Archive for the Commentary Category

« Older Entries

Polygraf AI and Carahsoft Partner to Help Public Sector Organizations Adopt AI While Maintaining Control Over Sensitive Data, Operational Risk and Compliance Requirements

Posted in Commentary with tags , on November 2, 2026 by itnerd

Polygraf AI and Carahsoft Technology Corp. today announced a partnership. Under the agreement, Carahsoft will serve as Polygraf AI’s Master Government Aggregator®, making the company’s AI security and governance solutions available to the Public Sector through Carahsoft’s reseller partners and NASA Solutions for Enterprise-Wide Procurement (SEWP) V, The Interlocal Purchasing System (TIPS) and OMNIA Partners contracts.

Polygraf AI offers AI security, data governance and sensitive-information protection solutions designed to help organizations adopt AI while maintaining control over data, security and compliance. Its AI Behavioral Control (AiBC) Plane applies real-time policy enforcement across AI interactions, endpoints, documents, email, collaboration tools and virtual meetings, helping organizations identify and protect sensitive information before it is transmitted, shared or processed by AI systems. Polygraf AI’s solutions include controls for AI prompts and outputs, sensitive-data discovery and redaction, AI-use monitoring, audit logging and detection of AI-generated and synthetic content. The platform can be deployed on-premise, in private cloud, at the edge or in air-gapped environments to support organizations with stringent data-residency and operational-control requirements.

Polygraf AI provides Public Sector organizations with capabilities to support the controlled adoption of generative AI while helping protect sensitive Government information. Its solutions can help agencies govern the use of public and private AI models, safeguard personally identifiable and other regulated information, monitor AI activity, secure virtual meetings and identify and redact sensitive content in documents and files. Through these capabilities, Polygraf AI provides an AI-specific security and governance layer that can integrate with existing technology environments and help Public Sector organizations expand the use of AI while maintaining established requirements for data protection and oversight.

Polygraf’s AI security and governance solutions are available through Carahsoft’s SEWP V contracts NNG15SC03B and NNG15SC27B, TIPS Contract #220105 and OMNIA Partners Contract #R240303. For more information, contact the Carahsoft Team at (703) 871-8548 or Polygraf@carahsoft.com; or learn more about Polygraf’s solutions here.

Leave a comment »

The $6.3 Bill Binance ownership failure & 3 Qs CEOs must ask

Posted in Commentary with tags on November 2, 2026 by itnerd

Binance lost about $6.3 billion in a single burst, the largest crypto theft on record. The early finding points to a compromised engineer laptop that reached an internal service able to submit withdrawals, which means the transactions looked authorized at every checkpoint they passed.

The failure wasn’t a missing tool. It was that nobody owned the whole path from a developer machine to a withdrawal. So nobody tested it, fixed it, and tested it again.

Waseem Ahmed, Head of Engineering, Secure.com:

“The $6.3 Billion Binance hack Is a wake-up Call:  the traditional security model needs to change.

“Most of the money left in about 20 minutes. That is the detail security teams should sit with. Binance’s investigation is still open. Early reports pointed to a compromised DevOps machine, but the company has since said the attack involved additional breach points and was not simply one engineer’s permissions. The pattern is still familiar: an action can be technically authorised and still not be legitimate, and monitoring alone will not tell you the difference in time.

“Three questions worth asking this week. What could our most privileged developer identity reach if it were stolen? Would we see that use in minutes, not hours? Is there a human approval step before an irreversible transfer?

“The organisations that close this gap test their own attack paths continuously, and they decide in advance what gets contained automatically and what needs a person.”

Hopefully organizations wake up to the fact that to be fully protected from hacks, everything must be considered. Otherwise you get stories like this.

Leave a comment »

LinearB launches Agentic Studio to give enterprise engineering leaders and coding agents the context to ship better software faster

Posted in Commentary with tags on November 2, 2026 by itnerd

LinearB today launched Agentic Studio, a key part of the next generation of developer productivity platforms.

Historically, productivity platforms gave engineering leaders metrics. LinearB now turns everything happening across software delivery into context that people and agents can consume and act on. Engineering leaders ask questions in plain language and get answers and next steps. They define the context surface with role-based access built in, and AI assistants help extend that context and build metrics, artifacts and dashboards. Coding agents receive that context, so they understand their task and environment better and make smarter decisions.

