Three out of four organizations worldwide use hybrid clouds, and three-quarters of them consider their IT migration and modernization projects to be successful. But what is success — and how does a successful IT project affect the business and capabilities of a company? Authors of the Enterprise Application Modernization: A Journey through Container-Based Cloud Architecture Transformation study tried to answer these questions and to summarize the available information on how the transition to cloud and container infrastructure affected the activities of companies that have made this transformation.

The economic arguments in favor of the transition turned out to be weighty. In the studied organizations, IT operating costs decreased by an average of 31%, and infrastructure costs by 45%, including routine maintenance costs that decreased by 52%. More importantly, for the first time in many years, businesses were able to unburden their IT teams from the tasks of supporting old code, and use their resources for new developments. In large organizations, IT services spend up to 80% of the budget on legacy IT support, and the transition to modern infrastructure not only speeds it up, but also frees up additional personnel for innovation. Software update cycles are ultimately accelerated by 65%, ensuring a quick response to market changes and better satisfaction of user needs. The authors call the transition to container and microservice architectures in the cloud environment, as well as automated assembly lines, the “three pillars” of efficiency that are responsible for all these radical improvements.

Part of the study is devoted to information security issues. Thanks to this, you can see what contribution various information security tools make to improving the efficiency of IT development, and what indicators you should strive for in your organization. We decided to analyze the main principles and tools and explain how they’re implemented in the updated version of Kaspersky Cloud Workload Security.

Automatic application and monitoring of information security policies

A key challenge for IT and information security is maintaining visibility and control over all IT assets, and this task has become more complex with the transition to hybrid cloud infrastructure. The diversity of assets and management tools results in increased costs and time spent on managing this “zoo” for the company. Therefore, unification of management, compliance control, creation and application of policies should be one of the priority goals in IT transformation projects. If the selected set of information security tools is able to solve this problem in the company’s cloud infrastructure, IT and information security services will save 73% of the time spent on policy management and achieving security compliance.

The practical embodiment of this principle can be seen in the new version of Kaspersky Cloud Workload Security, a solution that provides comprehensive protection for container infrastructure, cloud servers, and virtual machines. Several tools at once simplify work with policies and give administrators a centralized overview and control over the entire infrastructure. The security analysis function of the orchestrator and its clusters helps quickly find problems by structuring them by problem type. Automatic container profiling allows you to improve the security policies applied in the infrastructure with minimal human intervention, as well as to find abnormally operating containers for detailed analysis.

The unified cloud console of Kaspersky Hybrid Cloud Security provides an overview of the cloud or hybrid infrastructure, and allows security personal to instantly update policies for large groups of IT assets or simultaneously run tasks on them.

As for virtual and physical servers, the lightweight agent that protects them performs several functions related to compliance and security posture in automatic mode: from automatic patch management and system hardening to detailed event logging and the use of a role-based access control system (RBAC).

Container scanning in the DevSecOps pipeline

Integration of automated cybersecurity checks at all stages of development and operation of an IT product is the key to significantly increasing the level of security while reducing the workload of IT and information security teams and improving all metrics of the IT system’s “health”. Companies that have implemented a comprehensive approach to container security report a 79% reduction in the number of security-related incidents, and the elimination of 94% of known vulnerabilities at the stages before the deployment of the IT system. As a result, it’s possible to reduce the risk of incidents in the operated system by 89%, the risk of failure at the deployment stage by 68%, and at the same time reach a 99.97% level of unification of the configuration of similar containers. The unification is important because scanning containers is used not only to check for component vulnerabilities and malware, but also the for detection of insecure configurations, as well as typical developer errors, such as API keys and other secrets embedded directly in the code. Kaspersky Cloud Workload Security also implements integration with the HashiCorp Vault, allowing you to securely store solution secrets in this secrets manager software. Kaspersky Cloud Workload Security supports control of container image signatures, and integrates all checks directly with the DevOps pipeline, which helps developers not to take malicious and vulnerable images as a basis of their projects, as well as interrupt the process product development if critical security defects are detected. In general, KCWS helps the development team implement a shift-left approach, in which testing and quality assurance are performed at the early stages of development, including verification of APIs, container configurations, and microservice interactions. All this allows you to find and fix errors earlier, reducing the cost of maintaining and testing of the final product.

