Security Boulevard

The notorious Hunters International RaaS group that racked up hundreds of victims over two years says it's shutting down and offering decryption software to victims, but security pros say this happens regularly in the cybercriminal world and that the threat actors likely will return affiliated with other operations.

The post Security Pros Say Hunters International RaaS Operators are ‘Changing Jerseys’ appeared first on Security Boulevard.

A Barracuda Networks analysis of unsolicited and malicious emails sent between February 2022 to April 2025 indicates 14% of the business email compromise (BEC) attacks identified were similarly created using a large language model (LLM).

The post Analysis Surfaces Increased Usage of LLMs to Craft BEC Attacks appeared first on Security Boulevard.

By breaking down internal silos, leveraging advanced technology and embracing industrywide cooperation, organizations can shift from reactive to proactive fraud prevention to protect revenue and reputation while supporting sustainable business growth. 

The post Beyond Silos: The Power of Internal Collaboration on Transforming Fraud Prevention appeared first on Security Boulevard.

There is no question that vulnerability scanning and patch management remain necessary, but they are clearly no longer sufficient

The post We Are Losing the Scan/Patch Battle appeared first on Security Boulevard.

Understanding the difference between Shadow IT and BYOC, although subtle, requires different policies, procedures and technology to resolve.

The post The Differences and Similarities Between Shadow IT and BYOC appeared first on Security Boulevard.

Researchers from NordVPN and Silent Push uncover separate brand-spoofing campaigns that involve tens of thousands of fake websites impersonating real plans that are used to lure victims to hand their data and money to threat actors.

The post Silent Push, NordVPN Uncover Thousands of Brand-Spoofing Websites appeared first on Security Boulevard.

Data security governance provider Concentric AI announced its acquisition of Swift Security and Acante, two AI-driven security startups, in a move Concentric AI founder and CEO Karthik Krishnan hopes will reshape enterprise data protection.

The post Concentric AI Expands Data Security Ambitions With Swift Security, Acante Acquisitions  appeared first on Security Boulevard.

Security operations platform provider Blumira today released an intelligence assessment that tracked 824 security incidents attributed to Iranian threat actors over 21 months, providing insights into recent Iranian threat activity.

The post Blumira Identifies 824 Iranian Cyber Incidents Over 21 Months  appeared first on Security Boulevard.

A report published this week by Netcraft, a provider of a platform for combating phishing attacks, finds that large language models (LLMs) might not be a reliable source when it comes to identifying where to log in to various websites.

The post Report Finds LLMs Are Prone to Be Exploited by Phishing Campaigns appeared first on Security Boulevard.

The future of API security is not just about better firewalls — it is about smarter governance, automation and visibility at scale. 

The post API Sprawl Can Trip Up Your Security, Big Time appeared first on Security Boulevard.

When you design agentic AI with governance at the core, you stay ahead of risk and avoid reactive fire drills.

The post Your Agentic AI Governance Checklist: 7 Non-Negotiables to Fix Governance Blind Spots  appeared first on Security Boulevard.

With empowered advocates and continuous measurement, teams can navigate the fine line between compliance, rule adherence and creative freedom.

The post Guiding Global Teams: Fostering Compliance and Creativity appeared first on Security Boulevard.

Businesses must take the threat of identity-based attacks seriously and adapt their cybersecurity practices to address this challenge.

The post How Monitoring Users’ Holistic Digital Identities Can Help Businesses Eliminate Cybercriminals’ Greatest Advantage appeared first on Security Boulevard.

The DOJ announced a far-reaching operation that aimed to knock out a substantial number of North Korean IT worker scams that have victimized more than 100 U.S. companies that unwittingly hired North Korean operatives as remote workers, who then stole data and money to support the Pyongyang regime.

The post U.S. Target North Korean IT Worker Scams with Raids, Indictments appeared first on Security Boulevard.

We are pleased to feature a guest post from Jaime Halscott, Senior Technology Evangelist at IGEL. With a unique background that blends deep technical expertise, C-level experience, and a law degree, Jaime plays a key role in IGEL’s global alliances, including its work with Dispersive Stealth Networking. In this piece, he explores how stateless endpoints, secure virtual desktops, and stealth networking come together to support Zero Trust strategies in the field.

Part One: The Operator

The rain hadn’t stopped in days. 
 
In a cramped apartment nestled in the heart of a bustling foreign capital, the man sat quietly, sifting through a local newspaper he’d never actually read. He was clean-cut but unassuming, blending in with the thousands of expats and NGO workers who flooded the city. His name wasn’t his own. It changed with the country. His accent shifted like water. His past, if it existed, had been burned away long ago.   
He was a ghost. But even ghosts need tools. 
 