Acting on that context matters more than ever. LinearB’s 2026 AI benchmarks, covering 2.7 million pull requests across more than 250 organizations, show that developers who use AI most heavily nearly doubled their merged pull requests year over year. Yet the software factory faces new problems. In LinearB’s 2026 Software Engineering Benchmarks Report, AI-assisted pull requests were 2.6 times larger than unassisted ones at the 75th percentile, and agent pull requests waited more than five times longer for review.

LinearB’s effort skill, now in early access, matches a coding agent’s effort to the task. It gauges a change’s business relevance, complexity and risk using the code quality in the area, recent service incidents and ownership history. Low risk changes use less effort and fewer tokens. Complex, risky or high priority changes get more effort and careful, tested edits. More skills are on the way, focused on accelerating downstream stages of the software factory, such as review and merge.

Kraken used LinearB’s MCP server with AI to find what was really slowing its code reviews. The answer wasn’t large changes. It was time zones and reviewer availability. Kraken cut review time at the 90th percentile by more than half in four months.

The Agentic Studio is available now to all LinearB customers. Agent skills are available in early access.

Why it matters now

Engineering leaders have more data than ever and less time to use it. Boards and CFOs now ask whether AI spend is paying off, and a dashboard full of numbers doesn’t answer that. At the same time, coding agents write more of the code, and they start every task knowing nothing about the codebase’s history.

Productivity platforms have always been good at measuring. The next step is turning what they measure into action. That means answers for the people running engineering, and context for the agents doing more of the work.

What LinearB does

LinearB collects data from across the software delivery lifecycle and makes it usable. It normalizes data from different Git and project management systems into one model, matches each engineer’s identities across tools, and links every change from ticket to release. It adds AI attribution and industry benchmarks, so leaders can tell whether a number is good or bad.

The engineering context layer delivers that knowledge to people and to agents.

Engineering leaders ask questions in plain language, like where delivery is stuck, how their developers are doing and whether AI is paying off. Instead of reading a chart, they get an answer and a next step. They can build their own metrics and pull the same context into AI tools like Claude through MCP.

Coding agents get the same context through MCP and agent skills. The first skill, now in early access, matches an agent’s effort to the task. It checks how complex and risky a change is, using the code’s rework rate, recent incidents and ownership history. Simple, low risk changes use less effort and fewer tokens. Complex or risky changes get more effort and careful, tested edits, which raises quality where it matters most. The skill works with any coding agent, and leaders can see how often agents were routed to low, medium and high effort.

The platform is built for the enterprise, with role based access and guardrails on what agents can do.

Journey and milestones

LinearB started by giving engineering leaders visibility into how their teams deliver software. Years of integration work across the software delivery lifecycle gave it one of the largest datasets on how engineering teams work. Its 2026 Software Engineering Benchmarks Report drew on more than 8.1 million pull requests from 4,800 engineering teams in 42 countries. As AI coding tools spread, LinearB added AI attribution and connected to more of the tools teams use.

In 2026, Gartner named LinearB a Leader in its first Magic Quadrant for Developer Productivity Insight Platforms, for both its ability to execute and its completeness of vision. Early customer response to the context layer is strong. The AI assistant and MCP access show the highest user retention of any features LinearB has released.

Market trends

LinearB’s 2026 AI benchmarks, built from 2.7 million pull requests and 83,000 developers across 253 engineering organizations between February and May 2026, show why measuring AI isn’t enough on its own. The teams pulling ahead are the ones acting on what they learn.

  • Heavy AI users are pulling away. The typical developer who uses AI on at least 75% of coding days merged 96% more pull requests per week than a year earlier. The typical developer using no AI merged 3.6% fewer.
  • Adoption is shallower than the hype suggests. Even at elite organizations, AI assists only 54% of pull requests.
  • Agents still need people. At the 90th percentile, autonomous agents open 4.7% of pull requests. At elite organizations, 79% of agent pull requests merge within 30 days, compared with 92% of human only pull requests. At fair organizations, agent yield drops to 37%. The likely reason is ownership. When no developer owns an agent’s pull request, it often never merges.
  • AI code review is the fastest win. Pull requests with an AI review merge at the highest rate of any type and lift yield by up to five percentage points.
  • AI costs are climbing fast at the top. Token spend at the 90th percentile reached $35.20 per developer per coding day, up nearly 75% in three months, while the median barely moved.

Engineering leaders already use LinearB to answer the questions their boards are asking about AI.

