Explore how Ethereum revolutionizes industries with smart contracts, DeFi, NFTs, gaming, DAOs, and sustainability, shaping the future of…

Explore how Ethereum revolutionizes industries with smart contracts, DeFi, NFTs, gaming, DAOs, and sustainability, shaping the future of business innovation and blockchain technology.

Vitalik Buterin developed Ethereum in 2014 after taking inspiration from Bitcoin. However, he envisioned an open-source blockchain through which users could access smart contracts and trade cryptocurrency by excluding third parties. The reasons were clear: traditional financial companies risk compromising users’ data and exposing them to cybersecurity threats, which are less likely to occur on the blockchain, where users can maintain anonymity. Decentralization ensures robust maintenance through a network of global nodes and validators.

Since the blockchain offered developers many perspectives and tools, cryptocurrency has also become popular, reaching second place after Bitcoin. Now, you can buy Ethereum with a debit card or credit through Google Pay or Apple Pay, making it highly accessible globally.  Hence, one can say Ethereum’s future is bright, especially since the blockchain might become an innovative solution to modern problems. Here’s how. 

****Ethereum will promote the DeFi market** **

Decentralized Finance (DeFi) is expected to be the future of the financial industry, as it will merge features of decentralization, transparency and immutability into financial service companies like banks. This will be possible as security protocols, software, and hardware advancements will replace our current outdated systems. The financial sector of the future will ensure high accessibility to all communities, low fees for interest rates and autonomy due to decentralization. 

DeFi will be helpful for: 

*   Liquidity pools;
*   Prediction markets;
*   Non-fungible tokens;
*   Decentralized exchanges;

Developing DeFi apps might seem time-consuming at the moment. Moreover, we’re currently navigating uncertainty in regulations for crypto and blockchain, as well as in security measures, so it might take some time until DeFi apps can be safely used worldwide. 

****Ethereum will ensure access to smart contracts** **

Smart contracts are what made Ethereum so demanded by companies. They automatically seal contracts when the parties involved accomplish the predetermined instructions. Therefore, smart contracts could save companies a lot of time and money by employing automation, so there’s no need for third parties to be involved. 

Smart contracts can be useful in DeFi, for example, as they can allow fast and easy landing and borrowing. They can also help the supply chain management sector by automating the process of verifying product origin and tracing their history. Due to their benefits of interoperability and scalability, smart contracts can be applied to real estate, healthcare, and every other type of business. 

****Ethereum will innovate gaming** **

The gaming industry is one of the most successful ones, being one of the few sectors that flourished during the pandemic and continued growing after. Some of the most recent innovations in gaming include cloud gaming, AI-based development, and Virtual Reality, so it’s constantly changing to meet customer demands and expectations. 

Luckily, the Ethereum blockchain has already hopped on the trends, which is why blockchain P2E (play-to-earn) games are now widespread. Axie Infinity, the Sandbox, and Decentraland have already amassed millions of plays worldwide, allowing gamers to earn crypto while playing fun games. Most of these games are already based on the Ethereum blockchain as the network offers developers plenty of tools and mediums, so we expect it to innovate the gaming industry further. 

****Ethereum will enhance governance through DAOs****

In centralized networks, governance is based on a single central entity that makes all the critical decisions and manages businesses. While this system can be efficient because it ensures security and compliance, it can make it difficult for networks to scale and expose organizations to resistance to change. 

That’s why many are excited about working through DAOs (decentralized autonomous organizations) on Ethereum. Decisions here are made by multiple individuals, so participants are empowered to contribute to the group’s well-being. At the same time, participants’ votes are visible on the public blockchain, encouraging users to work together in building a safe space for investors and developers. 

****Ethereum can navigate business sustainability** **

Business sustainability is the latest industry trend, as companies must keep up with customer demand for green and ethical products. However, there are various challenges along the way, especially when it comes to holding companies accountable for their impact on nature. 

That’s where the Ethereum blockchain could help bring more transparency into the business area by tracking how much energy a business consumes and the carbon emissions resulting from various manufacturing or waste management actions. Ethereum is already equipped with such technology that can help assess external information through blockchain oracles. This technology would allow smart contracts to receive and send information on energy reports from the weather, for example. 

****Ethereum will power up non-fungible tokens** **

NFTs have been trending for a while as they offer investors new opportunities to expand their portfolios in a fun way. At the same time, the underlying technology allows for tokenizing real-world assets, from parcels of land to vehicles. 

The Ethereum blockchain allowed NFTs to grow and flourish, as artists had all the tools necessary to create and share them with communities. But in the future, we expect the blockchain to make it convenient for anyone to mint and trade NFTs, as the number of users that use NFTs is expected to grow to 11.64m by 2025, according to Statista. 

****Ethereum can ensure self-sovereign identity** **

Centralized systems expose users to cybersecurity vulnerabilities, leading to identity theft and unauthorized access. Luckily, with Ethereum blockchains, users will be able to store data on the network and choose who they’re sharing it with. 

This is called self-sovereign identity (SSI), which uses blockchain technology to make data more private and offer users control over their personal information. However, this would require them to use multiple identity platforms and keep track of their data alone. 

****Is Ethereum the perfect tool for future business innovation?** **

The Ethereum blockchain is an advanced network through which developers can learn to create NFTs, dApps, DAOs, and much more. The infrastructure uses smart contracts to deploy anything on the blockchain. Therefore, we expect Ethereum to become the driving force of future decentralization and efficiency. Users on the blockchain can promote DeFi, benefit from DAO governance, and make businesses more sustainable, which will ensure empowerment and high accessibility at the same time. 

1.  Could Bitcoin Be The Future Of DeFi?
2.  Is the Blockchain Secure? Yes, and Here’s Why
3.  Accepting Ethereum (ETH) for Businesses, An Overview
4.  Exploring the Phenomenal Rise of Ethereum as a Digital Asset
5.  Ethereum’s Layer 2 Solutions Could Outrun the Main Blockchain

_Editor’s Note: The information provided in this article is for informational purposes only and should not be considered financial advice. Please conduct your own research and consult a professional advisor before making any financial decisions, including buying or investing in cryptocurrency._

Why Ethereum Will Be a Key Platform for Businesses in the Future

In Russia’s war against Ukraine, electronic warfare, including signal-jamming, anti-drone weapons, and innovative protections for critical military systems, has become a key piece of the conflict.

