Insights
from the front lines of offensive security
26AI & Cybersecurity: The Future of Digital Resilience
In this brand-new podcast episode, host Henrike Tönnes talks with Dr. Mohamad Sbeiti and Samet Gökbayrak about leveraging AI in cybersecurity. The founders of the Bochum-based startup ENTRYZERO share how an AI-powered threat exposure management helps companies detect threats early and minimize risks - Cube 5 | Creating Security. Summary This was the focus of our discussion on “Nachgehackt – the IT Security Podcast”, where we explored the impact of AI on cybersecurity, particularly in the context of exposure management.
> continue reading
27Exposed and Unprepared? Inventoring Quantum Threats
The rapid advancement of quantum computing is accelerating the need for organizations to transition to post-quantum cryptography. A crucial first step is conducting a detailed quantum threat analysis—an in-depth inventory of IT assets and security algorithms that require protection. In our previous blog, we outlined commonly used security algorithms in Internet protocols, their quantum safety status, and potential quantum-safe alternatives. In this post, we illustrate an approach to exposure management with focus on quantum safety.
> continue reading
28Black Basta: Profiling Threat Actors in the German Landscape
A recently leaked chat log from the threat actor Black Basta offers a rare glimpse into the shadowy world of cybercrime in Germany. Our analysis reveals how threat actors discuss security vulnerabilities in their internal chats— which weaknesses they target most, what attack vectors they use, and which products are in their crosshairs. We examined 51 vulnerabilities mentioned in these conversations in connection with German domains. The findings paint an alarming picture of the current threat landscape and highlight the urgency for proper prioritization of vulnerabilities for remediation.
> continue reading
29Beyond Severity: Rethinking Vulnerability Prioritization
In this blog, we reflect on vulnerability data from 2024 to argue that effective vulnerability prioritization cannot rely solely on severity ratings - organizations patching critical vulnerabilities immediately, while scheduling others for the next patch cycle. We contend that an effective prioritization strategy must incorporate additional factors, such as threat intelligence on exploitation status, the availability of proof-of-concept (PoC) exploits, and more. Why Effective Prioritization Requires More Than Severity Ratings? In 2024, 32,958 vulnerabilities were published, with 3,082 of them rated as critical — an average of approximately 9 critical vulnerabilities per day.
> continue reading
30Quarterly Briefing: Threat Actor Using Unpatched Vulnerabilities
32% of ransomware attacks start with an unpatched vulnerability, and these have the greatest business impact. In our weekly ”Top 5 Hacker-Relevant Vulnerabilities" series, we report on vulnerabilities that are particularly pertinent to threat actors. As part of this ongoing effort, we will provide quarterly recaps on selected threat actors, associated breaches, and the vulnerabilities they exploit. Fourth Quarter 2024 Threat Actor: Clop Ransomware Gang Threat Actor Whois: Clop (also known as “Cl0p”) is a sophisticated cybercriminal organization active since 2019.
> continue reading- 31
Shadows at the Gates: Understanding Germany’s Threat Landscape
Germany’s cybersecurity landscape constantly evolves, with various Advanced Persistent Threat (APT) groups consistently testing the country’s defenses. This blog utilizes data from the Federal Office for Information Security (BSI), Malware Information Sharing Platform Galaxy (MISP Galaxy), and MITRE Adversarial Tactics, Techniques, and Common Knowledge (MITRE ATT&CK) to address a key question: Which APT groups are targeting Germany, what are their motivations, and what methods do they use? Predominant Threat Actors Targeting Germany The available data indicates that a majority of the APT groups targeting Germany have been attributed to China and Russia.
> continue reading - 32
Quantum Safety in Internet Exposure: What You Need to Know?
The rapid development of quantum computing presents a clear danger to widely used security algorithms. Future quantum computers will be capable of breaking these algorithms, potentially exposing sensitive data to cybercriminals. Even now, attackers may be collecting encrypted data, intending to decrypt it once quantum capabilities mature. This underscores the critical need for organizations to transition to quantum safe algorithms. To this end, understanding the impact of quantum threats and pinpointing vulnerable systems are vital first steps.
> continue reading - 33
Uncovering the Differences: U.S. vs. China Vulnerability Databases
In cybersecurity, national vulnerability databases are pivotal in cataloging and assessing software vulnerabilities. Two prominent databases are the U.S. National Vulnerability Database (NVD) and China’s National Vulnerability Database (CNNVD). Current industry practices often recommend utilizing Common Vulnerability Scoring System (CVSS) scores and severity ratings to prioritize actions such as patch management. This underlines the relevance of the reliability and consistency of the “ground truth” of these severity ratings. This blog is a comparative analysis of the severity assigned to 143,065 vulnerabilities by NVD and CNNVD from 2019 to October 2024.
> continue reading 
34Nessus, Qualys, Nuclei, GitHub: Optimizing Vulnerability Response!
CISA (the U.S. Cybersecurity and Infrastructure Security Agency) maintains a list of known exploited vulnerabilities, currently encompassing 1162 vulnerabilities. For each of these, CISA has evidence of active exploitation by threat actors. Among these, 741 vulnerabilities can be exploited without requiring user interaction. Prompt response to those vulnerabilities is paramount to an organization’s cybersecurity defense. In this blog, we analyze data from CISA to assess how quickly these vulnerabilities were flagged for security professionals.
> continue reading