Company Blogs – Page 24 – BackBox.org News

Shrinking your digital footprint: a checklist by Kaspersky | Kaspersky official blog

July 8, 2025/in Company Blogs

In today’s world, having an online presence is practically unavoidable. More and more of our daily lives happen online, and unless you’re a sailor out at sea or a forest ranger, living completely offline is a rare luxury. It’s estimated that each of us generates roughly two to three gigabytes of data every hour through our smartphones, IoT devices, and online services. So, it’s no wonder that, for example, around 70% of Americans are concerned about the government collecting their data, and a staggering ~80% worry about corporations doing the same. Today, we explore where and how our everyday actions leave digital trails, and what we can do about it.

Your morning routine: how your smartphone and browser track you

You wake up, check the weather, maybe scroll through some reels, like a few posts, and check your commute to see the possible traffic jams. When it comes to social media privacy settings, it’s pretty straightforward: you tweak them so your parents and colleagues don’t get a heart attack from your edgy humor. Our Privacy Checker website can help with that. But it gets trickier with geolocation data, which seemingly everyone wants to collect. We’ve already dived deep into how smartphones build detailed profiles on you, and explained what geolocation data brokers are and what happens when their data leaks.

Just imagine: about half of popular Android apps ask for your geolocation even though they don’t need it. And by default, Chrome and Safari allow cross-domain cookie tracking. This lets advertising networks build detailed user profiles for personalized ads. Pretty much all of your smartphone’s telemetry is used to create a thorough consumer portrait — no need for customer interviews or focus groups. The best marketer is in your pocket, but it’s not working for you. What should you do?

Normal measures

Head to Settings → Privacy → Permission Manager. From there, disable background access to the device’s location for messaging apps, weather widgets, and any other apps that needn’t be tracking your movements in the background.
Go to Settings → Privacy & Security → Tracking and turn off Allow Apps to Request to Track. Also, in newer iOS versions, under Settings → Privacy & Security, you’ll find a Safety Check section. This is a great place to review and adjust app and user access to your data, and even reset all access types in an emergency.
You can minimize tracking by following the instructions in our post What Google Ad Topics is, and how to disable it.
Enable Prevent cross-site tracking in Safari’s privacy and security settings on both your mobile devices and computers. Then, in the advanced settings, turn on Use advanced tracking and fingerprinting protection for all browsing.

Paranoid measures

Consider getting a Google Pixel and flashing it with GrapheneOS modified firmware that has Google Play Services disabled. Alternatively, research if AOSP firmware is available for your current Android phone. AOSP gives you a bare-bones Android experience where you choose exactly which services to install.
Enable Lockdown Mode (found under Settings → Privacy & Security). While it significantly limits functionality, it drastically reduces your chances of being tracked or having your iPhone compromised. We’ve covered this mode in detail in our article Protection through restriction: Apple’s new Lockdown Mode.
Set up a local DNS filter: for example, Pi-hole can block more than 280,000 trackers. Alternatively, you can install browser extensions like Privacy Badger for Firefox, Opera, Edge, and Chrome. Many modern routers also allow you to configure DNS filters that can block most ad network traffic on websites. For more on this, check out our post Why you should set up secure DNS — and how.

Hitting the road: the dangers of connected cars

You’re ready for your commute, hop into your car, hit the ignition… The system automatically plays your favorite playlist and has your loved ones on speed dial. Convenient, right? Absolutely, but there’s a caveat. Modern vehicles can transmit a staggering 25 GB of (your!) data per hour!

This creates two categories of problems. First, connected cars are often easier to hack because automotive manufacturers generally have a less-than-stellar approach to cybersecurity. While compromising a car’s onboard systems doesn’t always lead to theft, many vulnerabilities allow attackers to track you, or even remotely control your vehicle. For instance, in November 2024, a vulnerability was discovered in the Mazda Connect onboard system that allowed attackers to execute arbitrary code with root privileges. Before that, significant vulnerabilities were found in vehicles from Kia, Tesla, Jeep, and dozens of other carmakers.

Second, car makers themselves often enthusiastically monitor owners of the vehicles they sell and resell that collected data to data brokers and insurance companies.

What to do?

Normal measures

Dive into your car’s smart features menu and disable any that you don’t actively use or need.
Install an immobilizer that breaks the data bus connection. Some vehicles come with one built-in, but if yours doesn’t, consider a third-party immobilizer.
Regularly update your ECU firmware through official service centers. This helps patch known vulnerabilities, though it’s worth noting that new, undiscovered vulnerabilities could emerge with updates.

Paranoid measures

If you’re serious about minimizing data collection, consider buying a used car with minimal data-gathering and transmission capabilities. The absence of its own cellular module (GSM/3G/4G) in the car is a reliable sign that you’re on the right track.
Embrace public transport or cycling!

Lunch time: the hidden dangers of delivery apps

That much-anticipated lunch break is the perfect time to unwind… and leave a few more digital footprints. Whether you’re ordering coffee through an app or checking in to your favorite bakery on social media, you’re constantly adding to your online profile. This includes your location, payment details, and even your order history from delivery apps.

Food delivery apps, in particular, are incredibly data hungry. On average, they collect 21 categories of personal data, and a staggering 95% of this information is directly linked to your identity. Much of this data doesn’t stay with the delivery service; it gets sent elsewhere. Uber Eats, for instance, shares 12 out of 21 collected data points with partner companies, including your phone number, address, and search and order histories.

What’s more, food delivery services can experience data breaches. When that happens, your personal information — everything from your name, phone number and address to your shopping list and order costs — can end up exposed.

So, it’s clear: we need to do something about this too.

Normal measures

Check your app’s location settings. Instead of granting always-on access, switch it to “only while using the app”. If you’re extra cautious, you can turn off location services entirely and manually enter your address.
Unless the app’s core features genuinely require it, don’t let delivery services access your contacts, gallery or messages.

Paranoid measures

Set up a burner email address and use a different name for all your food orders. Even more radically, consider a second smartphone exclusively for delivery apps and other potentially risky applications.
Avoid providing your exact apartment number. Meet the courier at the entrance to the building instead. This can prevent your precise living location from being linked to your spending habits in case of a data breach.
Opting for cash payments ensures your purchase details aren’t stored in a payment system profile.
For a drastically reduced digital footprint, skip electronic lunch ordering altogether. Grab some cash, leave your phone at the office, and head to a local eatery. No phone means no GPS tracking, and cash transactions leave no digital trace whatsoever. While this won’t make you completely invisible (security cameras are still a thing!), it significantly shrinks your digital footprint.

Home sweet home: what your smart devices know about you

There’s nothing quite like relaxing at home after a long day. You ask your voice assistant to turn on the lights or recommend a movie. Smart speakers, TVs, robot vacuums, and other gadgets certainly make life easier. However, they also create a host of vulnerabilities for your home network, and often have questionable privacy practices. For instance, in 2023, Amazon faced a $25 million fine for retaining children’s voice recordings and other privacy violations related to Alexa.

And it’s not just corporations misusing voice assistant capabilities. Surveillance cameras, smart plugs, and even smart kettles are frequently hacked — often being roped into botnets for DDoS attacks. There have even been unsettling cases where malicious actors gained access to home cameras, using them for surveillance or pranks like speaking through a compromised baby monitor.

