Tag: ciberseguridad

Las claves de acceso están revolucionando el acceso digital

En la evolución continua de la ciberseguridad, los passkeys están emergiendo como una solución conveniente para el acceso a cuentas sin la necesidad de contraseñas tradicionales. Este sistema utiliza criptografía para autenticar al usuario, permitiendo el desbloqueo a través de métodos biométricos como la huella dactilar o el reconocimiento facial, así como PINs. Así, se elimina uno de los mayores inconvenientes de la vida digital actual: la necesidad de recordar múltiples contraseñas.

El cambio está llegando

Uno de los principales beneficios de los passkeys es su resistencia al phishing. A diferencia de las contraseñas que pueden ser robadas a través de sitios web falsos, los passkeys no permiten este tipo de ataque, lo que incrementa significativamente la seguridad en el inicio de sesión. Compañías tecnológicas líderes como Apple, Google y Microsoft están respaldando este nuevo estándar, que se presenta como una filosofía colectiva en lugar de un simple producto comercial.

Además de mejorar la seguridad, los passkeys prometen facilitar la experiencia de los usuarios al eliminar pasos adicionales, como la verificación mediante SMS o códigos difíciles de recordar. Sin embargo, persisten preocupaciones relacionadas con la pérdida de dispositivos, aunque se ha establecido que la recuperación de passkeys puede vincularse con la sincronización en la nube o entre dispositivos.

A pesar de sus ventajas, la adopción generalizada de passkeys enfrenta obstáculos. No todos los usuarios están listos para esta transición, especialmente en plataformas que siguen utilizando contraseñas tradicionales o que operan con sistemas híbridos. Esto es especialmente relevante en entornos compartidos, como dispositivos familiares o laborales, donde gestionar el acceso de manera segura sigue siendo un reto.

Desde una perspectiva empresarial, los passkeys son atractivos debido a su capacidad para reducir el robo de cuentas y los problemas relacionados con contraseñas olvidadas. A medida que más organizaciones adopten esta tecnología, podríamos estar ante el ocaso de las contraseñas como las conocemos. Mantener un método de respaldo sensato será clave en este nuevo panorama de seguridad digital.

North Korea is already using Gemini to hack computers around the world

A group of North Korean hackers known as UNC2970 has begun using Google’s Gemini artificial intelligence model to carry out reconnaissance activities and cyberattacks. This behavior has been documented in a report from the Google Threat Intelligence Group (GTIG), which highlights a concerning crossover between professional research and malicious activities in the field of cybersecurity. AI is fine, man According to reports, UNC2970 has focused on companies in the cybersecurity and defense sector, using open-source intelligence (OSINT) to profile high-value targets and prepare specific phishing campaigns. […]

A North Korean hacker group known as UNC2970 has begun using Google’s Gemini artificial intelligence model to carry out reconnaissance and cyberattack activities. This behavior has been documented in a report from the Google Threat Intelligence Group (GTIG), which highlights a concerning intersection between professional research and malicious activities in the field of cybersecurity.

AI is fine, man

According to reports, UNC2970 has focused on companies in the cybersecurity and defense sector, resorting to open-source intelligence (OSINT) to profile high-value targets and prepare specific phishing campaigns. The group uses Gemini to map technical roles and their salaries, creating profiles that facilitate the design of targeted attacks.

Researchers have identified new types of malware that use Gemini, such as HONESTCUE, a framework that allows attackers to generate additional functionality code, and COINBAIT, a phishing kit designed to masquerade as a cryptocurrency exchange, aimed at collecting credentials. HONESTCUE, for its part, operates by using the Gemini API to receive source code in C#, which is executed in memory, leaving few traces on the target system.

Additionally, ClickFix campaigns have been detected that use AI-generated instructions to solve common computer problems, but ultimately distribute malware designed to steal information. Experts warn that assuming keeping the model weights private is enough for protection is a serious mistake; gathering information through queries can result in the replication of the model’s original behavior.

Google has taken steps to disrupt these attacks and has highlighted the growing risk posed by hacker groups that use tools like Gemini to accelerate the phases of the cyber attack cycle. As technology advances, so do the tactics of those looking to exploit it.

The European Commission was on the ropes due to a cybersecurity incident

The European Commission has confirmed that it detected and contained a security incident that affected the central infrastructure responsible for managing staff mobile devices. The event, identified on January 30 through internal telemetry, resulted in unauthorized access to a limited subset of identifiable information, specifically names and mobile numbers of employees. It is important to highlight that the intrusion was limited to the management layer and did not compromise end devices during the attack. Mobile issues The affected systems were isolated and subjected to cleaning procedures for a total of approximately nine […]

The European Commission has confirmed that it detected and contained a security incident that affected the central infrastructure responsible for managing staff mobile devices. The event, identified on January 30 through internal telemetry, resulted in unauthorized access to a limited subset of identifiable information, specifically names and mobile numbers of employees. It is important to note that the intrusion was limited to the management layer and did not compromise end devices during the attack.

