Silver Spring, Maryland, 5th February 2025, CyberNewsWire

**Silver Spring, Maryland, February 5th, 2025, CyberNewsWire**

Aembit, the non-human identity and access management (IAM) company, today announced that Michael Trites has joined the company as senior vice president of global sales. In this role, Trites will lead Aembit’s global sales strategy, driving adoption of its industry-first Workload IAM Platform.

Trites brings over two decades of experience scaling sales organizations at high-growth security companies. He previously served as executive vice president of global sales at Dig Security, a provider of data security posture management, where he helped drive the company’s expansion and go-to-market strategy, leading to its acquisition by Palo Alto Networks.

> “Michael’s track record spearheading adoption in emerging cybersecurity markets makes him the ideal leader to accelerate Aembit’s growth,” said David Goldschlag, co-founder and CEO of Aembit. “His expertise will be essential as we help organizations recognize the importance of securing and managing their rapidly growing mix of client workloads, AI agents, and service accounts.”

Prior to Dig, Trites held sales executive roles at CyCognito, BigID (recognized by Deloitte as one of North America’s fastest-growing companies from 2020 to 2024), and Zimperium, where he helped expand market reach and drive revenue growth. He also spent more than a decade at Riverbed Technology, where he advanced through multiple sales leadership roles, ultimately overseeing sales for the Americas East region. Most recently, he led global sales at MineOS, focusing on data privacy and compliance solutions.

Now at Aembit, he is focused on helping organizations secure non-human identities by authenticating client workloads, enforcing access rights, and issuing short-lived credentials – eliminating static secrets and reducing an attack surface increasingly implicated in high-profile data breaches.

> “Aembit’s approach to non-human identity management fills a major gap in modern security,” Trites said. “Many solutions highlight the risk, but almost none actually solve it. Unlike tools that only provide visibility into service accounts, Aembit enforces policy-based, secretless access and removes the need for developers to build authentication into applications. That lets companies move faster and build with confidence. I’m excited to help bring this model to more organizations.”

For more information about Aembit, users can visit www.aembit.io.

**About Aembit**

Aembit is the leading provider of workload identity and access management solutions, designed to secure non-human identities like applications, AI agents, and service accounts across on-premises, SaaS, cloud, and partner environments. Aembit’s no-code platform enables organizations to enforce access policies in real time, ensuring the security and integrity of critical infrastructure. Users can visit the official website aembit.io and LinkedIn.

**Contact**

Apurva Davé

\[email protected\]

Aembit on LinkedIn

Website 

**Contact**

**CMO**  
**Apurva Davé**  
**Aembit**  
**\[email protected\]**

Michael Trites Joins Aembit as Senior Vice President of Global Sales

Canadian man charged in $65 million DeFi hack. Exploited KyberSwap, Indexed Finance smart contracts, laundered funds, and attempted extortion. Faces 20 years.

A 22-year-old Canadian man, Andean Medjedovic, is facing federal charges in the U.S. for allegedly exploiting **smart contract vulnerabilities** in two decentralized finance (DeFi) protocols, KyberSwap and Indexed Finance, fraudulently obtaining around $65 million from investors between 2021 and 2023.

The **indictment** (PDF), unsealed in a New York federal court accuses Medjedovic of taking advantage of the vulnerabilities and allegedly borrowing massive amounts of digital tokens, then using them to carry out “deceptive trades.”

These trades manipulated the smart contracts into incorrectly calculating key financial metrics. As a result, Medjedovic was able to withdraw millions of dollars in investor funds at inflated prices, effectively wiping out the value of their investments.

Prosecutors further Medjedovic of attempting to cover his tracks through a sophisticated money laundering operation. He allegedly used various techniques, including swap transactions, “bridging transactions,” and a **digital currency “mixer”** to obscure the origin and ownership of the stolen funds. He is also accused of using fake and borrowed identities to open accounts on cryptocurrency exchanges.

According to the DoJ’s **press release**, Following the KyberSwap exploit in November 2023, Medjedovic allegedly attempted to extort the victims. He proposed a bogus settlement, demanding complete control of the KyberSwap platform and its governing decentralized autonomous organization (DAO) in return for half of the stolen digital assets.

Medjedovic now faces a five-count indictment including wire fraud, unauthorized damage to a protected computer, attempted extortion, money laundering conspiracy, and money laundering. If found guilty on all counts, he could face up to 20 years in prison for each charge except the computer damage charge, which carries a maximum 10-year sentence.

The final sentence will be determined by a federal judge. The investigation involved multiple agencies including the IRS, Homeland Security Investigations, and the FBI, with international cooperation from authorities in the Netherlands.