Normal measures

Dive into your smart home management app (Google Home, Apple Home, the Alexa app, and so on) and look for sections titled Privacy or similar. Turn off options that send your voice recordings for analysis. For Alexa, this is typically Use of Voice Recordings. For Google Assistant, opt out of the quality improvement program. Enable automatic deletion of your voice history. You can also manually clear your query history. With Alexa, just say, “Alexa, delete everything I said today”. For Google Assistant, manage and delete recordings through your Google account. This significantly reduces the amount of data stored.
Every smart speaker has a microphone mute button. If you don’t need the assistant, especially during private conversations, hit that mute button.
Laptops and some smart cameras come with built-in privacy shutters or covers. Use them! It’s a simple way to prevent unwanted peeping.
Many smart TVs allow you to disable the collection of viewing statistics (often called ACR). It’s a good idea to turn this off to stop your TV from sending reports about every channel you flip through.
Modern routers often let you set up a secondary or guest Wi-Fi network. Connect all your IoT devices to that network. This prevents the gadgets from “seeing” your main computers and phones on your home network. Even if one of your smart devices gets hacked, the attacker won’t be able to access your personal data. Plus, it makes it easier to cut off internet access to IoT devices when they’re not in use.
Use a strong, unique password for every device. When you first set up a smart device, always change the default login and password. A reliable password manager like Kaspersky Password Manager can help you generate and store secure passwords.

Paranoid measures

The most drastic option is to completely abandon voice assistants and cloud-based smart home services. Flip those light switches manually, and use mechanical timers for your appliances. The fewer microphones and cameras in your home, the more peace of mind you’ll have. If you absolutely must have an assistant, consider offline alternatives. There are open-source projects like Mycroft AI that can be configured to process commands locally — without sending data to the cloud.
If you’re concerned about covert listening, consider purchasing a bug detector – if it’s allowed in your country. These devices help locate hidden cameras and microphones when, for example, you suspect that a smart light bulb is actually a spy cam. You can also check the four ways to find spy cameras, which we described earlier.
During confidential meetings, either unplug suspicious gadgets or remove them from the room entirely.
Look for IoT devices that can function autonomously. Examples include cameras with local storage that don’t stream to the cloud, or smart home systems built on a local server like openHAB where all your data stays right in your home.

Takeaways

In today’s digital world, your data is a valuable commodity. While it’s impossible to completely erase your digital footprint, that doesn’t mean you should give up doing what you can. By staying aware and implementing smart security measures, you can control a significant portion of your data exposure. The extra protection services found in Kaspersky Premium can further enhance your privacy and payment protection. And our Privacy Checker website offers a wealth of comprehensive guides: these cover privacy settings for smartphones, computers, social networks, apps, and even entire operating systems. Whether you’re looking for simple adjustments or more thorough security measures — we’ve got you covered.

While achieving absolute anonymity often requires an extreme, almost paranoid level of effort, while most people don’t need anonymity, adopting even the “normal” measures from our recommendations will significantly limit the ability of both cybercriminals and corporations to track you.

What other steps should you take to stay safe? Below are some examples:

Should you disable Microsoft Recall in 2025?

Watching porn safely: a guide for grown-ups

Messengers 101: safety and privacy advice

How to safely convert files

Creating an unforgettable password

Kaspersky official blog – Read More

How to protect your online store from fraud attacks

July 7, 2025/in Company Blogs

According to Juniper Research data, global e-commerce turnover surpassed $7 trillion in 2024, and is projected to grow by 1.5 times over the next five years. But cybercriminal interest in this field is growing even faster. Last year, losses from fraud exceeded $44 billion — and they’re expected to reach US$107 billion within five years.

Any online platform — regardless of size or industry — can become a target, whether it’s a content marketplace, a hardware store, a travel agency, or a water park website. If you accept payments, run a loyalty program, and allow creation of customer accounts, fraudsters will definitely come knocking. So which attack schemes are most common, what kind of damage can they cause, and how can you stop them?

Account theft

Thanks to infostealers and various database leaks, attackers have access to billions of email-password combinations used on various sites. They can try these combinations on any other site with user accounts, on the assumption that humans often use the same password for different services. This attack method is known as “credential stuffing”, and if successful, attackers can place orders using the victim’s linked bank card or spend loyalty points. Criminals can also use compromised accounts to make fraudulent payments with other credit cards.

Testing stolen cards

Just as with login credentials, attackers may have a database of credit-card data stolen using malware. They need to test which cards are still valid and can process online payments — and for this, any e-commerce site will do. These “test” purchases are usually small. Working cards are then resold to other criminals, who go on to drain the funds in various ways.

From the store’s side, this looks like a customer adding a bunch of random inexpensive items to their cart and repeatedly trying to check out, each time with a different card. Even small stores can end up with hundreds of abandoned carts. Eventually, the payment gateway may block the store for exceeding the allowed number of failed payment attempts.

Buyer fraud

Sometimes real customers may complete an order, only to later tell their bank they never made the purchase — and demand a refund. This could be a case of deliberate fraud, or simply one family member using another’s card without permission — for instance, a teenager using a parent’s card. Although such incidents are usually small-scale, they can still cause serious damage — especially if the store becomes known in “lifehacker” communities as a site that easily refunds money.

Fraudulent purchases

Depending on your store’s niche, location, and other factors, criminals may try to use stolen credit cards to “cash out” by purchasing goods or services. This can result in a wave of orders followed by a flood of disputes and cancellations. In some extreme cases, the volume alone becomes a threat — one store received 118 000 fraudulent orders, with criminals placing a fake order every three seconds.

Gift card attacks

If your store accepts gift cards, bots may attempt to brute-force thousands of card numbers and verification codes to find valid ones. Once found, they’re either used to make purchases or resold on the secondary market.

Loyalty points theft

If your store allows purchases using accumulated loyalty points without requiring additional verification via SMS or other methods, attackers can either immediately drain any account they manage to access, or wait for the victim to accumulate more points. The latter often happens with stores that sell high-value products and have a loyal customer base.

Scalping exclusive products

If you sell, say, tickets to popular concerts or limited-edition sneakers, be prepared for resellers. Scalper bots can snap up all exclusive stock within minutes, triggering justified outrage from loyal customers. There’s an active black market for bots designed for popular e-commerce platforms, such as Shopifybot.

Mass account registration

To successfully run the schemes described above, attackers often create hundreds or thousands of accounts in your store, increasing operational costs — for instance, by triggering welcome SMS messages and follow-up email campaigns.

Direct and indirect business losses

Even if neither you nor your customers lose money or goods, any of the above schemes can lead to a wide range of problems and expenses:

Costs from fraudulent transactions and repeated failed payments. Depending on the situation and the terms of your agreement with the payment gateway, you might have to cover transaction and chargeback fees, fines, and other costs. You might also exceed your transaction limits and temporarily lose access to the payment gateway — effectively paralyzing normal operations.
Advertising costs and distorted analytics. Bots often arrive via referral links, paid search ads, and other forms of online advertising. This means your real advertising budget may be wasted attracting fake users. Even if the bots don’t consume your budget directly, their activity can mess up ad platform algorithms, resulting in lower-quality traffic to your site.
Costs for marketing campaigns and promotions that are misused by exploiting newly created accounts. Already registered users create new accounts to spend welcome bonuses for the first purchase, and fraudsters look for vulnerabilities and try to obtain bonuses en masse by dishonest means. As a result, the marketing budget allocated for attracting and increasing user loyalty is wasted.
Poor planning. Numerous fake orders can be hard to filter out of your analytics — especially if you rely on the default analytics tools built into your e-commerce platform. As a result, planning for demand and stock becomes much more difficult.
Wasted time. Dealing with hundreds of abandoned carts, thousands of bogus accounts, and countless failed payment attempts consumes your employees’ time and energy, leading to operational delays and losses.
Customer dissatisfaction. Depending on the attack type, customers may suffer direct losses (money stolen, loyalty points drained, fraudulent activity on their account) or indirect inconveniences (product shortages, failed transactions). Whatever the issue, your support and marketing teams will have to handle it — offering discounts, compensation and so on. But many customers will simply walk away and never come back.

