Attack & Defend

We're back—and completely different.#1: CYBER_AI TodayWe're back—and completely different.Welcome to CYBER_AI, a new newsletter from the Packt team focusing on—well, exactly what it says on the tin: cybersecurity in the age of AI.The world of cybersecurity is changing fast—and artificial intelligence is leading the charge. Every day, new tools powered by AI are helping defenders spot threats faster, protect data smarter, and stay one step ahead of attackers. But the same technology that helps protect us can also be used by hackers to launch more advanced, more convincing attacks.That’s why understanding the mix of AI and security is more important than ever. From detecting phishing emails in seconds to predicting weaknesses before they’re exploited, AI is reshaping what it means to stay safe online. At the same time, trusted ideas like Zero Trust—the principle that no one and nothing should be trusted by default—are becoming even more critical. In a world where AI can fake voices, write code, or slip past simple security checks, Zero Trust provides a steady foundation: always verify, always question, always protect.Join us on Substack to find our bonus articles!In this newsletter, we’ll explore how AI is transforming cybersecurity—what’s new, what’s next, and what you can do to stay secure in the age of intelligent threats.Welcome aboard! The future of cyber defence starts here.Cheers!Austin MillerEditor-in-ChiefLLMs and Agentic AI In Production - Nexus 2025Build and fine-tune your own LLMs and Agents and deploy them in production with workshops on MCP, A2A, Context Engineering, and many more.Book now at 50% off with the code CYBER50News Wipe“Beware of double agents: How AI can fortify — or fracture — your cybersecurity”: This article explores how autonomous “agentic” AI systems can both strengthen and undermine cybersecurity. Microsoft emphasises that organisations must manage AI identities using Zero Trust principles—continuous verification, least privilege, and micro-segmentation. The piece highlights practical ways to secure AI agents as part of enterprise defence.“Zscaler Acquires AI Security Company SPLX”: Zscaler announced its acquisition of SPLX, an AI security firm, to integrate AI asset discovery, red-teaming, and governance into the Zscaler Zero Trust Exchange platform. The move marks a concrete step toward extending Zero Trust security models to cover AI systems and workflows.“Trend Micro Launches End-to-End Protection for Agentic AI Systems”: Trend Micro, in collaboration with NVIDIA, unveiled a new security framework that combines Zero Trust enforcement with AI-native threat detection for what it calls “AI factories.” The launch represents a practical evolution of Zero Trust from human and device access control to full AI system protection.“How low code can give agentic AI guide rails for the enterprise”: This feature examines how enterprises are using low-code and no-code platforms to deploy AI securely. It discusses how organisations can establish governance and Zero Trust-inspired guardrails for AI agents, ensuring safe interaction with data and systems.“AI Security: Defining and Defending Cybersecurity’s Next Frontier”: SentinelOne provides a deep dive into how organisations are adapting cybersecurity frameworks to AI-driven environments. The article focuses on embedding threat modelling, securing AI workflows, and applying Zero Trust strategies to protect AI infrastructures from both misuse and attack.Culture, You, and AIFaking Receipts with AI: Over the past few decades, it’s become easier and easier to create fake receipts. Decades ago, it required special paper and printers—I remember a company in the UK advertising its services to people trying to cover up their affairs. Then, receipts became computerized, and faking them required some artistic skills to make the page look realistic. Now, AI can do it all.Rigged Poker Games: The Department of Justice has indicted thirty-one people over the high-tech rigging of high-stakes poker games.In a typical legitimate poker game, a dealer uses a shuffling machine to shuffle the cards randomly before dealing them to all the players in a particular order. As set forth in the indictment, the rigged games used altered shuffling machines that contained hidden technology allowing the machines to read all the cards in the deck. Because the cards were always dealt in a particular order to the players at the table, the machines could determine which player would have the winning hand. This information was transmitted to an off-site member of the conspiracy, who then transmitted that information via cellphone back to a member of the conspiracy who was playing at the table, referred to as the “Quarterback” or “Driver.” The Quarterback then secretly signaled this information (usually by prearranged signals like touching certain chips or other items on the table) to other co-conspirators playing at the table, who were also participants in the scheme.Scientists Need a Positive Vision for AI: For many in the research community, it’s gotten harder to be optimistic about the impacts of artificial intelligence. As authoritarianism is rising around the world, AI-generated “slop” is overwhelming legitimate media, while AI-generated deepfakes are spreading misinformation and parroting extremist messages. AI is making warfare more precise and deadly amidst intransigent conflicts. AI companies are exploiting people in the global South who work as data labelers, and profiting from content creators worldwide by using their work without license or compensation. The industry is also affecting an already-roiling climate with its enormous energy demands.AI Summarization Optimization: These days, the most important meeting attendee isn’t a person: It’s the AI notetaker. This system assigns action items and determines the importance of what is said. If it becomes necessary to revisit the facts of the meeting, its summary is treated as impartial evidence. But clever meeting attendees can manipulate this system’s record by speaking more to what the underlying