This case goes on to show the ongoing **risks associated with DeFi platforms** and the vulnerabilities that can be exploited by malicious actors. It also underlines the increasing focus of law enforcement on cryptocurrency-related crimes and their commitment to pursuing those who attempt to profit from these schemes.

Canadian Charged in $65M KyberSwap, Indexed Finance DeFi Hack

A global phishing campaign is actively exploiting a legacy Microsoft authentication system to steal user credentials and bypass multi-factor authentication (MFA), targeting over 150 organizations.

A global phishing campaign is underway, exploiting a legacy Microsoft authentication system to steal user credentials and bypass multi-factor authentication (MFA), targeting over 150 organizations.

A sophisticated phishing campaign is exploiting vulnerabilities in Microsoft’s Active Directory Federation Services (ADFS) to compromise user accounts and bypass multi-factor authentication (MFA), as revealed in research by Abnormal Security.

The attackers employ a combination of social engineering and technical manipulation. Phishing emails, mimicking legitimate notifications, lure victims to spoofed ADFS login pages. These emails often use urgent tones, warn of supposed updates or policy changes, and incorporate legitimate branding, logos, and even contact information to appear genuine. 

One of the phishing pages was sent to a targeted company (Via Abnormal Security)

URL obfuscation and shortened links further conceal the malicious destination.  It is worth noting that the attackers personalize the phishing pages to match the target organization’s specific MFA setup, such as tailoring prompts for push notifications, and mechanisms like Microsoft Authenticator, Duo Security, and SMS verification. 

The phishing landing page replicates the organization’s ADFS portal, dynamically pulling logos and design elements, creating a convincing counterfeit. While some client-side validation might exist, the page does not verify credentials against the organization’s systems since any username and password combination is accepted.  

The next step involves capturing the user’s second-factor authentication. Phishing templates are designed to collect various MFA factors, including codes from authenticator apps, SMS messages, or even push notifications. This information, coupled with the stolen credentials, is relayed to the attackers.

To complete the deception, the victim is redirected to the genuine ADFS login page after submitting their information, reinforcing the illusion of a successful login. With the stolen credentials and MFA details, the attackers proceed with account takeover (ATO), often using VPNs to mask their location.  Post-compromise activity typically includes internal reconnaissance, setting up mail filter rules to conceal their presence, and launching lateral phishing attacks.

Lateral phishing, sent from the compromised account, leverages established trust relationships within the organization. These emails often mimic legitimate communication patterns, targeting colleagues and associates. The mail filter rules, often with deceptive names and obfuscated keywords (e.g., “Hish” for “Phish”), help the attackers remain undetected.

“This approach leverages nuanced psychological tactics to exploit human vulnerabilities and reinforce a false sense of legitimacy,” Abnormal Security’s report read.

A fake Microsoft ADFS used in the campaign (Via Abnormal Security)

Research reveals that this campaign has targeted over 150 organizations in various sectors. The education sector is most impacted with 50% of attacks followed by healthcare (14.8%), government (12.5%), technology (6.3%), and transportation (3.4%).  Geographically, the attacks are largely focused on the United States, but incidents have also been reported in Canada, Australia, and Europe.

The report suggests that attackers are exploiting the fact that many organizations have not switched to Microsoft’s modern identity platform, Entra. ADF reliance is particularly prevalent in sectors with slower technology adoption, emphasizing the need for prioritizing migration to modern solutions and employing a multi-layered security approach.

Roger Grimes, a data-driven defence evangelist at KnowBe4, commented on the issue, telling Hackread.com that this is the first time they have heard about fake ADFS login pages hinting at the sophistication of this campaign.

_“_I’m a 36-year cybersecurity expert and author of 15 books (one on hacking MFA and over 1,500 articles. This is the first time I’ve read about fake ADFS login pages, but ADFS has been involved in bypassing MFA authentication before, so it’s not completely new to use in the hacker scene._“_

_“_All users should use phishing-resistant MFA whenever they can,_“_ Roger warned. _“_Unfortunately, most of today’s most popular MFA solutions, including Microsoft Authenticator, Google Authenticator, Duo, push-based MFA, OTP, and SMS-based MFA are very phishable and subject to the exact type of attack reported here._“_

Hackers Using Fake Microsoft ADFS Login Pages to Steal Credentials

Morphisec uncovers a new ValleyRAT malware variant with advanced evasion tactics, multi-stage infection chains, and novel delivery methods…

Morphisec uncovers a new ValleyRAT malware variant with advanced evasion tactics, multi-stage infection chains, and novel delivery methods targeting systems.