The Invisible Russia-Ukraine Battlefield

This Tech Tip outlines what enterprise defenders need to do to protect their enterprise environment from the new NTLM vulnerability.

Roy Akerman, VP of Identity Security Strategy, Silverfort

December 20, 2024

4 Min Read

Source: Supapixx via Alamy Stock Photo

A new zero-day vulnerability in NTLM discovered by researchers at 0patch allows attackers to steal NTLM credentials by having a user view a specially crafted malicious file in Windows Explorer — no need for the user to open the file. These password hashes can be used for authentication relay attacks or for dictionary attacks on the password, both for identity takeover.

NTLM refers to a suite of old authentication protocols from Microsoft that provide authentication, integrity, and confidentiality to users. While NTLM was officially deprecated as of June, our research shows that 64% of Active Directory user accounts regularly authenticate with NTLM — evidence that NTLM is still widely used despite its known weaknesses.

The flaw is exploitable even in environments using NTLM v2, making it a significant risk to enterprises that have not yet moved to Kerberos and are still relying on NTLM. Considering Microsoft may not patch this issue for a while, enterprise defenders should take steps to mitigate the vulnerability in their environments. This Tech Tip outlines how dynamic access policies, a few hardening steps, and multifactor authentication (MFA) can help limit attempts to exploit this vulnerability. Upgrading the protocol, where possible, could eliminate the issue completely.

**What Is the NTLM Vulnerability?**

When a user views a malicious file in Windows Explorer — whether by navigating to a shared folder, inserting a USB drive containing the malicious file, or just viewing a file in the Downloads folder that was automatically downloaded from a malicious Web page — an outbound NTLM connection is triggered. This causes Windows to automatically send NTLM hashes of the currently logged-in user to a remote attacker-controlled share.

These NTLM hashes can then be intercepted and used for authentication relay attacks or even dictionary attacks, granting attackers unauthorized access to sensitive systems. Attackers can also potentially use the exposed passwords to access the organization's software-as-a-service (SaaS) environment due to the high rates of synced users.

The issue impacts all Windows versions from Windows 7 and Server 2008 R2 up to the latest Windows 11 24H2 and Server 2022.

The fundamental problem with NTLM lies in its outdated protocol design. NTLM transmits password hashes instead of verifying plaintext passwords, making it vulnerable to interception and exploitation. Even with NTLM v2, which uses stronger encryption, the hashes can still be captured and relayed by attackers. NTLM's reliance on weak cryptographic practices and lack of protection against relay attacks are key weaknesses that make it highly exploitable. Moreover, NTLM authentication does not support modern security features, such as MFA, leaving systems open to a variety of credential theft techniques, such as pass-the-hash and hash relaying.

**What Defenders Need to Do**

To mitigate this vulnerability, Microsoft has updated previous guidance on how to enable Extended Protection for Authentication (EPA) on LDAP, Active Directory Certificate Services (AD CS), and Exchange Server. On Windows Server 2022 and 2019, administrators can manually enable EPA for AD CS and channel binding for LDAP. There are scripts provided by Microsoft to activate EPA manually on Exchange Server 2016. Where possible, update to the latest Windows Server 2025 as it ships with EPA and channel binding enabled by default for both AD CS and LDAP.

Some organizations may still be dependent on NTLM due to legacy systems. Those teams should consider additional authentication layers, such as dynamic risk-based policies, for protecting existing NTLM legacy systems against exploitations.

Harden LDAP configurations. Configure LDAP to enforce channel binding and monitor for legacy clients that may not support these settings.

Check impact on SaaS. If you are unsure whether there are applications or clients in your environment that rely on NTLMv2, you can use Group Policy to enable the Network Security: Restrict NTLM: Audit incoming NTLM traffic policy setting. This will not block NTLMv2 traffic but will log all attempts to authenticate using NTLMv2 in the Operations Log. By analyzing these logs, you can identify which client applications, servers, or services still rely on NTLMv2, so you can make targeted adjustments or updates.

Using Group Policy to limit or disable NTLM authentication via the Network Security: Restrict NTLM setting will reduce the risk of fallback scenarios where NTLM is unintentionally used.

Monitor SMB traffic. Enabling SMB signing and encryption can help prevent attackers from impersonating legitimate servers and triggering NTLM authentication. Blocking outbound SMB traffic to untrusted networks will also reduce the risk of NTLM credential leakage to rogue servers. Implement network monitoring and alerting for unusual SMB traffic patterns, particularly outbound requests to unknown or untrusted IP addresses.

Leave NTLM behind. NTLM has been deprecated. Administrators should audit NTLM usage to identify which systems still rely on NTLM. Organizations should prioritize transitioning those systems away from NTLM to more modern authentication protocols, such as Kerberos. Once a more modern protocol is in place, implement MFA to add an additional layer of protection.

Taking these steps will help organizations address the fundamental flaws in NTLM and improve their security posture.

**About the Author**

VP of Identity Security Strategy, Silverfort, Silverfort

Roy Akerman is the VP of Identity Security Strategy at Silverfort and former co-founder and CEO of Rezonate. Prior to Rezonate, Roy served as VP of Product and Innovation at Cybereason, responsible for growing 3 new business lines on cloud security, mobile defense, and XDR. Roy is leading product incubations and new business initiatives, fusing the practices of advanced Technology, Psychology, and Business in forming new disruptive products and anti-disciplinary innovation teams. Akerman is blending business and innovation practices acquired in his MIT and business journey with problem-solving and tech approaches based on his Government and Military experience. Roy has 20 years of experience in Cybersecurity, as one of the senior leaders and founders of NISA - the Israeli Equivalent to the NSA/Cyber Command, retired as the chief of global cyber operations. In this role, Roy and his teams ran global counter-cyber defense operations for Israel’s Cyber Defense, built cutting-edge cyber security tech. They established partnerships and alliances with numerous states and business partners.

How to Protect Your Environment From the NTLM Vulnerability

Combating nation-state threat actors at the enterprise level requires more than just cyber readiness and investment — it calls for a collaborative effort.

