ASUS Routers Are Being Pwned By The Thousands… Here’s What You Need To Know

Posted in Commentary with tags on May 29, 2025 by itnerd

 Security firm GreyNoise has reported that thousands of ASUS routers are being hit with a stealthy backdoor that can survive reboots and firmware updates. Making it really, really dangerous.

Here’s what you need to know via GreyNoise:

  • Thousands of ASUS routers are confirmed compromised, with the number steadily increasing. 
  • Attackers gain access using brute-force login attempts and authentication bypasses, including techniques not assigned CVEs. 
  • Attackers exploit CVE-2023-39780, a command injection flaw, to execute system commands.
  • They use legitimate ASUS features to:
    • Enable SSH access on a custom port (TCP/53282).
    • Insert attacker-controlled public key for remote access.
  • The backdoor is stored in non-volatile memory (NVRAM) and is therefore not removed during firmware upgrades or reboots. 
  • No malware is installed, and router logging is disabled to evade detection. 
  • The techniques used reflect long-term access planning and a high level of system knowledge. 

Besides all of that, there’s this little tidbit from GreyNoise:

Disclosure deferred as we coordinated the findings with government and industry partners.   

That implies but does not confirm that this is a nation state behind this attack. That isn’t good.

So how do you protect yourself? You need to check to see if you’re infected if you’re an ASUS user. GreyNoise recommends the following:

  • Check ASUS routers for SSH access on TCP/53282. 
  • Review the authorized_keys file for unauthorized entries.
  • Block access to these four IP addresses: 101.99.91.151, 101.99.94.173, 79.141.163.179, 111.90.146.237
  • If compromise is suspected, perform a full factory reset and reconfigure manually.

Personally, if you’re the least bit paranoid, or you discover that you’ve been pwned, I would just factory reset the router and reconfigure it manually. Also, I will note that ASUS has patched a lot of the vulnerabilities that these threat actors are using. Thus if you haven’t applied the latest firmware updates to your ASUS router, you should. But my advice would be to do that AFTER you confirm that you haven’t been pwned.

UPDATE: Wade Ellery, Field CTO, Radiant Logic had this comment:

“This is a textbook example of why identity observability and infrastructure hygiene need to converge. Even something as mundane as a router becomes a strategic asset once it gains long-term identity in a threat actor’s infrastructure. Organizations must treat devices as identities—tracked, verified, and assessed for risk just like users. Observability tools that focus solely on app layers or human actors will miss campaigns like this. Real-time identity-aware telemetry across all assets, including IoT and edge devices, is essential for reducing dwell time and ensuring true Zero Trust enforcement.”

Debbie Gordon, CEO and Founder, Cloud Range adds this:

“This campaign highlights a dangerous shift in attacker strategy—from quick hits to long-haul persistence. AyySSHush’s ability to survive factory resets and firmware updates is a wake-up call: edge devices like routers are no longer low-value targets. In our cyber training environments, we stress layered response—not just patching, but validating assumptions about device integrity and persistence. Too often, routers are treated as ‘set-and-forget’ systems. That mindset is outdated and risky. These devices are now prime footholds for stealthy, scalable attacks.”

2 Comments »

Kyndryl Report: Why Most Businesses Are Not Yet Winning With AI

Posted in Commentary with tags on May 29, 2025 by itnerd

A new global study released today by Kyndryl found that only a small number of organizations have taken steps to align their workforce strategies with the growth of AI technology. Those that have done so have positioned themselves ahead in the race to deliver positive return on investments in the technology.

Based on a survey of more than 1,000 senior business and technology executives across 25 industries and eight geographies, Kyndryl’s first People Readiness Report reveals a striking gap between AI investment and workforce preparedness:

  • 95% of businesses have invested in AI
  • 71% of leaders say their workforces are not yet ready to successfully leverage the technology
  • 51% believe their organizations lack the skilled talent needed to manage AI
  • 45% of CEOs think most employees are resistant or even openly hostile to AI

Workforce readiness varies by industry. Businesses in Banking, Financial Services and Insurance report the highest levels of preparedness, while those in Healthcare report trailing behind.

Despite widespread attempts at implementation, most organizations are not currently benefiting from game-changing use cases that will drive new products and services for their customers. Generative AI tools are the most popular use case reported by those surveyed, yet only 4 in 10 leaders report using AI-powered insights to enhance decision-making or unlock growth for their business. Just one-fifth of leaders say the primary use case of AI at their organization is to develop new products and services for customers.