Effective monitoring of running processes

Despite numerous preliminary checks of images, runtime environments, and other infrastructure components, monitoring running containers, virtual servers, and the computing environment in which all this occurs remains a critical security task. According to the authors of the study, these measures allow detecting 87% of threats in the first half-minute after their occurrence, and preventing 96% of unauthorized access attempts.

Monitoring results in significant costs: additional computing load on cloud services, multiplied by the number of servers and clusters, as well as man-hours of SOC specialists. Therefore, computing and cost efficiency are critical requirements for both the containerization infrastructure itself and its security system.

This aspect is carefully thought out in Kaspersky Cloud Workload Security. For virtual and physical servers, Light Agent technology saves up to 30% of computing resources in a private cloud, and in a container infrastructure, security agents are launched in separate containers to prevent the performance degradation of the entire cluster. The system has excellent scalability and can protect clusters with up to ten thousand nodes.

Savings start right from the installation of the product — from flexible licensing terms adapted to a specific infrastructure, to effective security settings and rules “out of the box” that reduce the time of initial setup significantly.

Rapid incident response

How to prepare for a situation when an attacker has successfully penetrated the system? In this case, the information security team should have playbooks for incident response, and information security systems should provide the necessary tools. In an IT infrastructure equipped with a comprehensive cloud security system, the response time (MTTR), according to research, is reduced by an impressive 71%. The real difference can be seen in the example of a fast ransomware attack: will it be considered a routine information security incident, or a full-scale paralysis of the entire business for several days or weeks?

To simplify response, the new version of Kaspersky Cloud Workload Security has a container forensic function that permits investigating policy violations and gaining deeper insight into both specific violating events and events that occurred in a close time frame. Event logs in a running container have additional fields that are often needed when investigating an incident. Protection and logging are also carried out on the orchestrator nodes. In addition, event logs can now be sent directly from agents to SIEM systems. Comprehensive logging simplifies detection of the source of an attack, helps compare events that are registered during this attack, or detects vulnerabilities and other risks.

The transition to container and cloud infrastructures usually begins with economic necessity and the requirements of a competitive market. But in order to successfully make the transition and get the promised benefits, it’s important not to outweigh them by creating new high cyber-risks, or implementing an information security approach that will be economically ineffective. These negative scenarios can be avoided by implementing a comprehensive and well-scalable cloud security system, such as Kaspersky Cloud Workload Security.

Kaspersky official blog – ​Read More

In a strongly worded advisory, the FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have urged software developers to cease unsafe development practices that lead to “unforgivable” buffer overflow vulnerabilities. 

“Despite the existence of well-documented, effective mitigations for buffer overflow vulnerabilities, many manufacturers continue to use unsafe software development practices that allow these vulnerabilities to persist,” the agencies said in the February 12 Secure By Design alert. “For these reasons—as well as the damage exploitation of these defects can cause—CISA, FBI, and others designate buffer overflow vulnerabilities as unforgivable defects.” 

The agencies said threat actors leverage buffer overflow vulnerabilities to gain initial access to networks, thus making them a critical point for preventing attacks. 

We’ll look at the prevalence of buffer overflow vulnerabilities, some examples cited by CISA and the FBI, and guidance for secure development and use of memory-safe programming languages. 

Buffer Overflow Vulnerabilities: Prevalence and Examples 

The FBI-CISA guidance specifically mentions the common software weaknesses CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), along with stack-based buffer overflows (CWE-121) and heap-based buffer overflows (CWE-122). 

The phrase “buffer overflow” occurs in 67 of the 1270 vulnerabilities in CISA’s Known Exploited Vulnerabilities (KEV) catalog, or 5.28% of the KEV database. The words “buffer” and “overflow” occur in 84 of the KEV vulnerabilities (6.6%). 