AI weights for summarization and importance than to their colleagues. As a result, you can expect some meeting attendees to use language more likely to be captured in summaries, timing their interventions strategically, repeating key points, and employing formulaic phrasing that AI models are more likely to pick up on. Welcome to the world of AI summarization optimization (AISO).From the cutting edgeArtificial intelligence and machine learning in cybersecurity: a deep dive into state-of-the-art techniques and future paradigms from Knowledge and Information Systems, Vol. 67: This open-access review paper surveys the integration of AI/ML into cybersecurity, covering intrusion detection, malware classification, behavioural analysis and threat intelligence. It highlights the shift from traditional defence mechanisms to AI-driven ones, discusses technique categories and outlines future directions and gaps in research (such as adversarial robustness and real-time deployment).Generative AI revolution in cybersecurity: a comprehensive review of threat intelligence and operations from Artificial Intelligence Review, Vol. 58: This review focuses specifically on how generative AI (GenAI) is both a tool and a threat in cybersecurity operations. It explores how GenAI is being used for threat-intelligence generation, automating response operations, as well as how adversaries may use GenAI to automate attacks. The paper provides a detailed taxonomy of use-cases, implications for security operations centres (SOCs), and open issues (e.g., model abuse, data integrity).Strategic Management of AI-Powered Cybersecurity Systems: A Systematic Review (A. Wairagade) from Journal of Engineering Research and Reports, Vol 27 (8): This systematic review synthesises 87 peer-reviewed papers (2015-2024) on how organizations strategically manage AI-based cybersecurity systems. It identifies key themes including AI algorithms for threat detection, governance & risk management, organisational integration issues, ethical/legal concerns and scalability. The paper argues for proactive strategies (human-AI collaboration, governance frameworks, continual learning) to get maximum benefit from AI in cyber defence.Organizational Adaptation to Generative AI in Cybersecurity: A Systematic Review (C. Nott): This qualitative study examines how cybersecurity organisations are adapting to the integration of generative AI (GenAI). Based on analysis of 25 studies (2022-2025), it identifies three adaptation patterns: (1) LLMs integrated for security applications, (2) GenAI frameworks for automated detection/response, and (3) AI/ML-based threat-hunting workflows. The study highlights factors influencing readiness (maturity, regulation, workforce) and persistent challenges (data quality, bias, adversarial threats).*{box-sizing:border-box}body{margin:0;padding:0}a[x-apple-data-detectors]{color:inherit!important;text-decoration:inherit!important}#MessageViewBody a{color:inherit;text-decoration:none}p{line-height:inherit}.desktop_hide,.desktop_hide table{mso-hide:all;display:none;max-height:0;overflow:hidden}.image_block img+div{display:none}sub,sup{font-size:75%;line-height:0} @media (max-width: 100%;display:block}.mobile_hide{min-height:0;max-height:0;max-width: 100%;overflow:hidden;font-size:0}.desktop_hide,.desktop_hide table{display:table!important;max-height:none!important}}

Or are we?We're so backBut with something differentHello! Long time, no see.A while ago, you were on our mailing list to receive the Attack & Defend newsletter from Packt. However, in May this year, we saw that the newsletter wasn't really serving the purpose we want it to and decided to shelf the project as a good idea that didn't quite work out.But, thankfully, we've had another idea. And we reckon you'll be into it.Introducing... CyberAIOn the back of our successful Next-Gen Cyber AI event, we think that you'd enjoy our insights into this brave new world of cybersecurity augmented by artificial intelligence and heading in a whole new direction. We'll be looking at:- insider threats from rogue agents- Zero Trust in multi-agent systems- The future of the AI-augmented SOC- And much more!Sound like something you'd be interested in? Then hang on tight, you'll be receiving your new email in the near future (along with a whole new look for this newsletter)!Not for you? Click the button below to unsubscribe from our mailing list.Unsubscribe" target="_blank" style="color:#ffffff;text-decoration:none;">Unsubscribe*{box-sizing:border-box}body{margin:0;padding:0}a[x-apple-data-detectors]{color:inherit!important;text-decoration:inherit!important}#MessageViewBody a{color:inherit;text-decoration:none}p{line-height:inherit}.desktop_hide,.desktop_hide table{mso-hide:all;display:none;max-height:0;overflow:hidden}.image_block img+div{display:none}sub,sup{font-size:75%;line-height:0} @media (max-width: 100%;display:block}.mobile_hide{min-height:0;max-height:0;max-width: 100%;overflow:hidden;font-size:0}.desktop_hide,.desktop_hide table{display:table!important;max-height:none!important}}

Don't miss out on your chance for one of five free Packt booksWhen attacking digital wallets and SoftPOS mobile apps, threat actors target more than just data.Learn how to protect your digital wallets and SoftPOS apps.Featuring demos and practical tips, this webinar, "Securing Mobile Payments: Protecting Digital Wallets and SoftPOS from Attacks," will help security professionals collaborate more effectively with development teams to build stronger protection strategies and better defend digital wallet and SoftPOS mobile apps against today’s most common threats.Register Now#40: DragonForce, RSA's AI Obsession, and a NATO exerciseDon't miss out on your chance for one of five free Packt booksWelcome to Attack & Defend!Here we are again, investigating both red and blue team solutions to the dangers of the cybersecurity world. You'll find tutorials, best practices, tools, and a few other pointers to get you started on taking your next step. Make sure to check out the Humble Bundle deal listed below as well!Check out the