Yet this research also reveals that a small subset of AI Pacesetters has leveraged AI for business growth while addressing workforce readiness. They are making strategic workforce decisions and seeing benefits across their employee population. Pacesetters are uniquely addressing 3 key barriers that are inhibiting AI adoption, and they are seeing benefits from their actions across:

  1. Organizational change management: AI Pacesetters are three times more likely than others to report a fully implemented change management strategy for AI in the workplace.
  2. Lack of employee trust in AI: AI Pacesetters are 29% less likely to cite fears around AI affecting employee engagement.
  3. Skill gaps: AI Pacesetters are 67% more likely to agree that their organization has the tools and processes to accurately inventory the skills employees currently have. Four in 10 report no skills challenges at all.

Compared to CIOs and CTOs, CEOs are far more likely to say their organization is still in its early stages of AI, and two and a half times more likely to say their infrastructure is inadequate to support it. This difference also extends to how they choose to solve AI-related workforce challenges and the individual skills they believe their organization needs to be successful. CEOs are far more likely to turn to outside talent rather than upskilling their own employees.


To read the full report, visit Kyndryl’s People Readiness Report.

Leave a comment »

Unbound raises $4M to help enterprises embrace AI tools on their terms

Posted in Commentary with tags on May 29, 2025 by itnerd

Generative AI tools have become ubiquitous in the enterprise. Employees are using AI copilots to code, draft documents, brainstorm campaigns, and analyze data – often without IT’s knowledge or approval. As adoption spreads from the bottom-up, companies are losing control over how sensitive information is being handled, what models are being used, and who has access to what.

Unbound has raised $4 million to fix this. The oversubscribed seed round was led by Race Capital, with participation from Wayfinder Ventures, Y Combinator, Massive Tech Ventures and others include notable angel investors*. 

Unbound gives IT teams the visibility and controls they need to safely introduce and manage AI tools in the enterprise. Its AI Gateway plugs into commonly used tools – like Cursor, Roo, Cline or internal document copilots – and provides real-time protection, model routing, and usage analytics. From blocking sensitive information leakage to managing model costs and performance, Unbound helps organizations roll out AI on their terms.

The founding team brings deep experience in both enterprise security and infrastructure. CEO and co-founder Rajaram Srinivasan previously led data security products at Palo Alto Networks and Imperva, and earlier worked on SaaS security at the onset of the AI wave. He teamed up with Vignesh Subbiah, a seasoned engineer and former founding team member at Tophatter and Shogun, who scaled engineering teams and platforms from seed to growth stage. After working together at Adobe, the two reconnected to build a system that could meet the urgent security gaps emerging in the new AI stack.

The need became clear quickly. In the early days of GPT-3.5, teams were already sending sensitive prompts into AI tools without oversight – leaking secrets, exposing PII, and consuming costly licenses with no guardrails. Existing DLP tools either blocked the tool altogether or failed to adapt to newer AI workflows.

Unbound takes a different approach. It has already prevented the leakage of 100s of secret credentials – including passwords, API keys, and connection strings – as well as more than 500 instances of personally identifiable information such as customer names, phone numbers, and patient records. Rather than simply blocking prompts, Unbound redacts sensitive content in real time and reroutes high-risk requests to internal, open-source models hosted in the organization’s cloud. This ensures employees get their answers without ever seeing a security speed bump.

The platform also gives companies fine-grained control over model access and cost. Rather than buying a one-size-fits-all license, teams can allocate premium model access to high-stakes workflows – like engineers building core infrastructure – while routing lighter tasks, like content editing, to smaller open-source models. Mid-market customers using Unbound have already saved more than $10,000 annually on unnecessary AI seat licenses. And when new models outperform old ones – as with Gemini 2.5 recently overtaking Claude Sonnet for certain coding tasks – Unbound allows IT to roll them out incrementally, test their effectiveness, and swap them in without breaking employee workflows.

The product is already being used by a growing base of mid-market and enterprise customers across sectors including tech and healthcare. One customer, a leading tech company, recently used Unbound to safely introduce Gemini 2.5 into production AI tools for more than 100 engineers within the same week.