CISA and the FBI cited six examples of buffer overflow vulnerabilities in IT products: 

• CVE-2025-21333, a Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege vulnerability 
• CVE-2025-0282, a stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 
• CVE-2024-49138, a Windows Common Log File System Driver Elevation of Privilege vulnerability 
• CVE-2024-38812, a VMware vCenter Server heap-overflow vulnerability 
• CVE-2023-6549, an Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Citrix Systems’ NetScaler ADC and NetScaler Gateway 
• CVE-2022-0185, a heap-based buffer overflow flaw in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length (the CWE in this case was CWE-190, Integer Overflow or Wraparound). 

“These vulnerabilities can lead to data corruption, sensitive data exposure, program crashes, and unauthorized code execution,” the agency guidance said. “Threat actors frequently exploit these vulnerabilities to gain initial access to an organization’s network and then move laterally to the wider network.” 

They added that “the use of unsafe software development practices that allow the persistence of buffer overflow vulnerabilities—especially the use of memory-unsafe programming languages—poses unacceptable risk to our national and economic security.” 

Memory-Safe Software Development 

The agencies urged manufacturers “to take immediate action to prevent these vulnerabilities from being introduced into their products. … Software manufacturer senior executives and business leaders should ask their product and development teams to document past buffer overflow vulnerabilities and how they are working to eliminate this class of defect.” 

Customers should hold manufacturers accountable by requesting a Software Bill of Materials (SBOM) and a secure software development attestation, the FBI and CISA said. 

For development teams, the agencies recommended the following secure by design practices to prevent buffer overflow vulnerabilities: 

• Memory-safe languages should be used whenever possible “to shift the burden of memory management from the developer to the programming language’s built-in safety features.” They added that developers should never disable or override memory safety guarantees in languages when it’s possible to do so, and that using a memory-safe language in one part of a software package will not fix memory-unsafe code in other libraries. 

• A phased transition plan for implementing memory-safe languages should be used for upgrading existing codebases while using technologies to limit memory vulnerabilities in existing code. “Ideally, this plan should include using memory-safe languages to develop new code and—over time and when feasible—transition their software’s most highly privileged/exposed code to memory-safe languages,” the agencies said. 

• Enable compiler flags that implement compile time and runtime protections against buffer overflows to the extent that application performance allows, and “implement canaries that alert if an overflow occurs.” 

• Conduct unit tests with an instrumented toolchain such as AddressSanitizer and MemorySanitizer that checks source code for buffer overflows and other memory safety issues. 

• Perform adversarial product testing that includes static analysis, fuzzing, and manual reviews to ensure code safety and quality throughout the development lifecycle. 

• Publish a memory-safety roadmap that outlines plans to develop new products with memory-safe languages and to migrate older ones based on risk. 

• Conduct root cause analysis of past vulnerabilities, including buffer overflows, to identify patterns. “Where possible, take actions to eliminate entire classes of vulnerabilities across products, rather than the superficial causes,” the agencies said. 

The alert said eliminating buffer overflow vulnerabilities “can help reduce the prevalence of other memory safety issues, such as format string, off-by-one, and use-after-free vulnerabilities.” 

Conclusion 

As an initial entry point for attackers into a network, the importance of buffer overflow vulnerability prevention can’t be overstated. Development teams would be wise to implement CISA and the FBI’s advice to the maximum extent possible. 

Customers also have a role to play by demanding memory-safe documentation from suppliers. But they also shouldn’t neglect basic cybersecurity practices for the eventual vulnerabilities that will slip past even the most vigilant development teams. Zero trust, risk-based vulnerability management, segmentation, tamper-proof backups and network and endpoint monitoring are all critically important practices for limiting the damage from any cyberattacks that do occur. 

The post FBI, CISA Urge Memory-Safe Practices for Software Development  appeared first on Cyble.

Blog – Cyble – ​Read More

Cybercriminals around the world keep honing their schemes to steal accounts in WhatsApp, Telegram, and other popular messaging apps – and any of us could fall for their scams. Only by becoming a victim of such an attack can you fully appreciate how vital a tool instant messaging has become, and how diverse the damage from hacking a WhatsApp or Telegram account may be. But better not to let it come to that, and to learn to recognize key hijacking scams in order to prevent them in time.