Forward-looking vision

The effort skill is the first in a library of agent skills. Each one turns LinearB’s context into an action an agent or a leader can take. Next, LinearB will focus on helping teams merge and govern AI generated code safely, and on cutting what engineering organizations spend on AI. The goal is the one productivity platforms have always promised, helping teams deliver better software faster. LinearB now does it by giving people answers and giving agents the context to act.

Leave a comment »

Datadobi Receives SOC 2 Type I Attestation from KPMG for Its Software Engineering, Quality, and Security Processes

Posted in Commentary with tags on November 2, 2026 by itnerd

Datadobi today announced that it has once again received its Service Organization Control (SOC) 2 Type I attestation covering its software engineering, quality assurance, security, operations, and support processes, following an independent audit by KPMG. Developed by the American Institute of Certified Public Accountants (AICPA), SOC 2 is a widely recognized framework for assessing how service organizations protect customer data. The attestation confirms that Datadobi’s internal controls and processes continue to meet the highest standards for the integrity, security, and confidentiality of customer data.

With unstructured data growing exponentially in recent years, the challenge of managing it is accelerating at an ever-increasing pace. IT and business organizations are moving data for system upgrades, to take advantage of the cloud, for cost or compliance reasons, and to prepare data for AI, analytics, and research. The race to get unstructured data ready for AI raises the stakes further: data feeding AI models, retrieval pipelines, and agents must be complete, uncorrupted, and properly governed, because errors or exposures at this stage are amplified in every output that follows. Throughout these processes, data integrity must be protected against human and machine error as well as malicious attacks. That puts the spotlight not only on the software organizations rely on to manage their data, but on the engineering, security, and operational discipline of the vendor behind it.

The SOC 2 Type I report reaffirms Datadobi’s company-wide commitment to data integrity, security, and software quality, giving organizations confidence that the data they move, manage, and prepare for AI is handled under rigorous, independently audited controls. It provides an in-depth look at the internal controls and processes that govern how Datadobi builds, tests, releases, and supports its software, including:

Secure, Defensive Software Engineering

A defensive engineering methodology is embedded across Datadobi’s software development lifecycle. All code is deployed following a four-eyes principle, and every code change is peer reviewed and passes extensive automated testing before it is included in a release. An agile release methodology means Datadobi’s software can be adapted quickly to customer-specific needs or interoperability challenges, without compromising quality or control.

Independent Quality Assurance (QA) Function

Datadobi maintains a QA function that operates independently of development to verify the quality of every release. If an issue is identified in a customer environment, it is investigated, and a software patch is provided to resolve it. A root cause analysis then determines whether any process, test, or architectural change is needed, so that lessons learned feed back into how all Datadobi software is built.

Risk Assessment and Governance

Datadobi applies a formal risk-control matrix across the business to evaluate risks and the controls in place to mitigate them. The matrix is regularly reviewed by Datadobi’s management and product management teams, ensuring security and data protection remain leadership priorities embedded in day-to-day operations.

Training, Support, and Customer Guidance

Datadobi trains customers and partners to use its software effectively in complex, multi-vendor environments and supports them at every stage of a project, from planning and pre-cutover testing to dry runs, cutover, and verification. Customers also have access to an extensive knowledge base of storage interoperability guidance and best practices, along with chain-of-custody reporting that documents how their data has been handled.

To learn more about Datadobi’s service commitments and obtain the available SOC 2 Type I report, visit https://datadobi.com/kpmg/

Leave a comment »

Florida DOE data breach potentially exposes SSNs of 4.9 million people

Posted in Commentary with tags on November 1, 2026 by itnerd

The Florida Department of Education (FLDOE) has disclosed a cybersecurity breach potentially affecting approximately 4.9 million people.

The incident involved unauthorized access to the state’s Florida Student Financial Aid website, exposing personally identifiable information, including Social Security numbers. Department staff discovered the breach on October 19.

Officials believe the breach was limited to the financial aid website but warned that certain online services may experience temporary disruptions during recovery.

The https://www.floridastudentfinancialaidsg.org/ website read: “This site is currently under maintenance and will be available soon. We apologize for the inconvenience.”

The department confirmed that existing financial aid, tuition payments and eligibility for scholarships, grants and student loans will not be affected.

Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security:

“I never get used to hearing about incidents like this. It seems we barely finish discussing one breach before another reminds us how much sensitive information people are required to entrust to the systems they depend on.