The market is shifting fast. What started as shadow IT is quickly becoming mission-critical infrastructure. Generative AI is embedded in everything from customer support to software engineering – but the tooling around it is still stuck in early-stage chaos. CIOs and CISOs are looking for ways to support AI adoption without compromising security or governance. Unbound is building that foundation.

Unbound is just getting started. The team plans to expand integrations across the AI ecosystem, deepen model routing capabilities, and support internal model orchestration for enterprises adopting open-source LLMs. Their mission is simple: to ensure every organization can embrace AI without losing control in the process.

* Other investors in the round included: Alpha Square Group, Northside Ventures, Liquid2, Pioneer Fund, Scale Asia Ventures, SBXI and notable angels including Ram Shriram (founding board member at Google), Dr. Trishan Panch (CSO LuminHealth), Dr. John Brownstein (Chief Innovation Officer, Boston Children’s hospital), Taro Fukuyama (CEO, Fond), Eli Brown (CEO, Guilded, acquired by Roblox), Chris Siakos (CEO Sinefa, acquired by Palo Alto Networks), Joe Vadakkan (CISO, Ex- CRO), Zain Rizavi (Cloudflare, Ridge VC), Finbarr Taylor (CEO, Shogun) alongside other silicon valley and cybersecurity veterans.

Leave a comment »

Unimed exposed 14M patient-doctor messages 

Posted in Commentary with tags on May 29, 2025 by itnerd

Cybernews has discovered a major data leak with the world’s largest healthcare cooperative, Unimed, exposing 14 million patient-doctor messages. The data included uploaded pictures, documents, and other personal information.

What details are involved in the Unimed data leak?

  • Uploaded pictures
  • Uploaded documents
  • Sent messages
  • Names
  • Phone numbers
  • Email addresses
  • Unimed card numbers

What are the potential dangers of this leak?

Healthcare data is highly valuable to cybercriminals, enabling identity theft, insurance fraud, phishing, and even blackmail. In this case, the breach was especially severe, as it could have allowed attackers to send, delete, or alter messages to users — opening the door to serious manipulation.

To read the full research report, please click here.

Leave a comment »

New Travel Research Report Identifies Over 5,000 Newly Registered Domains Scamming Travelers in Q1 2025

Posted in Commentary with tags on May 29, 2025 by itnerd

With Summer approaching in just a month, the travel season is starting to bloom. However, as we enter one of the busiest travel seasons yet, a surge in travel plans unfortunately is accompanied by a surge in security threat risks all the way from travel to hospitality scams and everything in between. 

The BforeAI threat research team at PreCrime Labs has released their latest research determining the level of travel-related scam activity being actively planned for the 2025 travel season targeting the travel and hospitality sector. Research identified over 5,000 newly registered travel-related domains and significant update activity to over 6,000 existing relevant domains in the first quarter of 2025.

Additionally, the research exposed several campaigns that targeted travel victims filled with special flight giveaways, websites threatening to expose companies, and scams associated with lodging. 

With holiday travel surges, organizations must address the threat landscape extending beyond the traditional booking scams and typosquatting attempts, that further can extend to unconventional job offers, crypto coins, and integration of AI.

You can read the research here.

Leave a comment »

IAM Maturity Lagging Across Most Organizations, GuidePoint Security Finds

Posted in Commentary with tags on May 29, 2025 by itnerd

A new report released today by GuidePoint Security, in partnership with the Ponemon Institute, found that most organizations are falling short in their Identity and Access Management (IAM) strategy—leaving them vulnerable to identity-based threats.

Although 75% of cyberattacks leveraged identity-based threats last year, GuidePoint Security’s State of Identity and Access Management (IAM) Maturity Report has unveiled that IAM remains under-prioritized compared to other IT security investments, with most organizations still in the early to mid-stages of IAM maturity. Only half of respondents rate their IAM tools as effective, and even fewer (44%) express high confidence in their ability to prevent identity-based incidents.

The report also highlights significant gaps in IAM technology, expertise and resources—factors that are stalling programmatic maturity and making it more difficult for organizations to secure identities across today’s complex environments.