Cybersecurity researchers at Morphisec Threat Lab have discovered a new version of the sophisticated ValleyRAT malware distributed through various channels including phishing emails, instant messaging platforms and compromised websites. ValleyRAT is a multi-stage malware, linked to the notorious **Silver Fox APT** group.

According to Morphisec’s investigation, shared with Hackread.com, the key targets of this campaign are high-value individuals within organizations, especially those in finance, accounting, and sales, and the objective is to steal sensitive data.

Infection Chain (Via Morphisec)

Earlier ValleyRAT versions utilized PowerShell scripts disguised as legitimate software installers, which often employed DLL hijacking to inject their payload into signed executables from programs like WPS Office and even Firefox. In August 2024, Hackread.com **reported** about a ValleyRAT version using shellcode to inject malware components directly into the memory. 

Conversely, the current version uses a fake Chinese telecom company “Karlos” website (karlostclub/) to distribute the malware, which downloads a series of files, including a .NET executable that checks for administrator privileges and downloads additional components, including a DLL file.

“Interestingly, the actor reused the same URL for both the older and newer versions of their attack,” researchers wrote in the **blog post**.

According to researchers, a fake Chrome browser download from anizomcom/ is the initial infection vector in the attack chain, tricking the victim into downloading and executing the malware. The sscronet.dll file, deliberately named with a legitimate-sounding identifier to avoid suspicion, injects code into the legitimate svchost.exe process, acting as a monitor, terminating any processes on a predefined exclusion list to prevent interference with the malware’s operation. 

Fake Chrome browser download (Via Morphisec)

Next, the malware utilizes a modified version of the Douyin (Chinese TikTok) executable for DLL side-loading and a legitimate Tier0.dll from Valve games (specifically Left 4 Dead 2 and Killing Floor 2) to execute code hidden within the nslookup.exe process. This process retrieves and decrypts the main ValleyRAT payload from mpclient.dat. 

The decrypted payload uses the **Donut shellcode** to execute the malware in memory, bypassing traditional disk-based detection methods. It also tries to disable security mechanisms like AMSI and ETW.

For your information, ValleyRAT is a C++-based remote access trojan with basic **RAT functionalities** such as accessing the WinSta0 window station for screen, keyboard, and mouse interaction and monitoring the victim’s screen. It incorporates extensive anti-VMware checks to evade detection in virtualized environments and connects with its C2 server using IP addresses and ports that are initialized within its code during installation.

“If the malware does not detect that it is running inside a virtual machine (VM), it attempts to establish a connection to baidu.com as part of its network communication check,” researchers noted.

The Silver Fox APT group’s changing tactics/evasion techniques show the growing sophistication of new attacks. Organizations should adopt a proper security strategy, including stricter endpoint protection, **employee training**, and continuous monitoring, to mitigate risks.

New ValleyRAT Malware Variant Spreading via Fake Chrome Downloads

Austin, TX, USA, 4th February 2025, CyberNewsWire

**Austin, TX, USA, February 4th, 2025, CyberNewsWire**

SpyCloud’s Identity Threat Protection solutions spearhead a holistic identity approach to security, illuminating correlated hidden identity exposures and facilitating fast, automated remediation.

SpyCloud, a leading identity threat protection company, announced key innovations in its portfolio, pioneering the shift to holistic identity threat protection. By operationalizing its vast collection of darknet data with automated identity analytics that correlate malware, phishing, and breach exposures across individuals’ past and present work and personal personas, SpyCloud enables security and fraud prevention teams to comprehensively uncover hidden identity assets, rapidly remediate exposures, and better protect their businesses from previously unseen threats.  

Identity security vendors have focused narrowly on securing corporate accounts, leaving organizations vulnerable to cybercriminals exploiting the broader identity exposures of employees, consumers, and suppliers. A shift to an identity-centric perspective is needed, particularly as the scope of identity exposures continues to grow. SpyCloud research reveals that the average individual has as many as 52 unique usernames/emails and 221 passwords exposed on the darknet across their online personal and professional identities. 

The impact of these exposures is evident: nearly a quarter of data breaches resulted from compromised identity data. Credential attacks led to $4.81 million in related costs per breach and took the longest to identify and contain. 

SpyCloud’s holistic identity threat protection addresses these challenges by encompassing the full spectrum of an individual’s online presence. This innovative approach empowers security teams to proactively protect against previously unseen risks, including the darknet exposures of identity and authentication data stolen about employees, consumers, and suppliers that have been beyond their visibility to date. 