ongoing Top Ten MITRE ATT&CK threats of 2024 breakdown that has launched through our sister newsletter, the _secpro. But anyway, here's some of the biggest problems facing people inyour position today!Fill in this survey to win a free Packt book!Cheers!Austin MillerEditor-in-ChiefWysh Life Benefit allows any financial institution to offer free life insurance directly through their customers’ savings accounts. By embedding micro life insurance into deposit accounts, Life Benefit provides built-in financial protection that grows with account balances. It’s a simple, no-cost innovation that enhances loyalty, encourages deposits, and differentiates institutions in a competitive market. No paperwork. No medical exams. Just automatic coverage that provides peace of mind—without changing how customers bank.Talk to Our Team TodayAttacking and Defending - WorldwideDragonForce Claims Massive Breach at Co-op and M&S: A cybercriminal group named DragonForce has claimed responsibility for a significant cyberattack on the Co-op supermarket chain, alleging the theft of private information from 20 million Co-op members. The hackers reportedly accessed both customer and employee data, including member card numbers, personal contact information, and staff credentials. Initially, Co-op downplayed the incident, but later acknowledged the breach involved a significant amount of personal data. DragonForce also claimed involvement in cyberattacks on Marks & Spencer (M&S), which suffered a ransomware attack leading to online operations being paralyzed and significant financial losses.AI's Dual Role in Cybersecurity Highlighted at RSAC 2025: At the RSA Conference 2025, discussions centered around the transformative impact of AI on cybersecurity. Experts highlighted both the risks and opportunities presented by AI. While adversaries are leveraging AI tools for research and phishing, defenders are exploring AI's potential in vulnerability discovery and malware analysis. The conference emphasized the need for standardized security frameworks and responsible AI adoption to outpace evolving cyber threats.NATO's Locked Shields 2025: A Realistic Cyber Defense Exercise: NATO's Locked Shields 2025 exercise brought together participants from 21 countries to engage in realistic cyber defense scenarios. The event focused on areas such as red teaming, penetration testing, digital forensics, and situational awareness. By simulating real-world attack methods and technologies, the exercise aimed to enhance the resilience of member nations against cyber adversaries.AI-Driven Red Teaming: Emerging Threats and Techniques: A recent scoping review examined the use of AI technologies in cybersecurity attacks, highlighting how AI can automate the process of penetrating targets and collecting sensitive data. The study identified various AI-driven cyberattack methods targeting sensitive data, systems, and social media profiles. The application of AI in cybercrime presents an increasing threat, emphasizing the need for red teams to understand and simulate these advanced attack models.CyberAlly: Enhancing Blue Team Efficiency with AI: Researchers introduced CyberAlly, a knowledge graph-enhanced AI assistant designed to augment blue team capabilities during incident response. Integrated into a cyber range alongside an open-source SIEM platform, CyberAlly monitors alerts, tracks blue team actions, and suggests tailored mitigation recommendations based on insights from prior red vs. blue team exercises. This tool aims to equip defenders to tackle evolving threats with greater precision and confidence.Red team toolsVechus/ODC-challenges - A collection of offensive and defensive training resources, perfect for keeping you and your team sharp!shr3ddersec/Shr3dKit - This tool kit that is very much influenced by infosecn1nja's kit. Use this script to grab majority of the repos.lengjibo/FourEye - An AV Evasion tool for Red Team Ops.Mathuiss/cyber_wolf - A tool for building offensive skills with firewalls.jorge-333/Virtual-Machine-Home-Lab - …built for the purpose of studying, Installing, and configuring Switches, Routers, Firewalls, SIEMs, IPS's, and Offensive Security Tools.Blue team toolsVechus/ODC-challenges - A collection of offensive and defensive training resources, perfect for keeping you and your team sharp!awais922609/Defensive-Learning - This repo covers firewall configurations, SIEM deployment, and various other important defensive topics, giving you the tools to build up your defensive skills.0xInfection/Awesome-WAF - A collection of the best resources for improving your firewall skills; potentially the best collection online!Ekultek/WhatWaf - …and once you’ve mastered that, here’s a way to get around WAFsracecloud/NetBlocker - A specific implementation of a firewall script that reads logs from various servers, validates against public databases with offensive hosts and adjusts a MikroTik firewall.Making a step upRed Team and Blue Team Fundamentals – JobSkillShare: This comprehensive PDF guide provides a structured approach to understanding the core principles of both red and blue team operations. It covers practical skills such as vulnerability exploitation, incident response, and threat detection, making it an excellent starting point for professionals aiming to enhance their offensive and defensive cybersecurity capabilities.Navigating Red and Blue Team Collaboration: OffSec explores the dynamics between red and blue teams, emphasizing the importance of collaboration over competition. The article discusses how gamified exercises and real-world simulations can break down communication barriers, fostering a culture of continuous improvement and mutual respect between offensive and defensive teams.Red, Blue, and Purple Teams: Combining Your Security Capabilities – SANS Institute: This white paper delves into the integration of red and blue teams through the concept of purple teaming. It outlines how combining offensive and defensive strategies can lead to more effective security outcomes, offering insights into team structures, communication, and shared objectives.A Red and Blue Cybersecurity Competition Case Study: This academic study examines the effectiveness of cybersecurity competitions in enhancing the skills of both red and blue team members. It highlights how simulated attack scenarios in controlled environments can improve technical abilities, strategic thinking, and team coordination.Blue Team Fundamentals: Roles and Tools in a Security Operations Center (PDF): This research paper provides an in-depth look at the roles and tools essential for blue team operations within a Security Operations Center (SOC). It offers valuable insights into the responsibilities of blue team members and the technologies they employ to detect and mitigate threats.