It’s no surprise that, according to some estimates, for every hundred dollars in fraudulent orders, businesses lose over double that in total costs.

How to protect your online business

The days of blocking bots by filtering IP addresses or adding a CAPTCHA at checkout are over. The AI boom has empowered not only automation in marketing and customer support — but also a new generation of dangerous fraud bots that easily bypass traditional protection.

That’s why businesses of all sizes need next-generation security technologies that monitor every user session from the moment they land on the site until checkout. This kind of continuous protection helps detect any anomalies — whether it’s a compromised legitimate account, abuse of the payment gateway API, mass fake account creation, or attempts to circumvent security measures.

A leading solution in this space is Kaspersky Fraud Prevention. By continuously analyzing the user’s device, behavior, environment, and metadata in real time, it builds a profile of a legitimate user, detects anomalies early on, and protects against account compromise and fraud. Kaspersky Fraud Prevention can be tailored to the specific needs of your store using flexible rules that leverage both your own data and global analytics. The solution does not require installation on the user’s device and is integrated into an existing website and mobile application with minimal effort.

Many site owners report that advanced anti-fraud analytics actually improve the customer experience — since legitimate users encounter fewer CAPTCHAs, SMS verifications, and other friction points. And ultimately, your business faces fewer losses — and can focus more on developing your product range and service.

Kaspersky official blog – Read More

How to get into cybersecurity | Unlocked 403 cybersecurity podcast (S2E3)

July 5, 2025/in Company Blogs

Cracking the code of a successful cybersecurity career starts here. Hear from ESET’s Robert Lipovsky as he reveals how to break into and thrive in this fast-paced field.

WeLiveSecurity – Read More

Task scams: Why you should never pay to get paid

July 5, 2025/in Company Blogs

Some schemes might sound unbelievable, but they’re easier to fall for than you think. Here’s how to avoid getting played by gamified job scams.

WeLiveSecurity – Read More

How government cyber cuts will affect you and your business

July 4, 2025/in Company Blogs

Deep cuts in cybersecurity spending risk creating ripple effects that will put many organizations at a higher risk of falling victim to cyberattacks

WeLiveSecurity – Read More

A message from Bruce the mechanical shark

July 3, 2025/in Company Blogs

Welcome to this week’s edition of the Threat Source newsletter.

Hi, I’m Bruce, the 25-foot mechanical star of “Jaws.”

This summer marks 50 years since my 4 minutes of screentime kept people out of the water for decades. Maybe this Fourth of July weekend you’re planning to sea-shanty your way to a special screening? If you do, here’s a little behind-the-scenes story on how my endless malfunctions almost made Spielberg hang up his director hat before you could say “phone home.”

I was built for a studio tank — a predictable and safe environment. But Spielberg, in pursuit of realism, had other plans. He threw me into the Atlantic, where the salt water, rolling waves and unruly weather conditions caused more chaos than anybody had bargained for.

Each day, my hydraulics jammed, my pneumatics corroded and my paint peeled like a sunburned tourist on Amity Beach.

There were days when the crew could only capture one or two shots before either I broke, the weather broke, or one of the actors’ egos broke. Every night they’d patch me up and whisper an assortment of four-letter words into my rusty gills.

My saving grace became Verna Fields, aka “Mother Cutter.” Spielberg’s editor was the one to suggest they only use fleeting moments of footage starring yours truly. While I bobbed around like a skydancer on a windless day, Verna worked her magic: stitching reactions, cutting away at just the right moment and building tension with empty water. She turned me from a potential failure to a legend.

And thus, I became a lesson in what happens when you build for a predictable environment but deploy in the wild. Sound familiar?

I’ve been told that readers of Talos’ Threat Source Newsletter are security folks, and I’ve been asked to write something just for you. Here it goes…

“You’re gonna need a bigger boat.” Overprepare. Expect things to go wrong.
“It’s only an island if you look at it from the water.” Perspective matters. Make sure your alerts are honed to spot the things that really matter.
“Smile, you son of a…” Sometimes, your last line of defense is your defining moment. Should everything else fail, make sure you have something left in the tank.

In cybersecurity, your green ticked audit checklists mean nothing if you haven’t pressure-tested your environment against real red teamers. Incident response plans need ocean trials, not just bullet points.

If I have a legacy beyond people sticking their noggin in my teeth for “the gram,” it’s this: Build your defenses for salt water, not studio tanks. And remember, the mayor always wants to keep the network open…

Editor’s note: I’d like to thank Bruce for his time and perspective, and I hope he found our studio a relaxing place to write. I’m also sorry that I only had two barrels and not the requested three for him to play with.

Bruce’s story is why Cisco Talos Incident Response exists: to help you prepare for the effects of salt water before they wreak havoc on your system. With Talos IR, you can stress test your defenses using real world scenarios and incident responders who’ve experienced just about everything there is to see.

Enjoy the Fourth of July weekend, and remember to listen out for the duh dun.

The one big thing

Cisco Talos has enhanced its email threat detection engine to address brand impersonation tactics using PDF payloads in phishing attacks. These attacks often exploit popular brands to steal sensitive information, employing methods like QR code phishing and telephone-oriented attack delivery (TOAD), where victims are tricked into calling adversary-controlled phone numbers. Adobe’s e-signature service and PDF annotations have also been abused to bypass detection systems.

Why do I care?

Phishing attacks are getting sneakier, using PDFs and trusted brands to trick people into giving up personal info or downloading malicious software. If you’re not careful, you could fall for one of these scams, especially since attackers are using clever tactics like fake phone numbers or QR codes to seem legitimate.

So now what?

Be extra cautious with emails containing PDFs, even if they look legit. Avoid scanning QR codes or calling phone numbers from unsolicited emails. Cisco’s detection tools are updated often, but staying vigilant and double-checking anything suspicious is your best defense.

Top security headlines of the week

Europol Dismantles $540 Million Cryptocurrency Fraud Network, Arrests Five Suspects
The international effort, codenamed Operation Borrelli was carried out by the Spanish Guardia Civil, along with support from law enforcement authorities from Estonia, France, and the United States. (The Hacker News)

International Criminal Court hit by new ‘sophisticated’ cyberattack
In a statement yesterday, the ICC revealed that it had contained a “sophisticated and targeted” cybersecurity incident, which was discovered by systems in place to detect cyberattacks targeting its systems. (Bleeping Computer)

Windows’ Infamous ‘Blue Screen of Death’ Will Soon Turn Black
After more than 40 years of being set against a very recognizable blue, the updated error message will soon be displayed across a black background. (SecurityWeek)

Ahold Delhaize Data Breach Impacts 2.2 Million People
The incident impacted Giant Food pharmacies, Food Lion and Stop & Shop, among others. Stolen information may include names, contact info, date of birth, SSN, passport number, financial account information and more. (SecurityWeek)

Germany asks Google, Apple remove DeepSeek AI from app stores
The Berlin Commissioner for Data Protection has formally requested Google and Apple to remove the DeepSeek AI application from the application stores due to GDPR violations. (Bleeping Computer)

Can’t get enough Talos?

Decrement by one to rule them all: AsIO3.sys driver exploitation
Learn how our researcher, Marcin Noga, found two critical vulnerabilities in ASUS’ Armory Crate and AI Suite drivers.

Talos Takes: Teaching LLMs to spot malicious PowerShell scripts
Hazel chats with Ryan Fetterman from the SURGe team to explore his new research on how LLMs can assist security operations centers in identifying malicious PowerShell scripts.