> “The cybersecurity industry has spent years and billions of dollars securing accounts, but criminals have moved far beyond account-level access,” said **Ted Ross, SpyCloud’s CEO and Co-Founder**. “The dirty secret of the identity security industry is that efforts to lock down the perimeter fail because they focus on accounts, while bad actors target the full scope of users’ holistic identities. These sprawling identities, exposed through breaches, infostealer infections, and phishing attacks, create shadow data that traditional tools simply can’t address. ”

> Ross continued, “SpyCloud changes the dynamic by providing unmatched visibility into the same data criminals are exploiting, enabling organizations to remediate exposures across the entirety of users’ online personas. This shifts the advantage back to security leaders, empowering them to act on threats that were previously beyond their reach.”

**Key Innovations Underpinning SpyCloud’s Holistic Identity Threat Protection** 

*   **Refined analytics driving actionability on exposed identities:** SpyCloud applies advanced data science and proprietary technology to dynamically correlate billions of recaptured darknet data points, providing a broader and more accurate view of identities. By connecting authentication data, financial data, and personally identifiable information (PII), SpyCloud uncovers hidden relationships across seemingly unrelated accounts, continuously and at scale.
*   **Automated remediation in <15 minutes:** SpyCloud’s holistic identity portfolio now enables rapid, automated remediation within enterprise security ecosystems, including EDR, IdP, SOAR, and SIEM tools. This allows security teams to neutralize threats in less than 15 minutes of discovery, reducing risk without straining resources or operational bandwidth.
*   **Malware reverse engineering to combat ransomware:** SpyCloud specializes in the tracking and analyzing of malware – with deep insights into pervasive infostealers such as Lumma C2, Redline Stealer, Vidar, and more – as they are often a precursor to ransomware. Through its advanced malware reverse analysis, SpyCloud provides comprehensive visibility into malware-exposed data, helping organizations identify compromised devices, users, and applications and closes critical security gaps, including those stemming from unmanaged or under-managed devices used by employees, contractors, and vendors.
*   **Accelerated cybercrime investigations:** SpyCloud’s Investigations solution, used by cyber threat intelligence (CTI) teams, security operations, fraud and risk prevention analysts, and law enforcement globally, includes automated identity analytics to uncover the full scope of digital identity exposures, accelerating complex cybercrime investigations into threat actor attribution, insider risk (including potential hiring fraud), and supply chain risk analysis from days or hours to minutes.

**SpyCloud’s Capabilities Set a New Standard for Identity Security**

SpyCloud champions the transition to holistic identity security, backed by nearly a decade of experience and the industry’s largest repository of recaptured breach, malware-exfiltrated, and successfully phished data. Its holistic identity lens reveals a comprehensive view of exposed identity information – from credentials and PII to financial data and sensitive digital artifacts.

> “SpyCloud’s innovative identity threat protection is about as important as it gets in cyber; identity is **everything**,” said **John N. Stewart, SpyCloud Board Member and former Chief Security and Trust Officer of Cisco.** “By making it possible to view and act on the world’s best source for identity exposures, SpyCloud raised the bar to the top for proactive defense against all types of identity-driven cyber exploitation.”

> “We are redefining identity security by making holistic protection practical and achievable for our customers,” added **Damon Fleury, SpyCloud’s Chief Product Officer.** “SpyCloud has a long history of leading the way in understanding the cybercrime ecosystem, from our early days in world-class ATO prevention to continuing to build solutions that empower organizations to proactively protect against threats stemming from infostealer malware, phished and breach data.” 

> Fleury continued, “This evolution to make holistic identity threat protection a reality for enterprises is critical to our mission of disrupting cybercrime. We aim to stop identity-based threats once and for all.”

To learn more, users can contact SpyCloud or view the following resources:

*   The Holistic Identity Frontier: Why Shift from account-centric Security to holistic identity threat protection
*   Stop identity-based cybercrimes once and for all

**About SpyCloud**

SpyCloud transforms recaptured darknet data to disrupt cybercrime. Its automated holistic identity threat protection solutions leverage advanced analytics to proactively prevent ransomware and account takeover, safeguard employee and consumer accounts, and accelerate cybercrime investigations. SpyCloud’s data from breaches, malware-infected devices, and successful phishes also powers many popular dark web monitoring and identity theft protection offerings. Customers include seven of the Fortune 10, along with hundreds of global enterprises, mid-sized companies, and government agencies worldwide. Headquartered in Austin, TX, SpyCloud is home to more than 200 cybersecurity experts whose mission is to protect businesses and consumers from the stolen identity data criminals are using to target them now.

To learn more and see insights, users can visit spycloud.com.

**Contact**

**Public Relations**  
**Emily Brown**  
**REQ on behalf of SpyCloud**  
**\[email protected\]**

SpyCloud Pioneers the Shift to Holistic Identity Threat Protection

N. Korean ‘FlexibleFerret’ malware targets macOS with fake Zoom apps, job scams, and bug report comments, deceiving users…

N. Korean ‘FlexibleFerret’ malware targets macOS with fake Zoom apps, job scams, and bug report comments, deceiving users into installation.

