Another month has gone by, another premium issue of the _secpro has landed in the inboxes of our faithful readership. Thank you to you all! We wouldn't be able to do this without your contributions - in both content and support.

If you'd like to sign up and get access to podcasts, templates, premium articles, special offers for events and Packt books, as well as a load of other great features, click the link below to sign up for only $8/month on Substack.

Welcome to another_secpro!

We're starting up a series on the MITRE ATT&CK framework to best understand the Top Ten threats over the last year. Check it out below!

And then, of course, we've got our usual news, tools, and conference venues roundup. In the editor's spotlight this week, I advise you to all read Picus Security'sRed Report 2025!

As always, make sure to check out the templates, podcasts, and other stuff on ourSubstackand access the very best that we have to offer. You might even learn something!

Cheers!
Austin Miller
Editor-in-Chief

Got any good memes you want to share? Or an idea that you need someone to put together? Reply to this email with your meme or idea and get a chance to win afree Packt book (and there's only one available this week)!

Bruce Schneier - Web 3.0 Requires Data Integrity: If you’ve ever taken a computer security class, you’ve probably learned about the three legs of computer security—confidentiality, integrity, and availability—known as the CIA triad. When we talk about a system being secure, that’s what we’re referring to. All are important, but to different degrees in different contexts. In a world populated by artificial intelligence (AI) systems and artificial intelligent agents, integrity will be paramount.

Bruce Schneier - Rational Astrologies and Security: "John Kelsey and [Bruce] wrote a short paper for the Rossfest Festschrift: “Rational Astrologies and Security“: There is another non-security way that designers can spend their security budget: on making their own lives easier. Many of these fall into the category of what has been called rational astrology. First identified by Randy Steve Waldman [Wal12], the term refers to something people treat as though it works, generally for social or institutional reasons, even when there’s little evidence that it works—­and sometimes despite substantial evidence that it does not...

Bruce Schneier - Cell Phone OPSEC for Border Crossings: "Are there easy ways to delete data—files, photos, etc.—on phones so it can’t be recovered? Does resetting a phone to factory defaults erase data, or is it still recoverable? That is, does the reset erase the old encryption key, or just sever the password that access that key? When the phone is rebooted, are deleted files still available?"

Etay Moar - AI Giving Rise of the ‘Zero-Knowledge’ Threat Actor: Artificial intelligence is adouble-edged sword. On one side, AI empowers people to do their jobs better and faster while on the other, it enables people with malicious intent to become scammers, hacktivists and cyber criminals.

Google Workspace - Making end-to-end encrypted emails easy to use for all organizations: "The idea here is simple. Email messages are encrypted with just a few clicks in Gmail regardless of who they are being sent to — no need for end users to exchange certificates or use custom software. The emails are protected using encryption keys controlled by the customer and not available to Google servers, providing enhanced data privacy and security. And the IT team no longer needs to go through the complex S/MIME setup or certificate management."

Ivanti - April Security Advisory Ivanti Connect Secure, Policy Secure & ZTA Gateways (CVE-2025-22457): "Ivanti is disclosing one critical severity vulnerability in Ivanti Connect Secure (version 22.7R2.5 and earlier), Pulse Connect Secure 9.x (end-of-support as of December 31, 2024), Ivanti Policy Secure and ZTA gateways. This vulnerability has been fully patched in Ivanti Connect Secure 22.7R2.6 (released February 11, 2025) and was initially identified as a product bug. Successful exploitation could lead to remote code execution."

Microsoft Security - Threat actors leverage tax season to deploy tax-themed phishing campaigns: As Tax Day approaches in the United States on April 15, Microsoft has observed several phishing campaigns using tax-related themes for social engineering to steal credentials and deploy malware. These campaigns notably use redirection methods such as URL shorteners and QR codes contained in malicious attachments and abuse legitimate services like file-hosting services and business profile pages to avoid detection. These campaigns lead to phishing pages delivered via the RaccoonO365 phishing-as-a-service (PhaaS) platform, remote access trojans (RATs) like Remcos, and other malware like Latrodectus, BruteRatel C4 (BRc4), AHKBot, and GuLoader.

Sekoia - From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic: "The targeting of the cryptocurrency ecosystem byNorth-Korean threat groups is not new. Indeed, this country has used cyber operations as a means to bypass international sanctions and to finance its ballistic missile and nuclear weapons programs since at least 2014. According to Chainalysis, in 2024 DPRK threat actorsstole more from cryptocurrency platforms than ever with an estimated heist of $1.3 billion in 2024 compared to $660.5 million in 2023."

TrendMicro - A Deep Dive into Water Gamayun’s Arsenal and Infrastructure: "Water Gamayun, a suspected Russian threat actor also known as EncryptHub and Larva-208, has been exploiting the MSC EvilTwin (CVE-2025-26633), a zero-day vulnerability that waspatched on March 11. In thefirst installment of this two-part series, Trend Research discussed in depth its discovery of an Water Gamayun campaign exploiting this vulnerability. In this blog entry, we will cover the various delivery methods, custom payloads and techniques used by Water Gamayun to compromise victim systems and exfiltrate sensitive data."

MalwareArchaeology/ATTACK - These Cheat Sheets are provided for you to use in your assessments and improvements of your security program and so that you may customize them to your unique environment.

nshalabi/ATTACK-Tools - This repository contains the following: ATT&CK™ Data Model: a relational data model for ATT&CK™ and ATT&CK™ View: an adversary emulation planning tool.

mdecrevoisier/EVTX-to-MITRE-Attack - A set of EVTX samples mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.

Here are the five conferences we're looking forward to the most this year (in no particular order...) and how you can get involved to boost your posture!

RSA Conference (28th April - 1st May): The RSA Conference is a cornerstone of the global cybersecurity calendar. Known for its comprehensive content tracks, this conference addresses everything from cloud security to zero-trust architectures. The event also features an innovation sandbox, where start-ups showcase breakthrough technologies.

CyberUK (6th-7th May): Organised by the UK’s National Cyber Security Centre (NCSC), CyberUK is the government’s flagship cybersecurity event. It brings together security leaders, policymakers, and industry professionals to discuss pressing cybersecurity issues. With a strong focus on collaboration and innovation, CyberUK is a hub for public and private sector expertise.

DSEI (9t-12th September): DSEI stands out as a global platform that bridges defence, security, and cybersecurity. With its broad focus on cutting-edge technologies, this event is critical for those involved in national defence, law enforcement, and private security. Cybersecurity is a prominent theme, with sessions addressing both offensive and defensive cyber strategies.

Defcon (7th-10th August): Defcon is a legendary event in the hacker and cybersecurity communities. Known for its hands-on approach, Defcon offers interactive workshops, capture-the-flag contests, and discussions on emerging threats. The conference is ideal for those looking to immerse themselves in technical aspects of cybersecurity.

Black Hat (2nd-7th August): Black Hat USA is synonymous with advanced security training and research. This premier event features technical briefings, hands-on workshops, and sessions led by global security experts. Attendees can explore the latest trends in penetration testing, malware analysis, and defensive techniques, making it a must-attend for cybersecurity professionals.