“Florida estimates that approximately 4.9 million people may be affected. That number is preliminary, but even as an estimate, it’s substantial. From a security perspective, you prepare for the potential scope while allowing the investigation to establish what happened. The department has not publicly identified the intrusion method, so it’s important not to speculate about how the attackers gained access or which controls may have failed.

“What concerns me is the information potentially involved and what could happen to it afterward. Social Security numbers, dates of birth, addresses, and other personal identifiers can be combined with information from other sources to facilitate identity theft, synthetic identity fraud, or highly targeted social engineering. Those are potential downstream risks, not confirmed consequences of this incident. Unfortunately, personal information doesn’t come with an expiration date simply because a breach investigation has concluded.

“Having spent decades building, defending, and testing systems, I believe we must look beyond restoring operations and ask whether we’re adequately protecting the trust people place in these services. That means minimizing unnecessary sensitive data, limiting access, and continuously validating whether security controls work.

“It’s reassuring that officials say financial aid and eligibility will not be affected. But the larger issue is that people often have little practical choice about providing sensitive information to obtain essential services. They shouldn’t have to become cybersecurity experts to protect themselves afterward.

“An organization may recover its systems in weeks, but the people whose information was exposed could be dealing with the consequences for years. That’s the part of these incidents we cannot afford to normalize.”

ㅤ

Seemant Sehgal, Founder & CEO, BreachLock

“Student financial aid systems hold three high-value data categories. Identity information, financial records, and household income data are all on the table here.

“For other state education departments, this is the time to confirm whether anyone has pentested these portals the way an attacker would, and if not, kick that off now so they can patch the exploitable vulnerabilities before someone else finds them. Public sector web applications accumulate technical debt faster than they get security review, and the ones holding Social Security numbers deserve a different level of scrutiny.”

ㅤ

John Strand, Owner, Black Hills Information Security

“These types of breaches are heartbreaking to me. Usually, the organization shuts the site down for a while and offers credit monitoring to the victims. But people may not understand the full extent of the damage until much later, when their personally identifiable information is used to open fraudulent accounts in their name.

“The impact doesn’t necessarily show up right away. For some victims, the identity theft and financial damage could surface years down the line.”

ㅤBreaches are very bad. And this one will be no different for those who are affected. Organizations need to keep that in mind as these breaches affect more than just the organization in question.

Leave a comment »

Hackers steal $6.3 billion from Binance in 20 minutes

Posted in Commentary with tags on October 31, 2026 by itnerd

Hackers stole approximately $6.3 billion in cryptocurrency from Binance, the world’s largest cryptocurrency exchange, in what is believed to be the biggest crypto theft in history.

The majority of the stolen assets were transferred within approximately 20 minutes on October 29. Binance initially suspected a compromised employee laptop but subsequently identified additional points of breach.

Blockchain intelligence firm TRM Labs reported that attackers compromised Binance’s transaction-signing infrastructure, allowing them to authorize unauthorized transfers from the exchange’s wallets.

TRM Labs and Chainalysis linked the attack to North Korean hackers, citing similarities to previous cryptocurrency thefts, including the $1.5 billion Bybit breach in 2025. Binance has not independently confirmed who was responsible.

Stablecoin issuers including Tether, Circle, Ripple and World Liberty Financial moved to freeze approximately half of the stolen assets, with Tether freezing nearly $1.57 billion and Circle more than $800 million. However, researchers estimate approximately $2.4 billion in bitcoin and ether remains beyond the reach of issuer-level freezes. Binance temporarily suspended withdrawals and pledged to cover customer losses using its $1 billion protection fund and company resources.

John Strand, Owner, Black Hills Information Security

“Initially, it appeared that this attack started with a compromised DevOps engineer’s laptop. But as Binance shares more information, it’s becoming clear that wasn’t the entire story. Once again, we’re going to have to wait to find out what actually happened.

“The initial explanation concerns me. It’s very common for large organizations to find one person they can blame, and anybody working in security should watch for that. If compromising one employee’s laptop can bring down your entire security structure, you have problems that go well beyond that employee.

“The movement of Ethereum, the access required, and what Binance is describing as multiple points of entry also raise questions about how the attackers operated. Looking at the speed of execution, I suspect AI may have been involved alongside some very talented human beings. That hasn’t been established, and speed alone doesn’t prove AI involvement. But it certainly raises questions about the automation used to carry out the attack.