*{box-sizing:border-box}body{margin:0;padding:0}a[x-apple-data-detectors]{color:inherit!important;text-decoration:inherit!important}#MessageViewBody a{color:inherit;text-decoration:none}p{line-height:inherit}.desktop_hide,.desktop_hide table{mso-hide:all;display:none;max-height:0;overflow:hidden}.image_block img+div{display:none}sub,sup{font-size:75%;line-height:0} @media (max-width: 100%;display:block}.mobile_hide{min-height:0;max-height:0;max-width: 100%;overflow:hidden;font-size:0}.desktop_hide,.desktop_hide table{display:table!important;max-height:none!important}}

Keeping up to date and getting ahead of the curveWhen attacking digital wallets and SoftPOS mobile apps, threat actors target more than just data.Learn how to protect your digital wallets and SoftPOS apps.Featuring demos and practical tips, this webinar, "Securing Mobile Payments: Protecting Digital Wallets and SoftPOS from Attacks," will help security professionals collaborate more effectively with development teams to build stronger protection strategies and better defend digital wallet and SoftPOS mobile apps against today’s most common threats.Register Now#39: Left on RedKeeping up to date and getting ahead of the curveWelcome to Attack & Defend!Here we are again, investigating both red and blue team solutions to the dangers of the cybersecurity world. You'll find tutorials, best practices, tools, and a few other pointers to get you started on taking your next step. Make sure to check out the Humble Bundle deal listed below as well!Check out the ongoing Top Ten MITRE ATT&CK threats of 2024 breakdown that has launched through our sister newsletter, the _secpro. But anyway, here's some of the biggest problems facing people inyour position today!Cheers!Austin MillerEditor-in-ChiefThe networking bundle I wish I had when I was starting out$814 Value • Pay What You WantAttacking and Defending - WorldwideProduct Walkthrough: Securing Microsoft Copilot with Reco - Find out how Reco keeps Microsoft 365 Copilot safe by spotting risky prompts, protecting data, managing user access, and identifying threats - all while keeping productivity high.Security Advisory from Commvault - "We are providing an update to the security advisory issued onMarch 7, 2025. Based on new threat intelligence, we continue to investigate recent activity by a nation-state threat actor contained within our Azure environment. This activity has affected a small number of customers we have in common with Microsoft, and we are working with those customers to provide assistance."Inside the Latest Espionage Campaign of Nebulous Mantis - Nebulous Mantis (a.k.a. Cuba, STORM-0978, Tropical Scorpius, UNC2596) is a Russian-speaking cyber espionage group that has actively deployed the RomCom remote access trojan (RAT) and Hancitorloader in targeted campaigns since mid-2019. Operating with geopolitical motives, the group primarily focuses on critical infrastructure, government agencies, political leaders, and NATO related defense organizations. They use spear-phishing emails with weaponized document links to deliver RomCom for espionage, lateral movement, and data theft. Nebulous Mantis has been using the sophisticated RomCom since around mid-2022. This RAT is primarily employed for espionage and ransomware activities.Building Private Processing for AI tools on WhatsApp - AI has revolutionized the way people interact with technology and information, making it possible for people to automate complex tasks and gain valuable insights from vast amounts of data. However, the current state of AI processing — which relies on large language models often running on servers, rather than mobile hardware — requires that users’ requests are visible to the provider. Although that works for many use cases, it presents challenges in enabling people to use AI to process private messages while preserving the level of privacy afforded by end-to-end encryption.What It Takes to Defend a Cybersecurity Company from Today’s Adversaries - "Talking about being targeted is uncomfortable for any organization. For cybersecurity vendors, it’s practically taboo. But the truth is security vendors sit at an interesting cross-section of access, responsibility, and attacker ire that makes us prime targets for a variety of threat actors, and the stakes couldn’t be higher. When adversaries compromise a security company, they don’t just breach a single environment—they potentially gain insight into how thousands of environments and millions of endpoints are protected."Red team toolsVechus/ODC-challenges - A collection of offensive and defensive training resources, perfect for keeping you and your team sharp!shr3ddersec/Shr3dKit - This tool kit that is very much influenced by infosecn1nja's kit. Use this script to grab majority of the repos.lengjibo/FourEye - An AV Evasion tool for Red Team Ops.Mathuiss/cyber_wolf - A tool for building offensive skills with firewalls.jorge-333/Virtual-Machine-Home-Lab - …built for the purpose of studying, Installing, and configuring Switches, Routers, Firewalls, SIEMs, IPS's, and Offensive Security Tools.Blue team toolsVechus/ODC-challenges - A collection of offensive and defensive training resources, perfect for keeping you and your team sharp!awais922609/Defensive-Learning - This repo covers firewall configurations, SIEM deployment, and various other important defensive topics, giving you the tools