Cloud Security starts with you

Scroll for more

Services

01

Data breaches are a certainty. Our breach investigation service is carried out swiftly, discreetly and communicated clearly to you giving you peace of mind.

A security baseline will help you understand if your Microsoft 365 services are adequately protecting your users and data from cyber security risks. 

02

Services

The modern security perimeter now extends beyond an organisation's network to include employee and device identity. Protecting your identity is critical.

Secure Internet access anywhere, anytime on any device, whether your employees are on the corporate network or not, without any on-premises infrastructure!

03

Services

Safeguard your business against malicious threats posed by emails, attachments, links and collaboration tools across Microsoft 365 across all devices.

Data frequently travels beyond corporate network borders, but also across numerous platforms and devices over which your business have little or no control.

Microsoft has identified a Chinese cyber actor, Storm-0940, using the botnet Quad7, or CovertNetwork-1658, for sophisticated password spray attacks. These attacks aim to compromise credentials from various Microsoft clients. Active since 2021, Stor
Microsoft has identified a Chinese cyber actor, Storm-0940, using the botnet Quad7, or CovertNetwork-1658, for sophisticated password spray attacks. These attacks aim to compromise credentials from various Microsoft clients. Active since 2021, Storm-0940 gains entry through password sprays, brute force, or exploiting network applications. The malware targets brands like TP-Link, Zyxel, Asus, Axentra, D-Link, and NETGEAR's SOHO routers and VPNs. https://bit.ly/40BjYHs #CyberSecurity #Hacking #Botnet #Microsoft #DataBreach #PasswordSecurity #NetworkSecurity #ThreatIntelligence #CyberThreat #TechNews
Threat actors are actively attempting to exploit a now-patched security flaw in Veeam Backup & Replication to deploy Akira and Fog ransomware. Cybersecurity vendor Sophos said it has been tracking a series of attacks in the past month leveraging
Threat actors are actively attempting to exploit a now-patched security flaw in Veeam Backup & Replication to deploy Akira and Fog ransomware. Cybersecurity vendor Sophos said it has been tracking a series of attacks in the past month leveraging compromised VPN credentials and CVE-2024-40711 to create a local account and deploy the ransomware. CVE-2024-40711, rated 9.8 out of 10.0 on the CVSS scale, refers to a critical vulnerability that allows for unauthenticated remote code execution. It was addressed by Veeam in Backup & Replication version 12.2 in early September 2024. https://www.veeam.com/kb4649 #veeam #CyberCloud #cyberattack
The Irish Data Protection Commission (DPC) has fined #Meta €91 million (USD$101.56 million) as part of a probe into a security lapse in March 2019, when the company disclosed that it had mistakenly stored users' passwords in plaintext. The inve
The Irish Data Protection Commission (DPC) has fined #Meta €91 million (USD$101.56 million) as part of a probe into a security lapse in March 2019, when the company disclosed that it had mistakenly stored users' passwords in plaintext. The investigation, launched by the DPC the next month, found that the social media giant violated four different articles under the European Union's General Data Protection Regulation (#GDPR). The DPC faulted Meta for failing to promptly notify the DPC of the data breach, document personal data breaches concerning the storage of user passwords in plaintext and utilise proper technical measures to ensure the confidentiality of users' passwords. Meta originally revealed that the privacy transgression led to the exposure of a subset of users' Facebook passwords in plaintext, although it noted that there was no evidence it was improperly accessed or abused internally. A month later, the company acknowledged that millions of Instagram passwords were also stored in a similar manner and affected users notified. https://www.dataprotection.ie/en/news-media/press-releases/DPC-announces-91-million-fine-of-Meta #databreach #CyberCloud
The UK Information Commissioner's Office (ICO) has confirmed that social networking platform LinkedIn has suspended processing users' data in the country to train its artificial intelligence (AI) models. The ICO intends to closely monitor companies
The UK Information Commissioner's Office (ICO) has confirmed that social networking platform LinkedIn has suspended processing users' data in the country to train its artificial intelligence (AI) models. The ICO intends to closely monitor companies that offer generative AI capabilities, including Microsoft and LinkedIn, to ensure that they have adequate safeguards in place and take steps to protect the information rights of UK users. The development comes after the Microsoft-owned company admitted to training its own AI on users' data without seeking their explicit consent as part of an updated privacy policy that went into effect on September 18, 2024. https://bit.ly/4efWxay #LinkedIn #Microsoft #CyberCloud