Adam Finkelstein, Senior Vice President of Global Client Leadership, Sygnia

December 20, 2024

5 Min Read

Source: Pablo Lagarto via Alamy Stock Photo

COMMENTARY

Cyber warfare often mirrors traditional conflict, but as global geopolitical tensions continue to rise, the landscape of nation-state cyber-threat actors has shifted significantly. Recent events have spurred altered tactics, targets, and patterns of state-sponsored cyberattacks. While historically these threat actors focused primarily on critical infrastructure and government entities like energy grids and transportation, today's nation-state threat actors have expanded their scope further into the enterprise. 

This evolving threat landscape now demands that businesses strengthen their security posture and prepare for sophisticated nation-state-level attacks. The urgency is real — just recently, adversary groups like Velvet Ant, GhostEmperor, and Volt Typhoon have been spotted targeting major organizations, attempting to exfiltrate sensitive data and wreak havoc on critical systems. It's clear nation-state threat actors are moving out of the shadows and into the spotlight, and their threats are no longer on the horizon — they are at our doorstep. 

**Expanding Targets: Enterprises Under Siege**

In the past 12 months, an escalation of traditional conflicts has driven a rise in cyberattacks. For instance, as Iran supplies more weapons to Russia, and the US and Europe continue to impose additional sanctions against the country while arming Ukraine with advanced military capabilities, we can expect to see a rise in cyberattacks across various sectors. The vulnerability of critical infrastructure to cyber threats and heightened geopolitical tensions can be seen following the 2021 Colonial Pipeline attack, where prior agreements between US President Biden and Russian President Vladimir Putin to reduce cyberattacks on critical infrastructure were quickly abandoned with the eruption of the Ukraine war. 

As organizations digitize their services and operations, the interconnected nature of global business and infrastructure — and the vast amount of sensitive data they collect and store — have also made a wider range of enterprises attractive targets to nation-state threat actors. We are seeing increasing evidence of nation-state attacks, in unsuspecting industries like law, media, telecommunications, healthcare, retail, and supply chain logistics because of the sensitive data they are handling.

These companies hold high-value intellectual property, i.e., client information, patents, and proprietary contracts, and are often connected to wider networks of affiliates and vendors. A single cyberattack could grant the "keys to kingdoms" — undetected access to hundreds of critical systems and sensitive data — which is then leveraged by government-backed entities to gain a foothold in new markets and undercut competition. 

**Mission vs. ROI: Differentiating Nation-State Threat Actors From Ransomware Groups**

The key to defending yourself against a nation-state threat is first recognizing the different motives and goals of the threat actor. Unlike ransomware groups who are predominantly driven by financial return on investment (ROI) and, therefore, opt to target hundreds of businesses, waiting for one to bite, nation-state attackers are extremely well-resourced, mission-driven, and focused on long-term goals like stealing trade secrets, military intelligence, or high-profile personal information. Other motives include misinformation operations, disruption of critical infrastructure, and state financial gain under the guise of ransomware attacks. 

**Understanding the Technical Prowess of Nation-State Actors**

Nation-state threat actors have the time, technical expertise, and perseverance to achieve their specific goals — they have planned a highly targeted operation to gain knowledge through stealthy and persistent means, often moving laterally across networks to avoid detection, and reinfiltrating networks multiple times after being eradicated. They work diligently to hide their tracks from digital forensics and will go as far as to modify security logs, disable tools, encrypt systems, and alter timestamps, making it more difficult to attribute and differentiate their group, and hamper investigations.

Chinese-Nexus threat group, deemed Velvet Ant by Sygnia, demonstrated exceptional persistence by establishing and maintaining several footholds within its victim's environment — leveraging new techniques and the use of different technologies to evade detection. One method used for this persistence was exploiting a legacy F5 BIG-IP appliance, which was exposed to the Internet and leveraged as an internal command and control (C&C) system. The primary objective of this campaign was to maintain access to the target network for espionage purposes.

Similarly, a Demodex rootkit known to be used by GhostEmperor, a sophisticated nation-state actor first identified by Kaspersky in 2001, had resurfaced in the enterprise, attempting to carry out a wide-scale attack in 2023. The threat actor compromised servers, workstations, and user accounts by deploying the advanced rootkit and leveraging open source tools available on the Internet to communicate with a network of command-and-control (C2) servers, to avoid attribution.

**Navigating a More Complex Cyber Landscape**

Detecting and combating nation-state threat actors in the enterprise is an ongoing war, not just a battle. The most cyber-mature organizations assess and safeguard critical digital assets, prioritize network visibility, and take actionable steps consistently to strengthen their cyber resilience and hygiene in advance of a cyberattack. Other examples of key strategies include:

*   Regularly rehearsing various threat scenarios to clearly define response roles, at both technical and executive levels, and ensure a seamless and coordinated approach within the most critical first 24 hours of a crisis.
    
*   Utilizing and optimizing their security stack, prioritizing investment in tools that detect anomalies and offer both a holistic and a granular view of their networks and systems — because you can't find what you can't look for.
    
*   Looking into threat detection tools with AI and automation capabilities as part of their defense strategies to reduce costs and speed up digital forensic investigations.
    

Combating nation-state threat actors at the enterprise level requires more than just cyber readiness and investment — it calls for a collaborative effort. Before a crisis occurs, organizations should proactively build relationships with government agencies and industry peers. By fostering open communication and sharing insights and experiences, businesses can strengthen the wider security community and enhance collective defenses against these sophisticated nation-state-level threats.

**About the Author**

Senior Vice President of Global Client Leadership, Sygnia

Adam Finkelstein serves as the senior vice president of global client leadership at Sygnia. With more than two decades of expertise in directing business development and overseeing extensive security initiatives on a global scale, Finkelstein advises clients worldwide, including numerous Fortune 500 and Forbes Global 2000 companies. In his role, he oversees all aspects of Sygnia's client development, working hand-in-hand to proactively enhance their cyber resilience and thwart attacks within their networks.

How Nation-State Cybercriminals Are Targeting the Enterprise

During holidays and slow weeks, teams thin out and attackers move in. Here are strategies to bridge gaps, stay vigilant, and keep systems secure during those lulls.

