settings natively through Intune. The setting you want is called ‘Strive’ mode, which attempts encrypted DNS first but temporarily falls back to plaintext when it can’t connect, like when you’re stuck behind a hotel login page. The stricter ‘Require’ mode gives you better protection but will completely break internet access on any network that blocks outbound encrypted DNS until you authenticate, which is most hotels. And if you already have an always-on VPN deployed, make sure captive portal remediation is configured, because without it your users can’t authenticate to the hotel portal to get online in the first place, and the workaround is usually disabling the VPN entirely, which defeats the purpose.

   “Also disable WPAD via Group Policy. ReliaQuest saw the attackers attempt WPAD abuse in roughly a third of cases, serving a malicious proxy config that would route all Windows application traffic through the attacker’s proxy. WPAD is on by default in Windows and almost nobody needs it.”

Damon Small, Board of Directors, Xcape, Inc. followed with this comment:

   “Compromising hotel network gateways to hijack DNS traffic exposes traveling executives to silent account takeover without touching corporate email perimeters. When adversaries gain administrative control over hospitality Wi-Fi access points, they modify local DNS settings to route Microsoft 365 login attempts to credential harvesting portals. Security leaders must operate on a fundamental principle: never trust any network that you yourself do not control. Because remote employees frequently connect through untrusted public infrastructure, organizations must provide tamper-resistant access methods, such as an always-on full-tunnel Virtual Private Network (VPN), to encapsulate all DNS and application traffic. Enforcing encrypted tunnels alongside phishing-resistant multi-factor authentication ensures corporate identities remain secure even when local network environments are fully compromised.

   “Critical Takeaways

  • Assume local networks are hostile: Treat every hotel, conference center, and public network as untrusted, operating under the assumption that local DNS resolution may be compromised.
  • Mandate tamper-resistant access: Enforce always-on full-tunnel VPN policies on all corporate endpoints to route all DNS and web traffic through secure corporate resolvers.
  • Enforce phishing-resistant authentication: Deploy FIDO2 tokens or passkeys and disable vulnerable authentication flows to prevent token theft even if a user reaches a forged portal.

   “An always-on full-tunnel VPN turns an untrusted hotel network back into what it was meant to be: simple commodity bandwidth.”

John Strand, Owner, Black Hills Information Security, Inc. has this comment:

   “This attack reminds me of the Wall of Sheep that’s been a fixture at security conferences for years. The lesson has always been the same. If you don’t trust the network, then don’t trust the network. On a public WiFi connection, you have no control over the DNS settings, the proxy configuration, or what traffic is being monitored or manipulated. That’s why anyone accessing sensitive corporate resources should be connecting through a trusted corporate VPN or, in many cases, avoiding public WiFi altogether by using a cellular hotspot. Security professionals have been warning people not to trust public wireless networks for well over 15 years. This attack doesn’t introduce a new lesson. It reinforces one we’ve known all along.”

Larry Pesce, VP of Services, Finite State adds this:

   “What surprises me most isn’t the technique, it’s the timeline. Security researchers have been demonstrating and warning about exactly this class of attack for the better part of a decade. Compromise the gateway, own DNS, and you own where every guest thinks they’re going. What’s new here isn’t the method, it’s that we finally have large scale, in-the-wild evidence that real threat actors are operationalizing it. The gap between ‘we know this is possible’ and ‘we can prove it’s happening’ just closed, and that should worry anyone who travels for work.

   “For years the standard response to this kind of research was ‘sure, but who’s actually doing it?’ These findings are the answer. DNS on a network you don’t control is trust by default, and these attackers are simply cashing in on that trust.

   “The attribution here is worth understanding, but so is the caveat. ReliaQuest connects this to tradecraft overlapping with APT28, the Russian military intelligence group also known as Fancy Bear or Forest Blizzard, and specifically to a prior router-based operation they call FrostArmada. But they are careful, and rightly so. They are pointing at technique similarity, not shared infrastructure or code reuse, so this is a low to medium confidence link, not a fingerprint. That distinction matters, because it’s easy for headlines to turn ‘looks like’ into ‘is.’

   “If this is APT28 or something in that orbit, the interesting shift is who they went after. Groups like this have historically been surgical, redirecting only traffic that matched specific keywords or targets. What researchers describe here is the opposite: non-selective redirection that scooped up anyone who connected. The sector spread backs that up. Financial services, legal, healthcare, energy, professional services, retail, across US cities, India, and Saudi Arabia. That isn’t a laser pointed at one industry. That’s a net.

   “And that’s the part I want people to sit with. Even if a nation-state actor is ultimately hunting a handful of high-value people, they don’t know who’s going to sit down at that hotel lobby Wi-Fi. So they take everyone. Your credentials might not be the prize, but they are an asset. A mailbox at an unrelated company is a launch pad for business email compromise. A retail employee’s login is a foothold, a pivot, a way to look legitimate on the way to the real target. In espionage terms, access is access, and low value access still has value.