Beers with Talos: Terms and conceptions may apply
In this episode, the crew reassembles after a totally intentional and not-at-all accidental hiatus. They cover AI-assisted IVF, a possible underground war against dairy, and the real heroes: conference dogs.

Upcoming events where you can find Talos

NIRMA (July 28 – 30) St. Augustine, FL
Black Hat USA (Aug. 2 – 7) Las Vegas, NV

Most prevalent malware files from Talos telemetry over the past week

SHA 256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
MD5: 2915b3f8b703eb744fc54c81f4a9c67f
VirusTotal: https://www.virustotal.com/gui/file/9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
Typical Filename: VID001.exe
Claimed Product: N/A
Detection Name: Win.Worm.Coinminer::1201

SHA 256: cd697cc93851d0b1939a7557b9ee9b3c0f56aab4336dd00ff6531f94f7e0e836
MD5: c94c094513f02d63be5ae3415bba8031
VirusTotal: https://www.virustotal.com/gui/file/cd697cc93851d0b1939a7557b9ee9b3c0f56aab4336dd00ff6531f94f7e0e836/details
Typical Filename: setup
Claimed Product: N/A
Detection Name: W32.Variant:Gen.28iv.1201

SHA 256: 57a6d1bdbdac7614f588ec9c7e4e99c4544df8638af77781147a3d6daa5af536
MD5: 79b075dc4fce7321f3be049719f3ce27
VirusTotal: https://www.virustotal.com/gui/file/57a6d1bdbdac7614f588ec9c7e4e99c4544df8638af77781147a3d6daa5af536/details
Typical Filename: RemCom.exe
Claimed Product: N/A
Detection Name: W32.57A6D1BDBD-100.SBX.VIOC

SHA 256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91
MD5: 7bdbd180c081fa63ca94f9c22c457376
VirusTotal: https://www.virustotal.com/gui/file/a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91/details
Typical Filename: IMG001.exe
Claimed Product: N/A
Detection Name: Simple_Custom_Detection

SHA 256: 061e13a4fc9f1d4da0671082d5e4666f316bb251f13eded93f9cdb4a584d0bc0
MD5: 8d74e04c022cadad5b05888d1cafedd0
VirusTotal: https://www.virustotal.com/gui/file/061e13a4fc9f1d4da0671082d5e4666f316bb251f13eded93f9cdb4a584d0bc0/details
Typical Filename: smhost.exe
Claimed Product: N/A
Detection Name: Artemis:Lazy.27fx.in14.Talos

SHA 256: 2eb95ef4c4c24f1e38a5c8b556d78b71c8a8fb2589ed8c5b95e9d18659bde293
MD5: N/A
VirusTotal: N/A, use https://talosintelligence.com/sha_searches
Typical Filename: N/A
Claimed Product: N/A
Detection Name: W32.2EB95EF4C4-100.SBX.TG

Cisco Talos Blog – Read More

Best travel apps: maps, taxis, food, internet | Kaspersky official blog

July 3, 2025/in Company Blogs

Summer is in full swing, and that means one thing — it’s time to travel! Remember how people used to prepare for trips? Buying pocket guidebooks and phrasebooks, bombarding all our well-traveled friends with questions: “What should I see?”, “How much do tours cost?”, “And how do I get a SIM card?“.

These days, the world has changed. You can plan a comfortable trip while lounging on your sofa with a smartphone in hand — or even while waiting at the airport gate. All you need do is download the right apps. In this guide, we’ll help you prep both yourself and your phone for your journey:

How to find your bearings in a new place?

Sure, you could buy a paper map in advance, but it’s much easier to download a few mapping apps. Yes, a few — don’t rely on just one.

Google Maps. An absolute must-have for any traveler. Plan routes and find nearby hotels, cafes, currency exchanges, and attractions. Read folks’ reviews for insider knowledge on the best spots (and the ones to avoid). Google Maps is every traveler’s digital Swiss Army knife — useful for a ton of different things (as long as you’ve downloaded offline maps in advance or have an internet connection).

Organic Maps. If you’re going somewhere beyond the reach of mobile networks, offline maps are your best bet. You can download a detailed map of your destination before your trip. It includes everything you’d find in Google Maps — restaurants, shops, transport stops — just without user ratings and reviews.

One standout feature is route planning for walking, biking, and hiking. You can even switch to a topographic view to see elevation changes — great for mountainous terrain or outdoor adventures.

Guru Maps. Among tourists, this app is known as “the king of navigation” — and for good reason. With Guru Maps you can venture far off the grid without getting lost. It’s made for finding hiking trails, routes through the wilderness, even swamp-trekking — perfect for when Google Maps and Organic Maps find no route at all.

Like the other two, Guru Maps is free to use, but there’s also a paid Pro version. This lets you download unlimited maps and create enough pins and GPS tracks for even the most hardcore traveler.

How to stay connected?

Offline apps are great, but pre-downloaded information alone isn’t always enough. Especially in big cities, it’s essential to stay online. There are a few ways to do this.

eSIM. Get a local SIM card, or better yet, an eSIM. You can use the Kaspersky eSIM Store app to find and activate affordable local data plans — no roaming fees or plastic SIM cards needed.

It’s simple: install Kaspersky eSIM Store, choose your destination, and buy a data plan that suits your needs. Along with the data package, you’ll receive your free eSIM — simply install it in your device in a couple of clicks. Later you can top up your eSIM for the same or different destinations with more great plans from local operators. And you’re not limited to just one country at a time — if you’re traveling across several countries, choose a regional plan or even get global coverage in 122 countries for constant connection.

eSIMs from Kaspersky eSIM Store don’t include a phone number — they only support data transfer. But your regular SIM stays in your device, so you can still receive texts and calls. Of course, you don’t need to answer roaming calls — but you can see who contacted you and respond via messenger using your eSIM data.

The cool thing is that you can set up eSIMs in advance, including the date your data plan will activate. Kaspersky eSIM Store offers both expiring plans (valid for 30 days in most countries) and non-expiring ones where unused gigabytes are saved for your next trip.

eSIMs and related services are provided by our tech partner BNESIM Limited. For more on all the benefits of eSIMs, check out our blog post: Internet on the go with Kaspersky eSIM Store

Mobile operator app. If you still plan to use roaming from your usual operator, be sure to install their app to monitor your data use, enable roaming options, and top up.

However, there’s a downside here: roaming usually costs much more than using an eSIM from Kaspersky eSIM Store. Yes, some providers offer special plans like unlimited messaging or map access, but relying on them could backfire in a crucial moment. For example, what if you’re in a small town where Google Maps’ timetables for public transportation aren’t up to date? You’ll need to look for an alternative transport app or take a completely different route. That could mean using a search engine — which can be painfully expensive on roaming data.

How to get around comfortably?

This is where specialized apps come to the rescue — reliable in big cities and helpful even in small towns where you could otherwise get stuck.

Moovit. An app to help you navigate public transport almost anywhere in the world. It sources real-time data from transport providers — including private companies — so seasoned travelers trust Moovit in cities with a well-developed public transit system. But don’t expect it to tell you exactly when a local bus is going to arrive in a tiny remote village. In such cases, it’s best to rely on taxis.

Uber. If you’ve ever taken a taxi, there’s a good chance you already have Uber on your phone. It’s one of the world’s biggest ride-hailing platforms: just enter your destination, choose a rate, and wait for your driver. Simple and intuitive — but there’s a catch: Uber isn’t available everywhere. You’ll have no trouble getting a ride in North America, Europe, and parts of Asia, but elsewhere your best bet is often a local taxi app.