Source: Anastasia Nelen via Unsplash

Experienced security leaders know that attackers are patient. 

Attackers can infiltrate corporate chat systems like Slack or Microsoft Teams and just ... watch. For months, they monitor conversations, learn who the experienced staff are, and take notes on upcoming vacation plans and each team member's communication style. Then when the company shifts to a skeleton crew — perhaps during a major holiday or summer break — they strike.

For one organization, this silent reconnaissance had devastating results, says Ed Skoudis, president of the SANS Institute and founder of Counter Hack. An attacker posed as a trusted colleague in a chat channel and tricked a junior employee into making critical configuration changes while many team members were on vacation. The employee, isolated and eager to help, had no reason to doubt someone who was inside the company's trusted environment. The attacker's patience, timing, and social engineering created a perfect storm — one that underscores the need for verification, vigilance, and better operational safeguards during periods of reduced staffing.

Whether it is the slow week between Christmas and New Year's Day in Western countries, the European summer break in August, or other periods during the year when large numbers of employees go on vacation, organizations with a global footprint must maintain cybersecurity continuity during regional slowdowns. Holidays like Lunar New Year in Asia and the Eid feast days in the Middle East often mean fewer workers overseeing critical operations. When part of the workforce scales down, attackers ramp up.

"This is a very hard problem," says Skoudis, noting that fewer people at the helm leaves organizations vulnerable to attack. Security leaders have the challenge of protecting their environments when half the security team is offline.

**Why Cybercriminals Like Holidays**

With remote workforces, companies have fewer touchpoints with employees. Add holidays to the mix, and security teams face a slew of potential risks during these times.

"Attackers go on crime sprees during the holidays," Skoudis says. "They know organizations are downscaling operations. Combine that with staff who may be junior, unfamiliar with procedures, or isolated, and you have an ideal time for attackers to strike."

Beyond direct threats, these slow periods also exacerbate operational gaps. Patching schedules, configuration monitoring, and incident response times can lag.

It's not just defense, says Chris Niggel, a regional CSO at Okta. It's about making sure operations continue to run smoothly when teams are short-staffed.

"The biggest challenge is making sure that your teams can maintain the service-level agreements and are able to react to threats quickly, even when the teams are smaller," Niggel says.

For example, the critical vulnerability in Log4j was discovered toward the end of December 2021, a time when many organizations were operating with minimal staff. Addressing the flaw required immediate and prompt action, and many businesses struggled to respond quickly enough. Attackers, well aware of the delays in response, seized the window of opportunity to exploit unpatched systems.

"Teams were already thin, but still had to react," Niggel says. "That's where having solid communication plans and fallback strategies is essential."

Niggel also notes that organizations that fared better during Log4j had prepared for such scenarios by implementing automated monitoring tools, preemptive patching plans, and clear escalation paths for when key personnel were unavailable. These measures ensured that vulnerabilities could be prioritized and addressed, even with a reduced workforce.

**Preparation Is Key to Bridging the Gaps**

By identifying risks, training employees, leveraging technology, and strategically distributing workloads, companies can create a safety net that protects both systems and operations. The key is not waiting until the last minute; preparations must be in place before staff members sign off.

Organizations can mitigate holiday risks with proactive strategies:

*   Create a plan in advance. Identify staffing levels and clearly outline escalation paths. "It's like Tetris blocks," Skoudis says. "You need to fill the hours, define decision-makers, and avoid leaving critical choices to the most junior staff."
    
*   Always verify. Train employees to verify requests for urgent actions, particularly during downtime. Skoudis recommends simple measures: callback phone numbers, video chats to confirm identity, and using photos in a corporate directory. Never trust a message at face value, he says. "You're looking to get more measures of verification that this person is who they say they are," he says.
    
*   Deploy technology and automation. Automate alerts and verifications to reduce human error. Niggel says Okta's method of notifying employees about unusual log-ins includes automation that allows security to focus on important signals. "If an employee logs in from a unique location, they'll get a message in Slack," he says. "If an employee is logging in from grandma's house, they can click yes to verify."
    
*   Freeze changes for critical systems. Code and configuration freezes during slow periods reduce operational risks. "A freeze requires extra effort to make changes," Skoudis says. "It prevents attackers and limits the chance of accidental mistakes."
    
*   Adopt a "follow-the-sun" model. Multinational organizations can distribute workloads across time zones. Mark Lance, head of DFIR at GuidePoint Security, suggests using teams in regions where holidays are not being observed. "It's about balance," he says. "When one region steps back, another steps up."
    

**Culture, Collaboration, and a Healthy Dose of Paranoia**

The human element is also critical to any security plan — even when fewer employees are on the clock. Lance says fostering collaboration and reducing isolation during skeleton crew periods is key to defense.

"Better decisions happen when you're not alone," Lance says.

Having escalation paths and ensuring junior employees know where to turn when something feels off can make all the difference. Niggel agrees, emphasizing the importance of properly training staff on how to handle these types of situations.

"Policies exist for a reason," he says. "Employees need to know they can fall back on established processes and ask for help."

Vigilance must remain high, no matter the season. Attackers don't take breaks — and neither should enterprise defenses. While companies can't always predict when an attack might occur, preparedness, verification, and smart staffing strategies help bridge security gaps when part of the team is off. As holiday seasons and global events come and go, staying one step ahead requires a mix of technology, planning, and teamwork.

"Always be suspicious," Skoudis says. "If something feels wrong, verify it. You might stop a disaster."

**About the Author**

Contributing Writer, Dark Reading

Joan Goodchild is a veteran journalist, editor, and writer who has been covering security for more than a decade. She has written for several publications and previously served as editor-in-chief for CSO Online.

Managing Threats When Most of the Security Team Is Out of the Office

In the last newsletter of the year, Thorsten recalls his tech-savvy gift to his family and how we can all incorporate cybersecurity protections this holiday season.

Thursday, December 19, 2024 14:02

Welcome to the final Threat Source newsletter of 2024. 

Watching "Die Hard" during the Christmas season has become a widely recognized tradition for many, despite ongoing debates about its classification as a Christmas movie. I know it isn't everyone's cup of tea. Whether you like the movie or not, let me share a story about what didn't quite go as planned in my family last year.  

