Attack Path Analysis: Why Your Critical Vulnerabilities May Not Be Your Biggest Risk

Attack Path Analysis: what are we talking about? Most organizations have become very good at finding vulnerabilities. They run vulnerability scanners, conduct penetration tests, and receive regular reports listing hundreds or even thousands of security findings. Yet despite this visibility, many security teams continue to struggle with a fundamental question: Which vulnerabilities actually matter? The […]

Hacking: Penetration Test on a PLC

A Penetration Test on a PLC highlights how protecting an ICS environment is not trivial, as these systems weren’t designed to resist cyber attacks. This means that you have to somehow integrate cybersecurity resilience measures inside and around the ICS. Such measures include, for example: perimeter protection, such as firewalls to reduce the risk of unwanted network […]

Google Dorks for Hacking: Finding SCADA in the Network

Before diving into Google Dorks, let’s take a step back and understand why Google is such a powerful tool for information discovery. It is estimated that Google has stored more pages than any other search engine in the world. With more than billions of pages and a relatively low execution time, the popular Californian search […]

4 ways to steal money from your corporate account

Robbers with guns and masks carrying cash out of an office window are heroes of old movies. Modern criminals conduct remote cyber-attacks to steal money. It can take them just 15 minutes to transfer all the money from a corporate account – with the help of careless employees. Here are 4 ways to steal money […]

Phishing attacks targeting companies: how do they work

There is something in common between cyber-attacks targeting companies. Most of them are phishing attacks, starting silently with a carefully crafted spear phishing email. Though the messages look quite ordinary, they contain infected files or malicious links and are addressed to specific employees within organizations. Phishing emails targeting common users are usually not very “personalized” […]

Manipulation of Human Emotions: A Core Strategy in Phishing Attacks

Manipulation of human emotions is one of the most powerful tools in a cybercriminal’s arsenal – especially when it comes to phishing attacks. By exploiting fear, urgency, curiosity, or trust, attackers can bypass even well-configured technical protections and reach the weakest link in the security chain: people. Take this real-world example. Last week, I received […]

Carbanak – the cyber theft of the century

According to multiple estimations Carbanak has generated around 1 billion dollars by hitting banks worldwide. It was mainly attacking companies in Europe, the United States, and China between 2013 and 2014. Modus Operandi Each Carbanak attack started with a well-crafted spear phishing email. It contained a malicious attachment that installed a backdoor on the victim […]