Yandex Go. Great for rides in Russia, Georgia, Kazakhstan, Belarus, Moldova, Armenia, Kyrgyzstan, Lithuania, Serbia, and Uzbekistan.
DiDi. Use this app in China, Argentina, Australia, Brazil, Chile, Colombia, Costa Rica, Ecuador, Egypt, Japan, Mexico, New Zealand, Panama, Peru, and the Dominican Republic.
Grab. The go-to ride-hailing app for Southeast Asia: Singapore, Cambodia, Myanmar, Malaysia, the Philippines, Thailand, Vietnam, and Indonesia.
Careem. Ideal for travel in Egypt, Bahrain, Iraq, Jordan, Pakistan, Saudi Arabia, Kuwait, Morocco, and the UAE.

Bonus: InDrive is a unique app that lets you name your price for a ride and choose a driver. Available in 48 countries.

How to enjoy a city like a local?

Sometimes you only have a few hours or a couple of days to explore a huge city. So how do you quickly decide what to see and where to go? Previously, you could find such answers on Foursquare — but what now?

Visit a City. According to its developers, this app covers more than 3000 cities worldwide. Choose free mini-guides, buy tickets to museums and attractions, or book tours. With just a few clicks, you can plan a trip — say, two days in Istanbul — and get a detailed itinerary down to the minute.

Many major cities now offer their own travel apps — so check those out too. For a Thames-side stroll, try Visit London; if it’s mosques and markets you’re after, check Istanbul Tourist Pass; and if you’ve always dreamed of seeing Park Güell, use Hola Barcelona.

ChatGPT. Yes, artificial intelligence can help here too, creating an itinerary for any city on Earth and offering it in a neat PDF or spreadsheet. Just bear in mind that AI can’t always account for real-world factors like traffic or opening hours — things that are kept up-to-date by real people in specialized apps like Visit a City.

But for general plans, ChatGPT works wonderfully. Just tell it something like, “Plan a 2-day trip to Istanbul for two people in their 30s. The pace should be relaxed and must include Galata Tower, a San Sebastián cheesecake stop, and a Bosphorus cruise. Break it down by time, considering traffic.”

How to find good food?

If you’re just looking for a quick bite while exploring, Google Maps or any other map app will do the trick — as long as you’ve got an internet connection, you’ll see nearby food options in seconds. But if you’re after something more authentic or sophisticated, there are dedicated apps for that.

The MICHELIN Guide. Not sure where to eat and want a guaranteed good spot? Pick any restaurant in this guide — and you can even book a table right in the app. A common myth is that Michelin is only for expensive fine dining, but that’s not true anymore: today the guide includes plenty of local gems with reasonable prices and great service. So whether you’re a foodie or just want a reliable recommendation, the MICHELIN Guide has something for every budget.

TheFork. This popular app makes sure no tourist goes hungry — at least in Europe. It’s packed with everything you need: addresses, menus, cuisine types, food photos, average prices, real reviews, and the ability to book a table directly. Sounds ideal, but as usual there’s a catch: TheFork only works in certain major European cities — for now: Paris, Amsterdam, Barcelona, Lisbon, Madrid, Milan, Rome, Geneva, Brussels, Stockholm, Marseille, and Bordeaux.

Local apps. Just like with taxis, every country — or even every city — tends to have its own version of TheFork. So it’s worth doing a little research to see what app is popular at your destination. For example, in the United States, you’ll want Resy and Yelp, while in China, Dianping is the go-to (if your Chinese is ok: it’s only available in Chinese).

Bonus: Flush Toilet Finder. This handy app helps you locate public toilets all over the world — a perfect companion to your restaurant guide. While general maps might also show toilet locations, Flush Toilet Finder provides extra details such as wheelchair accessibility, whether access codes or keys are required, and how much it costs.

How to travel safely?

Connecting to the first open Wi-Fi spot you find is not a great idea — and neither is storing a passport scan in your photo gallery. Here’s how to add a dash of digital safety to your perfect trip mix:

Obsidian. You’ll probably want to plan your trip in advance — and most likely, you’ll try to do so using the standard Notes app on your phone. That’s not the safest option, and sometimes not the most convenient either when it comes to storing important information. Consider Obsidian — it protects your notes with end-to-end encryption and syncs them across your devices. But there are other similar apps out there, which we wrote about in our article Keep it under wraps: encrypted note-taking apps and to-do lists.

Kaspersky Password Manager. Store photos or PDFs of your passports, tickets, vouchers, and other important documents in secure storage — they can only be decrypted and viewed after entering a main password that only you know. At the same time, you can easily add or open any document on any device — the app is cross-platform and constantly syncs information between your smartphone and computer. In addition, our password manager can store two-factor authentication tokens. Remember that traditional one-time passwords may not arrive via SMS while roaming, or they may be severely delayed. Take a couple of minutes at home to configure your frequently used apps and websites so that 2FA codes are generated in Kaspersky Password Manager instead of being sent via SMS.

Kaspersky VPN Secure Connection. If you’ll be connecting to unfamiliar Wi-Fi networks often during your trip, your best bet is to protect your connection. You can do this with the help of one of the fastest VPNs in the world. Plus, VPN also lets you change your phone’s location in advance — so your search results become local! That way, even from home, you can plan visits to the events that locals actually go to, not just tourist traps.

Wherever you’re going, remember — happiness is only real when shared. Stay connected with Kaspersky eSIM Store and share your favorite travel moments with your loved ones.

What else to read before your trip:

How to travel safely

Internet on the go with Kaspersky eSIM Store

Fake Wi-Fi on board a flight

Going on vacation? Beware of scammers

Four ways to find spy cameras

Kaspersky official blog – Read More

Release Notes: Detonation Actions, Enhanced QR Extraction, and 1,400+ New Detection Rules

July 2, 2025/in Company Blogs

We’ve packed June with updates designed to make your day-to-day analysis faster, clearer, and easier than before. Whether you’re just getting started or deep into reverse engineering every day, these improvements are here to save you time and help you catch more threats.

In this update:

Real-time Detonation Action hints that guide you through the steps needed to keep the analysis forward

Enhanced QR code extraction, making it easier to detect phishing links hidden in documents, images, or dropped during runtime

Expanded threat coverage, including 120 new behavior signatures, 12 YARA rules, and 1,320 Suricata rules across Windows, Linux, and Android

Scroll down to see what’s new and how these updates can help your team work faster, spot threats earlier, and get more from your ANY.RUN sessions.

Product Updates

Detonation Actions: Faster, Clearer Malware Analysis with Real-Time Guidance

In June, we focused on helping analysts work faster and with more clarity, especially during high-pressure investigations. That’s why we introduced Detonation Actions: real-time execution hints that keep your analysis moving forward without guesswork.

Now, when a sample requires interaction to detonate, like opening a file or following a link, Detonation Actions will show exactly what needs to be done.

*You can find the Actions tab next to the Processes tab*

Whether you’re clicking through manually or relying on automation, you’ll see helpful hints to understand how the threat at hand unfolds.

See example

Manual Mode (Community plan):
You’ll see suggested actions during the session and can approve or reject them individually, helping you uncover hidden behavior faster.

Automated Interactivity (Paid plans):
Detonation Actions are automatically followed as part of a guided flow. Each step is logged and visible, so your team gets full transparency, even when analysis is fully hands-off.

You’ll find Detonation Actions inside the Actions tab, right next to the process tree. They work across all samples and help analysts of any skill level trigger and observe malware behavior with confidence.

Speeds up threat analysis by guiding analysts through key detonation steps.