A new version of North Korean malware called ‘FlexibleFerret’ is making rounds, specifically targeting macOS devices and developers. This malware, linked to the ‘Contagious Interview’ campaign, uses tricky methods to infect systems, even disguising itself as legitimate software.

****The ‘Contagious Interview’ Trick****

The campaign begins with a **social engineering tactic**. Hackers lure their targets, often job seekers, into downloading malware through fake job interview processes. They send a link that appears to require a software update, like a fake virtual meeting application.

It is worth noting that the ‘Ferret’ malware family was originally discovered in September 2024 targeting Blockchain professionals with fake video conferencing and job scams. The latest variant, ‘FlexibleFerret,’ was discovered by SentinelLabs, and shows that hackers constantly change their methods to avoid detection.

Interestingly, Apple recently strengthened its XProtect security tool to deal with threats like “Ferret,” and other macOS malware. However, despite new security protocols, according to SentinelLabs’ **blog post** shared with Hackread.com, FlexibleFerret remained undetected, at least initially.

****How FlexibleFerret Works****

‘FlexibleFerret’ uses a dropper, which is essentially a package that installs the malware onto the system. This particular dropper contains several components, including fake applications and scripts.

After installation, the malware begins executing several malicious actions. It places and runs hidden components in the computer’s temporary folders, ensuring its presence remains unnoticed. At the same time, it creates a **fake Zoom application** that secretly connects to a suspicious domain.

To further trick victims, it displays a fake error message, making it seem like the installation failed while actually continuing to install itself in the background. Once embedded, it establishes persistence, allowing it to automatically run even after the system is restarted.

****A Signed Threat Against Job Seekers and Developers****

Unlike some older versions, ‘FlexibleFerret’ was initially signed with a valid Apple Developer signature. This helped it bypass some security checks, making it appear more legitimate. Security experts used this signature to discover even more related malware samples. That certificate has since been revoked, but a trail of other signed files has turned up.

The hackers behind ‘FlexibleFerret’ aren’t just focusing on job seekers anymore. They’re also targeting developers directly, using **fake bug reports or comments** on websites like GitHub to trick them into downloading the malware.

A threat actor tricking users into installing FlexibleFerret malware (Via SentinelLabs)

****Links to ChromeUpdate Malware****

FlexibleFerret includes a binary labeled “Mac-Installer.InstallerAlert,” which strongly matches code previously spotted in “**ChromeUpdate**,” an older piece of malware involved in these job interview lures. While Apple’s updated rules catch ChromeUpdate, they currently overlook this newer malware, indicating that attackers have changed minor elements to sneak past protections.

> _“The ‘Contagious Interview’ campaign and the FERRET family of malware represent an ongoing and active campaign, with threat actors pivoting from signed applications to functionally similar unsigned versions as required.”_
> 
>   
> SentinelLabs

1.  **Feds Bust N. Korean Identity Theft Ring Targeting US Firms**
2.  **Hackers used fake job website to scam jobless US veterans**
3.  **KnowBe4 Tricked into Hiring a North Korean Hacker as IT Pro**
4.  **Fake LinkedIn job offers scam spreading More\_eggs backdoor**
5.  **Fake GitHub Repos Caught Dropping Malware as PoCs AGAIN!**
6.  **Employee Duped by AI-Generated CFO in $25.6M Deepfake Scam**
7.  **Fake PoC Script Tricked Researchers into Downloading VenomRAT**

N. Korean ‘FlexibleFerret’ Malware Hits macOS with Fake Zoom, Job Scams

Malicious DeepSeek packages on PyPI spread malware, stealing sensitive data like API keys. Learn how this attack targeted developers and how to protect yourself.

Cybersecurity researchers at the Positive Technologies Expert Security Center (PT ESC) have found a sneaky malware campaign targeting the Python Package Index (PyPI), a popular online repository for **Python software**. The attack focused on developers, machine learning engineers, and AI enthusiasts who might integrate DeepSeek AI into their projects.

It all began on January 29, 2025, when a suspicious user named “bvk,” whose account had been inactive since its creation in June 2023, uploaded two malicious packages: deepseeek or deepseekai. These packages were designed to mimic legitimate integrations with DeepSeek but contained malicious code aimed at stealing sensitive information from users’ systems.

Malicious DeepSeek packages (Via PT ESC)

Once installed, the harmful packages executed commands that collected system information and stole environment variables. These variables often contain critical data, such as credentials for cloud storage, database access, or other infrastructure resources. The stolen information was then sent to a command-and-control (C2) server hosted on Pipedream, a developer integration platform.

