Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Elastic’s piped query language, ES|QL, brings joins to the party Threat hunters rejoice! Have you been looking for a way to join data with the speed and power of Elastic? Well, we heard you! Elastic can now join data sources with a new function for the piped query language, ES|QL (Elasticsearch Query Language). This will enable robust searches that range from advanced behavior detections to alert triage and of course, threat hunting.

In today’s era, where the digital landscape is as critical as the physical, the urgency to adapt and reinforce our cybersecurity infrastructure is more pressing than ever. For government operations, where data breaches and cyberattacks frequently make the headlines, adopting a whole-of-state approach to cybersecurity isn’t just a precaution—it’s a strategic imperative to protect our communities and safeguard our future.

In this post, we introduce our “Adversarial AI Explainability” research, a term we use to describe the intersection of AI explainability and adversarial attacks on Large Language Models (LLMs). Much like using an MRI to understand how a human brain might be fooled, we aim to decipher how LLMs can be manipulated.

As cyber risk leaders are called to balance the responsibility of managing risk in the face of both broader attack surfaces and increased regulatory and budgetary scrutiny, prioritization of work is everything. Cybersecurity resources are finite, while the vulnerabilities and threats just keep growing. The best way for modern security programs to keep up is by directing resources to the risks that matter most to their specific organizations.

For Managed Service Providers (MSPs), ransomware attacks aren’t just a security issue, they’re a business-killing risk. In 2020, the average cost of downtime caused by ransomware was $274,200 — nearly double what it was the year before. Now, imagine you’re an MSP responsible for multiple clients, each relying on your service for their critical operations.

Kroll continues to observe widespread attempted initial access through CLEARFAKE via fake CAPTCHA pop-ups across a wide range of industry sectors. As detailed in previous Kroll reporting, CLEARFAKE is a malicious in-browser JavaScript framework deployed on compromised webpages as part of drive-by compromise campaigns. Although CLEARFAKE continues to show the same themes surrounding its use alongside fake CAPTCHA pop-ups, there are also a wide range of nuances that have appeared in the past few months.

As our reliance on digital devices and technologies has increased, so have concerns about the negative effects of excessive screen time on mental and physical health. As a result, many people are choosing digital detox as a structured way to disconnect, improve well-being, and have greater control over their digital footprint.

Let’s face it: The cloud has become the go-to platform for modern infrastructure—and for good reason. Scalability, flexibility, and speed are hard to beat. But as organizations increasingly rely on the cloud to run their critical operations, the threat landscape is evolving just as fast. And attackers? They’re getting smarter, stealthier, and more cloud-savvy by the day. That’s why monitoring cloud network traffic is no longer optional—it’s essential.

Ransomware has evolved from a distant “I hope it doesn’t happen to us” threat to an insidious, worldwide crisis. Among the sectors most affected is manufacturing, which has found itself more and more in attackers’ crosshairs. Manufacturing has long viewed itself as immune to digital crime, but ransomware attackers have belied this belief.

The FBI is set to report that ransomware was the most pervasive cybersecurity threat to US critical infrastructure during the year of 2024. As Reuters reports, complaints of ransomware attacks against critical sectors have jumped 9% over the previous year.