Mobile Issues

The affected systems were isolated and subjected to cleaning procedures for a total of approximately nine hours, a time that demonstrates a mature incident response capability. The rapid containment of the incident prevented lateral movements from the management infrastructure to the mobile fleet, effectively neutralizing the risk of a larger security breach.

The incident occurred shortly after the implementation of significant updates to the EU’s cybersecurity governance framework, including the new cybersecurity package and the Cybersecurity Act 2.0. This legislation introduces critical controls to mitigate risks associated with high-risk providers, as well as strict security requirements across the 18 critical sectors defined by the NIS2 Directive.

CERT-EU (Computer Emergency Response Team for EU institutions) leads the defense of the digital perimeter of the Commission, continuously monitoring threats. The knowledge gained from this incident will directly influence the ongoing development of the Commission’s defensive capabilities, ensuring that proactive measures are taken against future threats in a high-risk environment.

The implemented strategies will facilitate collaboration among member states and the effective communication of intelligence on threats, which is essential to address the frequent hybrid attacks that threaten essential services today.

CISA has asked federal agencies to abandon firewalls and routers

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an order directed at federal agencies to cease the use of edge devices, such as firewalls and routers, that are no longer supported by their manufacturers. This measure aims to address the persistent vulnerabilities of these devices, which are known to be frequent access points for cyber attackers. CISA does not cease Under this directive, federal executive agencies must conduct an inventory of the devices in their systems that have become unsupported within three months. Additionally, they must replace […]

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an order directed at federal agencies to cease the use of edge devices, such as firewalls and routers, that are no longer supported by their manufacturers. This measure aims to address the persistent vulnerabilities of these devices, which are known to be frequent access points for cyber attackers.

The CISA does not cease

By virtue of this directive, federal executive agencies must conduct an inventory of the devices in their systems that have become unsupported within a period of three months. Additionally, they must replace these devices with others that are supported within the course of a year. CISA has highlighted that maintaining unsupported devices on enterprise networks poses a significant risk to federal cybersecurity.

The acting director of CISA, Madhu Gottumukkala, emphasized that “unsupported devices pose a serious risk to federal systems and should not remain on networks.” Although CISA does not have the authority to compel agencies to comply with its orders, the organization works collaboratively with them to strengthen cyber resilience and suggests that non-federal entities follow these guidelines.

The announcement comes in a context of growing concern over cyber campaigns that threaten both public and private sectors, putting the security and privacy of American citizens at risk. CISA has observed that outdated devices are frequently used by hackers as a gateway to federal information system networks. Therefore, agencies are urged to develop a process that allows them to regularly identify devices that have become or are about to become unsupported within two years.

Amazon is facing cybersecurity issues… because of AI!

Recent findings from Sysdig’s threat research team highlight an alarming shift in the way malicious actors are using artificial intelligence (AI) to carry out attacks in the cloud. According to the report, attackers have drastically reduced the cloud attack cycle from hours to minutes, using AI tools like language models to automate information gathering and the generation of malicious code. Is Amazon against AI? A notable case occurred in November 2025, when attackers obtained valid Amazon Web Services (AWS) credentials stored from […]

Recent findings from the Sysdig threat research team highlight an alarming shift in the way malicious actors are using artificial intelligence (AI) to carry out cloud attacks. According to the report, attackers have drastically reduced the cloud attack cycle from hours to minutes, using AI tools such as language models to automate information gathering and the generation of malicious code.

Amazon against AI?

A notable case occurred in November 2025, when attackers obtained valid Amazon Web Services (AWS) credentials that were publicly stored in S3 buckets. In less than 10 minutes, they escalated from the initial credential theft to gaining administrative privileges, thereby compromising an AWS environment that included critical services such as Lambda, EC2, and CloudWatch.

During the operation, the attackers distributed their processes across 19 AWS principles and created a user with administrative access named “backdoor-admin.” This strategy demonstrates a remarkable sophistication in the persistence of their attacks. Additionally, security evasion techniques were employed, such as tools to rotate IP addresses, making it difficult to detect their activities.

The research also indicates that the use of language models allowed attackers to produce more effective code, including a script that featured comprehensive exception handling and comments in Serbian. Additionally, several AI-generated “hallucinations” were identified, such as attempts to assume roles in fictitious AWS account IDs and references to non-existent repositories.

Experts warn about the need to implement least privilege principles for all users and IAM roles, restrict certain permissions, and enable invocation logging to prevent future incidents. With the advancement of language model capabilities, it is likely that attacks of this kind will become more common, highlighting the urgency of strengthening defenses in the field of cybersecurity.