Interestingly, according to PT ESC’s **blog post** shared with Hackread.com, the attackers appeared to use an AI-powered assistant to write their malicious script, as evidenced by the code’s comments explaining its functionality. **AI-generated content** and codes have become a significant cybersecurity threat, with experts warning that the risk is only growing.

****Quick Action****

After discovering the malicious packages, Positive Technologies immediately alerted PyPI administrators, who quarantined and deleted the packages within an hour. However, during that short window, the packages had already been downloaded 222 times across various tools and methods in the following countries:

*   **US**: 117 downloads

*   **China**: 36 downloads

*   **Russia**: 12 downloads

*   Other countries, including Germany, Canada, and Hong Kong, also reported downloads.

****Exploiting DeepSeek’s Popularity****

Although the attack was contained before causing large-scale harm, it presents important questions about the security of open-source repositories. Cybercriminals frequently monitor emerging trends and exploit them to trick unsuspecting users. In this example, the **popularity of DeepSeek** likely attracted malicious actors seeking to exploit its growing user base.

In a comment to Hackread.com, **Jason Soroko**, Senior Fellow at Sectigo, emphasized the impact of this incident stating, “This report underscores how attackers exploit trusted naming conventions and the reliance on authentic package sources within the open-source ecosystem. While the threat was neutralized quickly, it serves as a reminder of the growing risks associated with software supply chains.”

****Protecting Yourself from Similar Threats****

This incident is a good sign to be careful when downloading and installing software, especially from public repositories like PyPI. Here are a few quick tips to help you stay safe:

*   **Security Tools**: Use services like Positive Technologies’ PyAnalysis, which monitors PyPI for malicious activity in real-time.

*   **Verify Package Sources**: Only download well-established packages with a strong reputation. Be cautious of newly uploaded tools, especially those with names similar to popular projects.

*   **Scan Dependencies**: Use tools to analyze the code of packages before installing them.

*   **Monitor Environment Variables**: Keep an eye on sensitive data stored in your system and limit its exposure where possible.

Hackers Hide Malware in Fake DeepSeek PyPI Packages

The healthcare industry has become increasingly reliant on technology to enhance patient care, from advanced image-guided surgery to…

The healthcare industry has become increasingly reliant on technology to enhance patient care, from advanced image-guided surgery to computerized provider order entry (CPOE). However, this dependence has also made it a prime target for cybercriminals.

Hospitals, clinics, and medical practitioners handle vast amounts of sensitive data, including medical records, financial information, and administrative details. This data holds substantial value on the black market, where it is often exploited for identity theft or financial fraud.

****Ransomware Attacks on Healthcare Organizations****

In 2024, a ransomware attack on Synnovis, a pathology testing organization serving two NHS trusts in London, resulted in the theft of patient data. Hackers infiltrated the laboratory’s computer systems, making crucial medical information inaccessible. The group behind the attack later published portions of the stolen data online, including personal identifiers such as names, NHS numbers, and test codes.

This incident highlights the complexity of ransomware attacks and the ongoing risks they pose. To reduce the likelihood of similar breaches, healthcare organizations must conduct regular cybersecurity risk assessments, strengthen data protection protocols, and provide staff training to minimize human error.

****The Need for Stronger Data Protection Measures****

Many countries in Europe have strengthened data protection and cybersecurity laws in recent years, with significant implications for healthcare systems. Medical institutions regularly process highly sensitive personal data, and a lack of funding for security measures does not justify neglecting data protection responsibilities.

Personally identifiable information must be safeguarded against unauthorized access, loss, or damage. Failing to do so can have severe consequences, including a loss of trust in healthcare institutions and regulatory penalties.

****Consequences of Data Breaches in Healthcare****

Health data is classified as a special category of information under the UK GDPR, requiring stricter security measures. Organizations handling such data must conduct risk assessments before processing any information that could pose a threat to individual privacy.

Unauthorized access to patient records can lead to serious consequences, such as identity theft, financial fraud, and reputational harm for healthcare providers. Additionally, failure to comply with data protection laws can result in legal and regulatory penalties.

****How to Check If Your Health Data Has Been Leaked****

A data breach is a serious violation of privacy, often exposing individuals to fraud and scams. Cybercriminals may use stolen medical data to craft convincing phishing emails or impersonate healthcare providers in an attempt to extract further personal information.

To minimize the risk, only authorized healthcare professionals should handle sensitive medical records, and administrative staff must be reminded of their confidentiality obligations. If you suspect your information has been compromised, find out exactly what was exposed.