to build up your defensive skills.0xInfection/Awesome-WAF - A collection of the best resources for improving your firewall skills; potentially the best collection online!Ekultek/WhatWaf - …and once you’ve mastered that, here’s a way to get around WAFsracecloud/NetBlocker - A specific implementation of a firewall script that reads logs from various servers, validates against public databases with offensive hosts and adjusts a MikroTik firewall.Making a step upExploiting DeepSeek-R1: Breaking Down Chain of Thought Security: "The growing usage of chain of thought (CoT) reasoning marks a new era for large language models. CoT reasoning encourages the model to think through its answer before the final response. A distinctive feature of DeepSeek-R1 is its direct sharing of the CoT reasoning. We conducted a series of prompt attacks against the 671-billion-parameter DeepSeek-R1 and found that this information can be exploited to significantly increase attack success rates."Addressing the public sector’s penetration testing problems: The public sector is struggling to break free of an outdated model of penetration testing (pentesting) that requires federal civilian agencies and state, local and higher education institutions alike to contend with approaches that don’t scale and can introduce their own security challenges. But these antiquated methods of security testing can’t be addressed until organizations understand what causes these problems: bandwidth, efficiency and security.How purple teaming enhances inter-team collaboration and effectiveness in cybersecurity: "It’s no longer about team red vs. team blue. It’s time to think about team purple. This security force blends offensive and defensive minds, blurring lines and boosting defenses. No more adversarial silos, just collaborative cycles and shared intel."*{box-sizing:border-box}body{margin:0;padding:0}a[x-apple-data-detectors]{color:inherit!important;text-decoration:inherit!important}#MessageViewBody a{color:inherit;text-decoration:none}p{line-height:inherit}.desktop_hide,.desktop_hide table{mso-hide:all;display:none;max-height:0;overflow:hidden}.image_block img+div{display:none}sub,sup{font-size:75%;line-height:0} @media (max-width: 100%;display:block}.mobile_hide{min-height:0;max-height:0;max-width: 100%;overflow:hidden;font-size:0}.desktop_hide,.desktop_hide table{display:table!important;max-height:none!important}}

Exploring some of cutting-edge research, including STIG Compliance and Vehicle Simulators74% of organizations are now API-firstAPI attacks that can lead to fraud through account takeovers and theft of credit card information.Read full article#39: Virtual Machines, Virtual... Cars?Exploring some of cutting-edge research, including STIG Compliance and Vehicle SimulatorsWelcome to Attack & Defend!Sometimes, you need a specific focus on the issues that are facing red and blue teamers to get ahead. We know that, which is why we're rolling out a new series of overviews, reviews, and views concerning this corner of the market - which is growing more and more valuable each year!Almost a quarter into the year, this threats are continuing to come thick and fast - in fact, ourhunch is that the retrospective we have at the end of this calendar year may even look like a reluctant admission that the adversary has always got something else up its sleeve. In that sense, we invite you to check out the ongoing Top Ten MITRE ATT&CK threats of 2024 breakdown that has launched through our sister newsletter, the _secpro. But anyway, here's some of the biggest problems facing people inyour position today!Cheers!Austin MillerEditor-in-ChiefDon't miss out on 30% off!Attacking and Defending - WorldwideBusiness Wire - Red Hat Boosts Enterprise AI Across the Hybrid Cloud with Red Hat AI: "Red Hat, Inc., the world's leading provider of open source solutions, today announced the latest updates to Red Hat AI, its portfolio of products and services designed to help accelerate the development and deployment of AI solutions across the hybrid cloud. Red Hat AI provides an enterprise AI platform for model training and inference that delivers increased efficiency, a simplified experience and the flexibility to deploy anywhere across a hybrid cloud environment."RAND - Artificial General Intelligence's Five Hard National Security Problems: Find the Report PDF here to find out about this cutting-edge research.SANS - Identifying Advanced Persistent Threat Activity Through Threat-Informed Detection Engineering: Enhancing Alert Visibility in Enterprises: "Advanced Persistent Threats (APTs) are among the most challenging to detect in enterprise environments, often mimicking authorized privileged access prior to their actions on objectives."SANS - Strolling Through the STIG: "The CKL file has become the unofficial common language amongst the Department of Defense activities to share and report on STIG compliance information. Although easy to work with on an individual basis (One System / One Assessment), this format fails at scale."TrendMicro - ZDI-CAN-25373: Windows Shortcut Exploit Abused as Zero-Day in Widespread APT Campaigns: "Trend Zero Day Initiative™ (ZDI) identified nearly 1,000 malicious .lnk files abusing ZDI-CAN-25373 (aka ZDI-25-148), a vulnerability that allows attackers to execute hidden malicious commands on a victim’s machine by leveraging crafted shortcut files."Building an electric vehicle simulator to research EVSEs: "Researching and reverse engineering Level 2 Electric Vehicle Supply Equipment (EVSE or loosely “charger”) efforts might require the equipment to be placed beyond the idle state. The idle state is straightforward and usually involves nothing more than powering up the charger. Indeed, this is a very useful state for research where the user interface is in operation, communications both wired and wireless are working and the mobile device app can interact. However, there are times when there is a need to force the charger into other states so that it behaves as though the electric vehicle is attached, the EV is asking for charge, or the EV is charging