These new phishing tactics that take advantage of trust among senior executives

Recently, a sophisticated phishing attack has put companies on alert, especially those operating in the Middle East. Malicious actors managed to impersonate an ongoing email thread between high-level executives, using a phishing link that mimicked a Microsoft authentication form, demonstrating a clever execution of social engineering. The clever impersonation technique The attack began with a compromised sales manager account in a contracting company, allowing the insertion of a malicious message into a legitimate conversation. This tactic exploits trust […]

Recently, a sophisticated phishing attack has put companies on alert, especially those operating in the Middle East. Malicious actors managed to impersonate an ongoing email thread between high-level executives, using a phishing link that mimicked a Microsoft authentication form, demonstrating a clever execution of social engineering.

The Ingenious Identity Theft Technique

The attack began with a compromised sales manager account at a contracting company, allowing the insertion of a malicious message into a legitimate conversation. This tactic, which exploits trust and communication within organizations, has proven to be particularly effective, as attackers took advantage of genuine emails between employees to create an appearance of normalcy in their phishing emails.

Researchers have linked the incursion to an active campaign since December 2025, which has primarily targeted companies in the financial and energy sectors in the region. The investigation revealed the use of EvilProxy, a phishing tool that evades traditional detections, by introducing a proxy system that allows attackers to operate undetected.

This type of attack not only takes advantage of technical vulnerabilities but also crafts human workflows, making emails appear perfect, which makes them harder to detect by filtering systems like DMARC. As remote work becomes normalized and asynchronous approval processes become common, companies face an increased risk of compromises.

The importance of having adequate defense measures has grown significantly. Tools like ANY.RUN provide the ability to detect phishing behaviors in real-time, shortening response times to incidents and strengthening corporate cybersecurity.

The rise of AI-generated malware poses new threats to cybersecurity

Security researchers have warned of an alarming increase in the development of malware using artificial intelligence tools, marking a significant transition from the theoretical to the practical in cybercrime. This phenomenon has been documented by the cybersecurity firm Check Point Research, which has analyzed the activities of a well-known state-backed threat actor from North Korea, known as KONNI, which has been active for over a decade. The evolution of cyber threats Initially, KONNI’s focus was on politicians, diplomats, and academics, primarily in South Korea. However, in its latest campaign, […]

Security researchers have warned of an alarming increase in the development of malware using artificial intelligence tools, marking a significant transition from the theoretical realm to practical applications in cybercrime. This phenomenon has been documented by the cybersecurity firm Check Point Research, which has analyzed the activities of a well-known state-backed threat actor from North Korea, known as KONNI, which has been active for over a decade.

The evolution of cyber threats

Initially, KONNI’s focus was on politicians, diplomats, and academics, primarily in South Korea. However, in its latest campaign, the group has changed its strategy, targeting software developers, especially those related to blockchain and cryptocurrencies. The attackers have been using highly convincing phishing techniques to access cloud infrastructures, source code repositories, and blockchain credentials.

CPR researchers explain that those who have fallen into the trap have allowed the installation of an AI-generated backdoor in PowerShell, which has provided attackers with full access to the victims’ computers and the secrets stored on them. This use of AI-generated malware not only accelerates the development of new attacks but also allows for faster and more flexible customization of threats, thereby evading traditional signature-based detection methods.

In light of this new reality, cybersecurity professionals will need to adapt their approaches. There is an emphasis on the need to consider development environments as high-value targets and to strengthen prevention against phishing within collaboration and development workflows. Additionally, it is recommended to protect development infrastructures and the cloud with robust access controls and to use AI-driven threat prevention techniques to detect malware that is not visible in the early stages of an attack.

In Jordan, being an activist can lead to your phone being hacked

Jordanian authorities have used the phone unlocking technology from the company Cellebrite to access the devices of activists and human rights defenders in the country, according to an investigation by Citizen Lab. This access, obtained without consent, violates the international human rights treaties that Jordan has ratified. The investigation, published on Thursday, was conducted in coordination with the Organized Crime and Corruption Reporting Project (OCCRP) and found that the phones of four activists were subjected to forensic extraction using Cellebrite technologies. Be careful in Jordan! These cases occurred between late […]

Jordanian authorities have used the phone unlocking technology from the company Cellebrite to access the devices of activists and human rights defenders in the country, according to an investigation by Citizen Lab. This access, obtained without consent, violates the international human rights treaties that Jordan has ratified. The investigation, published on Thursday, was conducted in coordination with the Organized Crime and Corruption Reporting Project (OCCRP) and determined that the phones of four activists were subjected to forensic extraction using Cellebrite technologies.

Beware in Jordan!