When  some celebrities had their social media accounts compromised, I saw it as the perfect opportunity to introduce my family to the world of multi-factor authentication (MFA) for their online accounts. Our home IT setup is diverse— With Linux, Macs, Windows; Androids, iOS, we needed something cross-platform. Also, we needed a user-friendly solution as we have both standard users and IT experts (never underestimate your users). From my professional standpoint, I decided to go “all in” with hardware tokens - they work cross platform and "survive" one or the other OS installs from scratch. Providing two for each person was mandatory in case one got lost, which had happened to me already. So it wasn't a cheap exercise. In my defense, this was before the side-channel attack EUCLEAK was discovered, which has since expanded to affect more products as noted in the first release. 

In the spirit of John McClane : “Now I know what a TV dinner feels like.” 

The kids found the gift "boring" and almost a year later, the adoption rate is still only 30%. Fortunately, my wife had the foresight to prepare real presents for the family, saving Christmas Eve from being a "bad guys win" scenario. (Only John Thor can drive somebody that crazy.) 

I share this anecdote not to discourage you, but to help you avoid making the same mistake and risking your celebrations. Unless everyone gathered around the Christmas tree is an infosec professional, it might not be the time to go "Yippee-ki-yay Mr Falcon" with tech gifts.  

However, spending time with loved ones is a great opportunity to discuss the trends and importance of cybersecurity. We've been highlighting compromised credentials for a long time, as seen in our previous posts \[here\], \[here\], \[here\] and \[here\]. For the fourth consecutive time in over a year, the most observed means of gaining initial access was the use of valid accounts, making it clear identity-based attacks are becoming more prevalent, and wont be gone anytime soon. 

 Advocate for the use of a password managers—there are paid versions with family plans on one end, and excellent open-source alternatives on the other. Avoid storing credentials in browsers, as they can be extracted by info-stealers. Consider using passkeys where possible. According to the fido alliance, more than 20% of the world's top 100 websites support passkeys already. If passkeys are not yet enabled for one of your services? Any MFA is better than none. Even using "just" TOTP in a software container is a significant improvement over just a password. 

But it's not just about enabling MFA. As Martin wrote last week, we need to close the gap by communicating and understanding the the threat landscape. When it comes to stolen credentials, share resources like https://haveibeenpwned.com/ or https://sec.hpi.de/ilc/?lang=en with your loved ones so they can check if their email has been part of a breach.   

If you decide not to bother your friends & famliy (though I strongly believe Mbappe, Sweeny and Odenkirk would have preferred a more secure account) with Account/Password Hygiene, there are some more work related recommendations in Hazel’s “How are attackers trying to bypass MFA” 

Whichever is your idea of Christmas, then, like Argyle said, "I gotta be here for New Year's!"  

We look forward to seeing you in 2025!   

**The one big thing**

At the time of writing, our Vulnerability Research Team Disclosed 207 Vulnerabilities, and had another 93 reported to the respective Vendor in 2024.  Di you know  Talos has a team which investigates software and operating system vulnerabilities in order to discover them before malicious threat actors do? Every day, they try to find vulnerabilities that have not yet been discovered, and then work to provide a fix for those before a zero-day threat could ever be executed. 

**Why do I care? **

We see threat actors exploiting known vulnerabilities constantly. Sometimes those CVEs are Years old.  

**So now what? **

Maybe you want to check for some CVEs or conduct a network security assessments.   
You can our team’s reports,roundups,spotlights and deep dives on our blog. 

**Top security headlines of the week **

 Blackhat Europe 2024 took place Dec 9-12 in London, UK. Loaded with a lot of interesting Sessions, my favorites are “Vulnerabilities in the eSIM download protocol” and “Over the Air: Compromise of Modern Volkswagen Group Vehicles” both showing how far an attack surface can possibly extend.  

Germany's Federal Office for Information Security (BSI) says it blocked communication between appr. 30.000 Android IoT Devices which were sold with BadBox malware preinstalled, and their command and control (C2) infrastructure by sinkholing DNS queries (Bleeping Computer)  

Law enforcement agencies worldwide disrupted a holiday tradition for cybercriminals: launching Distributed Denial-of-Service (DDoS) attacks. Booter and stresser websites were taken down, administrators were arrested and over 300 users were identified for planned operational activities. (Europool) 

The Willow chip is not capable of breaking modern cryptography,” Google’s director of quantum tells The Verge.

**Can’t get enough Talos? **

*   The evolution and abuse of proxy networks 
*   Microsoft Patch Tuesday for December 2024 contains four critical vulnerabilities 

**Upcoming events where you can find Talos **

  Cisco Live EMEA (February 9-14, 2025) 

Amsterdam, Netherlands 

**Most prevalent malware files from Talos telemetry over the past week  **

**SHA256:**873ee789a177e59e7f82d3030896b1efdebe468c2dfa02e41ef94978aadf006f   
**MD5:** d86808f6e519b5ce79b83b99dfb9294d    
**VirusTotal:**  
https://www.virustotal.com/gui/file/873ee789a177e59e7f82d3030896b1efdebe468c2dfa02e41ef94978aadf006f   
**Typical Filename:** n/a   
**Claimed Product:** n/a    
**Detection Name:** Win32.Trojan-Stealer.Petef.FPSKK8  

**SHA256:**9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507   
**MD5:** 2915b3f8b703eb744fc54c81f4a9c67f    
**VirusTotal:**  
https://www.virustotal.com/gui/file/9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507    
**Typical Filename:** VID001.exe    
**Claimed Product:** n/a    
**Detection Name:** Win.Worm.Bitmin-9847045-0 

 **SHA 256:**  
7b3ec2365a64d9a9b2452c22e82e6d6ce2bb6dbc06c6720951c9570a5cd46fe5    
**MD5:** ff1b6bb151cf9f671c929a4cbdb64d86    
**VirusTotal:** https://www.virustotal.com/gui/file/7b3ec2365a64d9a9b2452c22e82e6d6ce2bb6dbc06c6720951c9570a5cd46fe5   
**Typical Filename:** endpoint.query    
**Claimed Product:** Endpoint-Collector    
**Detection Name:** W32.File.MalParent  