Why hijack your WhatsApp or Telegram account?

A stolen account can be appealing because of its content, access rights, or simply the fact that it’s verified, linked to a phone number, and has a good reputation. Having stolen your Telegram or WhatsApp account, cybercriminals can use it in a variety of ways:

• To send spam and phishing messages on your behalf to all your contacts – including private channels and communities.
• To write sob stories to all your friends asking for money. Worse yet – to use AI to fake a voice or video message asking for help.
• To steal accounts from your friends and family by asking them to vote in a contest, “gifting” them a fake Telegram Premium subscription, or employing some other fraudulent scheme – of which there are many. Coming from someone the recipient knows, messages like this tend to inspire greater trust.
• To hijack a Telegram channel or WhatsApp community you manage.
• To blackmail you with the contents of your chats – especially if there’s sexting or other compromising messages.
• To read your chats quietly, which may have strategic value if you’re a businessman, politician, military or security officer, or civil servant.
• To upload a new photo to your account, change your name, and use your account for targeted scams: from flirting with crypto investors (pig butchering) to requests from the victim’s boss (boss scams).

Due to this variety of applications, criminals need new accounts all the time, and anyone can become a victim.

WhatsApp, Telegram, and QQ quishing

Scammers used to steal accounts by tricking people into giving them text verification codes (required to log in), or by intercepting these codes. But since this method is no longer as effective, the focus has shifted to trying to link an additional device to the victim’s account. This works best when using phishing schemes based on QR codes – known as quishing.

Attackers either put up their own ads or carefully stick malicious QR codes on top of someone else’s to overlay the legitimate code. They can also print a QR code on a flyer and drop it in a mailbox, post it on a social network or website, or simply send it by email. The pretext can be anything: an invitation to join a neighborhood chat; connect to an office, campus, or school community; download a restaurant menu or claim a discount; or view cinema showtimes or extra information on movies and other events.

The code alone can’t cause your account to be hijacked, but it can lure you to a scam website containing detailed instructions telling you where to click in the messaging app, and what to do after that. The site shows you another, dynamically generated, QR code, which the attackers’ server requests from WhatsApp or Telegram when it asks the service to link a new device to your account. And if you, determined to enjoy every benefit civilization has to offer, decide that another code won’t hurt and follow the instructions, then the device used by the attackers will get access to all your data in the app. In fact, you can see it in the “Devices” or “Linked devices” sections of Telegram or WhatsApp, respectively. However, this attack is designed for those who aren’t very familiar with messaging app settings, and who might not check such submenus regularly. Incidentally, users of QQ, China’s most popular messaging app, are also targeted by similar attacks.

Malicious polls, fraudulent gifts, and girls… undressing

Aside from QR codes, scammers may also attack you by sending seemingly harmless links, such as those for “people’s choice” votes, instant lotteries, or giveaways. On Telegram, they like to mimic the interface used for receiving a Premium subscription as a gift.

Typically, you get to such pages through messages from friends or acquaintances whose accounts have already been compromised by the same scammers. The homepage is always full of catchy phrases like “vote for me” and “claim your gift”.

A variation on the scam involves messages from a “messaging app security service”. You might get contacted by someone using a name like “Security” or “Telegram security team”. They offer to protect your data by transferring your account to a secure account clicking a link and enabling “advanced security options”.

Lastly, you could get an ad for a service or bot that offers something useful or fun – like an AI chatbot or a… nude generator.

There’s another potential scam scenario for Telegram: since 2018, the service has offered website owners authentication of visitors using the Telegram Login Widget. It’s a real, functioning system, but scammers take advantage of the fact that few people know how this authentication is supposed to work – replacing it with a phishing page to steal information.

