Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

By James Rees, MD, Razorthorn Security From 2020 to 2024, cybersecurity underwent a transformative period that reshaped the industry. This era witnessed several significant high profile security breaches, whilst the World Economic Forum recognised cybersecurity as one of the top ten threats to global economic stability.

Space Bear is a relatively new ransomware group that first appeared on the radar in April 2024. The gang, which is aligned to the Phobos ransomware-as-a-service group, steals sensitive data from organisations, encrypts victims' computer systems, and demands that a ransom be paid for a decryption key or the data will be published on the dark web.

Many are familiar with how GitLab leverages Falco in its Package Hunter project to detect threats through system call monitoring. However, fewer may be aware of a powerful GitLab plugin for Falco that ingests audit events directly from GitLab, transforming them into actionable fields within Falco. By integrating GitLab audit event fields, you can create Falco rules to detect potential threats in real time and send alerts through your configured notification channels.

The year 2025 marks an exciting chapter for BDRSuite as we unveil a roadmap dedicated to empowering Managed Service Providers (MSPs). With a strong emphasis on Remote Centralized Management, we aim to redefine the managed backup experience for MSPs. Additionally, our roadmap introduces new features and enhancements focusing on ransomware protection, virtual environments (Proxmox VE, oVirt, KVM) and latest security updates, addressing evolving market demands and user needs.

The Cyberint (now a Check Point Company) Philippine Threat Landscape 2024-2025 report unravels the evolving cyber threats and scam operations targeting organizations in the Philippines—mainly within the Government, Education, Financial, and Telecommunications sectors. Data from Cyberint sources indicates a surge in cyber threats such as malware, social engineering, and system exploitations.

On January 8, 2025, Ivanti published a security advisory announcing the patching of a critical, actively exploited vulnerability in Ivanti Connect Secure, Policy Secure, and ZTA Gateways. Tracked as CVE-2025-0282, the vulnerability allows remote unauthenticated threat actors to achieve remote code execution (RCE) via a stack-based buffer overflow flaw. Ivanti confirmed that exploitation has only been observed in Connect Secure, and no exploitation has been reported in Policy Secure or ZTA Gateways.

Zombie APIs, sometimes called “orphaned” or “forgotten” APIs, refer to endpoints that were initially deployed for a specific purpose but are no longer actively used or maintained. These APIs are often left operational within an organization’s infrastructure due to oversight or incomplete decommissioning processes.