Cybersecurity researchers have disclosed a critical security flaw impacting Microsoft's Copilot Studio that could be exploited to access sensitive information. Tracked as CVE-2024-38206 (CVSS score: 8.5), the vulnerability has been described as an i
Cybersecurity researchers have disclosed a critical security flaw impacting Microsoft's Copilot Studio that could be exploited to access sensitive information. Tracked as CVE-2024-38206 (CVSS score: 8.5), the vulnerability has been described as an information disclosure bug stemming from a server-side request forgery (SSRF) attack. An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network. https://bit.ly/3XshSWX #Copilot #Cybersecurity #CyberCloud
SonicWall has disclosed that a critical security vulnerability in SonicOS, recently patched, may be actively exploited. It is crucial for users to promptly apply the updates. Known as CVE-2024-40766, this vulnerability has a CVSS score of 9.3 out o
SonicWall has disclosed that a critical security vulnerability in SonicOS, recently patched, may be actively exploited. It is crucial for users to promptly apply the updates. Known as CVE-2024-40766, this vulnerability has a CVSS score of 9.3 out of 10. An issue with access control in SonicWall SonicOS management access and SSLVPN has been detected, potentially leading to unauthorised access to resources and, under certain circumstances, causing the firewall to malfunction. Affected devices include SonicWall Firewall Gen 5 and Gen 6, along with Gen 7 devices running SonicOS 7.0.1-5035 and older versions. https://bit.ly/3TmcCTE #CyberSecurity #NetworkSecurity #CyberCloud
An unidentified malicious actor has been associated with a large-scale fraudulent operation that took advantage of a misconfiguration in the email routing system of email security provider Proofpoint. This operation involved the sending of millions o
An unidentified malicious actor has been associated with a large-scale fraudulent operation that took advantage of a misconfiguration in the email routing system of email security provider Proofpoint. This operation involved the sending of millions of fake emails impersonating well-known companies like Best Buy, IBM, Nike, and Walt Disney. These emails were sent through official Proofpoint email servers with verified #SPF and #DKIM signatures, allowing them to evade #DMARC security measures and trick recipients into divulging financial information and credit card details. Cybersecurity experts have named this scheme EchoSpoofing. It is believed that this activity began in January 2024, with the threat actor exploiting the loophole to send an average of three million emails per day, reaching a peak of 14 million in early June when Proofpoint started implementing countermeasures. https://buff.ly/3YlNtM3 # Proofpoint #CyberCloud
Cybersecurity researchers have discovered a new "0.0.0.0 Day" impacting all major web browsers that malicious websites could take advantage of to breach local networks. The critical vulnerability exposes a fundamental flaw in how browsers
Cybersecurity researchers have discovered a new "0.0.0.0 Day" impacting all major web browsers that malicious websites could take advantage of to breach local networks. The critical vulnerability exposes a fundamental flaw in how browsers handle network requests, potentially granting malicious actors access to sensitive services running on local devices. 0.0.0.0 Day impacts Google Chrome/Chromium, Mozilla Firefox, and Apple Safari, all of which enable external websites to communicate with software that runs locally on MacOS and Linux. It does not affect Windows devices as Microsoft blocks the IP address at the operating system level. https://buff.ly/3SJopLl #Cyberthreat #CyberCloud
Facebook users are the target of a scam e-commerce network that uses hundreds of fake websites to steal personal and financial data using brand impersonation and malvertising tricks. It exclusively targeted mobile users who accessed the scam sites v
Facebook users are the target of a scam e-commerce network that uses hundreds of fake websites to steal personal and financial data using brand impersonation and malvertising tricks. It exclusively targeted mobile users who accessed the scam sites via ad lures on Facebook, some of which relied on limited-time discounts to entice users into clicking. The counterfeit websites and ads have been found to mainly impersonate a major online e-commerce platform and a power tools manufacturer, as well as single out victims with bogus sales offers for products from various well-known brands. Another crucial distribution mechanism entails the use of fake user comments on Facebook. https://bit.ly/4fOhV8b #Facebook #Cybercrime #CyberCloud
Cybersecurity researchers are concerned about a new phishing campaign that targets Microsoft OneDrive users with the aim of executing a malicious PowerShell script. The campaign heavily relies on social engineering tactics to deceive users into exec