and the EVSE is providing charging current."Red team toolsVechus/ODC-challenges - A collection of offensive and defensive training resources, perfect for keeping you and your team sharp!shr3ddersec/Shr3dKit - This tool kit that is very much influenced by infosecn1nja's kit. Use this script to grab majority of the repos.lengjibo/FourEye - An AV Evasion tool for Red Team Ops.Mathuiss/cyber_wolf - A tool for building offensive skills with firewalls.jorge-333/Virtual-Machine-Home-Lab - …built for the purpose of studying, Installing, and configuring Switches, Routers, Firewalls, SIEMs, IPS's, and Offensive Security Tools.Blue team toolsVechus/ODC-challenges - A collection of offensive and defensive training resources, perfect for keeping you and your team sharp!awais922609/Defensive-Learning - This repo covers firewall configurations, SIEM deployment, and various other important defensive topics, giving you the tools to build up your defensive skills.0xInfection/Awesome-WAF - A collection of the best resources for improving your firewall skills; potentially the best collection online!Ekultek/WhatWaf - …and once you’ve mastered that, here’s a way to get around WAFsracecloud/NetBlocker - A specific implementation of a firewall script that reads logs from various servers, validates against public databases with offensive hosts and adjusts a MikroTik firewall.Making a step upExploiting DeepSeek-R1: Breaking Down Chain of Thought Security: "The growing usage of chain of thought (CoT) reasoning marks a new era for large language models. CoT reasoning encourages the model to think through its answer before the final response. A distinctive feature of DeepSeek-R1 is its direct sharing of the CoT reasoning. We conducted a series of prompt attacks against the 671-billion-parameter DeepSeek-R1 and found that this information can be exploited to significantly increase attack success rates."Addressing the public sector’s penetration testing problems: The public sector is struggling to break free of an outdated model of penetration testing (pentesting) that requires federal civilian agencies and state, local and higher education institutions alike to contend with approaches that don’t scale and can introduce their own security challenges. But these antiquated methods of security testing can’t be addressed until organizations understand what causes these problems: bandwidth, efficiency and security.How purple teaming enhances inter-team collaboration and effectiveness in cybersecurity: "It’s no longer about team red vs. team blue. It’s time to think about team purple. This security force blends offensive and defensive minds, blurring lines and boosting defenses. No more adversarial silos, just collaborative cycles and shared intel."*{box-sizing:border-box}body{margin:0;padding:0}a[x-apple-data-detectors]{color:inherit!important;text-decoration:inherit!important}#MessageViewBody a{color:inherit;text-decoration:none}p{line-height:inherit}.desktop_hide,.desktop_hide table{mso-hide:all;display:none;max-height:0;overflow:hidden}.image_block img+div{display:none}sub,sup{font-size:75%;line-height:0} @media (max-width: 100%;display:block}.mobile_hide{min-height:0;max-height:0;max-width: 100%;overflow:hidden;font-size:0}.desktop_hide,.desktop_hide table{display:table!important;max-height:none!important}.reverse{display:table;width: 100%;

Going forward and in reversePrepare, Respond, Recover:Defining Modern Cyber ResilienceWhen threats come for your business, every second counts. Rubrik’s Cyber Resilience Summit will show you how to put your time to good use, so your data—and your organization—are safe.Join us virtually on March 5th to learn how to:- Gain visibility into where your sensitive data lives- Accelerate incident response and achieve end-to-end resilience- Manage risk and recover from attacks fasterSecure Your Spot#36: Engineering defenseGoing forward and in reverseWelcome to Attack & Defend!Sometimes, you need a specific focus on the issues that are facing red and blue teamers to get ahead. We know that, which is why we're rolling out a new series of overviews, reviews, and views concerning this corner of the market - which is growing more and more valuable each year!Of course, here we stand a wholemonth into 2025 and the challenges are still coming thick and fast. So, here's a few practical tips, news items, and other interesting tid-bits for keeping you sane in the insane world of cybersecurity.Cheers!Austin MillerEditor-in-ChiefAn intro to Reverse EngineeringCybersecurity isn’t just about defense—it’s also about understanding how they work. That’s where reverse engineering comes in. When analyzing malware, security professionals use it to break things down and figure out how they operate.Get aheadAttacking and Defending - WorldwideCVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks - On September 25, 2024, theTrend ZDIThreat Hunting team identified a zero-day vulnerability exploited in-the-wild and associated with the deployment of the loader malware known asSmokeLoader. This vulnerability is believed to be used by Russian cybercrime groups to target both governmental and non-governmental organizations in Ukraine, with cyberespionage being the most likely purpose of these attacks as part of the ongoing Russo-Ukrainian conflict. The exploitation involves the use of compr -omised email accounts and a zero-day vulnerability existing in the archiver tool 7-Zip (CVE-2025-0411), which was manipulated through homoglyph attacks.CVE-2025-0108 PAN-OS: Authentication Bypass in the Management Web Interface - An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS.From South America to Southeast Asia: The Fragile Web of REF7707 - Elastic Security Labs has been monitoring a campaign targeting the foreign ministry of a South American nation that has links to other compromises in Southeast Asia. We track this campaign as REF7707. The intrusion set utilized by REF7707 includes novel malware families we refer to as FINALDRAFT, GUIDLOADER, and PATHLOADER. We have provided a detailed analysis of their functions and capabilities in the