Key findings from The State of Identity and Access Management (IAM) Maturity Report include:

  • IAM is underfunded and underdeveloped. Only 50% of respondents believe their IAM tools and investments are effective. Investments in IAM trail behind other security priorities.
  • Manual processes and expertise gaps are barriers to maturity. A lack of appropriate technologies (54%), in-house expertise (52%) and resources (45%) are cited as top challenges to achieving IAM maturity. Many organizations still rely on spreadsheets, scripts and other manual efforts.
  • IAM maturity is a path to enhanced security. A small group (23%) of organizations that have invested in automation and advanced IAM technologies report fewer security incidents and stronger identity controls. They lead in adopting biometric authentication, identity threat detection and integrated governance platforms.
  • IAM implementation is misaligned with security goals. Surprisingly, 45% of respondents say the primary driver for IAM investments is to improve user experience—not security.
  • There is a disconnect in program perception and reality. While most organizations report having policies in place or in development (83%), only 28% have these policies integrated into their IAM platforms.

The State of Identity and Access Management Maturity Report is based on responses from a comprehensive survey of 625 U.S.-based IT and IT security professionals involved in their organizations’ identity and access management program.

Click here to download The State of Identity and Access Management (IAM) Maturity, 2025

Leave a comment »

LexisNexis Pwned With The Personal Data Of 360,000 Out In The Wild

Posted in Commentary with tags on May 28, 2025 by itnerd

 It was confirmed today that information belonging to more than 360,000 people was leaked in a data breach affecting an arm of the analytics giant LexisNexis.

The breach occurred on December 25th, but Lexis Nexis only discovered it on April 1st, 2025, and is just starting to notify people. The company says it “promptly launched an investigation” and “notified law enforcement” once it discovered the breach, adding that the types of information exposed “varied by affected individual.” 

LexisNexis spokesperson Jennifer Richman told TechCrunch that an attacker obtained the data through the firm’s GitHub account. Neither LexisNexis nor GitHub immediately responded to The Verge’s request for comment.

LexisNexis is one of the biggest data brokers in the US, as it works to collect and sell vast amounts of personal information for fraud and risk assessment. Last year, LexisNexis was named in a report from The New York Times, which found that automakers had been sharing driving data with the firm that the firm then sold to insurance companies, leading to higher premiums for the drivers. Other than serving as a data broker, LexisNexis also offers access to a database of news articles, public records, and legal documents.

Chris Hauk, Consumer Privacy Champion at Pixel Privacy had this to say:

“Data breaches like this one underscore the need for users to remove their personal data from as many data brokers as possible. Data brokers are popular targets among the bad actors of the world, as they are literal treasure troves of personal and often financial information. This one is particularly troubling due to what was exposed, including driver’s license and Social Security numbers, as well as date of birth. This information is of value to hackers, as it can be used to open fraudulent accounts in the victim’s name, and it can also be used to gain access to current financial accounts.”

“There needs to be more legislation as to how data brokers collect, store, and share and sell users’ information. Personally, I am not a fan of LexisNexis, following the retaliation it conducted against the group of users that filed a class action lawsuit against the company last year, by freezing their credit and falsely reporting them as identity theft victims. This is uncalled for and is what should be considered criminal conduct. At the very least, it was childish.”

A data breach at a company like LexisNexis is not just bad news, it’s horrible news. The damage that this creates is potentially huge and underscores why personal data needs to be better controlled.

UPDATE: James McQuiggan, security awareness advocate at KnowBe4 added this comment:

“Third-party integrations can expose organizations to serious risk. When sensitive data flows through external platforms, oversight must match internal standards. Token misuse, shared credentials, and poor API security create vulnerabilities that attackers exploit without breaching your perimeter.

Security questionnaires and audits often miss insecure development practices in vendor tools. Many organizations trust integrations by default without visibility into how data is accessed or stored. Vendor risk is operational risk, and short-lived API tokens can be considered. Organizations and security teams should build incident response plans that account for data leaks caused by third parties, not just direct attacks. You can’t outsource responsibility without oversight.”

Leave a comment »

KnowBe4 Named to Newsweek’s List of the 2025 Global Most Loved Workplaces

Posted in Commentary with tags on May 28, 2025 by itnerd

Newsweek Magazine today announced the 2025 Top 100 Global Most Loved Workplaces®, developed in partnership with Most Loved Workplace®, a division of Best Practice Institute (BPI). KnowBe4 was ranked #51 on this prestigious list, which highlights companies across the globe where employees genuinely love to work.

Now in its third year, the Top 100 Global Most Loved Workplaces® list is based on research from BPI’s Love of Workplace Index®, drawing on data from more than two million employees worldwide. Companies featured have demonstrated extraordinary commitment to building cultures of trust, respect, purpose, and employee connection, regardless of size, location, or industry.