Cybersecurity researchers are concerned about a new phishing campaign that targets Microsoft OneDrive users with the aim of executing a malicious PowerShell script. The campaign heavily relies on social engineering tactics to deceive users into executing a PowerShell script, thereby compromising their systems. The attack unfolds via an email containing an HTML file that, when opened, displays an image simulating an OneDrive page and includes the error message that says: "Failed to connect to the 'OneDrive' cloud service. To fix the error, you need to update the DNS cache manually." The message also comes with two options, namely "How to fix" and "Details," with the latter directing the email recipient to a legitimate Microsoft Learn page on Troubleshooting DNS. However, clicking "How to fix" prompts the user to follow a series of steps, which includes pressing "Windows Key + X" to open the Quick Link menu, launching the PowerShell terminal, and pasting a Base64-encoded command to supposedly fix the issue. https://www.trellix.com/blogs/research/onedrive-pastejacking/ #OneDrive #Phishing #CyberCloud
Businesses globally face disruptions to their Windows workstations due to a faulty update from cybersecurity firm CrowdStrike. Various sectors like have been impacted. CrowdStrike has fixed the issue with its Falcon Sensor product. https://buff.ly/4c
Businesses globally face disruptions to their Windows workstations due to a faulty update from cybersecurity firm CrowdStrike. Various sectors like have been impacted. CrowdStrike has fixed the issue with its Falcon Sensor product. https://buff.ly/4cPyHS6 #CrowdStrike #CyberCloud
American telecom service provider AT&T has confirmed that threat actors breached their systems and accessed data belonging to almost all of its wireless customers and mobile virtual network operators (MVNOs) using AT&T's services. The breach
American telecom service provider AT&T has confirmed that threat actors breached their systems and accessed data belonging to almost all of its wireless customers and mobile virtual network operators (MVNOs) using AT&T's services. The breach occurred due to unauthorised entry into an AT&T workspace hosted on a third-party cloud platform between 14-25 April 2024, resulting in the theft of files containing customer call and text records spanning from May to October 2022 and January 2023. The compromised information included phone numbers, communications with AT&T or other service providers, as well as the duration of phone calls. https://buff.ly/3XVKRo7 #AT&T #CyberCloud #Cyberthreat
Cybersecurity experts have uncovered a vulnerability in the RADIUS network authentication protocol named BlastRADIUS that could be exploited by malicious actors to conduct Mallory-in-the-middle (MitM) attacks and evade integrity checks in specific si
Cybersecurity experts have uncovered a vulnerability in the RADIUS network authentication protocol named BlastRADIUS that could be exploited by malicious actors to conduct Mallory-in-the-middle (MitM) attacks and evade integrity checks in specific situations. The RADIUS protocol permits certain Access-Request messages to skip integrity or authentication verifications, enabling attackers to tamper these packets without detection. The attacker would be able to force any user to authenticate and give any authorisation (like VLAN access) to that user. RADIUS, short for Remote Authentication Dial-In User Service, is a client/server protocol that provides centralised authentication, authorisation, and accounting (AAA) management for users connecting to a network service. https://buff.ly/4cwLgSs #BlastRADIUS #Cyberthreat #CyberCloud
A China-nexus cyber espionage group, Velvet Ant, has exploited a zero-day flaw in Cisco NX-OS Software used in its switches to deliver malware. Vulnerability CVE-2024-20399 (CVSS score: 6.0), concerns a command injection issue that allows an authent
A China-nexus cyber espionage group, Velvet Ant, has exploited a zero-day flaw in Cisco NX-OS Software used in its switches to deliver malware. Vulnerability CVE-2024-20399 (CVSS score: 6.0), concerns a command injection issue that allows an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. Velvet Ant executed a previously unknown custom malware that allowed the threat group to remotely connect to compromised Cisco Nexus devices, upload additional files, and execute code on the devices. According to Cisco, the issue stems from insufficient validation of arguments that are passed to specific configuration CLI commands. https://buff.ly/3XI5LqG #Cisco #CyberCloud #Malware
A malvertising campaign is leveraging trojanized installers for popular software such as Google Chrome and Microsoft Teams to deploy a backdoor known as Oyster. Rapid7 discovered fake websites housing these malicious payloads that users are redirect
A malvertising campaign is leveraging trojanized installers for popular software such as Google Chrome and Microsoft Teams to deploy a backdoor known as Oyster. Rapid7 discovered fake websites housing these malicious payloads that users are redirected to after searching on Google and Bing. Threat actors are luring unsuspecting users to fake websites claiming to offer genuine software, but attempting to download the setup binary launches a malware infection chain instead. The executable serves as a pathway for Oyster, enabling it to collect data about the compromised system, communicate with a predetermined command-and-control server, and facilitate remote code execution. https://buff.ly/3RFtdks #Oyster #Malvertising #Rapid7 #CyberCloud