Since tracking all online activity is nearly impossible, your personal data may already be circulating on the dark web. To check what information about you is publicly accessible, search your full name on major search engines. A larger digital footprint increases the risk of exposure. Healthcare organizations must notify patients if their data has been compromised and provide guidance on protective measures.

****Legal Rights and Compensation for Data Breaches – You Can Sue A Healthcare Organization For Breaching Your GDPR Rights****

Under the General Data Protection Regulation (GDPR), organizations are required to implement security measures that protect against data corruption, compromise, or loss. Healthcare institutions use various cybersecurity tools, including firewalls, identity and access management systems, and encryption, to safeguard patient data.

If you have suffered from damaging consequences of a data breach, such as financial loss or privacy violations, you may be entitled to compensation. It is advisable to consult legal experts to assess the strength of your case rather than relying on online legal advice.

The GDPR allows individuals to take legal action when their data protection rights have been violated. Compensation claims are particularly relevant in cases of significant breaches, with litigation processes in the UK following a model similar to those in the United States. Victims can pursue claims individually or as part of group litigation.

****Steps to Take Immediately After a Data Breach****

The loss of personal data can be distressing, but there are steps you can take to mitigate potential harm:

*   **Check for free credit monitoring services** – Some organizations offer free credit monitoring to affected individuals. These services alert you to suspicious activity, such as new credit applications in your name.
*   **Update your passwords immediately** – If your credentials have been compromised, change your login information as soon as possible to prevent unauthorized access.
*   **Stay alert for scams** – Cybercriminals may exploit your leaked data to trick you into revealing more information or making fraudulent payments. Be wary of unexpected emails or phone calls requesting sensitive details.

Be mindful of the information you share with healthcare providers, as excessive data disclosure could increase your risk of exposure. Only provide the details necessary for your care, and stay alert about cybersecurity threats.

Image credits: Pixabay

Your Health Information Was Compromised. Now What? 

Children love online gaming, and it’s no surprise they do it, considering it offers them fun and interactive…

Children love online gaming, and it’s no surprise they do it, considering it offers them fun and interactive experiences that entertain them in a way nothing else can. However, as a parent, you are concerned for their safety because online gaming comes with particular risks. You are probably aware that your kids are exposed to privacy issues, cyberbullying, or in-game purchases that can have a negative impact on their wellbeing. 

You want to protect your children from all dangers, and when it comes to online threats, you can achieve this by identifying the risks and teaching them how to stay safe when gaming. This blog explores the ways in which you can help your children stay safe while enjoying their favourite online games. 

****First, understand what risks are associated with online gaming****

If your kids have just started playing online games, you might not be aware of the complexity of digital threats they are exposed to. For example, cyberbullying is one of the greatest issues of the moment because your children can receive hurtful comments or get caught in hurtful actions without their consent.

It’s vital to stay in touch with what happens in the gaming world so you can prevent your children from getting exposed to harmful interactions that might affect their emotional and mental health. Also, it’s important to know that online predators take advantage of games to manipulate young players. 

Your kids’ privacy is also at risk when playing online games because the majority of platforms require them to provide personal information. Make sure you educate yourself on the signs of a data breach. You can find information at sources like Data Breach Compensation Expert.

In addition, online games allow players to message each other, which could transform into a privacy issue if your kids share their sensitive information. You should monitor the settings of your children’s gaming so you can ensure they don’t engage in behaviours that put their privacy at risk. When you understand the risks associated with online gaming, you can prepare strategies to protect them. 

In-game purchases could also become dangerous when your kids buy something without discussing it with you first. Some online platforms encourage children to spend money on upgrading their characters or purchasing items that could help them advance in a game. You should always know what games your children play and familiarize yourself with their requirements to prevent taking any financial risk. 

****Teach your children how to stay safe online****

As mentioned earlier, one of the greatest dangers when your kids are playing online games is that they might be tempted or convinced to share sensitive information. Online gaming platforms facilitate engagement with other players, so they discuss with strangers, who might not have genuine intentions and ask them to reveal their real name, address, or other details. Children don’t realize the risks they expose themselves to when they tell strangers their real names, school addresses, or phone numbers, and it’s your role to explain why these are private details they shouldn’t share with someone they met online. 

When discussing the importance of online privacy with your kids, try to keep things simple. Explain in words they understand, and follow up with them regularly to find out what kind of activities they engage in online. 

****Use parental control options****

You already know that most apps include parental control features, and if you haven’t used them until now, you might want to have a look into them because they enable you to protect your kids online. Parental control options allow you to manage your children’s interactions and prevent unwanted purchases. You’ll find it easier to enforce some proper gaming safety rules, so learn how to set them up in the games your kids play, and keep excessive spending and cybercriminals at bay. 