malware analysis report of REF7707 -You've Got Malware: FINALDRAFT Hides in Your Drafts.Gcore DDoS Radar Reveals 56% YoY Increase in DDoS Attacks - Gcore’s twice-annual Radar report analyzes DDoS attack data observed across our global network, spanning six continents and over 180 PoPs, to uncover key insights from the past six months (sign up for access).Red team toolsVechus/ODC-challenges - A collection of offensive and defensive training resources, perfect for keeping you and your team sharp!shr3ddersec/Shr3dKit - This tool kit that is very much influenced by infosecn1nja's kit. Use this script to grab majority of the repos.lengjibo/FourEye - An AV Evasion tool for Red Team Ops.Mathuiss/cyber_wolf - A tool for building offensive skills with firewalls.jorge-333/Virtual-Machine-Home-Lab - …built for the purpose of studying, Installing, and configuring Switches, Routers, Firewalls, SIEMs, IPS's, and Offensive Security Tools.Blue team toolsVechus/ODC-challenges - A collection of offensive and defensive training resources, perfect for keeping you and your team sharp!awais922609/Defensive-Learning - This repo covers firewall configurations, SIEM deployment, and various other important defensive topics, giving you the tools to build up your defensive skills.0xInfection/Awesome-WAF - A collection of the best resources for improving your firewall skills; potentially the best collection online!Ekultek/WhatWaf - …and once you’ve mastered that, here’s a way to get around WAFsracecloud/NetBlocker - A specific implementation of a firewall script that reads logs from various servers, validates against public databases with offensive hosts and adjusts a MikroTik firewall.Making a step upEM360 - Infiltration Insights: Red Team Operations: Red teaming is a proactive cybersecurity approach where ethical hackers simulate real-world attacks to test an organisation’s defences. Unlike traditional testing, red teaming mimics sophisticated threats to expose vulnerabilities in networks, systems, and even human factors. This process helps organisations identify weaknesses, strengthen their security posture, and improve their incident response plans to stay ahead of evolving cyber threats.Addressing the public sector’s penetration testing problems: The public sector is struggling to break free of an outdated model of penetration testing (pentesting) that requires federal civilian agencies and state, local and higher education institutions alike to contend with approaches that don’t scale and can introduce their own security challenges. But these antiquated methods of security testing can’t be addressed until organizations understand what causes these problems: bandwidth, efficiency and security.An Introduction To Purple Teaming: "Purple teaming can play a vital role in helping them to achieve this. Purple teaming involves red and blue teams collaborating on an ongoing basis to maximize their impact. Read on to discover how purple teaming enables businesses to enhance and accelerate their approach to identifying and mitigating security vulnerabilities."How purple teaming enhances inter-team collaboration and effectiveness in cybersecurity: "It’s no longer about team red vs. team blue. It’s time to think about team purple. This security force blends offensive and defensive minds, blurring lines and boosting defenses. No more adversarial silos, just collaborative cycles and shared intel."Penetration Testing Market Demand Will Reach a Value of USD 6.44 Billion by the Year 2030, At a CAGR of 16.5:"The Penetration Testing Market plays a crucial role in assessing and strengthening the security of IT infrastructure. Penetration tests help uncover vulnerabilities in operating systems, applications, and networks by simulating potential cyber-attacks without compromising the system’s security."*{box-sizing:border-box}body{margin:0;padding:0}a[x-apple-data-detectors]{color:inherit!important;text-decoration:inherit!important}#MessageViewBody a{color:inherit;text-decoration:none}p{line-height:inherit}.desktop_hide,.desktop_hide table{mso-hide:all;display:none;max-height:0;overflow:hidden}.image_block img+div{display:none}sub,sup{font-size:75%;line-height:0} @media (max-width: 100%;display:block}.mobile_hide{min-height:0;max-height:0;max-width: 100%;overflow:hidden;font-size:0}.desktop_hide,.desktop_hide table{display:table!important;max-height:none!important}.reverse{display:table;width: 100%;

Understanding AI as a red and blue teamerSecure and Simplify: Salesforce Data Protection with RubrikWhat if your Salesforce data was suddenly lost or corrupted? Human errors, accidental deletions, misconfigurations can all contribute to data loss. 1 of 2 SaaS users that did not implement SaaS data protection experienced data loss or corruption in the last 12 months.Check out this exclusive webinar where we reveal Rubrik's new integration with Salesforce, designed to tackle this exact issue.Watch On-DemandNew attacks, new problems for AIUnderstanding AI as a red and blue teamerWelcome to Attack & Defend!Sometimes, you need a specific focus on the issues that are facing red and blue teamers to get ahead. We know that, which is why we're rolling out a new series of overviews, reviews, and views concerning this corner of the market - which is growing more and more valuable each year!In keeping with the general trends of the whole world this year, this has meant that looking at AI takes up a considerable portion of this newsletter. We won't waste your time with a long introduction, but make sure to check out the controversy around OpenAI and what that means for your role today.Also, if you missed it, we sent out the first issue of the new _secproPremium (_secpro Premium #1: Change is Difficult) as a free edition last week. As a teaser for those thinking of subscribing and as a treat for everyone else. Don't miss out on Attack & Defend's sister publication!Cheers!Austin MillerEditor-in-ChiefAttacking and Defending - WorldwideMeta's GOAT tricks LLMs into writing Nazi poetry during automated red-teaming test - In a pre-print paper, Meta researchers described