“And here we are again. Another massive breach where the rest of us have to wait for the details so we can understand what failed and build better defenses.”

ㅤExpect this to be the first of many. And you may not hear that organizations get hacked. That’s not good for us.

Leave a comment »

Pentagon investigates suspected cyberattack on military base freezers

Posted in Commentary with tags on October 31, 2026 by itnerd

The Pentagon is investigating a suspected cyberattack involving refrigeration systems at at least six U.S. military bases, according to Reuters.

The malfunctions occurred in August at military commissaries, where freezer temperatures unexpectedly increased, spoiling food. At Fort Huachuca in Arizona, officials reported that a freezer entered defrost mode overnight, heating its contents rather than maintaining safe storage temperatures.

The investigation follows a confirmed cyberattack on commercial refrigeration systems at more than 350 establishments in France earlier this month.

Damon Small, Board Member, Xcape, Inc.

“Compromising industrial refrigeration systems transforms routine facility hardware into an immediate operational liability, spoiling vital food supplies and disrupting logistics across military bases. While refrigeration devices may seem an unlikely target, the reality of the situation is that attackers are often opportunistic. The question we have to ask is whether these and other incidents against industrial cooling units are targeted to cause panic and damage, or if it is simply a matter of adversaries finding a new attack path. With similar attacks recently targeting healthcare organizations, this trend is having a chilling effect (pun intended) on operational technology security. Aside from the weak authentication and identification mechanisms featured in these industrial units, the fact that they are accessible from the Internet remains the primary concern. In short, if the question is who would want to attack a freezer, the answer, apparently, is lots of people.”

“Critical Takeaways:

  • Opportunistic exposure over advanced capability: Industrial control systems frequently suffer from weak authentication and legacy identity mechanisms, making any unit reachable from the public Internet an easy mark for threat actors.
  • Cascading operational disruption: Whether spoiling commissary provisions across defense installations or compromising temperature-sensitive pharmaceuticals in healthcare facilities, cooling failures yield immediate physical consequences.
  • Mandatory perimeter isolation: Security teams must immediately audit facilities networks to remove refrigeration controllers from direct Internet exposure, isolate operational technology on dedicated segments, and enforce strict access controls.

“Attackers may not care about commissary breakfast menus, but they will happily exploit any exposed thermostat that responds to default credentials.

ㅤ

Seemant Sehgal, Founder & CEO, BreachLock

“The pattern here is getting hard to miss at this point. Nichirei Logistics in Japan this summer, 700 French supermarkets through Danfoss controllers earlier this month, and now suspected activity at six U.S. military commissaries, with one freezer entering defrost mode overnight exactly like the attack in France.

“The question for investigators is whether this is the same actor working through different sectors, whether the technique has spread far enough that multiple groups are picking it up independently, or just a coincidence.

“This pattern impacting military bases takes the concern to another level. Spoiled food sounds minor, but the same access that defrosts a freezer could do a lot worse at a military base that runs on cold storage for medical supplies, blood, or really anything else relying on temperature control. Any operator still running internet-reachable refrigeration controllers at this point should get ahead by finding every reachable controller in their environment this week and either disconnecting them from the public internet or putting them behind a VPN.”

ㅤ

Steven Swift, Managing Director, Suzu Labs

“We probably won’t, and shouldn’t get additional detail regarding the potential to freezer tampering as a cybersecurity attack. Reports thus far are that freezer temperatures were unexpectedly set to defrost, and that it was a “potential cyberattack”

“In a similar 2022 attack against supermarkets, they had been using obsolete versions of cold storage controllers. IOT devices such as these are famously insecure, out of date devices even more so. There’s just not enough incentive for manufacturers to invest much into security, no one is making purchasing decisions based on how secure they think their refrigerator is.

“Many of these devices were never intended to be connected to the public internet. It matters a lot less if a device is insecure, if its only accessible locally. It’s just a much smaller attack surface. However, lots of these devices are getting connected to the internet, which suddenly makes those vulnerabilities matter.

“We don’t have any way to know if this was actually a cyberattack. Its pretty easy to blame issues on “the hackers must have done it” for what could have also been either human error, or a glitch in the system. Especially so for infrastructure which is typically insecure.”