Perched beside an aging electric kettle on the apartment’s rickety table was an off-the-shelf Windows laptop—an unremarkable model, cheap, dented at the corners. On first glance, it looked like something a college student would use to scroll Reddit or work on a term paper. A quick inspection revealed browser bookmarks for local job boards, a cluttered desktop with family photos, a spreadsheet of household expenses—every detail meticulously planted to look perfectly boring. 
 
He plugged in a small device—sleek, matte black with a keypad on the front. The Apricorn Aegis Secure Key 3. He tapped in his code. The LED flashed green. 
 
Moments later, the laptop bypassed Windows entirely, booting into IGEL OS, an ultra-lightweight, hardened Linux environment that ran exclusively from the encrypted thumb drive. Within seconds, his real mission began. 
 
Through the IGEL interface, he launched a connection to his Omnissa Horizon virtual desktop, a secure image hosted thousands of miles away on government-controlled infrastructure back in the United States. Everything he needed—classified documents, operational files, AI-enhanced reconnaissance tools—lived in that virtual machine. Nothing was stored locally. 
 
But that wasn’t enough. In this country, the regime’s surveillance apparatus was sophisticated—watching, listening, inspecting packets of network data for even the faintest whiff of foreign interference. 
 
That’s where Dispersive Stealth Networking came in. 
 
His IGEL environment was configured to automatically tunnel all communications through Dispersive’s software-defined network, a multi-path, encrypted transmission system originally built to withstand cyber warfare. His traffic splintered into dozens of encrypted fragments across dynamic channels—unreadable, untraceable, unstoppable.  
 
Even if someone intercepted a piece of it, it would be meaningless on its own. 
 
He exhaled, cracked his fingers, and began typing. The world around him could crumble—but his data, his access, his mission—they were untouchable. 
 
He was in and out of the system within 22 minutes. 
 
When he was done, he ejected the Secure Key. If compromise ever came—if boots crashed through the door or an asset flipped—the key could be wiped in seconds with a single button press. Not even the NSA could recover it after that. 
 
He was already gone before anyone knew he was there.

Learn the essential security strategies to safeguard AI models, data, and infrastructure from advanced threats. Download the White Paper: Best Practices Protecting AI Workloads White Paper

Part Two: The Technology Behind the Tradecraft IGEL OS: A Hardened, Stateless Endpoint

IGEL OS is a lightweight, read-only Linux-based operating system optimized for secure access to virtual environments and cloud workspaces. Unlike traditional operating systems, IGEL is designed to be stateless, minimizing the attack surface and eliminating local data storage.

Technical Advantages

- Immutable OS architecture: The operating system runs from a read-only partition. This prevents tampering, ensures consistency, and eliminates the risk of persistent malware.
- No local attack vector: Without locally stored data or user applications, the risk of lateral movement by threat actors is greatly reduced.
- Chain of trust: IGEL supports UEFI Secure Boot and TPM-based chain of trust, ensuring every boot component is verified before loading.
- Modular deployment: The OS is highly modular and can be deployed on a wide range of x86 hardware—even as a live environment from USB (as in our fictional operator’s use case).
- Policy enforcement: Centralized configuration via IGEL UMS ensures endpoints remain compliant regardless of location or connectivity status.

Apricorn Aegis Secure Key 3: Portable Hardware Encryption

The Secure Key is more than just a thumb drive—it’s a FIPS 140-2 Level 3 validated device with onboard AES-XTS 256-bit encryption and physical brute-force protection.

Security Features

- Onboard PIN authentication: No software required—access control happens directly on the device using a built-in keypad.
- Hardware-based encryption: Full AES-256 encryption in XTS mode, performed in hardware before the host ever touches the data.
- Auto-lock and brute force response: Configurable settings allow for rapid auto-lock, and after a preset number of incorrect attempts, the device crypto-erases itself.
- Secure wipe: A single command can trigger an instant full-key wipe, ensuring total data destruction in seconds.

Omnissa Horizon + Dispersive Stealth Networking: Centralized Zero Trust

Omnissa Horizon provides centralized, cloud-hosted or on-prem VDI (Virtual Desktop Infrastructure), enabling access to a fully contained digital workspace. When coupled with Dispersive Zero Trust Network Access, it becomes a zero-trust gateway and remote access client with integrated authentication, conditional access, and federated identity services.

Key Architectural Components

- Dispersive VTC Endpoint and Gateway: High-performance multipath optimized for remote access, minimizing bandwidth in lossy conditions while offering real-time network encryption and secure isolation and connectivity to users, devices and workloads.

Dispersive Stealth Networking: Dynamic, Multi-Path Networking Built for Threat Evasion

Dispersive Stealth Networking takes a fundamentally different approach to secure networking—drawing from concepts originally developed for military communications. Rather than routing data through a single encrypted tunnel like a traditional VPN, it breaks data into multiple encrypted shards, each routed independently.

