← Cybersecurity Headlines
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series. It's Cybersecurity Headlines
- [00:07]
B
these are the cybersecurity headlines for Friday, February 27, 2026. I'm Steve Prentiss iPhone and iPad cleared for classified NATO Work the announcement was made yesterday by Apple that its phones and tablets are the first consumer devices to receive approval for working at the NATO restricted. The devices are now part of the NATO Information Assurance Products Catalog. This means that iPhones and iPads can be used with classified information without requiring special software or settings. The listing specifies that the native mail, calendar and Contacts apps for iOS and iPadOs provide secure access to data, US education and healthcare. Targeted with Door Backdoor this attack is being conducted by a previously unknown group named by cisco talus as UAT 10027. The group's goal is to deliver a new backdoor codenamed door, which uses DNS over HTTPs, hence the DoH in its name for command and control communications. The campaign is suspected to involve the use of social engineering phishing techniques leading to the execution of a PowerShell script. The threat actor hides the command and control servers behind the cloudflare infrastructure, and although the group has not been identified, certain attributes of the campaign strongly resemble those used by North Korea's Lazarus and Kim Suki groups. Trend Micro warns of Critical Apex 1 Code execution flaws the cybersecurity software firm has patched the two vulnerabilities, which would allow attackers to gain remote code execution on vulnerable windows systems. ApexOne is an endpoint security platform that detects and responds to security threats, including malware, spyware, malicious tools and vulnerabilities. Both of these named vulnerabilities have CVE numbers, as Trend Micro explained in a security advisory released on Tuesday. Successful exploitation requires attackers to have access to the Trend Micro Apex one management console, end quote, meaning customers whose console's IP address is exposed externally should consider mitigating factors such as source restrictions if not already applied. European E commerce chain Mano Mano suffers data breach Mano Mano, spelled M A N O M A N O is an online marketplace specializing in DIY home improvement, gardening and related products. It is based in France and sells to customers in France, Belgium, Spain, Italy, Germany and the United Kingdom, and its E stores reportedly have about 50 million unique visitors per month. The company learned of the hack in January of this year and an investigation has determined that 38 million individuals are affected. The data stolen appears to be basic PII with no financial information. The cause of the breach is believed to be a third party vendor, specifically a Tunis based customer support service provide that suffered a Zendesk breach. Huge thanks to our sponsor Adaptive Security. This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI powered social engineering security training fails when it's generic. Adaptive's platform personalizes training and runs deepfake simulations across email, sms, voice and video. And with Adaptive's AI content creator, you can drop in a breaking threat or compliance doc and instantly turn it into interactive multilingual training. No designers, no delays. You can learn more@adaptivesecurity.com that is the two words adaptive security together.com. Ransomware payments dropped in 2025, but attack numbers reached record levels A new report released yesterday by blockchain research company Chainalysis stated that claimed attacks grew by 50%, but victim payment rates dropped to a record low of 28%. This translates to a total of $820 million in payments to ransomware actors in 2025, which might rise to 900 million as more data arrives. Chainalysis researchers attribute the increase in attacks and slowdown in payments to the fact that companies are getting better at incident response and that regulatory scrutiny has increased to the point where payouts are now heavily discouraged. The UK turns to automated scanning to speed cyber fixes the British government said yesterday that it has slashed the time required to fix some of the most serious cyber vulnerabilities across the public sector, pointing to a new automated monitoring service, end quote. This service is called the Vulnerability Monitoring Service and it quote operates as a central scanning platform that continuously checks Internet facing systems used by public bodies from central government departments to health and local authorities for signs of known security weaknesses, end quote. This is the latest in a series of steps and attempts made by the UK government to formulate a stronger cyber defence position. The service currently covers around 6,000 organizations and is leading to about 400 confirmed vulnerabilities being processed and resolved each month. AI driven development makes security unattainable, warns Veracode in its annual State of Software Security report. The company says that based on data from 1.6 million applications tested on its cloud platform, more vulnerabilities are being created than are being fixed and that high velocity development with AI is making comprehensive security unattainable. The researchers do say, however, that the higher numbers may be a result of increasing use of testing tools, meaning that more problems are being spotted than might have previously been missed. Veracode also suggests that there is an accelerating pace of software releases, causing new code to be added more quickly than existing vulnerabilities are addressed and that AI generated code makes remediation more difficult. Aeternum C2 botnet stores encrypted commands on Polygon blockchain Researchers at Curator Labs have disclosed details of a new botnet loader called Aeternum C2 that is spelled A E T E R N U M that uses a blockchain based command and control infrastructure to make it resilient to take down efforts. End quote. The public Polygon blockchain being used is widely used by decentralized applications including Polymarket, the world's largest prediction market. Aeternum C2 first appeared in December of last year when a threat actor advertised the malware on underground forums. Are you going to be in Central Florida next week? Then there's a good chance that you can join us for a live CISO series podcast recording. We will be in Clearwater, Florida on March 3rd as part of the Convene Conference and then we will be in Orlando on March 6th for Zero Trust World. For more information on how to join and some discount codes to register for both events, head on over to the events page@cisoseries.com and of course, if you have some thoughts on the news from today or about this show in general, please be sure to reach out to us@feedbackisoseries.com we would love to hear from you. I'm Steve Prentiss reporting for the CISO Series.
- [08:13]
A
Cybersecurity headlines are available every weekday. Head to CISO series.com for the full stories behind the headlines.