ㅤ

Jermaine Logan, Staff Product Security Engineer, Finite State

“If these turn out to be cyberattacks, the lesson isn’t that freezers are fragile. It’s that the software inside everyday equipment is rarely something the buyer can actually see. Our own work showed how much is sitting in a refrigeration controller’s firmware. Buyers with serious stakes, the DoD included, should be demanding that visibility from device makers before deployment, not reconstructing it after the food spoils.”

Freezers are to be considered critical infrastructure. So you should take the same precautions that you do take with critical infrastructure. You do take precautions with critical infrastructure, do you?

Leave a comment »

As foldable competition heats up, Samsung is putting experience front and centre

Posted in Commentary with tags on October 30, 2026 by itnerd

Fresh competition has brought renewed attention to foldable smartphone technology, and Samsung’s message is simple: experience matters.

With eight generations of Galaxy Z Fold devices behind it, Samsung is launching a new campaign that highlights its history in the category, while making a playful reference to the latest developments in the foldable market.

The creative takes inspiration from the familiar aesthetic of smartphone advertising, featuring striking photography interrupted by a bright line across the screen, alongside the message: “Folding. We know a thing or eight.”

For reference, check out the posts on Instagram and Tik Tok that went live yesterday.

The campaign will appear on a mobile billboard in Toronto and Vancouver today (as well as Montreal over the weekend), bringing Samsung’s perspective on the evolving foldable landscape directly to consumers.

Leave a comment »

BDO Canada partners with ServiceNow to help organizations govern AI and simplify operations

Posted in Commentary with tags , on October 30, 2026 by itnerd

BDO Canada today announced a new partnership with ServiceNow, the Super Intelligence Control Tower for business reinvention, to help organizations modernize operations, govern AI-enabled work and improve returns on technology investments. The partnership combines BDO’s advisory, risk, cyber, data, technology, and industry experience with the ServiceNow AI Platform to connect systems, processes and teams.

Organizations are adopting digital tools and AI faster than their processes, controls, and operating models can evolve. As a result, disconnected systems, manual work, and unclear governance can slow execution and limit the value of technology investments.

BDO and ServiceNow address these challenges by linking business strategy and governance with process design, platform implementation, and ongoing optimization. BDO aligns people, processes, data and controls around defined business outcomes, using ServiceNow to put AI to work across the organization.

Delivered through BDO’s Advisory practice, the offerings cover strategy and roadmaps, workflow design, implementation and integration, change and adoption, managed services, and continuous improvement. It will support service operations, process automation, digital risk and response, AI governance, and ongoing platform management.

BDO’s business and regulatory experience will help clients identify value opportunities, manage risk and establish governance for responsible AI adoption.

Clients will have access to BDO advisory, implementation and managed services across service management, operations, automation, integration, AI, security, risk and platform management.

For more information about BDO’s ServiceNow consulting services, see here.

Leave a comment »

Fake Adobe Acrobat Pages Used to Deliver Remote Access Software

Posted in Commentary with tags on October 30, 2026 by itnerd

Cybercriminals are using fake Adobe Acrobat and document-signing pages to distribute legitimate ConnectWise ScreenConnect remote-access software, potentially giving external operators persistent access to Windows systems.

A new CloudSEK investigation reveals how trusted, digitally signed software is being used with unauthorized remote-access configurations, creating risks that conventional file-signature checks alone may not detect.

Key findings:

  • Legitimate software abused: Two genuine, digitally signed ScreenConnect installers were identified with configurations pointing to separate remote-access tenants. The installers were not found to be trojanized.
  • Suspicious infrastructure: Researchers analysed eight additional URLs linked to document-signing lures. Five page variants shared nearly identical JavaScript and a common background image.
  • Telegram-based tracking: The pages sent visitors’ IP addresses, ISP details, device and browser information, timestamps and location data to Telegram bots.
  • Selective downloads: The pages checked visitors’ operating systems and ISPs before automatically delivering ScreenConnect clients.
  • Potential persistent access: Static analysis showed that the Adobe-associated installers were configured to create automatically starting Windows services running as LocalSystem.
  • Five ScreenConnect tenants identified: Researchers documented the tenant identifiers and associated infrastructure to help security teams investigate unauthorized installations.

The investigation did not confirm any victim compromise or establish the identity of the operators.

The report includes technical findings, indicators of compromise (IOCs), ScreenConnect tenant identifiers and recommended defensive actions.

Full research: https://www.cloudsek.com/blog/fake-adobe-acrobat-lures-deliver-screenconnect-remote-access-clients

Leave a comment »

« Older Entries