Core Technical Features

- Multipath UDP tunneling: Dispersive splits traffic into streams sent over multiple UDP paths simultaneously, increasing resilience and minimizing detection.
- Dynamic path shifting: The system adapts in real time to congestion, latency, or threats, re-routing shards via alternate paths without breaking sessions.
- Forward error correction and reassembly: Packets are reassembled only at the trusted endpoint, and lost fragments are recovered using advanced FEC algorithms.
- End-to-end obfuscation: Beyond encryption, Dispersive cloaks the traffic signature itself—making DPI (deep packet inspection) and traffic fingerprinting ineffective.

Use Case Alignment

- Ideal for environments where nation-state surveillance, DPI, or BGP and offline decrypt or attribution of the user using hijacking and other interception methods are real threats.
- Supports deployment in air-gapped, low-bandwidth, or high-latency networks common in DoD and tactical field environments.

Integrated Stack Benefits

Feature

IGEL OS

Omnissa Horizon + Workspace ONE

Dispersive Stealth Networking

Local Data Footprint

Zero

Zero

Zero

OS Attack Surface

Minimal

N/A (remote execution)

N/A

Encryption

None at OS level; uses Secure Key

TLS, host isolation

AES-256 + traffic obfuscation

Access Control

UMS policies + BIOS boot restrictions

Contextual access + Multi-Factor Authentication

Identity-aware encrypted endpoint access

Ideal Scenarios

Tactical field use, remote endpoints

Controlled, compliant access to critical systems

Covert comms in surveillance-heavy regions

Final Thoughts

Combining these tools creates an operational framework that is:
- Invisible to attackers
- Secure by default
- Centralized, yet decentralized in deployment
- Compliant with Zero Trust and federal cyber mandates

Whether you’re deploying for field intelligence, critical infrastructure, or commercial enterprises facing nation-state threat actors, this integrated approach delivers the highest possible assurance without sacrificing mobility or speed.

To learn more, please reach out to schedule a demo or consultation.

Header image courtesy of Sergey Gricanov from Pixabay.

The post Ghost in the Machine: A Spy’s Digital Lifeline appeared first on Security Boulevard.

The DOJ and other U.S. agencies has charged 324 people, including medical professionals and pharmacists, in connection with a series of investigations into health care fraud, with one investigation dubbed Operation Gold Rush involving $10.6 billion in fraud, the largest such case in history.

The post DOJ Charges 324 in Sprawling $14.6 Billion Health Care Fraud Scams appeared first on Security Boulevard.

The FY 2026 House Homeland Security Appropriations Bill highlights growing focus in Congress on protecting border infrastructure from cyber threats. The directive to implement continuous monitoring and real-time threat intelligence reflects a broader push toward modern, preventive cybersecurity across federal agencies.

As the digital and physical worlds become increasingly intertwined, the technologies used to protect national borders — once largely isolated — are now connected, intelligent and, unfortunately, more vulnerable than ever. Surveillance systems and cameras, biometric scanners, drones and other operational technology (OT) systems have become essential components of modern border protection. But with their growing capabilities comes an urgent need to secure them against cyber threats.

Today’s cybersecurity landscape demands more than just IT protection. The OT and internet of things (IoT) environments that underpin essential services, especially at the border, must be integral to any modern security strategy.

A legislative signal: Border security in the spotlight

Recent developments in Congress underscore a significant policy direction. The House Appropriations Committee recently passed its version of the FY 2026 (FY26) House Homeland Security Appropriations Bill. The bill places a clear focus on securing border infrastructure through proactive cybersecurity measures. This momentum builds on broader federal cybersecurity efforts, including:

• Executive Order 14306 reinforcing critical infrastructure defenses in response to escalating nation-state cyber threats
• Transportation Security Administration (TSA) security directives targeting OT in pipeline, rail and aviation infrastructure
• The Cybersecurity and Infrastructure Security Agency (CISA) Binding Operation Directive 23-01 requiring comprehensive asset visibility across IT, OT and IoT
• The Office of Management and Budget (OMB) Memorandum M-24-04, mandating inventories of all IoT and OT devices

While the FY26 House Homeland Security Appropriations Bill still needs to pass the House floor, the Senate, and be signed into law by the President, its language sends a strong signal: OT systems are no longer cybersecurity afterthoughts — they are national security imperatives.

A clear mandate for proactive security

The bill specifically encourages U.S. Customs and Border Protection (CBP) to "implement a proactive strategy to support real-time threat intelligence, risk-based prioritization, and continuous monitoring of critical border security technologies." This is a powerful statement, emphasizing a move away from reactive incident response to a more preventive and adaptive security posture.