Microsoft has underscored the importance of enhancing the security of internet-connected operational technology (OT) devices in light of a series of cyber assaults aimed at such environments since late 2023. The recurrent breaches targeting OT devi
Microsoft has underscored the importance of enhancing the security of internet-connected operational technology (OT) devices in light of a series of cyber assaults aimed at such environments since late 2023. The recurrent breaches targeting OT devices highlight the critical necessity to bolster the security stance of these devices to prevent them from being vulnerable to cyber threats. Microsoft has pointed out that a cyber breach on an OT system could enable malicious individuals to manipulate crucial parameters utilised in industrial operations, either through the programmable logic controller (PLC) or the graphical interface controls of the human-machine interface (HMI), leading to operational malfunctions and system downtime. https://buff.ly/3x8K9sq #Microsoft #cyberbreach #CyberCloud
Research indicates that ransomware attacks on VMware ESXi infrastructure exhibit a consistent pattern regardless of the specific malware used. Virtualisation platforms are a crucial element of organisational IT systems but often contain vulnerabiliti
Research indicates that ransomware attacks on VMware ESXi infrastructure exhibit a consistent pattern regardless of the specific malware used. Virtualisation platforms are a crucial element of organisational IT systems but often contain vulnerabilities that are exploited by threat actors. Various ransomware tools like LockBit, HelloKitty, BlackMatter, and others have been employed in attacks on virtual environments, showing a common sequence of tactics. To mitigate these risks, organisations should focus on implementing robust monitoring and logging, establishing secure backup procedures, enforcing strict authentication protocols, strengthening the environment's defenses, and implementing network controls to prevent lateral movement. https://buff.ly/4by1kTb #VMware #Ransomware #CyberCloud
Researchers have unearthed a fresh security flaw in the IEEE 802.11 Wi-Fi standard, leading users to connect to insecure networks. The SSID Confusion flaw, known as CVE-2023-52424, affects various systems and Wi-Fi clients, jeopardizing network tra
Researchers have unearthed a fresh security flaw in the IEEE 802.11 Wi-Fi standard, leading users to connect to insecure networks. The SSID Confusion flaw, known as CVE-2023-52424, affects various systems and Wi-Fi clients, jeopardizing network traffic. Attackers can deceive victims by posing as a trusted network, enabling them to intercept data or launch attacks. Moreover, this exploit can disable VPNs set to auto-disable on trusted networks, exposing user traffic. #SSIDConfusion #WiFiVulnerability #NetworkSecurity #DataPrivacy #InternetThreats #Cybersecurity #VulnerabilityDisclosure #SSIDAttack
Researchers have detailed a VPN bypass technique named TunnelVision that allows threat actors to intercept network traffic on the same local network. The method, assigned CVE identifier CVE-2024-3661 with a CVSS score of 7.6, affects operating syst
Researchers have detailed a VPN bypass technique named TunnelVision that allows threat actors to intercept network traffic on the same local network. The method, assigned CVE identifier CVE-2024-3661 with a CVSS score of 7.6, affects operating systems with DHCP client support for DHCP option 121 routes. TunnelVision works by routing unencrypted traffic through a VPN via an attacker-controlled DHCP server using option 121 to manipulate the user's routing table. This vulnerability arises from the lack of authentication in DHCP option messages. https://bit.ly/3UHeAxL #TunnelVision #VPN #CyberCloud
The U.S. government has issued a recent cybersecurity advisory regarding the activities of North Korean threat actors. These actors are employing tactics to make their emails appear as if they are coming from trusted sources. The Democratic People'
The U.S. government has issued a recent cybersecurity advisory regarding the activities of North Korean threat actors. These actors are employing tactics to make their emails appear as if they are coming from trusted sources. The Democratic People's Republic of Korea (DPRK) uses spear-phishing campaigns to gather intelligence on geopolitical events, foreign policy strategies of adversaries, and any information that impacts DPRK interests. They achieve this by gaining unauthorised access to private documents, research, and communications of their targets. This particular technique takes advantage of poorly configured DNS Domain-based Message Authentication, Reporting, and Conformance (DMARC) record policies to mask their social engineering efforts. By exploiting DMARC policies set to 'none', threat actors can send fake emails that seem to originate from a legitimate domain's email server. CyberCloud advises organisations to update their DMARC policies to direct their email servers to treat email messages that fail the checks as suspicious or spam (i.e. quarantine or reject) and receive feedback reports by establishing an email address in the DMARC record. https://buff.ly/49ZDKND #DMARC #CyberCloud #socialengineering