 **SHA256:**47ecaab5cd6b26fe18d9759a9392bce81ba379817c53a3a468fe9060a076f8ca   
**MD5:** 71fea034b422e4a17ebb06022532fdde   
**VirusTotal:** https://www.virustotal.com/gui/file/47ecaab5cd6b26fe18d9759a9392bce81ba379817c53a3a468fe9060a076f8ca   
**Typical Filename:** VID001.exe   
**Claimed Product:** n/a    
**Detection Name:** Coinminer:MBT.26mw.in14.Talos 

 **SHA 256:** a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91    
**MD5:**  
7bdbd180c081fa63ca94f9c22c457376    
**VirusTotal:** https://www.virustotal.com/gui/file/a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91   
**Typical Filename:** IMG001.exe    
**Claimed Product:** N/A     
**Detection Name:** Trojan/Win32.CoinMiner.R174018

Welcome to the party, pal!

Protect yourself from sophisticated phishing attacks that leverage Google Calendar to steal your personal information.

**KEY SUMMARY POINTS**

*   **Google Calendar Targeted:** Hackers are exploiting Google Calendar’s features to send phishing emails disguised as legitimate invites.

*   **Sophisticated Tactics:** Attacks leverage tools like Google Forms and Google Drawings to bypass traditional email security and enhance credibility.

*   **Widespread Impact:** Over 4,000 phishing emails linked to this campaign were detected in a four-week period, affecting around 300 brands.

*   **Social Engineering:** Cybercriminals use urgency, fear, and impersonation to trick victims into clicking malicious links and entering sensitive information.

*   **Preventive Measures:** Advanced email security, monitoring third-party app usage, and behavior analytics are essential to mitigate these evolving threats.

According to the latest research from Check Point, shared with Hackread.com, a widely used scheduling tool called Google Calendar has become the newest target for cybercriminals.

For your information, Google Calendar is part of **Google Workspace** (formerly known as G Suite). It is a popular tool for organizing schedules and managing time used by over 500 million people in 41 languages.

According to CPR’s research, attackers are manipulating Google Calendar and its associated features, like Google Drawings, to launch phishing attacks by sending seemingly legitimate emails with links that bypass traditional email security measures. These links appear to connect to Google Forms or Google Drawings, further enhancing the attack’s credibility.

The malicious email and Google Calendar setup (Via CPR)

Initially, they exploited the user-friendly features inherent in Google Calendar, offering links connecting to Google Forms. However, after observing that security products could flag malicious Calendar invites, they evolved the attack to align with Google Drawings capabilities.

“Cyber criminals are modifying “sender” headers, making emails look as though they were sent via Google Calendar on behalf of a known and legitimate individual. Roughly 300 brands have been affected by this campaign thus far, with cyber researchers observing over 4,000 of these phishing emails in a four-week period,” revealed Check Point’s **blog post**.

The attackers leverage the trust and familiarity associated with Google Calendar to lure victims into clicking malicious links. They create a seemingly legitimate calendar invite, often from a known contact or a familiar organization. This initial invite may contain a link to a Google Form Google Drawing or ICS file attachment, which appears to be a simple request for information or a survey, often displaying a **CAPTCHA** or support button.

However, once the victim clicks on the link, they are redirected to a malicious website designed to steal personal information or corporate data through a fake authentication process, potentially leading to financial scams. This website might mimic a legitimate login page, a cryptocurrency exchange, or a tech support page.

The goal is to trick the victim into entering sensitive information like passwords, credit card details, or personal identification numbers. Stolen information can be used for credit card fraud or unauthorized transactions, posing significant risks to both parties.

It is worth noting that the attackers often use social engineering tactics to increase the credibility of the attack. They might create a sense of urgency, fear, or curiosity to entice victims to click on the malicious link. They may also impersonate trusted individuals or organizations to gain the victim’s trust.

To stay protected from phishing threats, organizations should implement advanced email security solutions, **monitor third-party Google App usage**, implement strong authentication mechanisms, and use behavior analytics tools to detect unusual login attempts or suspicious activities to ensure a secure and secure online environment for all users.

1.  **Google Workspace Vulnerable to Takeover**
2.  **Misconfigured Google Groups Settings Leak Sensitive Data**
3.  **Google Chrome mobile phishing scam can steal private data**
4.  **Scammers Weaponize Google Forms in New BazarCall Attack**
5.  **Threat actors using Google Docs exploit to spread phishing links**

Google Calendar Phishing Scam Targets Users with Malicious Invites

This post is the result of research into the real-world application of the Bring Your Own Vulnerable Driver (BYOVD) technique along with Cisco Talos’ series of posts about  malicious Windows drivers.

Exploring vulnerable Windows drivers

A free VPN app called Big Mama is selling access to people’s home internet networks. Kids are using it to cheat in a VR game while researchers warn of bigger security risks.

In the hit virtual reality game _Gorilla Tag_, you swing your arms to pull your primate character around—clambering through virtual worlds, climbing up trees and, above all, trying to avoid an infectious mob of other gamers. If you’re caught, you join the horde. However, some kids playing the game claim to have found a way to cheat and easily “tag” opponents.

Over the past year, teenagers have produced video tutorials showing how to side-load a virtual private network (VPN) onto Meta’s virtual reality headsets and use the location-changing technology to get ahead in the game. Using a VPN, according to the tutorials, introduces a delay that makes it easier to sneak up and tag other players.

While the workaround is likely to be an annoying but relatively harmless bit of in-game cheating, there’s a catch. The free VPN app that the video tutorials point to, Big Mama VPN, is also selling access to its users’ home internet connections—with buyers essentially piggybacking on the VR headset’s IP address to hide their own online activity.

This technique of rerouting traffic, which is best known as a residential proxy and more commonly happens through phones, has become increasingly popular with cybercriminals who use proxy networks to conduct cyberattacks and use botnets. While the Big Mama VPN works as it is supposed to, the company’s associated proxy services have been heavily touted on cybercrime forums and publicly linked to at least one cyberattack.