In any of these scenarios, once you’re through the enticing landing page, you’ll be asked to “sign in to your messaging app”. This procedure might involve scanning a QR code or simply entering your phone number and the OTP code on the website. This part of the website is typically disguised as a standard WhatsApp or Telegram authentication interface – creating the illusion that you’ve been redirected to the official website for login. In reality, the entire process is happening on the attackers’ own site. If you comply and enter the data or scan the code, cybercriminals will immediately gain control of your messaging app account. Your only reward? Some kind of thank-you message like your premium subscription will activate within 24 hours (it won’t; who knew?!).

Hacking a smartphone with a fake WhatsApp or Telegram app

An old yet still effective way to hijack accounts is by using trojanized mods; that is – modified versions of messaging apps. This threat is especially relevant for Android users. You can come across ads touting “improved” versions of popular messaging apps on forums, in groups chats, or simply in search results. WhatsApp mods often promise the ability to read deleted messages and see the statuses of those who hid them, while Telegram fans are promised free Premium features.

Downloading and installing a mod like this infects your phone with malware that can steal the messaging account along with all the other data on the device. Interestingly, Android users can encounter spyware-infected mods even in the “holy of holies”: the official Google Play store.

What happens to a hijacked Telegram or WhatsApp account?

The fate of your hijacked account depends on the attackers’ intentions. If their goal is espionage or blackmail, they’ll just quickly download all your chats for analysis, and you may not notice anything at all.

If cybercriminals want to send fraudulent messages to your contacts, they’ll immediately delete sent messages by using the “delete for me only” feature to make sure you don’t notice anything for as long as possible. However, sooner or later, you’ll start receiving messages from surprised, outraged, or simply vigilant friends, or you yourself will notice traces of an unauthorized presence.

Another consequence of hacking may be the messaging service’s reaction to the spam. If recipients report your messages, your account may become restricted or blocked – preventing you from sending messages for several hours or days. You can appeal the restrictions by using a special button, such as “Request a Review” in the message from the moderators, but it’s best to first ensure that you have exclusive control over your account and wait at least a few hours afterward.

Telegram treats all devices linked to an account equally, which means scammers can take over your entire account and kick you out by disconnecting all your devices. However, to do this, they’d need to remain logged in unnoticed for a whole day: Telegram has a 24-hour waiting period before one can log out other devices from a newly connected account. If you’ve been locked out of your own Telegram account, read our detailed recovery guide.

On WhatsApp, the first device you use to log in to your account becomes the primary one, and other devices are secondary. This means hackers can’t pull off that trick there.

How to protect yourself from WhatsApp and Telegram account hijacking

You can find detailed instructions on how to secure your Telegram, WhatsApp, Signal, and Discord in our separate guides. Let’s go over the general principles again:

• Be sure to enable two-factor authentication (also variously known as “cloud password” or “two-step verification”) in the messaging app, and use a long, complex, and unique password or passphrase.
• On WhatsApp, you can choose a passkey instead of a password. This protection is more reliable.
• Avoid taking part in giveaways and lotteries. Don’t accept gifts that you didn’t expect – especially if you need to log in to some websites through the messaging app to receive them.
• Learn how legitimate authorization through Telegram looks, and immediately close any websites that look different. To put it simply, during a legitimate authorization process, all you need to do is click the “Yes, I want to go to such-and-such website” button within the Telegram chat with the bot. No scanning or entering of codes is required.
• Check your WhatsApp and Telegram settings regularly to see what devices are connected. Disconnect any that look old or fishy.
• Always use official messaging apps downloaded from trusted sources like Google Play or the App Store, Galaxy Store, Huawei AppGallery, and other major app stores.
• Be more careful with desktop messaging clients – especially at the office.
• Use a reliable protection system on all your devices to avoid visiting phishing sites or installing malware.

Kaspersky official blog – ​Read More

Overview

Cyble’s weekly industrial control system (ICS) vulnerability report to clients warned about internet-facing medical imaging and critical infrastructure asset management systems that could be vulnerable to cyberattacks.

The report examined six ICS, operational technology (OT), and Supervisory Control and Data Acquisition (SCADA) vulnerabilities in total, but it focused on two in particular after Cyble detected web-exposed instances of the systems.