The ranking is informed by employee perspectives in five key areas: how positive employees feel about their future at the company, career achievement, alignment of employer values with employee values, respect at all levels, and collaboration. Additional factors—such as diversity and belonging, leadership, and professional development—were also evaluated in relation to these core sentiment drivers.

To view the complete 2025 Global Most Loved Workplaces® list, visit https://rankings.newsweek.com/global-most-loved-workplaces-2025.

Methodology

The 2025 Global Most Loved Workplaces® list was developed in partnership with Best Practice Institute (BPI) using its proprietary Love of Workplace Index®, which includes direct employee survey responses and analysis across five core sentiment areas: employee satisfaction with future vision, career achievement, values alignment, respect, and collaboration. More than two million employees worldwide were surveyed across companies ranging in size from 10 to over 10,000 employees. Additional evaluation included written submissions and interviews with several hundred company executives, along with analysis of external public ratings. Newsweek’s global editorial team then conducted independent research to finalize the list—recognizing companies that place trust, belonging, and respect at the center of their business and workplace culture.

Leave a comment »

Massive data leak exposes 1.6M of Etsy and other TikTok shops customer details

Posted in Commentary with tags on May 28, 2025 by itnerd

The Cybernews research team has uncovered a major data breach affecting 1.6 million customers of Etsy, Poshmark, and other TikTok shops, primarily in the U.S., with some affected users in Canada and Australia.

Two exposed instances revealed shipping confirmation emails in HTML format, exposing personal information such as full names and addresses.

What data was leaked? 

  • Full names
  • Home addresses
  • Email addresses
  • Shipping order details

Why is an Etsy shipping email leak dangerous?

  • Attackers could impersonate Etsy or shipping providers to launch convincing phishing campaigns.
  • Leaked order details make fraudulent emails appear legitimate, increasing the success rate of scams.
  • Access to email and shipping info enables social engineering tactics to extract additional personal or financial data from victims.

To read the full research report, please click here.

Leave a comment »

Radiant Logic Unveils Real-Time Identity Observability Capabilities to its Identity Security Posture Management Platform 

Posted in Commentary with tags on May 28, 2025 by itnerd

Radiant Logic today announced its new Identity Observability features as part of the RadiantOne platform. As identity remains the dominant attack vector for cybercriminals, the latest enhancements to the RadiantOne platform deliver real-time visibility and context into the entire Identity and Access Management (IAM) ecosystem—empowering organizations to proactively detect, prioritize and remediate risks before they are exploited. 

Gartner® in their 2025 Guidance for Comprehensive IAM Architecture Strategy recommends organizations should “Invest in a centralized identity and access data platform that integrates discovery tools across all IAM layers to aggregate, correlate and reconcile identity and access data. Implement emerging artificial intelligence (AI)-driven identity and access intelligence solutions to enhance observability and automation to quickly remedy vulnerabilities or facilitate a response to identity threats.”  

RadiantOne discovers, correlates and unifies all human and non-human identity data through a centralized, AI-powered platform that delivers real-time visibility and risk remediation across an organization’s hybrid and multi-cloud environments.    

RadiantOne Key Features include:

  • Real-Time Discovery and Observability: Continuously monitors identity systems, change events and access paths—alerting teams to anomalies and deviations from policy. 
  • Unified Visibility Across the Identity Stack: Provides a graph-based, semantic model of the entire identity ecosystem, including Active Directory, LDAP, On-premise apps, Entra Identity, SaaS apps and more. 
  • Dynamic Risk Scoring: Uses advanced heuristics and pattern recognition to evaluate the maturity and risk of identities and access relationships. 
  • AI-Driven Remediation with AIDA: The AI Data Assistant (AIDA) analyzes complex identity relationships, recommends corrective actions, and facilitates collaborative remediation with line managers and resource owners. 
  • Dashboards and Reporting: Offers real-time identity hygiene monitoring, rich reporting, and maturity assessments to guide policy enforcement and compliance. 

Deployed as a SaaS solution or in a self-managed environment, the RadiantOne platform fits seamlessly into enterprise architectures and accelerates the time-to-value for identity-first security initiatives such as IAM, IGA, and Zero Trust—without the need to rip and replace.  

Leave a comment »

« Older Entries
Newer Entries »