Researchers at cybersecurity company Trend Micro first spotted Meta’s VR headsets appearing in its threat intelligence residential proxy data earlier this year, before tracking down that teenagers were using Big Mama to play _Gorilla Tag_. An unpublished analysis that Trend Micro shared with WIRED says its data shows that the VR headsets were the third most popular devices using the Big Mama VPN app, after devices from Samsung and Xiaomi.

“If you’ve downloaded it, there’s a very high likelihood that your device is for sale in the marketplace for Big Mama,” says Stephen Hilt, a senior threat researcher at Trend Micro. Hilt says that while Big Mama VPN may be being used because it is free, doesn’t require users to create an account, and apparently doesn’t have any data limits, security researchers have long warned that using free VPNs can open people up to privacy and security risks.

These risks may be amplified when that app is linked to a residential proxy. Proxies can “allow people with malicious intent to use your internet connection to potentially use it for their attacks, meaning that your device and your home IP address may be involved in a cyberattack against a corporation or a nation state,” Hilt says.

"Gorilla Tag is a place to have fun with your friends and be playful and creative—anything that disturbs that is not cool with us,” a spokesperson for Gorilla Tag creator Another Axiom says, adding they use “anti-cheat mechanisms” to detect suspicious behavior. Meta did not respond to a request for comment about VPNs being side-loaded onto its headsets.

**Proxies Rising**

Big Mama is made up of two parts: There’s the free VPN app, which is available on the Google Play store for Android devices and has been downloaded more than 1 million times. Then there’s the Big Mama Proxy Network, which allows people (among other options) to buy shared access to “real” 4G and home Wi-Fi IP addresses for as little as 40 cents for 24 hours.

Vincent Hinderer, a cyber threat intelligence team manager who has researched the wider residential proxy market at Orange Cyberdefense, says there are various scenarios where residential proxies are used, both for people who are having traffic routed through their devices and also those buying and selling proxy services. “It’s sometimes a gray zone legally and ethically,” Hinderer says.

For proxy networks, Hinderer says, one end of the spectrum is where networks could be used as a way for companies to scrape pricing details from their competitors' websites. Other uses can include ad verification or people scalping sneakers during sales. They may be considered ethically murky but not necessarily illegal.

At the other end of the scale, according to Orange’s research, residential proxy networks have broadly been used for cyber espionage by Russian hackers, in social engineering efforts, as part of DDoS attacks, phishing, botnets, and more. “We have cybercriminals using them knowingly,” Hinderer says of residential proxy networks generally, with Orange Cyberdefense having frequently seen proxy traffic in logs linked to cyberattacks it has investigated. Orange’s research did not specifically look at uses of Big Mama's services.

Some people can consent to having their devices used in proxy networks and be paid for their connections, Hinderer says, while others may be included because they agreed to it in a service’s terms and conditions—something research has long shown people don’t often read or understand.

Big Mama doesn’t make it a secret that people who use its VPN will have other traffic routed through their networks. Within the app it says it “may transport other customer’s traffic through” the device that’s connected to the VPN, while it is also mentioned in the terms of use and on a FAQ page about how the app is free.

The Big Mama Network page advertises its proxies as being available to be used for ad verification, buying online tickets, price comparison, web scraping, SEO, and a host of other use cases. When a user signs up, they’re shown a list of locations proxy devices are located in, their internet service provider, and how much each connection costs.

This marketplace, at the time of writing, lists 21,000 IP addresses for sale in the United Arab Emirates, 4,000 in the US, and tens to hundreds of other IP addresses in a host of other countries. Payments can only be made in cryptocurrency. Its terms of service say the network is only provided for “legal purposes,” and people using it for fraud or other illicit activities will be banned.

Despite this, cybercriminals appear to have taken a keen interest in the service. Trend Micro’s analysis claims Big Mama has been regularly promoted on underground forums where cybercriminals discuss buying tools for malicious purposes. The posts started in 2020. Similarly, Israeli security firm Kela has found more than 1,000 posts relating to the Big Mama proxy network across 40 different forums and Telegram channels.

Kela’s analysis, shared with WIRED, shows accounts called “bigmama\_network” and “bigmama” posted across at least 10 forums, including cybercrime forums such as WWHClub, Exploit, and Carder. The ads list prices, free trials, and the Telegram and other contact details of Big Mama.

It is unclear who made these posts, and Big Mama tells WIRED that it does not advertise.

Posts from these accounts also said, among other things, that “anonymous” bitcoin payments are available. The majority of the posts, Kela’s analysis says, were made by the accounts around 2020 and 2021. Although, an account called “bigmama\_network” has been posting on the clearweb Blackhat World SEO forum until October this year, where it has claimed its Telegram account has been deleted multiple times.

In other posts during the last year, according to the Kela analysis, cybercrime forum users have recommended Big Mama or shared tips about the configurations people should use. In April this year, security company Cisco Talos said it had seen traffic from the Big Mama Proxy, alongside other proxies, being used by attackers trying to brute force their way into a variety of company systems.

**Mixed Messages**

Big Mama has few details about its ownership or leadership on its website. The company’s terms of service say that a business called BigMama SRL is registered in Romania, although a previous version of its website from 2022, and at least one live page now, lists a legal address for BigMama LLC in Wyoming. The US-based business was dissolved in April and is now listed as inactive, according to the Wyoming Secretary of State’s website.

A person using the name Alex A responded to an email from WIRED about how Big Mama operates. In the email, they say that information about free users’ connections being sold to third parties through the Big Mama Network is “duplicated on the app market and in the application itself several times,” and people have to accept the terms of conditions to use the VPN. They say the Big Mama VPN is officially only available from the Google Play Store.

“We do not advertise and have never advertised our services on the forums you have mentioned,” the email says. They say they were not aware of the April findings from Talos about its network being used as part of a cyberattack. “We do block spam, DDOS, SSH as well as local network etc. We log user activity to cooperate with law enforcement agencies,” the email says.

The Alex A persona asked WIRED to send it more details about the adverts on cybercrime forums, details about the Talos findings, and information about teenagers using Big Mama on Oculus devices, saying they would be “happy” to answer further questions. However, they did not respond to any further emails with additional details about the research findings and questions about their security measures, whether they believe someone was impersonating Big Mama to post on cybercrime forums, the identity of Alex A, or who runs the company.