These are cases that occurred between late 2023 and mid-2025, in a context of protests in support of the Palestinians. The analyzed phones belonged to a political activist, a student organizer, a researcher/activist, and a human rights defender, three of them being iPhones and one an Android device. The court documents related to Jordan’s Cybercrime Law of 2023 provided additional evidence regarding these illegal accesses.

The activists whose phones were analyzed expressed their discomfort and the feeling of vulnerability that this generated, leading them, in some cases, to self-censorship due to a lack of trust in the privacy of their data. “I feel violated, as if something has been stolen from me”, commented one of the affected, on the condition of anonymity.

Cellebrite has stated that it prohibits transactions with entities on sanction lists and ensures that its technology is licensed solely for legal purposes. However, a history of abuse of its technology has been documented in several countries, as reported by Amnesty International in the case of Serbia. Citizen Lab criticized Cellebrite’s responses to its inquiries, deeming them “vague and unfounded.”

The situation highlights concerns about the surveillance of activists in Jordan and the complicity of technologies designed for security, which can be used to infringe fundamental rights.

An important password management company is suffering a phishing attack that could lead you to lose your account

LastPass users are facing a new and dangerous phishing campaign that attempts to steal their credentials. Cybercriminals are impersonating the popular password management company to trick users into believing they need to create a local backup of their digital vaults, where their passwords are stored. According to a statement released by LastPass, this campaign began on January 19 and has been described as highly convincing. Don’t fall for this phishing case. The fraudulent emails appear to come from illegitimate addresses, such as “support@lastpass[.]server8” and “support@sr22vegas[.]com,” and aim to create a sense of […]

LastPass users are facing a new and dangerous phishing campaign that attempts to steal their credentials. Cybercriminals are impersonating the popular password management company to trick users into believing they need to create a local backup of their digital vaults, where their passwords are stored. According to a statement released by LastPass, this campaign began on January 19 and has been described as highly convincing.

Don’t fall for this phishing case

Fraudulent emails appear to come from illegitimate addresses, such as “support@lastpass[.]server8” and “support@sr22vegas[.]com”, and aim to create a sense of urgency by claiming that backing up is necessary due to scheduled maintenance. LastPass emphasized that it has not asked its customers to back up their accounts within 24 hours, warning about possible manipulation.

Hackers are cunning in including a button that says “Create backup now,” which when clicked takes users to a phishing site designed to steal their credentials, potentially including the master password. This type of deception underscores the importance of being alert to warning signs and practicing good cyber habits.

Experts recommend that users utilize different services to store critical passwords and memorize their master password, avoiding writing it down in an accessible place. Additionally, passkeys offer a more secure alternative, as they are linked to a specific device and are harder to crack than traditional passwords.

In this context, it is crucial to remain calm and not be swayed by urgency when receiving suspicious emails. It is always advisable to carefully inspect the links and the legitimacy of the email addresses to avoid falling for scams that can compromise the security of our personal information.

Avast Free Antivirus DOWNLOAD

Ransomware negotiators are one step away from the Wild West, with no rules of any kind

Ransomware negotiation has emerged as a controversial and dark practice within cybersecurity, where the needs of organizations clash with financial crimes. Without a regulatory framework or clear standards, this situation resembles a Wild West, leaving negotiators in a complicated position. They must balance the needs of their clients without contributing to financial crime, facing ethical and legal dilemmas. The Wild West of cybersecurity The lack of transparency in these negotiations allows attackers to manipulate the narrative and increase ransom demands. Criminals, in search of notoriety, […]

Ransomware negotiation has emerged as a controversial and murky practice within cybersecurity, where the needs of organizations clash with financial crimes. Without a regulatory framework or clear standards, this situation resembles a Wild West, leaving negotiators in a complicated position. They must balance their clients’ needs without contributing to financial crime, facing ethical and legal dilemmas.

The Cybersecure Wild West

The lack of transparency in these negotiations allows attackers to manipulate the narrative and increase ransom demands. Criminals, in search of notoriety, have even resorted to physical threats, which further complicates the situation. Furthermore, although many payments result in satisfactory agreements, there is a risk of re-extortion, creating a cycle of vulnerability for the victims.

Diverse incident response firms adopt different approaches when negotiating with cybercriminals. While companies like CrowdStrike and Mandiant refuse to engage directly in ransom negotiations, others, like Palo Alto Networks, negotiate but do not make payments. Experts emphasize the need for a standardized framework that defines negotiation rules and protects victims from abuse.

The negotiation of ransomware, still lacking a structured process and certification, creates an environment where business and ethical interests intertwine. Some negotiators, motivated by economic gain, may face conflicts of interest when taking a percentage of the ransom. This environment not only puts victim organizations at risk but also perpetuates the criminal cycle in which ransomware operate.

Ultimately, the cybersecurity community faces the challenge of finding a balance between protecting victims and disincentivizing cybercriminals, a goal that cannot be achieved in the dark.