Improves SOC handover with action-based insights for smoother investigations.

Accelerates incident response by automating detonation and surfacing behavior fast.

Simplifies onboarding by helping junior analysts learn through guided workflows.

Enables smarter decisions with clearer behavioral context during investigations.

Supports automation by integrating with existing workflows and API-based pipelines.

You can activate Detonation Actions by clicking the new Auto button when launching your VM or toggle Automated Interactivity (ML) manually in Advanced Settings.

*Options for enabling Detonation Actions with Automated Interactivity*

Enhanced QR Code Auto-Extraction for Broader Use Cases

We’ve improved how the sandbox detects and extracts QR codes, making it easier to investigate threats hidden in documents, images, and archives.

Now, QR code detection works more reliably across a wider range of file types and delivery methods. Whether it’s a malicious link embedded in a PDF or a code inside an SVG file, the sandbox will automatically pick it up and display the decoded URL in the QR tab under Static Discovering.

*QR code decoded under Static Discovering*

QR-based phishing is still on the rise. This improvement makes it even easier to detect and investigate QR code threats before a user ever scans them.

Threat Coverage Updates

This month, we expanded threat detection across all supported platforms, Windows, Linux, and Android, with major additions to our rule base and signature library.

120 new behavior-based detection signatures

12 new YARA rules

1320 new Suricata rules

These updates improve detection accuracy, shorten triage time, and give analysts better visibility into evasive threats. From commodity malware to nation-state actors, the latest rules reflect real-world samples seen in the wild and analyzed inside ANY.RUN.

New Behavior Signatures

We added 120 behavior signatures targeting stealers, ransomware, RATs, loaders, and evasive techniques, many of which were observed in active campaigns.

Some highlights:

PurpleFox – A rootkit-enabled malware that abuses SMB vulnerabilities for lateral movement

Bert Loader – Dropper with obfuscated payload delivery tactics

Bondy Loader – Frequently used to stage ransomware and remote control tools

XData Ransomware – Resurfaces with updated infection logic and encryption flow

LD_PRELOAD Hijacking – A Linux-based persistence technique now tracked as standalone behavior

Winlocker – Known for fake law enforcement messages and aggressive blocking behavior

Ransomblox – Displays error pop-ups while communicating with its C2 during encryption

Conti-style variant – Exhibits callbacks to infrastructure overlapping with known Conti and DragonForce setups

Dacic ransomware – Recently observed in campaigns with custom servers and DNS-based C2

Cyberkiller – Attempts stealthy exfiltration before launching destructive behavior

Platform-Specific Threats

New behavior detections were also added for threats targeting specific operating systems:

Windows:

Kiwistealer – Stealer that extracts browser data, passwords, and system information

KimJongRAT – Remote access trojan that abuses trusted binaries and uses a GUI-based control panel

Byakugan – Leverages signed binaries to inject into processes and maintain stealth

Linux:

DSLogdRAT – Lightweight Linux backdoor with keylogging, reverse shell access, and simple evasion logic

Android:

Antidot – Spyware disguised as a system utility app, capable of remote monitoring

Zanubis – Banking trojan that abuses accessibility services to intercept credentials

Godfather – Targets financial apps and intercepts MFA codes to bypass login security

YARA Rule Updates

We released 12 new and updated YARA rules this month to support faster static detection and classification of threats across all platforms. These rules help flag malicious files before execution and enhance attribution in multi-stage attacks.

Some of the key additions include:

Katz – Credential-dumping tool used in post-exploitation phases

Ryuk – Ransomware version attributed to the hacker group WIZARD SPIDER

WirelessKeyView – Tool that extracts stored Wi-Fi credentials from Windows systems

Mail PassView – Password-recovery tool that reveals the passwords and other account details for email clients

SmartSniff – Network sniffer commonly abused in data exfiltration scenarios

LClipper – Clipper malware that hijacks clipboard data to redirect crypto transactions

Phantom – Stealer with anti-analysis techniques, commonly used in phishing kits

Suricata Rule Updates

To improve detection of phishing threats at the network layer, we added 1,320 new Suricata rules in June. These rules help security teams identify malicious domains, redirection chains, and phishing infrastructure early in the attack flow.

Here are some of the highlights:

Lndeed domain typosquatting pattern (sid:85000784): Identifies indeed.com – themed phishing attempts

Document-themed phishing (sid:85000452): Detects phishing domains utilizing social engineering methods (“See / review / share” + “document”)

EvilProxy domain chain (sid:85000494): Tracks EvilProxy phishing kit activity by sequence of queried domains

New Detection Techniques

We added behavior-based detection for a tactic used by malware to bypass standard execution monitoring:

Command execution via FileFix technique – This method involves abusing renamed or repurposed legitimate executables (e.g., “FileFix.exe”) to stealthily launch payloads. It’s commonly used in commodity loaders to blend in with normal activity.

This new detection helps analysts flag unusual execution chains earlier in the process tree and trace hidden payload delivery paths more efficiently.

About ANY.RUN

ANY.RUN supports over 15,000 organizations across industries such as banking, manufacturing, telecommunications, healthcare, retail, and technology, helping them build stronger and more resilient cybersecurity operations.

With our cloud-based Interactive Sandbox, security teams can safely analyze and understand threats targeting Windows, Linux, and Android environments in less than 40 seconds and without the need for complex on-premise systems. Combined with TI Lookup, YARA Search, and Feeds, we equip businesses to speed up investigations, reduce security risks, and improve team’s efficiency.

Integrate ANY.RUN’s Threat Intelligence suite in your organization →

The post Release Notes: Detonation Actions, Enhanced QR Extraction, and 1,400+ New Detection Rules appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – Read More

A Guide to Developing Security-First Culture Powered by Threat Intelligence

July 2, 2025/in Company Blogs

Security-First Culture (SFC) is an organization-wide commitment where security considerations influence decision-making at every level, from strategic planning to daily operational tasks.

It’s not just about having fancy tech or a dedicated IT team; it’s about making security a core part of how the company thinks and acts. A mindset where every decision, from coding a new app to sending an email, considers “How could this go wrong, and how do we protect against it?”.

Leaders set the tone by prioritizing security, allocating resources, and weaving it into the company’s strategy. Every employee, regardless of their role, understands that they play a critical part in the organization’s security posture.

Main Principles of Security-First Culture

Proactive Risk Management. Teams don’t wait for incidents to happen. They actively identify, assess, and mitigate risks before they materialize into threats.

Continuous Learning and Adaptation. Threats evolve, so should your people and your strategies. Regular training, updates, and process improvements are standard practice.

Transparency and Communication. Open dialogue about security concerns, incidents, and best practices creates an environment where problems are addressed quickly.

Security by Design. New products, services, and processes are developed with security considerations built-in from the beginning. Security supports innovation; it doesn’t block it.

Data-Driven Decision Making. Security decisions are based on threat intelligence, risk assessments, and measurable outcomes rather than assumptions or gut feelings.

The principles sound sensible but quite challenging to implement. Transferring to SFC might look like an organizational revolution demanding changes on all levels, from the leadership mindset to everyday practices. And of course it must be quite a recourse-consuming adventure. Is the outcome worth it?

Benefits of Security-First Culture

The advantages of implementing SFC extend far beyond just preventing cyberattacks. But the straightforward outcome of suffering less breaches must certainly be considered. Verizon’s 2022 Data Breach Report says 82% of breaches involve human error, so a security-minded workforce can slash that risk.

Fewer breaches mean less damage: financial, reputational, operational. Preventing even one incident can save millions: the average cost of a data breach exceeded $4 million back in 2023, according to IBM. Besides, if an attack does happen, a prepared organization bounces back faster, minimizing damage and downtime.

