Nico Waisman

🚨 Critical Alert: Initial Access Brokers (IABs) Setting Their Sights on Brazil's Energy Sector As a cybersecurity professional, I'm deeply concerned about the recent reports of IABs targeting Brazil's energy infrastructure. This isn't just a local issue – it's a warning sign for critical infrastructure worldwide. Key Observations: • IABs are increasingly focusing on energy sector vulnerabilities • Critical infrastructure remains an attractive target for cybercriminals • The potential for cascading effects on public safety and economy is significant Why This Matters: These attacks represent a dangerous trend where cybercriminals first gain access, then sell it to the highest bidder – often ransomware groups. Think of it as leaving your house keys with professional burglars who then auction them off. 🛡️ Critical Actions Needed: 1. Enhanced monitoring of OT/IT networks 2. Regular security assessments 3. Robust incident response planning 4. Cross-border threat intelligence sharing 5. Employee security awareness training Industry Implications: This trend isn't isolated to Brazil. Energy sectors globally need to recognize that they're prime targets. The commoditization of initial access makes sophisticated attacks more accessible to less skilled threat actors. #Cybersecurity #CriticalInfrastructure #EnergySecctor #ThreatIntelligence #InfoSec #CyberResilience https://lnkd.in/g6QRW2br

9

Audits and forensics aren’t witch-hunts to “name the hacker.” They’re how you stop the next breach. A good audit/forensic review will: Expose misconfigurations and control gaps Surface broken processes (people • tech • vendors) Produce a clear timeline to improve response Provide evidence for insurance claims and regulators Demonstrate senior management intent and due diligence One breach costs more—in money, trust, and time—than doing the work properly up front. At Tylers, we turn incidents into hardening plans: fixes, owners, deadlines. Not blame—better security. #CyberSecurity #DigitalTrust #Forensics #Audit #IncidentResponse #Tylers

17

2 comentarios

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 comentarios

884,000 credit cards stolen—via text messages. The latest Darcula PhaaS campaign reminds us: phishing isn’t just email anymore. SMS-based phishing (smishing) is on the rise, and attackers are exploiting trust in mobile messaging to bypass traditional defenses and reach employees directly. CISOs must prioritize mobile phishing simulations to build real awareness. That’s why we built Keepnet’s Smishing Simulator, https://lnkd.in/e35aKSQY, to train people in real-world scenarios, reduce human risk, and close one of the biggest gaps in your phishing defense. Don’t wait until it’s too late. https://lnkd.in/e5s6yHZr #cybersecurity #phishing #smishing #humanriskmanagement #securityawareness #CISO

21

2025 is shaping up to be the year of IT compliance ✅ 📋 💣 CRA, PLD, DORA, SSDF updates—if you're compliance-adjacent, it's been absolutely wild. A new standard or update seems to drop every other week. But here's the thing that's actually changing: SBOMs are now mandatory and compliance isn't an annual ritual anymore. The CRA demands SBOMs for every release, stored for 10 years. PCI-DSS 4 requires vulnerability scans at least every three months. This means evidence collection is now continuous. When you do something once a year, you can wing it with manual effort. When you do it every day, you need automation. You need DevOps thinking applied to compliance requirements. That's where CompOps comes in—think DevOps, but for continuous compliance. Your DevOps team already knows how to solve these problems. They've been building resilient, repeatable systems forever. Compliance requirements are just another set of requirements they can architect solutions for. But security teams need to be cautious. They are used to being the star during a crisis. If they show up and declare everything will be fine because security is here, they will lose before the compliance program has even got started. The future of compliance means working with your DevOps team as a trusted partner, not showing up as the hero. I wrote about how to actually make this work (and why in a few years we won't even talk about CompOps anymore—it'll just be part of the workflow): https://lnkd.in/g4QSFY4P #Cybersecurity #CompOps #DevOps #Compliance #SoftwareSupplyChain