Microsoft has identified a Chinese cyber actor, Storm-0940, using the botnet Quad7, or CovertNetwork-1658, for sophisticated password spray attacks. These attacks aim to compromise credentials from various Microsoft clients. Active since 2021, Stor Threat actors are actively attempting to exploit a now-patched security flaw in Veeam Backup & Replication to deploy Akira and Fog ransomware. Cybersecurity vendor Sophos said it has been tracking a series of attacks in the past month leveraging The Irish Data Protection Commission (DPC) has fined #Meta €91 million (USD$101.56 million) as part of a probe into a security lapse in March 2019, when the company disclosed that it had mistakenly stored users' passwords in plaintext. The inve The UK Information Commissioner's Office (ICO) has confirmed that social networking platform LinkedIn has suspended processing users' data in the country to train its artificial intelligence (AI) models. The ICO intends to closely monitor companies Cybersecurity researchers have disclosed a critical security flaw impacting Microsoft's Copilot Studio that could be exploited to access sensitive information. Tracked as CVE-2024-38206 (CVSS score: 8.5), the vulnerability has been described as an i SonicWall has disclosed that a critical security vulnerability in SonicOS, recently patched, may be actively exploited. It is crucial for users to promptly apply the updates. Known as CVE-2024-40766, this vulnerability has a CVSS score of 9.3 out o An unidentified malicious actor has been associated with a large-scale fraudulent operation that took advantage of a misconfiguration in the email routing system of email security provider Proofpoint. This operation involved the sending of millions o Cybersecurity researchers have discovered a new "0.0.0.0 Day" impacting all major web browsers that malicious websites could take advantage of to breach local networks. The critical vulnerability exposes a fundamental flaw in how browsers Facebook users are the target of a scam e-commerce network that uses hundreds of fake websites to steal personal and financial data using brand impersonation and malvertising tricks. It exclusively targeted mobile users who accessed the scam sites v Cybersecurity researchers are concerned about a new phishing campaign that targets Microsoft OneDrive users with the aim of executing a malicious PowerShell script. The campaign heavily relies on social engineering tactics to deceive users into exec Businesses globally face disruptions to their Windows workstations due to a faulty update from cybersecurity firm CrowdStrike. Various sectors like have been impacted. CrowdStrike has fixed the issue with its Falcon Sensor product. https://buff.ly/4c American telecom service provider AT&T has confirmed that threat actors breached their systems and accessed data belonging to almost all of its wireless customers and mobile virtual network operators (MVNOs) using AT&T's services. The breach Cybersecurity experts have uncovered a vulnerability in the RADIUS network authentication protocol named BlastRADIUS that could be exploited by malicious actors to conduct Mallory-in-the-middle (MitM) attacks and evade integrity checks in specific si A China-nexus cyber espionage group, Velvet Ant, has exploited a zero-day flaw in Cisco NX-OS Software used in its switches to deliver malware. Vulnerability CVE-2024-20399 (CVSS score: 6.0), concerns a command injection issue that allows an authent A malvertising campaign is leveraging trojanized installers for popular software such as Google Chrome and Microsoft Teams to deploy a backdoor known as Oyster. Rapid7 discovered fake websites housing these malicious payloads that users are redirect Microsoft has underscored the importance of enhancing the security of internet-connected operational technology (OT) devices in light of a series of cyber assaults aimed at such environments since late 2023. The recurrent breaches targeting OT devi Research indicates that ransomware attacks on VMware ESXi infrastructure exhibit a consistent pattern regardless of the specific malware used. Virtualisation platforms are a crucial element of organisational IT systems but often contain vulnerabiliti Researchers have unearthed a fresh security flaw in the IEEE 802.11 Wi-Fi standard, leading users to connect to insecure networks. The SSID Confusion flaw, known as CVE-2023-52424, affects various systems and Wi-Fi clients, jeopardizing network tra Researchers have detailed a VPN bypass technique named TunnelVision that allows threat actors to intercept network traffic on the same local network. The method, assigned CVE identifier CVE-2024-3661 with a CVSS score of 7.6, affects operating syst The U.S. government has issued a recent cybersecurity advisory regarding the activities of North Korean threat actors. These actors are employing tactics to make their emails appear as if they are coming from trusted sources. The Democratic People'