Most games come with built-in parental control features, making it easy to set up parental control. When your child plays games on Xbox or PlayStation, you can block the games you don’t find educative, stop purchases, and limit screen time. Both Xbox and PlayStation let parents setup parental controls.

Make sure you also keep a close eye on their chat activity and restrict who they can manage to prevent them from interacting with people who might harm them. You can limit friend requests and turn off chatting with users they don’t know. 

****Encourage them to discuss with you about their gaming activities****

One of the most effective ways to keep your children safe online is to discuss with them openly about their gaming activities. Start by taking an interest in the games they like, ask them questions, and spend time in the same room they are playing, so you can learn more about the game. Make sure they feel comfortable sharing with you their gaming experiences, and whether they made online friends or chatted with someone new recently. 

A simple question such as “Did something unusual happen today when you were playing?” could help you uncover suspicious behaviour. 

****Make sure they play age-appropriate games****

It’s paramount to ensure your kids play age-appropriate games when making efforts to protect them from online threats. Games are designed for each age group for a reason: young children aren’t ready to fully understand some behaviours. For them, some level of violence might turn harmful, and it’s best to prevent their access. Check the list of games your kids want to play, and add to their library only those they are mature enough to play. This will also ensure a more enjoyable experience for them because it is tailored to their preferences and skills. 

****Set a good example****

Kids aren’t the only ones who play online games. They might have inherited the passion from one of their parents, and if this is the case, you should provide them with a good example. They are always watching what you do, so regardless of whether you’re playing games on your computer or Xbox, you should always show respect toward other players, have healthy gaming habits, and communicate responsibly. 

It’s your responsibility to keep your kids safe when they play online games. This article provides you with a couple of recommendations, but we encourage you to educate yourself about the subject. 

Image source: Unsplash

Online gaming safety for kids: learn how to protect your children

DeepSeek R1, a cost-efficient AI model, achieves impressive reasoning but fails all safety tests in a new study…

DeepSeek R1, a cost-efficient AI model, achieves impressive reasoning but fails all safety tests in a new study by Cisco’s Robust Intelligence. Researchers used algorithmic jailbreaking to demonstrate 100% vulnerability to harmful prompts, raising concerns about its training methods and the need for superior AI security measures.

Chinese start-up DeepSeek has gained attention for introducing large language models (LLMs) with advanced reasoning capabilities and cost-efficient training. Its recent releases DeepSeek R1-Zero and DeepSeek R1 have achieved performance comparable to leading models like OpenAI’s o1 at a fraction of the cost and outperformed Claude 3.5 Sonnet and ChatGPT-4o on tasks like math, coding, and scientific reasoning.

 However, the latest research from Robust Intelligence (now part of Cisco) and the University of Pennsylvania, shared with Hackread.com, reveals critical safety flaws.

Researchers reportedly collaborated to investigate the security of DeepSeek R1, a new reasoning model from the Chinese AI startup DeepSeek. The assessment cost was less than $50 and involved using an algorithmic validation methodology.

The team tested DeepSeek R1, OpenAI’s o1-preview, and other frontier models using an automated jailbreaking algorithm applied to 50 prompts from the HarmBench dataset. These prompts spanned six categories of harmful behaviour, including cybercrime, misinformation, illegal activities, and general harm. 

Their key metric was the Attack Success Rate (ASR), measuring the percentage of prompts that elicited harmful responses. The results were alarming: DeepSeek R1 exhibited a 100% attack success rate, failing to block a single harmful prompt. This contrasts sharply with other leading models, which demonstrated at least some level of resistance to such attacks. 

It is worth noting that researchers used a temperature setting of 0 for reproducibility and verified jailbreaks through automated methods and human oversight. DeepSeek R1’s 100% ASR starkly contrasts with o1, which successfully blocked many adversarial attacks. This suggests that DeepSeek R1 while achieving cost efficiencies in training, has significant trade-offs in safety and security.

Via Cisco’s Robust Intelligence

For your information, DeepSeek’s AI development strategy utilizes three core principles- Chain-of-thought” prompting, reinforcement learning, and distillation, which enhance its LLMs’ reasoning efficiency and self-evaluate reasoning processes.

As per Cisco’s investigation these strategies, while being cost-efficient, may have compromised the models’ safety mechanisms. Compared to other frontier models, DeepSeek R1 appears to lack effective guardrails, making it highly susceptible to algorithmic jailbreaking and potential misuse.  

The research emphasizes the need for rigorous security evaluation in AI development to balance efficiency and reasoning without compromising safety. It also highlights the significance of third-party guardrails for consistent security across AI applications.

Source

HackRead