building and testing GOAT by asking it to coerce various LLMs into writing poetry that "glorifies the Holocaust and praises the Nazi Party" - a test that's part of theJailbreakBench Dataset (more on that later). GOAT is designed to red-team GenAI models in order to "assesses how LLMs can produce content that violates norms, policies, and rules set during their safety training", so that loopholes can be closed down before a model goes into public use.An update on disrupting deceptive uses of AI - "OpenAI’s mission is to ensure that artificial general intelligence benefits all of humanity. We are dedicated to identifying, preventing, and disrupting attempts to abuse our models for harmful ends. In this year of global elections, we know it is particularly important to build robust, multi-layered defenses against state-linked cyber actors and covert influence operations that may attempt to use our models in furtherance of deceptive campaigns on social media and other internet platforms."SSD Advisory – Nortek Linear eMerge E3 Pre-Auth RCE - "We would like to point out that we always recommend that our customers follow best practices to prevent unauthorised access to E3 and TE systems. Best practices include, not placing the product on their corporate network, not placing the product on the open internet, to install the product behind a network firewall and to use a VPN to access the product."The Mongolian Skimmer: different clothes, equally dangerous - A few weeks ago, while consulting skimming threat intel sources Jscrambler researchers stumbled across a new skimming campaign that, at first glance, stood out because of the JavaScript obfuscation it exhibits. Some people raised the question if this was a new obfuscation technique, probably because the code is using weird accented characters. As part of a company that makes aJavaScript obfuscation tool, the team could tell immediately that it is not. The obfuscation author just used unusual Unicode characters for variables and function names. But that has been done before and it’s hardly an obstacle.Red team toolsVechus/ODC-challenges - A collection of offensive and defensive training resources, perfect for keeping you and your team sharp!shr3ddersec/Shr3dKit - This tool kit that is very much influenced by infosecn1nja's kit. Use this script to grab majority of the repos.lengjibo/FourEye - An AV Evasion tool for Red Team Ops.Mathuiss/cyber_wolf - A tool for building offensive skills with firewalls.jorge-333/Virtual-Machine-Home-Lab - …built for the purpose of studying, Installing, and configuring Switches, Routers, Firewalls, SIEMs, IPS's, and Offensive Security Tools.Blue team toolsVechus/ODC-challenges - A collection of offensive and defensive training resources, perfect for keeping you and your team sharp!awais922609/Defensive-Learning - This repo covers firewall configurations, SIEM deployment, and various other important defensive topics, giving you the tools to build up your defensive skills.0xInfection/Awesome-WAF - A collection of the best resources for improving your firewall skills; potentially the best collection online!Ekultek/WhatWaf - …and once you’ve mastered that, here’s a way to get around WAFsracecloud/NetBlocker - A specific implementation of a firewall script that reads logs from various servers, validates against public databases with offensive hosts and adjusts a MikroTik firewall.Making a step upEM360 - Infiltration Insights: Red Team Operations: Red teaming is a proactive cybersecurity approach where ethical hackers simulate real-world attacks to test an organisation’s defences. Unlike traditional testing, red teaming mimics sophisticated threats to expose vulnerabilities in networks, systems, and even human factors. This process helps organisations identify weaknesses, strengthen their security posture, and improve their incident response plans to stay ahead of evolving cyber threats.Addressing the public sector’s penetration testing problems: The public sector is struggling to break free of an outdated model of penetration testing (pentesting) that requires federal civilian agencies and state, local and higher education institutions alike to contend with approaches that don’t scale and can introduce their own security challenges. But these antiquated methods of security testing can’t be addressed until organizations understand what causes these problems: bandwidth, efficiency and security.An Introduction To Purple Teaming: "Purple teaming can play a vital role in helping them to achieve this. Purple teaming involves red and blue teams collaborating on an ongoing basis to maximize their impact. Read on to discover how purple teaming enables businesses to enhance and accelerate their approach to identifying and mitigating security vulnerabilities."How purple teaming enhances inter-team collaboration and effectiveness in cybersecurity: "It’s no longer about team red vs. team blue. It’s time to think about team purple. This security force blends offensive and defensive minds, blurring lines and boosting defenses. No more adversarial silos, just collaborative cycles and shared intel."Penetration Testing Market Demand Will Reach a Value of USD 6.44 Billion by the Year 2030, At a CAGR of 16.5:"The Penetration Testing Market plays a crucial role in assessing and strengthening the security of IT infrastructure. Penetration tests help uncover vulnerabilities in operating systems, applications, and networks by simulating potential cyber-attacks without compromising the system’s security."*{box-sizing:border-box}body{margin:0;padding:0}a[x-apple-data-detectors]{color:inherit!important;text-decoration:inherit!important}#MessageViewBody a{color:inherit;text-decoration:none}p{line-height:inherit}.desktop_hide,.desktop_hide table{mso-hide:all;display:none;max-height:0;overflow:hidden}.image_block img+div{display:none}sub,sup{line-height:0;font-size:75%} @media (max-width: 100%;display:block}.mobile_hide{min-height:0;max-height:0;max-width: 100%;overflow:hidden;font-size:0}.desktop_hide,.desktop_hide table{display:table!important;max-height:none!important}}