During its analysis, Trend Micro’s Hilt says that the company also found a security vulnerability within the Big Mama VPN, which could have allowed a proxy user to access someone’s local network if exploited. The company says it reported the flaw to Big Mama, which fixed it within a week, a detail Alex A confirmed.

Ultimately, Hilt says, there are potential risks whenever anyone downloads and uses a free VPN. “All free VPNs come with a trade-off of privacy or security concerns,” he says. That applies to people side-loading them onto their VR headsets. “If you’re downloading applications from the internet that aren't from the official stores, there’s always the inherent risk that it isn’t what you think it is. And that comes true even with Oculus devices.”

This VPN Lets Anyone Use Your Internet Connection. What Could Go Wrong?

Working closely with CISOs, chief financial officers can become key players in protecting their organizations' critical assets and ensuring long-term financial stability.

Shai Gabay, Co-Founder & CEO, Trustmi

December 18, 2024

4 Min Read

Source: Dzmitry Skazau via Alamy Stock Photo

COMMENTARY

Cybersecurity has spurred many changes in the past five years, from the technology and tools needed to protect an organization from cyberattackers to the skill sets required by IT professionals. The consistent and ongoing ripple effect has also influenced organizational roles and responsibilities. Arguably, one of the most dramatic shifts has been the role of the chief financial officer (CFO).

Today's CFOs must be collaborative leaders, willing to embrace an expanding role that includes protecting critical assets and securing the bottom line. To do this, CFOs must work closely with chief information security officers (CISOs), due to the sophistication and financial impact of cyberattacks. Financial professionals understand data flows and financial processes, while security professionals know the latest cyber threats and best practices to combat those threats. Combining this expertise results in more informed technical investments, faster detection of anomalies, and stronger overall cybersecurity measures.

This enhanced approach is critical as we see payments and unsuspecting financial professionals increasingly become the targets of cyberattacks. Both are prime targets because of the volume of money and transactions they process, often manually leaving organizations even more vulnerable to phishing schemes that can go undetected for months. Collaboration between finance and security departments is crucial to threat detection, maintaining compliance, addressing third-party risks, and providing companywide cybersecurity education and training.

**The Impact of a Security Breach**

The increasing financial impact of a cyberattack alone mandates CFO involvement in cybersecurity matters. According to IBM's "Cost of a Data Breach Report 2024," the global average cost of a data breach reached $4.88 million in 2024, a 10% increase over last year. This substantial financial risk underscores why CFOs must now consider cybersecurity a primary concern for an organization's economic health.

CFOs are uniquely positioned to understand the potential financial devastation from cyber incidents. The costs associated with a breach extend beyond immediate financial losses, encompassing longer-term repercussions, such as reputational damage, legal liabilities, and regulatory fines. CFOs must measure and consider these potential financial impacts when participating in incident response planning.

**Compliance Requires Protection**

The regulatory landscape for CFOs has evolved significantly beyond Sarbanes-Oxley. The Securities and Exchange Commission's (SEC's) rules on cybersecurity risk management, strategy, governance, and incident disclosure have become a primary concern for CFOs and reflect the growing recognition of cybersecurity as a critical financial and operational risk.

The SEC's cybersecurity rules require public companies to disclose material cybersecurity incidents within four business days and provide periodic updates on their cybersecurity risk management, strategy, and governance. This places significant responsibilities on CFOs, who must ensure timely disclosure of cyber incidents and help to develop and implement risk management strategies. As a result, CFOs must work closely with CISOs, board members, and executives to establish effective cybersecurity governance and provide detailed reporting on the company's cybersecurity posture and incident response capabilities.

CFOs must also navigate other cybersecurity regulations, such as the General Data Protection Regulation (GDPR) in the European Union, the California Consumer Privacy Act (CCPA), and similar state-level regulations, and adhere to industry-specific regulations like the Health Insurance Portability and Accountability Act (HIPAA). These regulations carry significant financial penalties for noncompliance, further emphasizing the critical role CFOs play in managing cyber-risks. As a result, CFOs must now be well-versed in cybersecurity best practices, incident response protocols, and the evolving regulatory landscape to protect their organizations' financial interests and maintain compliance effectively.

**Collaboration and Allocation**

Adding to the complexity, the CFO is now a cross-functional collaborator who must work closely with IT, legal, and other departments to prioritize cyber initiatives and investments. They must also work with the CISO and chief information officer (CIO) to educate the CEO and the board on cybersecurity matters and communicate broadly, at times, with employees, customers, partners, and investors.

CFOs needs to consider the corporate strategy and broader business decisions as they help determine the company's approach and investment in cybersecurity tools and technologies. This level of decision-making requires CFOs to understand the cyber landscape, threats and trends, and viable investment strategies. This expanded role requires CFOs to help their organizations build resilience against cyber threats while ensuring that security measures are cost-effective and aligned with overall business strategy.

**How CFOs Can Succeed**

Working closely with CISOs, CFOs can become key players in protecting their organizations' critical assets and ensuring long-term financial stability. To succeed in this new landscape, CFOs must foster strong partnerships with CIOs and CISOs, develop a deep understanding of cybersecurity risks and technologies, and integrate cybersecurity considerations into all aspects of financial planning and risk management. Doing so can help organizations build resilience against cyber threats while supporting broader business objectives and growth strategies.

**About the Author**

Co-Founder & CEO, Trustmi

Shai Gabay is the co-founder and CEO of Trustmi, a leading end-to-end payment security platform founded in Israel in 2021. Before Trustmi, he was General Manager at Opera and Vice President of Product and Services at Cynet. He also served as the CIO at Cyberbit and the CISO at Discount Bank, among other roles in cybersecurity and risk management. Shai holds a bachelor’s degree in software engineering from Shenkar College and a master’s in business administration and management from Tel Aviv University. Additionally, Shai was selected for the prestigious full scholarship executive excellence program at the Hoffman Kofman Foundation, a program tailored to outstanding alumni of the Israeli Defense Force's Elite Units. Through this program, he studied with prominent co-founders and leaders at renowned global tech companies and professors at elite universities.

Tag

#ios