It also directs CBP to brief Congress on its efforts to "assess, prioritize, and mitigate cybersecurity vulnerabilities and misconfigurations across all IT, OT, and IoT assets within the border security technology ecosystem." The directive explicitly calls for a holistic view of the attack surface, acknowledging that security gaps in OT and IoT systems can pose as significant a risk as those in traditional IT.

Why this matters for federal agencies

Border technologies do more than monitor perimeters, they enable the entire infrastructure of U.S. border operations. These systems help detect illegal crossings, track cargo, identify high-risk individuals and facilitate lawful trade and travel. A cyber attack on these systems isn’t just a technical problem, it’s a national security risk. Disruptions could impair real-time situational awareness, halt operations at ports of entry and potentially allow bad actors to bypass detection.

Congressional focus on OT/IoT security at the federal level is a significant step forward for several reasons:

• Elevating OT/IoT to national priority: The bill validates what many in the cybersecurity community have long recognized: that OT and IoT systems are core components of critical infrastructure and must be secured accordingly.
• Driving a proactive approach: The emphasis on "proactive strategy," "real-time threat intelligence," "risk-based prioritization" and "continuous monitoring" reflect modern cybersecurity best practices. It’s a clear move from reactive defenses to proactive exposure management.
• Encouraging comprehensive visibility: Today’s border systems don’t operate in isolation. They’re part of a broader ecosystem that includes IT networks, cloud platforms, OT and IoT devices. Directing CBP to secure all IT, OT and IoT assets reinforces the need for complete visibility across the entire attack surface because you can't secure what you can't see.
• Safeguarding data privacy and operational continuity: Border security systems handle highly sensitive data — including biometric records, surveillance footage and traveler information — making them a prime target for attacks. The bill’s language underscores the need for strong, proactive controls to protect data and avoid operational interruptions.
• Setting a precedent for broader federal security: The language within the Homeland Security bill can serve as a strong indicator for other federal agencies and departments regarding the increasing importance of securing their own OT and IoT deployments. This ripple effect could lead to a broader enhancement of critical infrastructure security across the U.S. and inspire similar initiatives globally.

Beyond the border: A broader commitment to cyber resilience

In addition to the border security language, the FY26 House Homeland Security Appropriations Act also includes several other crucial cybersecurity initiatives relevant to a secure federal attack surface:

1. Advancing CDM capabilities: This bill supports strengthening foundational security initiatives like piloting next gen technologies- like OT asset discovery and integration into the Continuous Diagnostics and Mitigation (CDM) program.
2. Embracing modern security paradigms: The bill encourages the adoption of cutting-edge security approaches such as AI-powered security and detection tools, application-based IoT discovery, cloud security, Zero Trust Architecture (ZTA) and post-quantum cryptography, highlighting a commitment to modern, adaptive defense models.
3. Supply chain and critical infrastructure protection: The bill directs CISA to focus on the most vital critical infrastructure sectors, explore new services like supply-chain vendor certification and real-time risk monitoring and assess a cyber readiness pilot for DHS contractors.

What this means for Tenable U.S. customers

The FY26 House Homeland Security Appropriations Bill reinforces a critical national priority: safeguarding the cyber integrity of U.S. border security technology and homeland security systems. This aligns closely with Tenable’s mission to support federal agencies in gaining visibility, understanding risk and proactively strengthening their cybersecurity posture.

As agencies like CBP deploy advanced technological solutions, the need for trusted, capable partners becomes even more vital. Tenable is committed to standing alongside our federal partners — not just as a technology provider but as a mission ally in defending the systems that protect U.S. borders and, ultimately, the nation’s national resilience. Because securing border technologies isn’t just about protecting entry points — it’s about setting a standard for how critical infrastructure is secured across the country.

Learn more

• Explore Tenable solutions for government
• Learn more about Tenable One FedRAMP
• Learn more about Tenable OT Security
• Request a demo

The post U.S. House Homeland Security Appropriations Bill Seeks to Modernize Border Infrastructure Security with Proactive OT/IT Security Measures appeared first on Security Boulevard.

 

The post Europe’s EUVD could shake up the vulnerability database ecosystem appeared first on Security Boulevard.

Introduction You’ve probably seen those little one-time codes pop up when you’re logging into your bank, email, or some app […]

The post How OTP Works (Step-by-Step) — What Really Happens Behind Those One-Time Codes appeared first on Security Boulevard.

Data Breaches in June 2025 left behind a string of major incidents that exposed sensitive information and interrupted services across industries.  From global airlines to municipal governments and investment platforms,...

The post Top 6 Data Breaches in June 2025 That Made Headlines appeared first on Strobes Security.

The post Top 6 Data Breaches in June 2025 That Made Headlines appeared first on Security Boulevard.