11

1 comentario

Sick SOC: A Practical Checklist of Symptoms! That SOC that looks operational (alerts, dashboards, tools) but lacks strategy, visibility, and repeatable response, so it quietly fails. Yeah… that’s called a sick SOC. I love the term “Sick SOC” — framed by Reza A. in his article, highlighting key metrics and warning signs that indicate your SOC isn’t operating at its best quality. • Strategic misalignment • Process & governance breakdown • Visibility & detection gaps • Knowledge & capability gaps vs threats • Architecture & technical implementation flaws • People & culture You can’t cure a sick SOC with more alerts; you cure it with clarity, coverage, and capability: https://lnkd.in/g9k63pfF If you want to make that checklist more “complete” and more usable in real SOC assessments, I’d add these categories: • Service management + customer alignment (SOC as a product) • Detection engineering lifecycle  • Data quality management (not just “data sources”) • Identity-centric operations (where modern incidents live) • Resilience + readiness • Third-party / supply-chain visibility I don't know what you heard about me! I practice, test, learn in public, and share what actually works ... daily and free! Threat hunting 101 series on YouTube: https://lnkd.in/g7D4pTVk Daily Cyber Drops on Medium: https://lnkd.in/gsekf7kB Nothing Cyber. Keep hunting. #cybersecurity #threathunting #threatdetection #opensource #tips #career #blueteam #soc #socanalyst #skillsdevelopment #careergrowth #IR #dataanalysis #incidentresponse #ai

30

2 comentarios

A common challenge we've incorporated in to our tabletop exercises is when frontline staff, either briefed or assuming a cyber attack, share that information/opinion with customers. We recently saw this happen at a Spanish airport, where our team member was stuck, airport staff informed customers of a supposed cyber attack before any details of the black out was confirmed. The key takeaway? Effective crisis communication requires more than just briefing HQ - it demands clear guidance and training for all customer-facing staff, ensuring consistency and accuracy across the board. ☕️ also... good morning

44

6 comentarios

Bitsight reveals that Brazilian threat actors have launched a new Lampion infostealer malware campaign targeting local users through phishing lures tied to fake job offers and tax-related themes. The campaign highlights a growing trend of localized social engineering and supply-chain targeting within Brazil’s financial and tax sectors. 📋 Recommended Actions ☑️ Monitor for and alert on anomalous domains ending in .br and related to tax/finance-themes in Brazil. ☑️ Enforce file extension visibility and restrict execution of scripts disguised as “fix” tools or support utilities. ☑️ Train employees in Brazil (and Portuguese-speaking teams) to recognize job-offer and tax-authority themed phishing lures. ☑️ Deploy endpoint protection with script block-lists, and monitor for VBScript/PowerShell loaders sideloading infostealer modules. ☑️ Conduct threat hunting for Lampion IoCs and look for post-infection credential theft or lateral movement behaviors in Brazilian contexts. 🧐 Researchers João Godinho 🔗 Blog https://lnkd.in/gJzBVt-j #Bitsight #cyber #threatintelligence #infosec #CTI #Brazil #Lampion #infostealer #ClickFix #malware

21

The addition of the Govern function in NIST CSF 2.0 addresses the rise of risk management and governance as an essential task for IT and security teams. While it has existed in previous versions, this elevation to a core function places it in a position of necessary prominence for any organization looking to proactively assess, mitigate, and transfer their cyber risk through risk-driven cybersecurity strategies.

12

Jason Soroko and I explain the major news items from the most recent CA/Browser Forum face-to-face meeting in Tokyo on the Root Causes Podcast. Topics include MPIC, 47-day certificate term, and Temporary Restraining Orders. Audio: https://lnkd.in/g-RaJifc Video: https://lnkd.in/gDJuyRAg

34

1 comentario

Two newly disclosed N-able vulnerabilities, CVE-2025-8875 and CVE-2025-8876, have been added to CISA’s KEV Catalog. They affect N-able’s N-central remote monitoring and management (RMM) platform. These flaws allow local code execution and command injection but require authentication to exploit, meaning they are unlikely to be used at the beginning of an exploit chain. Alexander Culafi at Dark Reading covers the details, noting the vulnerabilities impact versions prior to 2025.3.1. The article also features insight from Rapid7's Seth Lazarus: “They require authentication to achieve exploitation, which is much less severe than what we’ve recently seen, and likely why exploitation in the wild doesn’t appear to be widespread.” Read the full breakdown here: https://lnkd.in/eiukB6HM

77