Customers, partners, and stakeholders have greater confidence in organizations that demonstrably prioritize security. This translates to stronger business relationships and competitive advantages.

Less obvious but no less valuable benefits include:

Improved Operational Efficiency: When security practices are integrated into daily workflows, they become second nature, reducing friction and improving overall productivity.

Regulatory Compliance: A security-first approach makes compliance with various regulations (GDPR, HIPAA, SOX, etc.) more straightforward and less costly.

Innovation Enablement: Paradoxically, strong security foundations enable organizations to innovate more freely, knowing they have robust safeguards in place.

Employee Empowerment: When staff feel confident handling threats, they’re more engaged and take ownership of their role in security.

Enrich your threat knowledge with TI Lookup

Learn about TI Lookup and its capabilities to see how it can contribute to your company’s security

Explore more

SFC Champions and Those Who Paid the Price

Several organizations have become benchmarks for security-first culture:

Microsoft: Following significant security challenges in the early 2000s, Microsoft implemented their “Security Development Lifecycle” and “Assume Breach” philosophy, fundamentally transforming their approach to security.

Google: Their “BeyondCorp” zero-trust security model and continuous security innovations demonstrate a deep cultural commitment to security.

Apple: Known for privacy-by-design principles and strong encryption standards across all products and services.

Not every company gets it right (providing us with impressive and didactic examples). These high-profile disasters could’ve been mitigated with a stronger SFC:

Equifax (2017): A failure to patch a known vulnerability led to a breach exposing 147 million people’s data. A lack of proactive monitoring and employee awareness was a key factor.

SolarWinds (2020): A supply chain attack compromised multiple organizations. Inadequate security training and siloed responsibilities left gaps that attackers exploited.

AT&T (Multiple breaches 2023-2024): Repeated incidents affecting millions of customers demonstrate ongoing security culture deficiencies despite previous breaches.

Evaluating Your Current Security Culture

Here’s how to understand where you stand:

Strong Security-First Culture Indicators	Warning Signs of Weak Security Culture
Employees proactively report security concerns	Security seen as “someone else’s job”
Security is discussed in regular business meetings	Frequent workarounds to security policies
New projects include security requirements from the start	Incident response is chaotic or delayed
Incident response is swift and coordinated	Security training completion rates below 90%
Regular security training has high participation rates	Security budget cuts during tough financial periods
Security metrics are tracked and reported to leadership	Repeated similar security incidents

Cyber Threat Intelligence as a Pillar of Security-First Culture

Cyber Threat Intelligence (CTI) isn’t just a technical capability — it’s the nervous system of a security-first culture. CTI provides the contextual awareness that transforms reactive security measures into proactive, strategic defense.

Like security-first culture permeates and consolidates every organizational unit and structure, state-of-the-art CTI vendors like ANY.RUN offer solutions to cover security-related challenges on all business levels.

CTI for Enriching Cyber Threat Investigations and Response

Daily security operations rely on CTI to prioritize alerts, contextualize incidents, and guide response efforts. Instead of treating all security events equally, intelligence helps teams focus on genuine threats.

Threat Intelligence Lookup allows employees of any grade to utilize a vast database of fresh Indicators of Compromise (IOCs), Behavior (IOBs), and Attack (IOAs) to instantly collect context for alerts, incidents, and campaigns. The data is continuously updated and derived from the attacks on over 15,000 companies using ANY.RUN’s Interactive Sandbox for hands-on investigations of malware and phishing attacks.

An employee does not have to be a security expert to make a search request like a suspicious IP address and receive an instant verdict that the notorious banking stealer Lumma might have penetrated the perimeter:

*TI Lookup actionable IP search results*

TI Lookup enables teams to quickly gather critical threat context, transforming existing indicators tin actionable insights into the threat to hand to mitigate risks and protect the organization.

CTI for Proactive Threat Monitoring

When it comes to tactical implementation, security tools and controls are configured based on current threat intelligence, ensuring defenses remain relevant as the threat landscape evolves.

Threat Intelligence Feeds provided by ANY.RUN deliver up-to-date curated indicators of compromise like URLs, domains, and IPs, enriched with threat context, to integrate with detection and monitoring systems and identify threats before they become incidents.

CTI For Early Detection of Malicious Files and URLs

Smart threat intelligence solutions improve employees’ ability to make better security decisions in ambiguous situations. ANY.RUN’s Interactive Sandbox makes it possible to analyze any suspicious link, email, or file, and not just get a malicious/benign verdict, but to understand malware’s behavior as well as its operators’ TTPs.

Thanks to interactivity, the sandbox makes it possible to engage with the environment and the threat just like on a standard desktop, detonating every stage of the attack to reveal the final malicious payload.

*A suspicious .exe file can be securely detonated in the sandbox*

As we can see, the Sandbox file analysis exposes its malicious behavior and labels it as AsyncRAT trojan.

The intuitive interface of the sandbox simplifies malware analysis for junior security professionals and even non-specialists, providing them with a clear understanding of any threat.

CTI For Improving Security Strategy

In strategic planning, CTI informs long-term security investments by identifying emerging threats and industry-specific risks. When planning business expansion, drafting a security budget for the next quarter, or gathering information on the key cybersecurity risks, it provides crucial context about the current threat landscape.

ANY.RUN’s TI Reports contain manually collected intel on APTs, as well as malware and phishing campaigns that pose a danger to businesses right now. The reports help security teams gain greater visibility into the threats active at the moment and proactively defend their infrastructure.

Step-by-Step Algorithm to Deploy SFC

Assess Current State: Survey employees, audit processes, and measure metrics like phishing click rates to identify gaps.

Develop Security Strategy: Align security with business goals, like customer trust or operational continuity. Create comprehensive plan addressing people, process, and technology. Establish policies and security rules (e.g., password standards, MFA use) and integrate them into workflows.

Train Employees and Implement Tools: (firewalls, encryption, threat intelligence solutions, and monitoring systems to support human efforts).

Measure and Iterate: Track KPIs (e.g., incident response time, training completion) and refine strategies based on results.

Review Regularly: Conduct quarterly audits and update tactics to address new threats.

Celebrate Successes: Recognize and reward security-positive behaviors. Share knowledge and learn from security community.

Final Thoughts

A security-first culture isn’t just about tech — it’s about people, processes, and a shared commitment to staying safe. By embedding cyber threat intelligence into every step, from leadership to daily operations, organizations can stay ahead of attackers, protect their data, and build trust with customers.

Organizations that successfully implement security-first culture supported by robust threat intelligence capabilities don’t just survive in today’s threat environment. They thrive, using their security posture as a foundation for innovation, growth, and competitive advantage.

About ANY.RUN

Over 500,000 cybersecurity professionals and 15,000+ companies in finance, manufacturing, healthcare, and other sectors rely on ANY.RUN. Our services streamline malware and phishing investigations for organizations worldwide.

Speed up triage and response: Detonate suspicious files using ANY.RUN’s Interactive Sandbox to observe malicious behavior in real time and collect insights for faster and more confident security decisions.

Improve threat detection: ANY.RUN’s Threat Intelligence Lookup and TI Feeds provide actionable insights into cyber attacks, improving detection and deepening understanding of evolving threats.

Start 14-day trial of ANY.RUN’s solutions in your SOC today

The post A Guide to Developing Security-First Culture Powered by Threat Intelligence appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – Read More

PDFs: Portable documents, or perfect deliveries for phish?

July 2, 2025/in Company Blogs

Cisco recently developed and released an update to its brand impersonation detection engine for emails. This new update enhances detection coverage and includes a wider range of brands that are delivered using PDF payloads (or attachments).
A significant portion of email threats with PDF payloads persuade victims to call adversary-controlled phone numbers, displaying another popular social engineering technique known as Telephone-Oriented Attack Delivery (TOAD), also known as callback phishing.
Talos observed that these threat actors often use Voice over Internet Protocol (VoIP) to remain anonymous. These phone numbers are sometimes reused on consecutive days. Additionally, Talos has identified instances of Adobe platform abuse to deliver PDF attachments to victims in TOAD emails.
Talos plans to collect and gather intelligence around phone numbers as an additional indicator of compromise (IOC).
Talos provides new insights into the use of QR codes and PDF annotations in email threats that impersonate legitimate brands through PDF payloads.

Brand impersonation via PDF payload

The portable document format (PDF) is a standard method for sharing information electronically. Files created in other applications (e.g., Microsoft Word) are often converted into this format, which can then be viewed using PDF rendering applications like Adobe Reader, commonly available on most OSs. Thanks to its excellent portability, this file format is widely used for the mass distribution of documents to large audiences. However, in recent months, it has also been exploited for illegitimate purposes, such as brand impersonation.

Brand impersonation is a social engineering technique that exploits the popularity of well-known brands to persuade email recipients to disclose sensitive information. As discussed in our previous blog, adversaries can deliver brand logos and names to victims using multiple types of payloads. One of the most common methods of delivering brand logos and names is through PDF payloads (or attachments).

In some cases, the entire email, including a brand’s logo, is embedded within a PDF attachment. Figure 1 displays an example of a QR code phishing email that impersonates the Microsoft Corporation brand. The threat actor used an enticing subject line, “Paycheck Increment,” timed strategically during periods when promotions or merit changes are likely to occur in various organizations.

PDFs: Portable documents, or perfect deliveries for phish? — Figure 1. A QR code phishing email impersonating the Microsoft brand.

In other cases, the company’s logo is included in a separate image or PDF attachment and is displayed to the victim as soon as they open the email. Below is an example of a QR code phishing email that impersonates both the Microsoft and Adobe Inc. brands. Figure 2 shows the Adobe logo attached to an email as an image file.

A brand’s logo may not always be present in every brand impersonation attempt. For example, the following phishing email, which impersonates the Adobe brand, does not include any logos.

When the victim clicks on the “View the Attached online here” hyperlink, they are redirected to a phishing page impersonating a Dropbox, Inc. webpage.

Telephone-oriented attack delivery (TOAD)

A significant portion of email threats with PDF payloads persuade victims to call adversary-controlled phone numbers, displaying another popular social engineering technique: telephone-oriented attack delivery (TOAD), also known as callback phishing.

Victims are instructed to call a specific number in the PDF to resolve an issue or confirm a transaction. Once the victim calls, the attacker poses as a legitimate representative and attempts to manipulate them into disclosing confidential information or installing malicious software on their computer.

Phishing typically involves sending emails or messages with malicious links or attachments that direct the victim to a counterfeit website. Callback phishing, however, does not rely on fake websites or phishing links. Instead, attackers use direct voice communication to exploit the victim’s trust in phone calls and the perception that phone communication is a secure way to interact with an organization. Additionally, the live interaction during a phone call enables attackers to manipulate the victim’s emotions and responses by employing social engineering tactics. Callback phishing is, therefore, a social engineering technique rather than a traditional email threat.

Most phone numbers found in email threats leveraging this social engineering technique are Voice over Internet Protocol (VoIP) numbers, as it is significantly harder to trace a VoIP number back to a specific individual or physical location compared to a traditional phone number. Below is an example of a TOAD attack that impersonates the McAfee LLC brand.

Talos has observed that phone numbers are sometimes reused on consecutive days. This could happen for multiple reasons. First, intelligence about phone numbers is collected and distributed at a slower pace compared to other artifacts like URLs and files. In most cases, phone numbers observed in emails by cybersecurity companies are not shared with third-party reputation services, or vice versa. As a result, these phone numbers often remain under the radar for several days. Second, the reuse of phone numbers provides logistical advantages for scam call centers. It enables consistent contact for multi-stage social engineering attacks, scheduling callbacks, and maintaining a credible “brand” presence with victims. Lastly, phone numbers may be reused to minimize costs, particularly if the VoIP service is not free. The plot below illustrates a case where the number +1-818-675-1874 was used in TOAD emails impersonating Best Buy’s Geek Squad brand for four consecutive days.

Talos has also observed several cases of e-signature service abuse on the Adobe platform between April and May 2025. Figure 8 shows an example email that impersonates the PayPal brand. In this case, the entire PDF file (i.e., the body of the email) was uploaded to Adobe and sent directly to the victim through the e-signature service.

QR codes in PDF payloads

Adversaries extensively use QR codes alongside brand impersonation phishing emails, a tactic known as QR code phishing. As seen in Figures 10 – 12, attackers exploit the legitimacy of popular brands to convince users to scan the QR code, ultimately redirecting them to a phishing page, which is often protected by some form of CAPTCHA.

In most QR code phishing emails with PDF payloads, the entire email body is embedded in the attachment and is rendered for the victim as soon as they open the email. This technique easily evades email filters and detection engines that rely on textual features and keywords, unless preceded by optical character recognition (OCR) analysis. However, OCR is an error-prone process and increases computational costs.

Annotations in PDF payloads

Although the PDF format is an open standard, its structure is not straightforward to understand (this book provides an excellent explanation). PDFs can contain both visible and hidden information within their three main components: the text layer, the image layer and the internal structure (e.g., comments and annotations). This flexibility allows certain elements within a PDF to make it appear legitimate, helping it evade spam filters and detection systems.

To make QR code phishing emails more evasive, attackers often exploit otherwise legitimate PDF annotations. For example, a phishing URL might be embedded in a text annotation, sticky note, comment, or form field within a PDF attachment. Alternatively, attackers may add irrelevant text (or “noise”) to bypass detection systems.

Figures 13 and 14 demonstrate how multiple URLs can be embedded in a PDF attachment using annotations. In this case, the QR code may link to a legitimate web page to build the recipient’s trust, while the embedded annotation points to the actual phishing page. To further obscure the attack, attackers may use shortened URLs, making it harder for users to verify the link’s legitimacy before clicking.

Trends of brand impersonation via PDF payloads

Brand impersonation remains a prevalent social engineering tactic in phishing attacks, with Talos frequently observing PDF payloads delivering brand names or logos in recent months.

Using Cisco Secure Email Threat Defense’s brand impersonation detection engine, we uncovered how widespread these attacks are. The plot in Figure 15, reflecting the period between May 5 and June 5, 2025, highlights the most impersonated brands detected in emails with PDF attachments. Microsoft and Docusign were among the most frequently impersonated brands in phishing emails with PDF attachments. Similarly, NortonLifeLock, PayPal, and Geek Squad were among the most impersonated brands in TOAD emails with PDF attachments.

The map in Figure 16 indicates where brand impersonation attempts using PDF attachments originated for the above brands, both locally and internationally, during this time period.

Protection against brand impersonation

Brand impersonation is one of the most popular social engineering techniques, and it is continuously being used by attackers in different types of email threats. Therefore, a brand impersonation detection engine plays a pivotal role in defending against cyber attacks.

Cisco Talos relies on a wide range of systems to detect this type of threat and protect our customers, from rule-based engines to advanced machine learning-based systems. Learn more about Cisco Secure Email Threat Defense’s brand impersonation detection engine here.

Cisco Talos Blog – Read More