Orthanc, Trimble Cityworks Vulnerabilities Highlighted by CISA

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued advisories alerting users to vulnerabilities in medical imaging and asset management products.

Orthanc is an open-source DICOM server used in healthcare environments for medical imaging storage and retrieval, while Trimble Cityworks is a GIS-centric asset management system used to manage all infrastructure assets for airports, utilities, municipalities, and counties.

In a February 6 ICS medical advisory, CISA said the Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled, which could result in unauthorized access by a malicious actor. The Missing Authentication for Critical Function vulnerability, CVE-2025-0896, has been assigned a CVSS v3.1 base score of 9.8, just below the maximum score of 10.0.

Orthanc recommends that users update to the latest version or enable HTTP authentication by setting the configuration “AuthenticationEnabled”: true in the configuration file.

Cyble provided a publicly accessible search query for its ODIN vulnerability search tool, which users can use to find potentially vulnerable instances.

“This flaw requires urgent attention, as Cyble researchers have identified multiple internet-facing Orthanc instances, increasing the risk of exploitation,” the Cyble report said. “The exposure of vulnerable instances could allow unauthorized access to sensitive medical data, manipulation of imaging records, or even unauthorized control over the server. Given the high stakes in healthcare cybersecurity, immediate patching to version 1.5.8 or later, along with restricting external access, is strongly recommended to mitigate potential threats.”

CVE-2025-0994 is an 8.6-rated Deserialization of Untrusted Data in Trimble Cityworks that was reported to CISA by Trimble, which quickly patched the vulnerability and issued mitigation guidance. CISA issued an advisory on the vulnerability, which affects Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10, and also added the vulnerability to CISA’s Known Exploited Vulnerabilities catalog.

Cyble provided an ODIN search query for users to check for exposed Cityworks instances and a hash query for ODIN subscribers.

Recommendations for Mitigating ICS Vulnerabilities

Cyble recommends several important controls for mitigating ICS vulnerabilities and improving the overall security of ICS systems. The measures include:

1. Staying on top of security advisories and patch alerts issued by vendors and regulatory bodies like CISA. A risk-based approach to vulnerability management reduces the risk of exploitation.
2. Implementing a Zero-Trust  Policy to minimize exposure and ensure that all internal and external network traffic is scrutinized and validated.
3. Developing a comprehensive patch management strategy that covers inventory management, patch assessment, testing, deployment, and verification. Automating these processes can help maintain consistency and improve efficiency.
4. Proper network segmentation can limit an attacker’s potential damage and prevent lateral movement across networks. This is particularly important for securing critical ICS assets, which should not be exposed to the Internet if possible and properly protected if remote access is essential.
5. Conducting regular vulnerability assessments and penetration testing to identify gaps in security that might be exploited by threat actors.
6. Establishing and maintaining an incident response plan and ensuring that it is tested and updated regularly to adapt to the latest threats.
7. All employees, especially those working with Operational Technology (OT) systems, should be required to undergo ongoing cybersecurity training programs. The training should focus on recognizing phishing attempts, following authentication procedures, and understanding the importance of cybersecurity practices in day-to-day operations.

Conclusion

These vulnerabilities show the danger that medical and critical infrastructure system vulnerabilities can pose to patients, utilities, airports, and other sensitive environments. The organizations and CISA responded rapidly in these cases, but now users must do the same and ensure that the systems are patched and properly protected.

Regardless of the sector, staying on top of ICS vulnerabilities and applying good cybersecurity hygiene and controls can limit risk. This includes limiting internet exposure and properly protecting assets that must be accessed remotely.

To access the full report on ICS vulnerabilities observed by Cyble, along with additional insights and details, click here. By adopting a comprehensive, multi-layered security approach that includes effective vulnerability management, timely patching, and ongoing employee training, organizations can reduce their exposure to cyber threats. With the right tools and intelligence, such as those offered by Cyble, critical infrastructure can be better protected, ensuring its resilience and security in an increasingly complex cyber landscape.

The post Cyble Warns of Exposed Medical Imaging, Asset Management Systems appeared first on Cyble.

Blog – Cyble – ​Read More