   “A takeaway isn’t ‘I’m not important enough to be a target.’ On a shared, compromised network, importance is decided after the fact. You give up the credential first, and someone else decides later how to monetize or weaponize it. That’s exactly why the hygiene matters for everyone, not just the executives and the obvious high-risk roles. The person who assumes they’re not worth targeting is often the easiest way in.

   “The core lesson is that connecting to a network is not the same as trusting it. Whoever controls the gateway controls name resolution, and if that gateway is compromised, your device will happily follow it straight to a fake Microsoft 365 login page.

   “Here’s the part people get wrong: WPA2 and WPA3 do not save you here. Wi-Fi security encrypts the link between your laptop and the access point. It says nothing about whether the gateway sitting behind that access point is honest. A hotel network can be fully WPA3 protected and still be poisoning your DNS. Link-layer encryption is not the same as a trustworthy network.

   “Assume any network you don’t own is hostile. Use a VPN or encrypted DNS, such as DNS over HTTPS or DNS over TLS pointed at a resolver you trust, so a compromised gateway can’t silently redirect you. Take TLS certificate warnings seriously instead of clicking through them. And move to phishing resistant authentication like passkeys or FIDO2 security keys, because even a perfect looking fake login page can’t replay a hardware-backed credential. If Microsoft 365 suddenly asks you to log in again on hotel Wi-Fi, that’s your cue to stop and get suspicious.”

This is a simple travel maxim. If you can’t see the router, or you can see it but you cannot control it, you can’t trust it. The easy fix is to use a VPN. It doesn’t matter which one. And it doesn’t matter if this is a corporate account or a personal one. Any WiFi that you can’t see or you can’t control is untrustworthy by default.

Canadian Wants Limits On How Long Rogers, TELUS, and Bell Can Put You On Hold… But That Won’t Solve The Issue

Posted in Commentary with tags , , on July 27, 2026 by itnerd

I hear all the time from the clients that I have that Rogers is the worst when it comes to customer service. A 2.5 hour wait time to get to customer service isn’t unusual. And disconnections are not uncommon which forces you to phone back in and try to get help. The thing is that Bell and TELUS isn’t any different when it comes to that respect. And Frank Brown has a plan to change that.

His fix is to force a 10-minute maximum hold time for every telecom operating in Canada. This would also be backed by financial penalties by the Federal Government for companies that miss it. Now if that sounds familiar, Spain has rules like that now. If you want to sign the petition, click here.

My take goes something like this. This only partially solves the problem. This only became a problem when Rogers, Telus and Bell were allowed to outsource jobs to countries like the Philippines, Morocco, and Egypt to name a few. Bringing those jobs back to Canadians who need jobs, and backing that with financial penalties would go a long way to solving this issue as well. What is needed is two things. One is Rogers, TELUS and Bell showing leadership and not only implanting a 10 minute or less hold time and bringing jobs back to Canada. Now that is wishful thinking as those three companies have failed to show any sort of meaningful leadership over the years. That brings to the Federal Government smacking them silly until they comply with both. Because if the Federal Government really wants to show leadership in this area, now would be the time to do so.

So, how about it Federal Government. Will you hold Rogers, TELUS and Bell accountable? Seriously, will you?

Epson EcoTank: The ultimate back-to-school companion every family needs 

Posted in Commentary with tags on July 27, 2026 by itnerd

The start of a new school year brings plenty of excitement. It also brings a steady stream of forms, assignments, work sheets and unexpected requests. As families prepare for the year ahead, Epson’s EcoTank printers are reliable home essentials that are as important as backpacks, pencil cases and a good pair of runners. From forgotten worksheets to study packages and last-minute projects, Epson is there when life inevitably throws you a pop quiz.

ET-2980 Wireless All-in-One Colour Supertank Printer (MSRP: $399.99 CAD)

For many parents, back-to-school season is all about finding ways to simplify busy routines. The Epson EcoTank ET-2980 is designed for the everyday printing needs that come with the school year and daily life, from science fair projects and study guides to family schedules and shipping labels.  Epson’s EcoFit bottles allow families to print worry free in colour, without the headache of changing cartridges. With enough ink included to last up to three years1, it helps reduce the last-minute stress of running out of ink, which aways seems to happen at the worst possible moment.

Where to Buy:

ET-4950 Wireless All-in-One Colour Supertank Printer(MSRP: $599.99 CAD)

As school and work increasingly overlap at home, many families need a printer that can handle more than the occasional homework assignment. The Epson EcoTank ET-4950 is designed for higher-volume printing needs, with features such as automatic double-sided printing, copying and scanning to support both students and professionals. Its wireless mobile printing capabilities2 also offer added flexibility for busy households where work and learning can happen from virtually anywhere.

Where to Buy: