zte

A blank field. A public repo. One reply to an email. A box left exposed. None of this sounds dramatic, which is partly the problem. This week’s threats keep finding leverage in small things that were easy to overlook. There are actively exploited bugs in the mix, cleaner intrusion paths, smarter automation, and a long patch list waiting behind them. Some attacks are getting more capable. Others

Depending on Chinese technology for European infrastructure poses risks that not every country takes seriously. So says the Royal United Services Institute (RUSI), which suggests that the EU needs to do better in helping members assess the risk and take appropriate action to safeguard the entire bloc. The UK-based think tank said in a report today that the EU should develop a new risk assessment framework that applies to all members and strengthens its own powers, without encroaching on members’ rights to set their own national security policies. It must delicately balance the need to secure the union, while maintaining the flexibility that both allows members to set domestic policies and lawmakers to account for different risk profiles across different sectors. The risks affecting telecoms will not necessarily apply to other sectors in the same way. Speaking of telecoms, currently there is only the voluntary EU Toolbox for 5G Security framework – voluntary being the operative word here, as only 10 of 27 members have fully implemented it since it launched in January 2020. On paper, it somewhat sets out to achieve what RUSI is calling for: a harmonized set of standards to mitigate 5G-related security risks affecting member states. Addressing the frustration over the lack of adoption, the European Commission proposed amendments to the Cyber Security Act (CSA) earlier this year that would allow it to build a list of untrusted vendors that members must preclude from the networks of 18 critical sectors. If passed, any countries using equipment from designated vendors would be forced to rip and replace it within 36 months. The EC has already indicated that it would suggest Huawei and ZTE be listed, should the amendments pass. But before the EU gets busy listing vendors it considers high-risk, it first needs to decide what a high-risk vendor even is. There is still no official definition, nor is it a legal category, and at present, it allows countries to wangle their way around these descriptions to buy the tech they want, bypassing whatever scrutiny may come their way should the CSA amendments come into force. RUSI’s researchers used Germany, Spain, and the UK as examples of how three countries can treat foreign tech vendors, such as Huawei and ZTE, very differently. Germany’s most important trading partner is China, a relationship worth €251.8 billion ($284.4 billion) annually, and historically the Bund has opted to preserve these valuable economic ties in favor of reducing supply chain risk. Under Chancellor Friedrich Merz, this is slowly changing, although RUSI does not expect to see a material shift in the makeup of Germany’s 5G RAN stack in the near future. Chinese suppliers accounted for an estimated 59 percent of the country’s 5G RAN in 2024. Chinese equipment accounted for an estimated 32 percent of Spain’s 5G RAN in 2024, although that share is expected to shrink. The debate intensified after last year’s controversy, when Spain awarded Huawei a contract involving the storage of judicial wiretap recordings. Spain’s past procurement decisions have shown it to often favor the most cost-effective option, and its government does not share the same national security concerns about China as the UK or US, or at least not to the same degree. The UK, meanwhile, looks set to completely eradicate Chinese technology from its telecoms network by the end of next year, and has bent to the US’ vehement demands that Huawei is bad, bad news for Western geopolitical security. Real security risks RUSI stated that concerns about Chinese IT vendors “are well-founded,” and that it is true that the Chinese government can empower authorities to exercise control over companies like Huawei. This includes providing the state with data on demand, hosting Chinese Communist Party (CCP) representatives, and reporting activity that signals a threat to national security. There is an additional law that requires tech companies to not just report vulnerabilities to the country’s government within 48 hours of discovery, but also to withhold the same disclosure from China’s overseas counterparts, except for the product vendor. “This converts China’s private sector security research into a state-controlled pipeline that grants intelligence services privileged early access to exploitable vulnerabilities,” RUSI said. Factoring in all of this, the country has also demonstrated the willingness and capability to launch cyberattacks against the critical national infrastructure of political adversaries, according to RUSI. Technical security aside, China’s technological advancements introduce economic risks, too. In some cases, its vendors have developed more capable products than equivalents in the EU or US, and sold them at more attractive prices. This advantage makes it difficult for some countries to justify the extra expense on non-Chinese equipment. In building a global reliance on its products, China could then introduce “unwelcome dependencies,” or cement itself as a dominant player in crucial supply chains, RUSI noted. China has shown in recent years that it is willing to exercise this influence, such as when it threatened Germany with “consequences” for the two countries’ economic ties during the heated 5G debate of 2019. Would a high-risk designation system work? One of the reasons why the think tank is calling for a more considered risk assessment framework for the EU is that there is no guarantee that what the EC is currently proposing in its CSA amendments will have much of an effect. Issuing blanket bans on companies, or countries, does not explicitly address the underlying security issues that make products vulnerable to attack. In other words, even if China were excluded entirely from the EU members’ tech stacks, the other vendors from ‘trusted’ countries have proved that they are unable to deliver penetration-proof software, which would open the door to attacks regardless. Remember, Salt Typhoon’s high-profile attack on US telco networks took place as recently as 2024. It should also be said that CSA-esque designations could apply to US companies, as some countries in Europe see US vendors as similarly risky, albeit for different reasons. Merz’s Germany is concerned about the relationship between the US and EU, for example, and similar concerns about dependence on Chinese technology could easily be applied to vendors in the US, should relations sour. In Spain, US cloud companies dominate, but anti-US sentiment is stronger than many realize, particularly around surveillance concerns. Those, along with higher prices from some non-Chinese suppliers, have reduced Spain’s appetite for ripping out equipment others deem high-risk. “One participant even noted that some officials view US legal instruments such as the Patriot Act as creating equivalent sovereignty risks to China’s National Intelligence Law, a narrative that is flawed when exploring the legislation, but politically convenient,” RUSI stated. The think tank suggested that if it wishes to enact change through policy, the EU must gather “greater economic courage” and a willingness to approach tech procurement as a means to secure its critical infrastructure, rather than “a compliance exercise.” ®

A domain used as harmless placeholder text showed up in roughly 1,700 repositories. Then somebody registered it and started serving malicious lures. That is the kind of week this was: forgotten assumptions turning into live attack surface. Elsewhere, weak service accounts, old bugs, exposed systems, phishing kits, and strangely easy exploit paths kept doing useful work for attackers. Nothing

EU takes member states to court over unimplemented cybersecurity law The European Commission on Wednesday filed legal referrals at the EU’s top court against four member states for failing to implement the bloc’s flagship cybersecurity law covering critical infrastructure. Ireland, Spain, France and the Netherlands are more than 20 months late in transposing the NIS2 Directive, which sets minimum security standards for hospitals, energy networks, transport operators and public administrations. The Commission has asked the Court of Justice of the European Union to impose a lump sum and ongoing daily financial penalties on all four countries until each formally notifies full transposition. Few member states met the original October 2024 deadline for transposing NIS2 into domestic legislation. As of January 2025, only six of the EU's 27 member states had transposed the directive. In practice, the fines being sought by the Commission are rarely paid. Member states in previous cases have generally adopted the required legislation while proceedings are under way, prompting the Commission to withdraw before the court makes a ruling. The filing comes as ENISA, the EU’s cybersecurity agency, has warned of thousands of cybersecurity incidents affecting the bloc in the year ending June 2025. ENISA identified public administration as the most-targeted critical sector at 38% of incidents, followed by transport at 7.5%. European officials have cast the risk in increasingly stark terms. Speaking in Munich in February, the Commission’s technology lead, Henna Virkkunen, warned the European Union could no longer afford to be “naive” about adversaries’ ability to switch off critical infrastructure, saying that power grids, hospitals and financial systems were all increasingly exposed. NIS2 is an update of the original Network and Information Security Directive of 2016, a law that covered fewer sectors and was applied unevenly across the bloc. The newer directive widened its scope to 18 critical sectors and added risk management and incident reporting requirements that were not included in the original directive. NIS2 also underpins a broader legislative program on cybersecurity. The EU’s Cyber Resilience Act, which imposes security requirements on connected products and whose vulnerability-reporting obligations begin to apply in 2027, relies on the national response-team network that NIS2 establishes. In January, the Commission proposed revising the EU’s Cybersecurity Act to strengthen ENISA and reduce risks in critical technology supply chains, including a provision that would see member states phase out designated high-risk suppliers such as Huawei and ZTE from critical infrastructure. Separately, the Commission proposed targeted amendments to NIS2 to provide greater legal clarity and ease compliance for companies — issues which officials have said contributed to delays in transposing the updated directive. Ireland said its National Cyber Security Bill, which will transpose NIS2 and place the country’s National Cyber Security Centre on a statutory footing, is close to finalization, with the minister responsible expecting to notify transposition by end of 2026. Spain, France and the Netherlands had not published comparable statements at the time of writing. Alexander Martin is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79

A new two-stage malware family called RustDuck is hijacking home routers, IP cameras, Android boxes, and poorly secured servers, then stitching them into a network built to knock websites and online services offline. Researchers at QiAnXin's XLab have tracked it since February 2026, and say the real story is not how big it is today, but how fast it is changing. The end goal is a distributed denial-of-service (DDoS) attack: flooding a target with junk traffic from the infected machines until it buckles. RustDuck is one more entrant in a crowded field, but it stands out for two reasons. It is being rewritten from the C programming language into Rust, and its newer versions go to unusual lengths to avoid being studied or shut down. How it spreads RustDuck does not lean on a single clever trick. It sprays a mix of old, well-known weaknesses and hopes one sticks. The first is the oldest in the book: devices left on the internet with weak or default passwords on their remote-login services (Telnet and SSH). Guess the password, walk in. The second is unpatched device bugs. XLab says RustDuck goes after exposed Android debugging interfaces and flaws in gear from TVT (DVRs and cameras), Ruijie, TP-Link, and ZTE, plus a handful of named, years-old vulnerabilities that still litter the internet: CVE-2017-17215, a remote code execution bug in Huawei HG532 routers that the original Mirai-style botnets abused back in 2017. CVE-2025-29635, a command-injection flaw in discontinued D-Link DIR-823X routers that Akamai watched Mirai variants exploit in March 2026. CISA added it to its Known Exploited Vulnerabilities list the next month. CVE-2024-1781, a command-injection bug in Totolink X6000R routers, whose maker never responded to the disclosure. CVE-2018-8007, a remote code execution path in Apache CouchDB that an authenticated admin can abuse. The third path is web software. RustDuck also targets known holes in ThinkPHP, Jenkins, and Hadoop YARN, which stretches its reach from cheap home hardware to exposed server software. XLab counted more than 20 internet addresses spreading the malware, with the busiest at 176.65.139[.]204. What makes it tricky RustDuck installs in two stages: a small loader that decrypts and unpacks a heavier core module. That core is where the interesting engineering lives, and it is the part being rewritten in Rust. Rust binaries are generally tougher for analysts to take apart than the C that has powered device malware for years, and XLab says RustDuck's Rust core shows real depth in how it derives its keys, hides from analysis, and talks to its servers. The switch points to active development, not a quick re-skin of leaked code. The bigger tell is how hard the newer samples work to stay hidden. Before doing anything, RustDuck runs a checklist to decide whether it has landed in a security researcher's lab instead of on a real victim's device. It looks for analysis tools like Wireshark and gdb, for debuggers attached to its own process, for the fingerprints of a honeypot trap, even for virtual-machine hardware. Each hit adds points to a risk score. Cross a threshold, and the malware erases its traces and quits before anyone can watch it run. Two of those checks stand out. One quietly tries to reach an internet address that is reserved for testing and should never answer; if something replies, RustDuck knows it is inside a fake network built to fool malware, and bails. Another compares two clocks to catch sandboxes that speed up time to rush malware into showing its hand. Its communications are locked down to match. RustDuck encrypts its traffic with modern ciphers: ChaCha20-Poly1305 for the handshake, AES-GCM once it is taking commands. It derives its keys with HKDF-SHA256 and a Curve25519 exchange, rotates them every ten minutes, and dresses the connection up to look like ordinary encrypted web traffic so it blends in. Once a device checks in, the operators can send a short list of orders: start an attack, stop it, report status, switch to new control servers, or quietly upgrade the malware to a newer build. The control addresses lean on free dynamic-DNS services like duckdns.org, which is where the "Duck" in the name comes from. This fits a bigger pattern RustDuck is not the first botnet to reach for Rust. In April 2025, Fortinet documented RustoBot, a Rust-based botnet that spread through Totolink and other routers to run DDoS attacks, using the same recipe: cheap routers, a modern language, and flood traffic on demand. It also arrives in a brutal year for DDoS. The same kind of botnet, scaled up, has produced the biggest floods on record. AISURU and a cluster of related botnets, more than three million hijacked devices between them, drove attacks near 30 Tbps before a US-led operation tore down their infrastructure this spring. Next to that, RustDuck is tiny. The worry is the direction it is heading. One detail worth a second look: RustDuck's busiest delivery address, 176.65.139[.]204, sits in the same small block of addresses as the server behind a separate ADB-targeting DDoS botnet reported in spring 2026. That could be a coincidence or shared bulletproof hosting, and XLab does not link the two, but the overlap is the kind of thing worth checking. What to do There is no patch for RustDuck itself, because it is malware, not a single bug. Defense means closing the doors it walks through: Get remote-management interfaces off the public internet. Turn off Android Debug Bridge, Telnet, and SSH where they are not needed, and never leave them reachable with default passwords. Patch what you can, replace what you can't. CouchDB has fixed releases to upgrade to, but some of these routers are past end-of-life. For the D-Link DIR-823X, CISA's advice is to pull it from service rather than wait for a patch that isn't coming, and the Totolink maker never answered the disclosure. Unsupported gear has to be replaced, not fixed. Block the known indicators. XLab's report lists the malware's file hashes, control domains, and source addresses; feed them into your monitoring. RustDuck is a small botnet wearing the engineering of a serious one. Whether it grows into a real threat or fizzles out, the techniques it is testing, a Rust rewrite and a paranoid hide-from-researchers routine, are the parts other crews are most likely to borrow.

Conferma, inoltre, per la creazione di un canale preferenziale per le Big Tech. Negli Usa, la Federal Communications Commission (FCC) ha votato giovedì per rafforzare i controlli e la supervisione in materia di cavi di comunicazione sottomarini. Del resto queste infrastrutture sono strategiche, transitandovi circa il 99% del traffico Internet internazionale. Le nuove regole puntano a costituire nuove barriere all’ingresso nel mercato alle aziende cinesi, legittimando al contempo un canale preferenziale per le Big Tech americane. Per la prima volta, la Commissione intende richiedere licenze agli operatori delle apparecchiature terminali delle linee sottomarine. Sono elementi cruciali dei sistemi di cavi, poiché collegano le reti oceaniche alle infrastrutture terrestri negli Usa. I benefici per le Big Tech Colossi tecnologici americani come Meta (proprietaria di Facebook) e Google (controllata da Alphabet), sottolinea la Reuters, “potrebbero beneficiare dell’iter autorizzativo più rapido“. In questo modo espanderebbero i propri sistemi per gestire la crescente domanda di traffico dati globale. Il vertice della FCC, Brendan Carr ha spiegato: “Esentiamo in via presuntiva le richieste di autorizzazione da revisioni lunghe e complesse. Tuttavia, solo se i richiedenti rispettano rigorosi standard di sicurezza e accettano un monitoraggio continuo. Il messaggio è semplice. Adottare elevate misure di Sicurezza Nazionale significa ottenere una corsia preferenziale per l’approvazione”. Il percorso accelerato richiederà alle aziende di proteggere le infrastrutture da attività di spionaggio e altri incidenti, oltre a garantire il rispetto delle linee guida della Difesa e la tutela dei dati. Gli operatori dovranno inoltre impegnarsi a non utilizzare apparecchiature straniere che possano rappresentare un rischio. L’ottica, in questo caso, è direttamente connessa alla sfida con la Cina. Il confronto con la Cina Con la forte crescita del settore dei cavi sottomarini, la FCC aveva già vietato lo scorso anno l’uso di tecnologie provenienti da aziende considerate una minaccia per la sicurezza nazionale degli Usa. Tra queste Huawei, ZTE, China Telecom e China Mobile. Le nuove regole potrebbero ampliare ulteriormente il divieto, includendo qualsiasi apparecchiatura proveniente da Paesi ritenuti “avversari stranieri”. Da oltre un anno, funzionari statunitensi esprimono preoccupazione per la rete globale di oltre 400 cavi sottomarini, ritenuta vulnerabile a potenziali interferenze da parte di Cina e Russia. Già nel 2021, il Dipartimento di Giustizia aveva sottolineato la necessità di accordi di sicurezza con aziende come Google e Meta. La motivazione formale era costituita dagli “sforzi costanti” della Cina per accedere a dati sensibili di milioni di cittadini americani. Da parte sua, la Cina ha reagito duramente alle misure statunitensi. All’inizio del mese, il Ministero del Commercio ha dichiarato di essere “fortemente insoddisfatto” e di opporsi fermamente alle restrizioni. Su questa linea ha invitato Washington a trattare equamente le aziende cinesi e a ritirare le misure adottate per ristabilire relazioni bilaterali più stabili e costruttive.

FCC votes to toughen rules in bid to better protect undersea cables The Federal Communications Commission (FCC) on Thursday voted to beef up oversight of undersea submarine cables that host nearly all internet traffic, saying they will block Chinese firms from selling related products and will allow the agency to quickly greenlight approvals for tech firms headquartered in the U.S. which meet certain conditions. In an unprecedented move, the FCC also said it plans to mandate that owners and operators of submarine line terminal equipment (SLTE) be licensed. SLTE plays the most important role in the submarine cable system by connecting it to U.S. terrestrial facilities. The SLTE licensing requirement will ensure FCC oversight of one of the most vulnerable parts of the submarine cable networks, according to an FCC press release. Big tech has long sought a more streamlined process and faster turnaround to lay additional cable systems that are needed as surging internet traffic and the emergence of artificial intelligence demands more infrastructure. The new rules will exempt cable operators who can certify high security standards, have operated cables “without incident” and agree to ongoing oversight from having to undergo an intensive review for approval, according to an FCC press release. Operators exempt from the intensive review process also have to agree to not use potentially insecure foreign equipment, the agency said. The revamped regulations will also safeguard the cables by updating protections that “address vulnerabilities related to principal equipment, third-party service providers and other areas of concern,” the press release said. The FCC has been working to bolster the security of submarine internet cables for some time and last year blocked companies it had identified as risks to national security from supplying equipment. Those firms were Huawei, China Telecom, ZTE and China Mobile. The new rules will go much further by also banning equipment from anywhere in China or any other country deemed a foreign adversary. The FCC first announced it planned to bar Chinese firms from the market in July 2025. At the time, the FCC said the ban would be one element of a suite of policies meant to fuel the expansion of submarine telecommunications infrastructure while beefing up firewalls to guard against “foreign adversary threats.” “We have seen submarine cable infrastructure threatened in recent years by foreign adversaries, like China,” Chairman Brendan Carr said in a statement at the time. “We are therefore taking action here to guard our submarine cables against foreign adversary ownership, and access as well as cyber and physical threats.” Spying is the biggest threat posed by China’s involvement in the undersea cable business, officials have said. The U.S. government is still grappling with the Salt Typhoon hacks which continue to be a problem more than a year after they first came to light in late 2024. Taiwan also has said that China threatens its undersea cables. In the Baltic Sea region, bad actors have physically damaged cables several times. “Undersea cables are the unsung heroes of the global internet — carrying up to 99% of global internet traffic,” FCC Chair Brandon Carr said in a Thursday statement. Carr said that building cables faster will make the internet more reliable and faster, especially given that AI is placing huge demands on connectivity. But his focus is on better protecting the highly vulnerable system, he said. “Submarine cables face greater threats than ever: Bad actors seek access to the sensitive data and communications that run on these cables, and threats from cyber or physical disruptions only grow,” the statement said. In April, the British government revealed that it had discovered what it called a secret Russia submarine operation encircling cables and pipelines in the ocean near the northern half of the U.K. A Russian attack submarine and other vessels were involved in what the UK Ministry of Defence called “nefarious activity over critical undersea infrastructure elsewhere.” After realizing that the UK had spotted its vessels, the Russians withdrew, officials have said. Suzanne Smalley is a reporter covering digital privacy, surveillance technologies and cybersecurity policy for The Record. She was previously a cybersecurity reporter at CyberScoop. Earlier in her career Suzanne covered the Boston Police Department for the Boston Globe and two presidential campaign cycles for Newsweek. She lives in Washington with her husband and three children.

Il lock-in tecnologico è la condizione in cui un’organizzazione diventa così dipendente da un vendor specifico – per ragioni tecniche, contrattuali, operative o normative – da rendere la transizione verso un’alternativa eccessivamente costosa, rischiosa o temporalmente impraticabile. Non è, di per sé, una patologia in quanto un certo grado di dipendenza dai propri fornitori è fisiologico in qualsiasi ecosistema tecnologico complesso. Semmai, il problema emerge quando questa stessa dipendenza raggiunge un livello tale da compromettere la capacità dell’organizzazione di prendere decisioni autonome sul proprio stack IT, di rispondere a variazioni del mercato o di gestire una crisi del fornitore senza subire interruzioni operative significative. Indice degli argomenti Nel contesto della cyber security, il lock-in tecnologico introduce una dimensione di rischio specifica che va oltre la semplice dipendenza commerciale. Un’organizzazione profondamente dipendente da un singolo vendor per funzioni di sicurezza critiche, come possono essere un EDR, un SIEM o una piattaforma di identity management, è esposta a un rischio che combina la concentrazione operativa con la superficie di attacco: se quel vendor viene compromesso (come nel caso CrowdStrike del 2024), non solo il servizio si interrompe, ma il sistema di difesa stesso diventa il vettore del problema. Dunque, la diversificazione non è solo una scelta commerciale ma una misura di resilienza. Per i soggetti NIS2 e DORA, il rischio di lock-in ha una dimensione normativa esplicita: DORA identifica la concentrazione verso un singolo provider ICT come rischio sistemico da presidiare e impone alle entità finanziarie di valutare e documentare le dipendenze critiche. NIS2, più in generale, richiede che le misure di sicurezza includano la continuità operativa, un obiettivo difficilmente raggiungibile in presenza di dipendenze non presidiate da adeguate strategie di uscita. La pianificazione della reversibilità non è, quindi, un’opzione avanzata per le organizzazioni più mature: è un requisito di governance che le normative stanno progressivamente rendendo obbligatorio. Quando si parla di forniture IT si possono quindi identificare quattro differenti forme di lock-in tecnologico Il lock-in contrattuale è la forma più immediata e, paradossalmente, la più facilmente prevenibile se affrontata nella fase di negoziazione. Si manifesta attraverso clausole che rendono la cessazione del rapporto commerciale eccessivamente onerosa: penali di uscita anticipata calcolate sull’intero valore residuo del contratto, rinnovi automatici con finestre di disdetta strette, limitazioni al diritto di portabilità dei dati, periodi minimi contrattuali pluriennali senza clausole di revisione. Nei contratti con i grandi hyperscaler e con i vendor di software Enterprise, queste clausole sono spesso la norma, non l’eccezione. La difesa contrattuale contro questo tipo di lock-in richiede attenzione in fase di negoziazione: clausole di exit esplicite con termini e costi predefiniti; diritto di portabilità dei dati in formato standard senza costi aggiuntivi; finestre di disdetta ragionevoli (90 giorni è uno standard accettabile per la maggior parte dei servizi); limitazione delle penali di uscita anticipata a importi proporzionati e non punitivi. Per i contratti con vendor che gestiscono funzioni critiche, è opportuno negoziare anche obblighi di supporto alla transizione: un periodo di affiancamento post-contratto durante il quale il vendor fornisce accesso ai dati e supporto tecnico alla migrazione. Il lock-in tecnico è la forma più pervasiva e difficile da rimuovere una volta instauratasi. Si manifesta attraverso la dipendenza da formati proprietari (e quindi, dati che non possono essere esportati in formati standard senza perdita di informazioni o senza strumenti specifici del vendor) e da API proprietarie che richiedono riscrittura significativa delle integrazioni per migrare verso un’alternativa. Un CRM che archivia i dati in un formato interno non esportabile in CSV o JSON standard, un SIEM che produce log in un formato proprietario non leggibile da altri strumenti, una piattaforma cloud che offre servizi managed senza equivalenti standard: questi sono esempi concreti di lock-in tecnico che si accumula silenziosamente nel tempo, spesso senza che l’organizzazione ne sia consapevole fino al momento in cui cerca di uscire. La prevenzione del lock-in tecnico richiede una strategia di architettura deliberata: privilegiare standard aperti e interoperabili nelle scelte tecnologiche, evitare dipendenze da servizi proprietari privi di alternative equivalenti, mantenere layer di astrazione (API gateway, middleware) che isolino il business logic dalle specificità del vendor sottostante. Per le piattaforme cloud, l’adozione di strumenti di Infrastructure as Code (Terraform, Pulumi) con provider-agnostic configuration riduce significativamente il costo di una eventuale migrazione verso un hyperscaler alternativo. Il lock-in operativo è il meno visibile dei quattro e spesso il più costoso da risolvere. Si accumula nel tempo attraverso la specializzazione del personale su tecnologie proprietarie specifiche: team IT che conoscono profondamente una piattaforma ma non hanno esperienza con le alternative, processi operativi costruiti attorno alle specificità di un vendor, procedure di troubleshooting e documentazione che assumono implicitamente la presenza di quel vendor. Quando l’organizzazione deve cambiare, si trova a dover affrontare non solo la migrazione tecnica, ma anche un gap di competenze che richiede tempo e risorse significative per essere colmato. La gestione del lock-in operativo richiede un approccio proattivo alla formazione e alla documentazione: mantenere competenze interne che non dipendano esclusivamente da un singolo vendor; costruire processi operativi che siano il più possibile vendor-agnostic; documentare le configurazioni e le procedure in modo da renderle trasferibili. Per le competenze critiche, è buona pratica mantenere almeno una risorsa interna con conoscenza dell’alternativa principale, anche se non la si utilizza attivamente, per garantire la capacità di valutazione in caso di necessità di transizione. Il lock-in normativo è una categoria specifica dei settori regolamentati: si verifica quando la scelta di un vendor crea dipendenze che sono difficili da sciogliere per ragioni di conformità. Un sistema di archiviazione che garantisce la conservazione dei log per 10 anni secondo requisiti normativi specifici, una piattaforma di firma elettronica certificata secondo standard nazionali, un sistema di gestione dei dati sanitari conforme a requisiti specifici di settore: migrare da questi sistemi richiede non solo la migrazione tecnica dei dati, ma la verifica che il nuovo vendor garantisca la stessa conformità normativa, spesso un processo lungo e costoso. Per le organizzazioni nei settori critici NIS2, il lock-in normativo può manifestarsi anche attraverso la data residency: un vendor che garantisce la residenza dei dati in specifiche regioni geografiche richieste dalla normativa applicabile crea una dipendenza che limita le alternative disponibili. La prevenzione richiede di verificare, in fase di selezione, che esistano almeno due vendor alternativi in grado di soddisfare i requisiti normativi applicabili — non uno solo. Riconoscere il lock-in è necessario, ma non sufficiente: per prendere decisioni informate, l’organizzazione ha bisogno di uno strumento che consenta di misurarlo in modo coerente e comparabile tra vendor diversi. Il Vendor Dependency Index (VDI) è un framework di valutazione strutturato in sei dimensioni, ciascuna con un peso relativo proporzionale al suo impatto sulla capacità di transizione. Il risultato è un punteggio da 1 (dipendenza minima, transizione agevole) a 5 (lock-in critico, transizione estremamente costosa o impraticabile nel breve termine). Il VDI non è uno strumento assoluto, ma uno strumento di confronto e prioritizzazione. Il suo valore principale è rendere visibile e quantificabile un rischio che altrimenti rimane implicito nelle valutazioni soggettive dei team IT. Un VDI superiore a 3,5 per un vendor che gestisce funzioni critiche deve attivare un piano di mitigazione; un VDI superiore a 4,5 rappresenta una dipendenza che richiede attenzione immediata del management. La pianificazione della reversibilità è spesso percepita come un esercizio accademico, utile in teoria ma difficilmente necessario nella pratica quotidiana. Gli scenari di crisi che seguono hanno lo scopo di ancorare questa percezione alla realtà: sono casi che si sono verificati, si verificano regolarmente, e che le organizzazioni prive di una exit strategy hanno affrontato in condizioni di estrema difficoltà operativa. Un vendor IT che gestisce infrastrutture critiche entra in procedura fallimentare. Il servizio si interrompe con preavviso di 30-60 giorni. I dati sono bloccati fino alla nomina del curatore. L’organizzazione deve migrare in emergenza verso un’alternativa senza il supporto del vendor. Casi reali: il fallimento di diversi provider cloud di secondo livello negli anni 2015-2020 ha lasciato centinaia di clienti senza accesso ai propri dati per settimane. La lezione: la solidità finanziaria del vendor è un elemento del rischio lock-in, non solo un indicatore commerciale. Un VDI elevato su un vendor con indicatori finanziari in deterioramento è un segnale di allerta critico. Un vendor critico viene acquisito da un concorrente diretto dell’organizzazione cliente, o da un soggetto con interessi in conflitto. Il nuovo proprietario modifica le condizioni contrattuali, aumenta i prezzi in modo significativo, o discontinua il prodotto. L’organizzazione si trova vincolata a un contratto con un vendor che non avrebbe mai scelto. Casi reali: l’acquisizione di VMware da parte di Broadcom (2023) e la successiva ristrutturazione delle licenze ha costretto migliaia di organizzazioni a rivalutare la propria dipendenza dalla piattaforma di virtualizzazione, con costi di migrazione non previsti. La lezione: il vendor che si acquista oggi potrebbe non essere lo stesso tra due anni. Un vendor viene sanzionato da un’autorità regolatoria (ACN, Garante privacy, autorità di vigilanza finanziaria) o incluso in liste di restrizione per ragioni di sicurezza nazionale. L’organizzazione deve cessare il rapporto entro tempi imposti dalla normativa, indipendentemente dal costo e dalla complessità della migrazione. Casi reali: le restrizioni imposte in diversi paesi europei e negli USA a vendor di telecomunicazioni e software di origine cinese (Huawei, ZTE, Kaspersky) hanno costretto le organizzazioni nei settori critici a migrazioni urgenti. La lezione che ne possiamo trarre è che il rischio geopolitico è un componente del rischio lock-in che deve essere valutato esplicitamente per i vendor con sede o interessi in paesi ad alto rischio. Sviluppare un piano di transizione verso provider alternativi evita l’interruzione operativa del business in caso di crisi del fornitore. La pianificazione della reversibilità è un pilastro del Vendor Risk Management moderno per mitigare i rischi cyber: la capacità di uscire da una relazione con un vendor critico in tempi ragionevoli e senza interruzioni operative non è una misura difensiva straordinaria, ma un requisito di resilienza che le normative NIS2 e DORA stanno progressivamente codificando. La reversibilità non significa necessariamente cambiare vendor frequentemente o mantenere architetture ridondanti costose: significa avere la capacità di farlo quando necessario, in tempi accettabili, con un costo proporzionato. Questa capacità si costruisce nel tempo attraverso scelte architetturali deliberate, clausole contrattuali adeguate e un monitoraggio continuo del grado di dipendenza. Un’organizzazione che ha investito nella portabilità dei dati, nell’interoperabilità dei sistemi e nella formazione del personale su più piattaforme è intrinsecamente più resiliente e più conforme ai requisiti normativi di una che ha ottimizzato esclusivamente sull’integrazione con un singolo vendor. La portabilità dei dati è il prerequisito tecnico di qualsiasi strategia di exit. Senza la capacità di estrarre i propri dati in formato standard e completo, qualsiasi piano di migrazione è teorico. Eppure, nella pratica, molte organizzazioni scoprono i limiti alla portabilità dei dati solo quando tentano di effettuare la migrazione: formati di esportazione incompleti, API con rate limit che rendono l’estrazione di grandi volumi impraticabile in tempi ragionevoli, costi di egress per il trasferimento dei dati fuori dalla piattaforma del vendor. La difesa contro questo rischio deve essere contrattuale e tecnica insieme. Sul piano contrattuale: clausole esplicite che garantiscono l’esportazione completa dei dati in formati aperti e documentati, senza costi aggiuntivi, entro termini definiti dalla richiesta di cessazione. Sul piano tecnico: test periodici di esportazione dei dati critici (non solo la verifica che la funzione esista, ma la verifica che funzioni correttamente con i volumi reali) e documentazione aggiornata del formato dei dati esportati per facilitare l’importazione nel sistema del vendor alternativo. L’adozione di standard aperti e di architetture interoperabili è la strategia di prevenzione del lock-in tecnico più efficace a lungo termine. Nel contesto cloud, questo si traduce nella preferenza per servizi che implementano API standard (REST, OpenAPI, GraphQL) rispetto a API proprietarie, nell’utilizzo di formati di dati aperti (JSON, Parquet, CSV) rispetto a formati binari proprietari, e nell’adozione di strumenti di orchestrazione e provisioning che supportano nativamente più provider (Kubernetes per i container, Terraform per l’Infrastructure as Code). Per le piattaforme di sicurezza, l’interoperabilità è garantita dall’adozione di standard come STIX/TAXII per la condivisione di threat intelligence, OpenC2 per l’automazione della risposta, e OCSF (Open Cybersecurity Schema Framework) per la normalizzazione dei log di sicurezza. L’adozione di questi standard non è solo una scelta tecnica: è una misura di resilienza che riduce il costo di sostituzione di un componente della stack di sicurezza e facilita l’integrazione con nuovi vendor. La strategia multi-vendor, ossia distribuire le funzioni critiche tra vendor diversi per ridurre la concentrazione del rischio, è la risposta più diretta al lock-in tecnologico, ma anche quella con i costi operativi più elevati. Gestire più vendor per la stessa funzione introduce complessità: interfacce diverse, procedure operative distinte, costi di formazione moltiplicati, potenziali problemi di integrazione. La scelta tra vendor singolo e multi-vendor non è quindi una scelta tra sicurezza e comodità: è una valutazione del trade-off tra rischio di concentrazione e costo operativo della diversificazione. Un approccio pragmatico prevede di applicare la strategia multi-vendor selettivamente, in funzione della criticità della funzione e del VDI del vendor primario: per le funzioni essenziali con VDI elevato, la duplicazione è giustificata e raccomandabile; per le funzioni con VDI basso e alternative disponibili in tempi ragionevoli, la complessità aggiuntiva di un secondo vendor non è necessariamente giustificata. Il caso degli hyperscaler è emblematico: una strategia multi-cloud attiva (workload distribuiti tra AWS, Azure e GCP) riduce il lock-in ma aumenta significativamente la complessità operativa; una strategia cloud-agnostic basata su Kubernetes e Terraform mantiene la portabilità senza la complessità della gestione multi-cloud attiva. La exit strategy inizia dal contratto. Le clausole di reversibilità, spesso trascurate nella negoziazione, quando l’attenzione è concentrata sulla funzionalità e sul prezzo, sono lo strumento che garantisce all’organizzazione il diritto e la capacità pratica di uscire dalla relazione con il vendor in condizioni controllate. Gli elementi essenziali di una clausola di reversibilità efficace coprono quattro aree: il diritto di portabilità (esportazione completa dei dati in formato standard, senza costi aggiuntivi); il supporto alla transizione (periodo di affiancamento post-contratto, tipicamente 90-180 giorni, durante il quale il vendor continua a fornire accesso ai dati e supporto tecnico alla migrazione); la cancellazione certificata (distruzione sicura dei dati residui con certificazione documentata); la continuità del servizio (garanzia che il servizio continui a funzionare normalmente durante il periodo di transizione, senza degradazione delle performance o delle funzionalità). Il piano di migrazione è il documento operativo che traduce la strategia di exit in un progetto concreto con fasi, responsabilità, risorse e tempistiche. Deve essere preparato con anticipo: idealmente al momento dell’onboarding del vendor, non quando la migrazione diventa urgente, e aggiornato periodicamente per riflettere l’evoluzione dell’ambiente tecnologico e della relazione con il vendor. Un piano di migrazione mai aggiornato è quasi inutile nel momento del bisogno. Le fasi tipiche di un piano di migrazione da un vendor critico sono: assessment dell’ambiente attuale (inventario di dati, integrazioni, dipendenze, competenze); selezione del vendor alternativo (con processo di valutazione formale che include security assessment e VDI preliminare); progettazione dell’architettura target; migrazione pilota su ambiente non produttivo; migrazione progressiva degli ambienti produttivi con rollback plan; verifica funzionale e di sicurezza; dismissione dell’ambiente del vendor precedente con cancellazione certificata dei dati. Per i sistemi critici, la fase di coesistenza in cui entrambi i vendor operano in parallelo è raccomandata anche quando aumenta il costo a breve termine: garantisce la continuità operativa durante la transizione e riduce il rischio di interruzione. Il lock-in nei servizi cloud degli hyperscaler (AWS, Microsoft Azure, Google Cloud Platform) merita una trattazione specifica per la sua pervasività e per la complessità delle dipendenze che può generare. I grandi provider cloud offrono ecosistemi di servizi managed estremamente ricchi e integrati: database proprietari (DynamoDB, Cosmos DB, BigQuery), servizi serverless (Lambda, Azure Functions, Cloud Run), strumenti di ML/AI nativi, servizi di sicurezza integrati. L’adozione di questi servizi genera produttività immediata e integrazione nativa e il lock-in tecnico che cresce con ogni servizio managed aggiuntivo adottato. La risposta non è evitare i servizi managed degli hyperscaler, sarebbe come rinunciare a vantaggi competitivi reali, ma adottarli con consapevolezza del lock-in che generano. Una strategia cloud pragmatica distingue tra i servizi che sono accettabile avere in lock-in (servizi non critici, facilmente riproducibili, con basso VDI) e quelli per cui la portabilità deve essere preservata (dati critici, funzioni essenziali, sistemi con compliance normativa specifica). Per questi ultimi, l’investimento in architetture cloud-agnostic (container-based, IaC-managed, con storage in formati aperti) è un investimento in resilienza, non solo in flessibilità tecnica. Per le organizzazioni che operano in ambienti ibridi (infrastruttura on-premise combinata con servizi cloud) il rischio di lock-in si manifesta anche attraverso la dipendenza dagli strumenti di gestione dell’ambiente ibrido stesso: soluzioni come VMware (ora Broadcom), Azure Arc, AWS Outposts. L’acquisizione di VMware da parte di Broadcom e la conseguente ristrutturazione del modello di licensing è diventata il caso di scuola del lock-in negli ambienti ibridi: migliaia di organizzazioni si sono trovate a dover rivalutare la propria infrastruttura di virtualizzazione in condizioni di urgenza, con costi non previsti e alternative tecnicamente complesse da implementare in tempi brevi.

The security questions around Chinese AI coding models in U.S. software Software developers across the United States are using AI models built in China to write, debug, and review code, drawn by prices below those of American alternatives. These models carry risks for the security of American software, according to a report from Booz Allen Hamilton, which tested how the models respond when the user appears to work for the U.S. government. What the testing covered In May 2026, Booz Allen ran more than 2,800 trials against five frontier code-generation models on its internal test platform. Four came from China: Qwen3-Coder from Alibaba, MiniMax M2.5, Kimi K2.5 from Moonshot, and DeepSeek V4-Pro. One, Claude Opus 4.6, came from the United States. The trials combined tasks such as writing, auditing, and modifying code with personas that posed as developers for a U.S. defense contractor, a Chinese entity, and a Russian defense contractor. Probes drew on Navy, Taiwan air-defense, and Defense Industrial Base intelligence prompts, and the trials ran through both cloud APIs and locally hosted copies of the models. Together the five models generated about 460,000 lines of code. The published findings cover English-language prompts, and analysis of other languages continues. Vulnerability findings Three of the four Chinese models produced code with more security flaws when the prompt described the user as working for the U.S. government, according to the report. One test asked each model to build an internal admin console, once for a generic user and once for a U.S. government agency. Qwen3-Coder showed the largest change, adding roughly 130 percent more vulnerabilities under the government persona than under the neutral one. MiniMax M2.5 and DeepSeek V4-Pro showed smaller increases. Claude Opus 4.6 produced more secure code under the same government persona. Kimi K2.5 stood apart from the other Chinese models and recorded the lowest aggregate vulnerability score in the test, below the American model. Booz Allen states the flaws often lay beneath code that looked correct, and that its evidence stops short of showing backdoors or deliberate insertion. The company calls the results a snapshot from a single experiment and ties the behavior to how the models are built, including training data governed by Chinese information controls and methods used to steer model responses. Refusals on politically sensitive topics All four Chinese models declined to write code for tasks touching subjects Beijing treats as off-limits. Mean refusal rates ran from 8 percent for DeepSeek V4-Pro to 80 percent for MiniMax M2.5, with Qwen3-Coder at 54 percent and Kimi K2.5 at 32 percent. Claude Opus 4.6 refused 2 percent of the same tasks. MiniMax M2.5 repeatedly refused requests to security-audit code for a U.S. weapons system. Topics tied to Taiwan independence and the Hong Kong democracy movement drew the strongest refusals. Chinese law requires AI models, their outputs, and their training data to reflect “Core Socialist Values.” Policy proposals Researchers recommend that the U.S. government default-block Chinese and other untrusted AI models from government and critical infrastructure use, pointing to existing supply chain risk authorities as a basis. The report ties its proposals to President Trump’s Winning the AI Race plan and asks Congress to pass legislation that keeps untrusted models out of sensitive settings. The U.S. Department of War and some agencies have already barred Chinese AI models from government systems for employees and contractors. China applies a mirror policy: the Cyberspace Administration of China must approve every generative AI service available in the country, and no U.S. frontier model holds that approval, leaving OpenAI and Anthropic products outside the lawful Chinese market. The report draws a parallel to Huawei and ZTE, whose telecommunications equipment prompted a U.S. removal effort that reached costs in the billions and remains underway in 2026. Qwen3-Coder, the model that performed worst in the testing, already ships inside several widely used software development tools. Booz Allen, which sells AI evaluation services and government technology work, argues that acting on Chinese coding models now would cost far less than removing them later.

Due gli obiettivi, tagliare quote di mercato alle aziende cinesi e nel contempo valorizzare una corsia preferenziale per quelle americane. La Federal Communications Commission (FCC) degli Usa ha annunciato un piano per rafforzare significativamente la supervisione del Governo dei cavi sottomarini per telecomunicazioni. Da queste infrastrutture transita infatti circa il 99% del traffico Internet globale. L’obiettivo è quello di creare un canale privilegiato per le aziende statunitensi, velocizzando le autorizzazioni e limitando ulteriormente la presenza di tecnologie cinesi nelle reti strategiche. Per la prima volta, sarà introdotto un sistema di licenze obbligatorie per gli operatori dei sistemi terminali dei cavi sottomarini. Si tratta di quei dispositivi che collegano i cavi oceanici alle infrastrutture terrestri. La misura, sottolinea la Reuters, “potrebbe favorire grandi gruppi tecnologici americani come Meta, proprietaria di Facebook e Google, controllata da Alphabet“. Questi ultimi potrebbero ottenere più rapidamente le autorizzazioni necessarie per realizzare e gestire nuovi sistemi che sostengano la crescente domanda globale di traffico dati. Sicurezza Nazionale al centro del piano Con l’esplosione della domanda globale di connettività e l’importanza strategica sempre maggiore delle reti sottomarine, l’iniziativa della Commissione ha una forte valenza geo-economica. Il progetto della FCC rappresenta infatti un ulteriore passo nella crescente competizione tecnologica e geopolitica tra Usa e Cina. Si consideri, per altro, che negli ultimi tre anni l’Asia è stata la principale area di sviluppo infrastrutturale, con circa 2 miliardi di dollari investiti in nuovi cavi, seguita dalle rotte transpacifiche con 1,7 miliardi. Per accedere alla corsia preferenziale prevista dalla FCC, “gli operatori dovranno adottare rigorosi standard di sicurezza, finalizzati a prevenire attività di spionaggio e altri incidenti informatici“. Le aziende saranno inoltre tenute a monitorare costantemente la conformità alle normative sulla Sicurezza Nazionale e sulla protezione dei dati. Un altro requisito fondamentale sarà l’impegno a non utilizzare apparecchiature straniere considerate potenziali rischi per la sicurezza delle infrastrutture critiche. Preoccupazioni per i sabotaggi Il tema, ovviamente, non ha soltanto una dimensione cibernetica ma anche cinetica, con i rischi connessi a danneggiamenti e sabotaggi. Ad aprile, il Presidente della Commissione Esteri del Senato americano, Jim Risch, aveva in tal senso chiesto un rafforzamento delle iniziative internazionali per proteggere queste infrastrutture strategiche. “Per fermare i sabotaggi sottomarini dobbiamo denunciarli apertamente quando avvengono e identificare pubblicamente i responsabili, quando possibile”, aveva dichiarato Risch. “Serve inoltre uno sforzo internazionale coordinato per aumentare la resilienza delle infrastrutture sottomarine e ridurre l’impatto di eventuali attacchi“. Nuove restrizioni contro i fornitori cinesi Le ulteriori limitazioni contro la Cina riprendono alcuni obblighi degli scorsi anni. Già nel 2024 la FCC aveva vietato l’utilizzo, negli impianti dei cavi sottomarini, di sistemi e servizi forniti da aziende presenti “nella lista delle società ritenute una minaccia per la sicurezza nazionale degli Usa“. Tra le aziende già colpite dal divieto figurano Huawei, ZTE, China Telecom e China Mobile. Le nuove regole potrebbero arrivare ad impedire l’impiego di componenti provenienti non solo dalla Cina. E con la Repubblica asiatica anche “da qualsiasi altro Paese considerato un avversario strategico di Washington“.

Introduction Mexico is one of the host countries for the 2026 FIFA World Cup, with matches to be played in three major cities: Mexico City, Monterrey, and Guadalajara. These locations are expected to see a large influx of international visitors, increasing the potential security risks. Many of those risks arise from users connecting to public wireless networks. To better understand the wireless environments that visitors may encounter, we at Kaspersky GReAT conducted a wardriving assessment in the three host cities. The aim of the study was to analyze characteristics, deployment patterns, security configurations and potential exposure risks of public Wi-Fi infrastructure in urban wireless environments. The information collected during the assessment was used exclusively for passive observation and infrastructure analysis. No attempts were made to authenticate, intercept communications, exploit systems or interact with the detected wireless networks beyond the publicly broadcast management information. During processing of the collected data, one step involved filtering out networks belonging to cars or cell phones categorized as mobile hotspots because they do not represent networks that can be considered part of the assessment. Research scope The cities included in the study have high population density and extensive wireless infrastructure deployments. We chose areas with the most prominent wireless network activity and highly concentrated public access points. We carried out wardriving research in Monterrey back in 2008, but the city’s hotspot landscape has changed since then. We chose the following analysis areas for each of the cities: Mexico City: México City Stadium, Mexico City International Airport, Zócalo, Paseo de la Reforma, Colonia Roma, La Condesa, Polanco, and Coyoacán. Guadalajara: Guadalajara Stadium, Guadalajara International Airport, the city center, Zapopan, Providencia, Avenida Chapultepec, Colonia Americana, Tlaquepaque, and the area around Andares. Monterrey: Monterrey Stadium, Monterrey International Airport, Fundidora Park, Cintermex Monterrey, the downtown area, Barrio Antiguo, MacroPlaza, and the San Pedro financial district. The wireless information was collected using passive wireless reconnaissance techniques. The collected information included: SSID analysis and information exposure, including BSSID-derived SSIDs Default router configurations and ISP deployments Frequency and signal characteristics Channel congestion and spectrum usage Wireless security configurations, including: - Open and insecure wireless networks - WPS-enabled networks - Secure networks (WPA2/WPA3) with WPS enabled We performed a wireless infrastructure analysis in Mexico City, Guadalajara, and Monterrey. We drove through the areas surrounding the World Cup stadiums, tourist zones, and other places where fan concentrations are likely to be largest. Our goal was to evaluate the security status, deployment characteristics and operational exposure of detected wireless networks. In total, we recorded 84,588 signals with 69,473 unique Service Set Identifiers (SSIDs) in busy locations and World Cup zones across the three cities. Mexico City accounted for 61.4% of the signals, Guadalajara for 23.6%, and Monterrey for 14.8%. Approximately 82% of the signals had a single SSID (81.9%, 81.34%, and 84% respectively). Notably, they all operate under the IEEE 802.11 standard protocol. Particular attention was given to identifying standard deployment patterns, legacy configurations, default vendor settings and information disclosure through publicly broadcast wireless identifiers. The following sections present the results that were obtained by analyzing wireless infrastructure across the three locations. Our findings SSID analysis and information exposure SSID analysis was conducted to evaluate naming conventions, deployment standardization and potential information exposure. Only a few networks (0.0047%) have an invisible SSID, meaning the names of these networks are not broadcast. Some users prefer to hide the SSID for various reasons, such as the network’s purpose, the profile of its users, internal policies, etc. In contrast, the rest of the networks maintained active SSID broadcasting. SSID structures may unintentionally disclose operational details about internet service providers (ISPs), device manufacturers, deployment practices, organizational ownership or user identity. The repeated presence of default SSID naming patterns across the analyzed locations indicates a significant degree of infrastructure homogeneity and reuse of default wireless configurations. It may also facilitate passive infrastructure profiling by revealing standard characteristics in use. Approximately 34% of the detected networks retained the default SSID naming conventions provided by the manufacturer or ISP, while 66% used customized identifiers. Distribution of SSID naming conventions (download) Several recurring SSID naming conventions associated with ISP-provided deployments were identified in the three cities. The most frequently observed patterns include identifiers such as “Club_Totalplay_WiFi”, “izzi WiFi”, and “Megacable WiFi”, which suggests extensive standardization of wireless infrastructure deployment. Additionally, we observed distinctive location-specific SSIDs in each area of analysis, such as “XXXX-Internet para Todos-CDMX” or “RED JALISCO”. Most frequently observed SSID patterns (download) Sequential SSID naming structures were also identified during the analysis. Patterns such as “INFINITUMXX” and “IZZI-XX” suggest automated ISP deployment and large-scale deployment strategies. We identified 33 unique sequential naming structures among the 137 sequential SSIDs in total, representing approximately 0.16% of the detected wireless networks. The following graph shows the top five sequential SSID patterns found in the largest number of networks: Five most frequently observed sequential patterns (download) Several customized SSIDs contained personal or organizational identifiers, including family names, professions, addresses or internal department references. Although personalized SSIDs may simplify local network identification for users, they may also expose sensitive information that could be useful for social engineering, physical targeting, or organizational profiling. BSSID-derived SSID During the analysis, multiple networks were identified that used the physical MAC address of a Wi-Fi access point (BSSID) as the visible SSID. This practice exposes hardware-level information that could facilitate vendor fingerprinting and targeted reconnaissance activities. The organizationally unique identifier (OUI) contained in the first bytes of the BSSID identifies the equipment manufacturer. Threat actors can correlate exposed manufacturers with device-specific vulnerabilities. BSSID-derived SSID by city (download) Notably, we found that more than 30% of networks in all three cities reuse the MAC address as the SSID. Default router configurations and ISP deployments We performed wireless infrastructure profiling to identify the most common wireless equipment manufacturers and ISP deployments across the three locations. Large-scale ISP deployments frequently use standardized wireless configurations and vendor-specific hardware platforms. Identifying dominant manufacturers and ISP naming conventions can provide insight into infrastructure and deployment practices facilitating the mapping of standardized attack surfaces. The following figure shows the distribution of the most commonly used manufacturers. Most frequently observed wireless equipment manufacturers (download) The manufacturer analysis revealed a strong concentration of wireless infrastructure among a limited number of vendors. Across the three locations, Huawei Technologies, MediaTek-based devices, and other manufacturers’ equipment that is distributed through ISP channels represented a significant portion of the detected deployments. Mexico City had the most diverse infrastructure, while Monterrey and Guadalajara had a greater concentration of wireless equipment known as SOHO (small office/home office) or residential-grade hardware. The widespread presence of standard vendor platforms may facilitate infrastructure fingerprinting and large-scale targeting of known device-specific vulnerabilities. Most frequently observed wireless equipment manufacturers across the three cities (download) ISP deployments frequently exhibited standardized configuration patterns and recurring manufacturer identifiers. Our ISP deployment analysis revealed a high concentration of access points associated with major residential internet providers. Deployments associated with Infinitum, Totalplay and Izzi represented a substantial portion of the detected wireless infrastructure across all locations. These findings suggest a high degree of deployment standardization across networks associated with major residential internet providers. This observation was supported by the repeated presence of ISP-associated SSIDs such as “Infinitum”, “Totalplay”, and “Izzi”, combined with manufacturer identifiers frequently associated with consumer equipment, including Huawei, ZTE and other residential wireless equipment vendors. It is important to note that, for this analysis, ISPs were primarily inferred from SSID naming conventions and manufacturer fingerprint data. A significant portion of the detected wireless networks fell into the “UNKNOWN/CUSTOM” category. This classification includes custom hotspots and networks whose naming conventions did not expose identifiable ISP-associated patterns. The findings suggest that many users and organizations (as we saw previously, approximately 66%) use custom network names, limiting direct provider attribution. The following figure illustrates the distribution of ISP-associated wireless deployments in general. Most frequently observed ISPs (download) To better understand this distribution, we took the most frequently observed ISPs by city. Most frequently observed ISPs across the three cities (download) Frequency and signal characteristics We also analyzed wireless signal characteristics to evaluate coverage quality, signal strength, and frequency band utilization in the three cities. In dense urban environments, signal quality and frequency spectrum distribution can affect wireless reliability, client connectivity, roaming performance, and overall network efficiency. Signal quality analysis revealed that a substantial portion of the detected access points operated under weak or very weak signal conditions. Monterrey had the highest percentage of very weak signals, with approximately 50% of detected deployments. Similar patterns were observed in Guadalajara and Mexico City, suggesting high-density wireless environments with overlapping coverage areas. Only a limited percentage of networks were classified within the very good or excellent signal categories across the three locations. Signal quality distribution by city (download) Signal stability analysis revealed that most detected wireless deployments exhibited stable beacon transmission behavior. More than 96% of the detected access points across all locations were classified as stable, while only a small percentage exhibited unstable or indeterminate signal behavior. These findings imply that the majority of the wireless infrastructure observed during the assessment corresponded to permanently deployed access points rather than transient or intermittent wireless devices. Signal stability status (download) Frequency band analysis revealed the strong prevalence of 2.4 GHz wireless deployments across the three locations. More than 95% of the detected wireless networks operated within the 2.4 GHz spectrum, while only a small percentage of deployments were classified under the unknown or non-standard frequency categories. This uneven distribution reflects the continued prevalence of legacy-compatible wireless infrastructure and SOHO deployments. Frequency band utilization (download) These findings are consistent with dense urban wireless environments with large numbers of access points in restricted spectrum allocations. Channel congestion and spectrum usage Next, we analyzed wireless channel utilization to evaluate frequency spectrum congestion and channel allocation patterns across the three cities. Our analysis focused on the 2.4 GHz spectrum, where channel overlap and high access point density commonly produce interference and degraded wireless performance. In densely populated wireless environments, an excessive concentration of access points on a limited number of channels can lead to co-channel interference, packet collisions, reduced throughput, and degraded network stability. Spectrum congestion analysis revealed that the 2.4 GHz band consistently experienced elevated congestion levels across the three cities. The detailed results showed a strong concentration of deployments on channels 11, 6 and 1, which are traditionally recommended as non-overlapping channels within the 2.4 GHz spectrum. Channel 11 was the most utilized channel, accounting for 25.2% of the detected access points, followed by channel 6 with 22.5% and channel 1 with 19.5%. This distribution indicates that most wireless deployments adhere to standard channel allocation practices for 2.4 GHz Wi-Fi environments. The following figure illustrates the overall distribution of the most frequently utilized wireless channels. Most utilized wireless channels (download) To further assess wireless spectrum saturation, the detected access points were grouped according to channel congestion levels: VERY_HIGH, HIGH, UNKNOWN, MEDIUM, LOW and NONE. Mexico City had the highest proportion of heavily congested wireless channels, with approximately 7% of detected access points operating under HIGH congestion conditions. Guadalajara followed with nearly 5% of deployments categorized as HIGH congestion, while Monterrey had the lowest percentage at approximately 3.29%. These findings suggest that wireless spectrum saturation increases proportionally with urban infrastructure density and access point concentration. Despite the presence of congested deployments, most detected access points were categorized as LOW or MEDIUM congestion, suggesting severe spectrum saturation was localized rather than uniformly distributed. Channel congestion by city (download) A thorough analysis of individual channel utilization revealed that channels 11, 6 and 1 consistently experienced the highest congestion levels across the three cities, which correlates with our previous findings. These channels accounted for the majority of VERY_HIGH congestion classifications, particularly within the 2.4 GHz band. In Mexico City, channel 11 alone accounted for more than 25% of detected deployments and consistently exhibited VERY_HIGH congestion levels. This behavior reflects the limited availability of non-overlapping channels within the 2.4 GHz spectrum and the widespread reliance on default wireless configurations. Most congested channels by city (download) Overall, the channel utilization analysis showed that wireless deployments are concentrated heavily within the traditional, non-overlapping 2.4 GHz channels. While this strategy reduces adjacent-channel interference, excessive access point density on the same channels can still produce significant co-channel contention and poor wireless performance in high-density urban environments. Wireless security configurations The next thing we evaluated was the security posture of the detected wireless networks. We analyzed the wireless security configurations advertised by access points in each of the locations. Overall security configuration distribution The analysis revealed that WPA2 was the dominant wireless authentication mechanism across the three cities. Mexico City had the highest WPA2 adoption rate at 81.19%, followed by Monterrey at 79.19% and Guadalajara at 77.59%. The study found that every 6th open access point (17%) was unsafe, namely 16.5% in Mexico City, 18.5% in Guadalajara, and 17.2% in Monterrey. Open wireless deployments were consistently present across all locations, ranging between 10% and 12% of detected access points. These findings show that despite the widespread deployment of modern wireless security standards, encryption adoption remains incomplete. Distribution of wireless authentication mechanisms across the three locations (download) To simplify the interpretation of wireless security posture, we grouped detected networks into four categories: Secure (WPA2/WPA3) Insecure (Open/WEP) Weak (WPA) Unknown Across the three locations, secure networks comprised most of detected deployments, accounting for approximately 82% of all access points. However, insecure open networks still account for between 10% and 12% of detected wireless infrastructure, consistent with our previous findings. It is important to mention that networks within the unknown category are not considered secure. Mexico City had the highest percentage of secure deployments at 83.54%, while Guadalajara had the highest percentage of insecure open networks at 12.46%. Although Monterrey had the lowest percentage of insecure networks, open deployments still accounted for more than 10% of the detected access points. Wireless security posture grouping across the three locations (download) Although modern WPA2/WPA3 encryption standards dominate current wireless deployments, the continued presence of open and legacy WPA deployments indicates that insecure wireless configurations remain relevant from an operational standpoint. These networks may expose users to passive traffic interception, unauthorized monitoring, rogue access point attacks, and credential harvesting techniques. WPS-enabled networks We also analyzed Wi-Fi Protected Setup (WPS) in all the locations to evaluate additional attack surfaces. WPS is a standard feature on wireless routers that enables devices such as printers, repeaters or mobile phones to connect to a secure Wi-Fi network without manually entering a long password, typically through a PIN-based enrolled mechanism. Although WPA2 and WPA3 provide strong encryption mechanisms, the presence of WPS can introduce security weaknesses due to inherently vulnerable PIN-based enrollment methods. By combining detections from the three locations, we found that 55% of all detected access points did not advertise WPS capabilities, leaving 45% of deployments vulnerable to WPS-based abuse. These results suggest that, despite the adoption of modern encryption standards, a significant portion of wireless infrastructure continues to expose legacy convenience features. During the analysis, we found that Mexico City had the highest proportion of WPS-enabled networks, with 46.61% of the detected access points advertising WPS capabilities. Guadalajara was second with 43.45%, while Monterrey had the lowest proportion at 40.93%. The percentage of detected access points advertising WPS capabilities across the three locations (download) Almost half of the detected wireless networks in each city continued to advertise WPS, indicating that WPS prevalence is consistently high across the three cities. Secure networks with WPS enabled In many cases, networks classified as secure because of WPA2/WPA3 encryption still had WPS functionality enabled, which effectively increased the available attack surface. To further assess the relationship between encryption strength and WPS exposure, we conducted a secondary analysis of secure networks (WPA2/WPA3) only. The results showed that around half of all secure deployments still exposed WPS, with the following breakdown for each city: Mexico City: 53.7% Guadalajara: 50.9% Monterrey: 47.5% The proportion of secure networks with WPS enabled across the three locations (download) These findings indicate that encryption strength alone is not enough to evaluate wireless security posture because additional protocol features, such as WPS, may still expose exploitable attack vectors. Additional security considerations Overall, travelers operating within dense public environments are exposed not only to insecure wireless infrastructure but also to various risks associated with digital interactions. These risks include many threats, from public USB charging systems and phishing QR codes to proximity-based protocols and exposure to shared public devices, such as interactive totems or kiosks. One particular point that should be taken into account in light of our research is the issue of rogue wireless deployments. Rogue access points are not necessarily malicious; they may be set up accidentally by misconfiguring router settings. An entry point for potential compromise might be caused by various misconfigurations, from a weak password to an insecure protocol. However, attackers deploy such unauthorized hotspots with malicious intent to infiltrate a network. Threat actors may deploy rogue access points posing as legitimate public wireless networks in airports, hotels, cafés and tourist areas. These deployments are called “evil twins” and can trick users into connecting to attacker-controlled infrastructure capable of intercepting traffic, harvesting credentials, or performing man-in-the-middle attacks. Further risk lies in the potential compromise of local network devices or even malware distribution. Such threats complement our findings, underscoring the importance of implementing traffic encryption, using a security solution and exercising extreme caution while browsing via public networks. Conclusion The wardriving assessment conducted in Mexico City, Guadalajara, and Monterrey revealed that modern wireless infrastructure continues to present multiple forms of operational exposure despite the widespread adoption of WPA2 and WPA3 security standards. The analysis demonstrated that wireless environments are highly standardized in all the locations, with recurring ISP deployments, default SSID naming conventions, homogeneous manufacturer distribution, and predictable channel allocation practices observed in all three cities. Although most of the detected networks were classified as secure under WPA2/WPA3 authentication mechanisms, a significant proportion were exposing additional attack surfaces through enabled WPS functionality, default configurations, sequential SSID structures, and infrastructure metadata disclosure. This demonstrates that encryption strength alone is insufficient for evaluating the overall security posture of wireless infrastructure. Additionally, the prevalence of open networks and legacy wireless configurations indicates that insecure deployments are still operationally relevant in all the locations. The results also showed that wireless infrastructure is heavily concentrated within the 2.4 GHz spectrum, particularly around channels 11, 6, and 1. This leads to elevated congestion and increased co-channel interference in densely populated urban environments. SSID analysis further revealed that publicly broadcast wireless identifiers frequently expose valuable operational information about ISPs, equipment manufacturers, deployment templates, organizational ownership, and user-defined naming practices. The identification of default ISP naming conventions, sequential SSID structures, and BSSID-derived SSIDs demonstrated that many deployments prioritize operational convenience and simplicity over exposure minimization and privacy. The scope of the threats stemming from vulnerable wireless configurations poses serious digital exposure risks for users. The widespread presence of standard deployments, predictable SSID naming and publicly exposed infrastructure identifiers can facilitate passive reconnaissance, infrastructure fingerprinting and opportunistic targeting. Recommendations To minimize the risks of wireless-based exposure and the attack surface related to hotspot infrastructure, we recommend taking the following measures: Disable WPS functionality on wireless routers whenever possible, particularly within WPA2/WPA3 deployments. Avoid using default SSID naming conventions that disclose ISP providers, router manufacturers, or deployment templates. Refrain from using personal, organizational, or location-based identifiers in wireless network names. Avoid configuring SSID using BSSID or naming conventions derived from MAC addresses, as these may expose hardware fingerprinting information. Promote migration toward modern WPA3-capable infrastructure while removing legacy wireless protocols when operationally feasible. Reduce wireless congestion by optimizing channel allocation strategies and minimizing excessive dependence on the 2.4 GHz spectrum. Encourage adoption of 5 GHz and newer wireless technologies to reduce interference and improve spectrum efficiency. The findings presented in this assessment emphasize the importance of combining strong wireless encryption standards, secure deployment practices, exposure minimization strategies, and user awareness to enhance the overall security posture of wireless environments.

In questo contesto, il Cybersecurity Act diventa qualcosa di più di una legge. È un atto di sovranità, un segnale politico, una dichiarazione di intenti. E, come ogni dichiarazione di questo tipo, genera una reazione. C’è una soglia, sottile ma decisiva, oltre la quale il diritto smette di essere un insieme di norme e diventa una forma di potere. L’Europa sembra averla attraversata con la revisione del Cybersecurity Act: ciò che nasceva come architettura tecnica per la sicurezza informatica si sta trasformando in uno strumento di selezione geopolitica, capace di ridefinire non solo chi può operare nel mercato europeo, ma anche chi può esistere, industrialmente, nel nuovo ordine digitale. La proposta della Commissione europea, parte di un più ampio pacchetto sulla resilienza cibernetica, si muove infatti lungo una direttrice chiara. L’obbiettivo è rafforzare il controllo sulle catene di approvvigionamento ICT, rendere vincolanti strumenti come il 5G Toolbox e introdurre criteri più stringenti per identificare i cosiddetti “fornitori ad alto rischio”. È un passaggio cruciale, perché segna il superamento di una concezione puramente tecnica della sicurezza e l’ingresso esplicito della dimensione politica nella valutazione del rischio. Non è un caso che, pur senza essere nominati formalmente nei testi normativi, i destinatari impliciti siano evidenti. Aziende come Huawei e ZTE vengono considerate da Bruxelles fornitori critici sulla base di valutazioni già maturate nell’ambito del 5G Toolbox, che gli Stati membri sono stati invitati ad applicare in modo più rigoroso. La novità, però, non sta tanto nell’individuazione del rischio, quanto nella volontà di trasformare raccomandazioni politiche in obblighi giuridici, vincolando l’intero mercato europeo a una scelta di campo. Pechino risponde La reazione cinese, ça va sans dire, diventa inevitabile, quasi strutturale. Il Ministero del Commercio di Pechino ha formalmente presentato osservazioni alla Commissione europea, denunciando una “politicizzazione” della cybersicurezza e mettendo in guardia contro possibili contromisure qualora le aziende cinesi venissero discriminate. Non si tratta di una semplice protesta diplomatica ma di un passaggio che richiama, esplicitamente, il quadro normativo internazionale, in particolare le regole del WTO, che secondo la Cina verrebbero violate da criteri ritenuti arbitrari e non tecnici. In questo scambio si intravede, però, un cambiamento più profondo. Ora più che mai, la sicurezza non è una categoria neutra, è diventata una variabile geopolitica, una leva attraverso cui ridefinire le relazioni economiche globali. Quando Bruxelles afferma che il rischio può essere anche “non tecnico”, sta introducendo un principio radicale, per cui la fiducia in un fornitore dipende non solo dalle sue tecnologie, ma dal sistema politico e istituzionale da cui proviene. “Una rottura rispetto al paradigma liberale che ha governato la globalizzazione tecnologica degli ultimi trent’anni“ È una rottura rispetto al paradigma liberale che ha governato la globalizzazione tecnologica degli ultimi trent’anni, fondato sull’idea che il mercato potesse essere separato dalla politica. Un mutamente che interviene mentre le infrastrutture digitali, quali reti 5G, fibra, sistemi energetici connessi, persino scanner di sicurezza, sono diventate la spina dorsale delle società contemporanee, e quindi irrinunciabile terreno di confronto tra potenze. L’Unione europea lo sa bene, e non lo nasconde più. La revisione del Cybersecurity Act, in questo senso, è parte di una strategia più ampia di “sovranità tecnologica”, che mira a ridurre la dipendenza da fornitori extra-europei e a costruire un ecosistema digitale autonomo. Una linea ribadita anche a livello istituzionale, dove si sottolinea la necessità di garantire che ogni prodotto digitale sia sicuro “fin dalla progettazione” e che le catene di fornitura siano resilienti a interferenze esterne. Questo orientamento trova riscontro diretto anche nei documenti ufficiali dell’Unione europea, come il testo del regolamento sul Cybersecurity Act e le attività dell’ENISA, che definiscono un quadro comune di certificazione e gestione del rischio a livello continentale. Parallelamente, anche governi nazionali, incluso quello italiano, hanno rafforzato negli ultimi anni i meccanismi di controllo sugli asset strategici digitali attraverso strumenti come il Golden Power, applicato più volte proprio nel settore delle telecomunicazioni. Fronte o cyber trincea? Ma ogni scelta strategica ha un costo, e nel caso europeo il prezzo si misura in termini di competitività. Gli operatori delle telecomunicazioni, pur condividendo l’obiettivo della sicurezza, temono l’impatto economico di una riduzione forzata dei fornitori, che potrebbe tradursi in un aumento dei costi infrastrutturali e in un rallentamento degli investimenti. È il paradosso di una politica industriale che, nel tentativo di proteggere il sistema, rischia di indebolirne la capacità competitiva nel breve periodo. La questione è particolarmente delicata in paesi come l’Italia, dove si è resa significativa la presenza di tecnologie cinesi nelle reti e solo progressivamente ridotta negli ultimi anni, attraverso una transizione verso fornitori europei come Ericsson e Nokia. Questo processo, già in atto, potrebbe accelerare sotto la pressione normativa europea, ma non senza tensioni tra esigenze di sicurezza e sostenibilità economica. In controluce, ciò che emerge è la progressiva costruzione di blocchi tecnologici. Da un lato l’Occidente, che tende a integrare sicurezza, regolazione e alleanze strategiche; dall’altro la Cina, che difende un modello alternativo basato su controllo statale e integrazione verticale delle proprie filiere industriali. Il rischio, sempre più concreto, è la frammentazione dello spazio digitale globale in sfere di influenza separate, dove standard, tecnologie e fornitori non sono più interoperabili ma politicamente connotati. “Il Cybersecurity Act diventa qualcosa di più di una legge“ Ecco perché, in questo contesto, il Cybersecurity Act diventa qualcosa di più di una legge. È un atto di sovranità, un segnale politico, una dichiarazione di intenti. E, come ogni dichiarazione di questo tipo, genera una reazione. La Cina lo ha già fatto capire, con chiarezza: se l’Europa chiude, Pechino è pronta a rispondere. Non necessariamente sullo stesso terreno, ma con strumenti analoghi, capaci di colpire le catene di approvvigionamento globali e ridefinire gli equilibri commerciali. La guerra invisibile, dunque, non solo è diventata visibile ma ha cambiato forma. Non passa più soltanto dai data center o dagli attacchi informatici, ma dalle norme che stabiliscono chi può costruire, gestire e controllare le infrastrutture del mondo digitale. E in quella guerra, oggi, la legge è l’arma più sofisticata.

A new Mirai-based malware campaign is actively exploiting CVE-2025-29635, a high-severity command-injection vulnerability affecting D-Link DIR-823X routers, to enlist devices into the botnet. CVE-2025-29635 allows an attacker to execute arbitrary commands on remote devices by sending a POST request to a vulnerable endpoint, triggering remote command execution (RCE). Akamai's SIRT, which detected the Mirai campaign in March 2026, reports that, although the flaw was first disclosed 13 months ago by security researchers Wang Jinshuai and Zhao Jiangting, this is the first time in-the-wild active exploitation has been observed. "The Akamai SIRT discovered active exploitation attempts of the D-Link command injection vulnerability CVE-2025-29635 in our global network of honeypots in early March 2026," reads Akamai's report. "This vulnerability exists in D-Link DIR-823X series routers in firmware versions 240126 and 24082, and allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to the /goform/set_prohibiting endpoint via the corresponding function, which can trigger remote command execution." The researchers who discovered the flaw briefly published a proof-of-concept (PoC) exploit on GitHub, but later retracted it. Akamai's observations show attackers are sending POST requests that change directories across writable paths, download a shell script (dlink.sh) from an external IP, and execute it. The script installs a Mirai-based malware named "tuxnokill," which supports multiple architectures. In terms of capabilities, it features Mirai's standard distributed denial-of-service (DDoS) attack repertoire, including TCP SYN/ACK/STOMP, UDP floods, and HTTP null. Akamai has also found that the threat actor behind this campaign also exploits CVE-2023-1389, impacting TP-Link routers, and a separate RCE flaw in ZTE ZXV10 H108L routers. The same attack pattern was observed across all of them, leading to the deployment of a Mirai payload. The impacted devices reached end of life (EoL) in November 2024, so it's likely the latest firmware available for the model does not address CVE-2025-29635. D-Link does not make exceptions when active exploitation is detected, so it's unlikely the vendor will provide a fixing patch now. BleepingComputer has contacted D-Link with questions about the reported activity and the status of the fix, and we will update this post as soon as we hear back. Meanwhile, users of routers that have reached EoL are recommended to upgrade to a newer model that enjoys active support with frequent security fixes, disable remote administration portals if not needed, change default admin passwords, and monitor for unexpected configuration changes. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A Mirai botnet is targeting discontinued D-Link routers impacted by a command injection vulnerability disclosed a year ago, Akamai reports. Tracked as CVE-2025-29635, the security defect exists because an attacker-controllable function value is copied without validation, and can be exploited through crafted POST requests. “The router extracts the value that ends up in the command buffer from the request body without checking which form field it came from,” Akamai notes. The observed exploitation attempts, it says, target the same code and trigger the same system call as a proof-of-concept (PoC) exploit published last year on GitHub, which has since been removed. As part of the observed execution path, a shell script is loaded to download and run a payload that has numerous Mirai characteristics, including XOR encoding, a hardcoded console execution string, and a hardcoded downloader IP. The exploited issue exists in D-Link DIR-823X series router firmware versions 240126 and 24082. The affected devices were discontinued last year and no longer receive software updates from the vendor. “D-Link strongly recommends that this product be retired and cautions that any further use of this product may be a risk to devices connected to it,” the company warned in September. The hackers have been observed targeting TP-Link and ZTE router vulnerabilities as well, Akamai says. The threat actor behind the recently observed attacks appears not to have used vibe coding to build their payload. “Mirai malware campaigns continue to plague the industry, with much of the original source code continuing to be reused by various threat actors, both skilled and unskilled. The low barrier of entry and potential financial benefits are some of the incentives that may entice individuals to enter the botnet space and become a cyberthreat actor,” Akamai notes. Related: Evasive Masjesu DDoS Botnet Targets IoT Devices Related: Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation Related: 174 Vulnerabilities Targeted by RondoDox Botnet Related: Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience

Threat actors are exploiting security flaws in TBK DVR and end‑of‑life (EoL) TP-Link Wi-Fi routers to deploy Mirai-botnet variants on compromised devices, according to findings from Fortinet FortiGuard Labs and Palo Alto Networks Unit 42. The attack targeting TBK DVR devices has been found to exploit CVE-2024-3721 (CVSS score: 6.3), a medium-severity command injection vulnerability affecting TBK DVR-4104 and DVR-4216 digital video recording devices, to deliver a Mirai variant called Nexcorium. "IoT devices are increasingly prime targets for large-scale attacks due to their widespread use, lack of patching, and often weak security settings," security researcher Vincent Li said. "Threat actors continue exploiting known vulnerabilities to gain initial access and deploy malware that can persist, spread, and cause distributed denial-of-service (DDoS) attacks." This is not the first time the vulnerability has been exploited in the wild. Over the past year, the security issue has been leveraged to deploy a Mirai variant as well as a distinct, relatively new botnet called RondoDox. In September 2025, CloudSEK also disclosed details of a large-scale loader-as-a-service botnet that has been distributing RondoDox, Mirai, and Morte payloads through weak credentials and old flaws in routers, IoT devices, and enterprise apps. The attack activity outlined by Fortinet involves the exploitation of CVE-2024-3721 to obtain and drop a downloader script, which then launches the botnet payload based on the Linux system's architecture. Once the malware is executed, it displays a message stating "nexuscorp has taken control." "Nexcorium has a similar architecture to the Mirai variant, including XOR-encoded configuration table initialization, watchdog module, and DDoS attack module," the security vendor said. The malware also includes an exploit for CVE-2017-17215 to target Huawei HG532 devices in the network and incorporates a list of hard-coded usernames and passwords for use in brute-force attacks targeting the victim's hosts by opening a Telnet connection. If the Telnet login is successful, it attempts to obtain a shell, set up persistence using crontab and systemd service, and connect to an external server to await commands for launching DDoS attacks over UDP, TCP, and SMTP. Once persistence is established on the device, the malware deletes the original downloaded binary to evade analysis. "The Nexcorium malware displays typical traits of modern IoT-focused botnets, combining vulnerability exploitation, support for multiple architectures, and various persistence methods to sustain long-term access to infected systems," Fortinet said. "Its use of known exploits, such as CVE-2017-17215, along with extensive brute-force capabilities, underscores its adaptability and efficacy in increasing its infection reach." The development comes as Unit 42 said it detected active, automated scans and probes attempting to exploit CVE-2023-33538 (CVSS score: 8.8), a command injection vulnerability impacting EoL TP-Link wireless routers, albeit using a flawed approach that doesn't result in a successful compromise. It's worth noting that the security flaw was added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog in June 2025. The vulnerability affects the following models - TL-WR940N v2 and v4 TL-WR740N v1 and v2 TL-WR841N v8 and v10 "Although the in-the-wild attacks we observed were flawed and would fail, our analysis confirms the underlying vulnerability is real," researchers Asher Davila, Malav Vyas, and Chris Navarrete said. "Successful exploitation requires authentication to the router's web interface." The attacks, in this case, attempt to deploy a Mirai-like botnet malware, with the source code featuring numerous references to the string "Condi." It also comes equipped with the ability to update itself with a newer version and act as a web server to spread the infection to other devices that connect to it. Given that the affected TP‑Link devices are no longer actively supported, users are advised to replace them with a newer model and ensure that default credentials are not used. "For the foreseeable future, the security landscape will continue to be shaped by the persistent risk of default credentials in IoT devices," Unit 42 said. "These credentials can turn a limited, authenticated vulnerability into a critical entry point for determined attackers." Update In a new analysis published on April 21, Akamai said it identified threat actors exploiting a command injection vulnerability impacting end-of-life D-Link DIR-823X series routers (CVE-2025-29635, CVSS score: 8.8) to deploy a Mirai botnet variant named "tuxnokill" via a shell script. The activity was detected against its honeypots in early March 2026. In addition to CVE-2025-29635, the attack has been observed attempting to exploit two other vulnerabilities: CVE-2023-1389, which affects TP-Link Archer AX21 devices, and a ZTE ZXV10 H108L router remote code execution (RCE) exploit. The campaigns are part of a broader effort undertaken by various threat actors to exploit known vulnerabilities in unpatched and retired IoT hardware, stealthily conscript them into a botnet, and then use those botnets to launch DDoS attacks. "Mirai malware campaigns continue to plague the industry, with much of the original source code continuing to be re-used by various threat actors, both skilled and unskilled," the company said. "The low barrier of entry and potential financial benefits are some of the incentives that may entice individuals to enter the botnet space and become a cyberthreat actor." (The story was updated after publication on April 22, 2026, to include details of additional Mirai botnet activity.)

The US Federal Communications Commission (FCC) has banned the import and sale of all “consumer-grade” internet routers produced in a foreign country, citing “an unacceptable risk” to the national security of the US. The ban, announced in an FCC public notice on March 23, means that all such routers made in foreign countries – not just a few select Chinese vendors – are now placed on the FCC’s covered list. The only exceptions include routers that have been granted a conditional approval by the US Department of Defense (DoD) or Department of Homeland Security (DHS). At the time of writing, the list of exceptions only includes drone systems and online surveillance systems. The agency highlighted that foreign-made routers “were directly implicated” in the Volt, Flax and Salt Typhoon cyber-attacks which targeted critical American communications, energy, transportation and water infrastructure. Consumer Routers Under Fire While the public notice sounds like a blanket ban of all foreign-made routers in the US, the FCC specifically banned “consumer-grade routers” as defined in NIST Internal Report 8425A, which refers to ones “intended for residential use and can be installed by the customer.” Existing Wi-Fi and wired routers currently in use may continue operating without restriction. Futher, companies that have previously secured FCC radio authorization for specific foreign-manufactured networking equipment are permitted to maintain imports of those approved models. However, since nearly all consumer-grade routers are produced outside the US, the FCC’s action effectively prohibits the import of the majority of future consumer router models. Shane Barney, CISO at Keeper Security, warned that focusing solely on country-of-origin risks oversimplifying a much broader security challenge. “In enterprise environments, routers and network devices are seen not just as connectivity tools, but as high-value control points that sit outside traditional security oversight. That risk is often compounded through weak governance rather than manufacturing geography,” he said. “Network infrastructure is frequently under-managed, lacks consistent patching and operates without integration into modern identity and access management frameworks. This creates an ideal foothold for attackers seeking persistent, low-visibility access into corporate environments.” For instance, in the Volt Typhoon and Salt Typhoon cyber-attacks, Chinese state-backed hackers primarily exploited vulnerabilities in Cisco and Netgear routers which were susceptible because their manufacturers had discontinued security updates for those specific, end-of-life models. US firm Netgear is understood to manufacture its routers in locations like Taiwan and Vietnam, meaning the firm will likely be heavily affected by the ban. Two major Chinese router makers, Huawei and ZTE, were placed on agency’s covered list in 2021. Another Chinese provider, TP-Link, is still widely used in the US. The company has taken recent steps to reduce its association with China, including a 2022 corporate restructuring that separated it from its Chinese parent entity. In 2024, the company established a global headquarters in California. TP-Link sued US firm Netgear in November 2025 for suggesting that TP-Link had been infiltrated by the Chinese government.

The Federal Communications Commission has updated its Covered List to include all consumer routers made in foreign countries, banning the sale of new models in the U.S. The Covered List, created under the Secure and Trusted Communications Networks Act of 2019, is an FCC-maintained list of communications equipment and services that the U.S. government has determined to pose an unacceptable risk to national security or the safety of Americans. The list previously included specific products and companies tied to security concerns, such as Kaspersky, Huawei, ZTE, Hikvision, and Dahua. Adding all routers manufactured abroad to the Covered List follows a National Security Determination issued on March 20 by an Executive Branch interagency body. According to the assessment, foreign-produced routers carry a supply-chain risk "that could disrupt the U.S. economy, critical infrastructure, and national defense." The agency determined that these devices could also be used "to immediately and severely disrupt U.S. critical infrastructure and directly harm U.S. persons." In support of the decision, the FCC highlights that foreign-made routers helped the Volt, Flax, and Salt Typhoon hackers carry out attacks that targeted vital U.S. infrastructure. Exemptions and alternative approval path Conditional approval has been granted to certain routers used in the U.S. Department of War (DoW) or the Department of Homeland Security (DHS) for drone systems, which have been determined not to constitute a security risk. Also, the new rules do not bar foreign consumer-grade router makers from seeking approval in the U.S., as long as they transparently disclose: Corporate and ownership structure, including any foreign government financial support and influence. Manufacturing and supply chain details, including bill of materials, country of origin for all components, IP ownership details, manufacturing and assembly locations, and origin of software/firmware. Plan to move critical components manufacturing to the United States, and provide a description of existing U.S.-based manufacturing or assembly processes. Consumer impact For regular consumers in the United States, the new rules are expected to have no immediate effect, as all existing routers will continue to be sold in the country. In what concerns Unmanned Aircraft Systems (UAS) and their critical components, the FCC noted that it will allow software and firmware updates until at least January 1, 2027. Access to new router models for U.S.-based consumers may become more difficult, and the devices may also become more expensive, as the regulatory approval process adds extra complications and costs. Given that testing, approvals, and FCC certification typically take a couple of months, even when all conditions are met. In some cases, this might lead to a delay in entering the U.S. market. Some manufacturers may also decide that the alternative certification pathway is not worth the effort - particularly due to the onshoring requirement - and exit the U.S. market, reducing model availability. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Western allies form 6G security coalition amid tech rivalry with China A group of Western and Indo-Pacific nations launched a coalition on Tuesday aimed at shaping the security foundations of next-generation 6G mobile networks, as China accelerates its own research and investment in the technology. The Global Coalition on Telecoms (GCOT) — comprising the United Kingdom, United States, Canada, Japan and Australia, with Sweden and Finland joining at the launch — unveiled voluntary security and resilience principles for the technology at the Mobile World Congress trade show in Barcelona. Drawing on lessons from the global rollout of 5G, the non-binding principles aim to ensure that future 6G networks are “secure by design” and resilient from the outset rather than retrofitted with protections later. The guidance calls for stronger containment of cyber threats, protection of data confidentiality and integrity, supply chain diversification, support for quantum-resistent cryptography and safeguards for artificial intelligence embedded in networks. According to the British government, the guidance is intended to influence researchers, vendors, operators and international standards bodies as 6G specifications are developed over the coming years. 6G is expected to integrate AI more deeply into network operations, link satellite and terrestrial systems and enable ultra-low-latency applications beyond current 5G capabilities — providing a new foundation for networks that already underpin sectors from finance and energy to defense and transportation. Commercial deployment is currently not expected until around 2030. Rivalry with China The coalition’s documents do not explicitly name China, but the initiative unfolds against a backdrop of growing strategic rivalry in advanced communications technologies. Beijing has prioritized 6G research through state-backed initiatives, including the IMT-2030 (6G) Promotion Group, and has emphasized participation in global standards-setting bodies including the International Telecommunication Union and 3GPP. The country's Ministry of Industry and Information Technology regularly celebrates domestic innovations on 6G. Chinese state-linked research has reported that China accounts for more than 40% of global 6G patent applications, although patent volume does not necessarily translate into final standards leadership or market share. During the global rollout of 5G, several coalition members restricted equipment from Chinese telecom suppliers including Huawei and ZTE over security concerns. Officials in these countries cited China’s national security laws, which they argue could require companies to secretly cooperate with Beijing’s intelligence services. These companies and officials in China have denied the allegations and said no evidence of wrongdoing has been produced. Beijing also rejects allegations by Western cyber agencies that it has engaged in a series of hacking campaigns targeting their governments and critical infrastructure. Supporters of the 6G coalition say embedding security, resilience and supplier diversity early could reduce systemic vulnerabilities and limit future economic dependence on a narrow group of vendors. Although formal 6G standards are still years away, the launch of the coalition underscores a view from governments that decisions made now on architecture and governance could shape the balance of technological and economic power for decades. Alexander Martin is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79

EU can’t be ‘naive’ about enemies shutting down critical infrastructure, warns tech official MUNICH, Germany — The European Union can no longer afford to be “naive” about adversaries’ ability to switch off critical infrastructure, the EU’s top tech official warned Friday, as she called for tougher rules and more investment to protect Europe from cyber and hybrid threats. Speaking at the Munich Cyber Security Conference, European Commission Executive Vice President Henna Virkkunen said cyberattacks have become a central tool of modern conflict, often coordinated with physical sabotage, disinformation and economic pressure. Europe’s power grids, hospitals, financial systems, satellites and military command networks are all deeply dependent on digital infrastructure — and increasingly exposed, she warned. “In today’s world, there is no security without cybersecurity,” said Virkkunen, pointing to recent attacks and interference targeting hospitals, energy networks, public administrations, supply chains and democratic processes across Europe. She said the Commission last month proposed revising the EU’s Cybersecurity Act to strengthen the bloc’s cybersecurity agency and reduce risks in critical information and communications technology supply chains. The draft proposal would see member states phase out the use of designated high-risk suppliers within their critical national infrastructure. The potential threat posed by Chinese network equipment suppliers such as Huawei and ZTE had previously resulted in several national decisions to restrict those vendors from contributing to various parts of telecommunications infrastructure. The use of U.S. technology and service providers had also prompted concern across the EU following President Trump’s unpredictable decisions to sanction various political figures — resulting in prohibitions against those officials using technology provided by companies such as Microsoft — and aggressive posture towards Greenland. Those concerns were partially assuaged by U.S. National Cyber Director Sean Cairncross on Thursday, who stressed the U.S. wants European partners to work alongside it in cyberspace to confront the most significant threats — and stressed that the U.S. technology stack was safer than that offered by China. Cairncross echoed a line coined by Secretary of State Marco Rubio, saying the U.S. “America first” approach does not mean “America alone.” Rubio is expected to deliver a keynote to the main Munich Security Conference on Saturday in the wake of an extremely controversial speech delivered by JD Vance last year. Without naming specific states, Virkkunen argued that Europe’s growing reliance on digital systems has expanded the attack surface for hostile actors and made cyber defense a core part of defense readiness. “We can no longer afford to be naive about who has the capacity to switch off the ICT systems running our critical infrastructure,” she said. She also pointed to new EU action plans on drone and undersea cable security, following recent incidents, as examples of efforts to improve prevention, detection and rapid response across borders. Cyber, she said, is now a core military domain, and Europe must build stronger capabilities and a homegrown cyber industry, including by using advanced computing and artificial intelligence for defense. The goal, Virkkunen said, is to ensure Europe remains resilient, secure and able to withstand growing hybrid threats. Alexander Martin is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79

La proposta di revisione del Cybersecurity Act della Commissione Europea ha ricevuto le critiche della Cina, che ha accusato l’Unione Europea di promuovere una scelta di “palese protezionismo”. La Cina rilancia la sua battaglia contro “il protezionismo” dell’Unione Europea, a tutela delle sue eccellenze cyber, con dure critiche alla proposte della Commissione Europea sul Cybersecurity Act. “Mercoledì scorso“, secondo POLITICO, “il Governo cinese è intervenuto in difesa di Huawei e di altre industrie tecnologiche contro la proposta di Bruxelles“. L’Unione Europea, infatti, “punta ad escludere i fornitori cinesi più a rischio dai settori industriali più critici“. Guo Jiakun, portavoce del ministero degli Esteri Wang Yi, ha dichiarato ai giornalisti che la proposta di legge sulla sicurezza informatica dell’UE equivale ad una misura di “palese protezionismo”. Inoltre, ha avvertito i funzionari europei che Pechino adotterà “le misure necessarie” per proteggere le sue aziende. La replica dell’Unione Europea In un clima di crescente tensione tra la Cina e i Paesi occidentali, non poteva mancare una risposta da parte della Commissione. Il suo portavoce Thomas Regnier ha motivato la misura affermando: “L’Europa ha permesso per troppo tempo a fornitori ad alto rischio di Paesi al di fuori dell’Unione di operare in settori strategici“. Il rischio comunque, ha sottolineato POLITICO, “è che Pechino possa scatenare una ritorsione in un momento delicato“. L’UE, infatti, “deve anche affrontare la possibilità di una guerra commerciale con gli Usa sulla Groenlandia“. Tuttavia, secondo alcuni analisti, la spinta dell’Unione a bloccare le aziende cinesi del comparto cyber “potrebbe essere una carta negoziale per allentare le tensioni con gli stessi Usa“. L’obiettivo degli Usa Da anni, infatti, Washington esorta le capitali europee a tagliare fuori dal mercato Huawei e altre società cinesi, tra le quali ZTE. Con la U.S. National Security Strategy released del dicembre 2025, una delle sette priorità della politica statunitense in Europa era un vero e proprio incoraggiamento all’Unione. In particolare “ad agire per combattere l’eccesso di capacità mercantilista, il furto tecnologico, lo spionaggio informatico e altre pratiche economiche ostili”. La misura di Bruxelles sulla cyber è l’ultima di una vasta serie di iniziative dell’UE volte a rafforzare la sua “autonomia strategica” nelle tecnologie e nei settori sensibili. Il tutto, “per ridurre il rischio per le sue economie di shock commerciali e coercizioni economiche“. Ursula von der Leyen: “L’UE risolva le proprie dipendenze strutturali“ Poche ore prima che l’iniziativa fosse resa pubblica, la Presidente della Commissione Ursula von der Leyen aveva ribadito le sue posizioni a Davos. Così von der Leyen: “L’Europa ha la necessità di costruire una nuova forma di indipendenza europea. Deve risolvere le dipendenze strutturali che abbiamo“. Un commento, quest’ultimo, rivolto sia a Pechino che a Washington. In base alla proposta sulla cyber, la Commissione Europea e le capitali dell’UE dovrebbero indicare i “Paesi che destano preoccupazione”. Quei Paesi che rappresenterebbero “una minaccia informatica in settori quali le telecomunicazioni, le energie rinnovabili, l’elettricità, l’acqua, i servizi cloud e i servizi di sicurezza“.

La Commissione europea è pronta a presentare una nuova proposta legislativa in materia di sicurezza informatica, con l’obiettivo di vietare progressivamente l’uso di apparecchiature di fabbricazione cinese nelle infrastrutture critiche dell’Unione. Secondo quanto anticipato da fonti ufficiali, il provvedimento interesserà in particolare le reti di telecomunicazioni, i sistemi per l’energia solare e gli scanner di sicurezza. Aziende come Huawei e ZTE, indicate come fornitori cinesi ad alto rischio, potrebbero essere escluse da segmenti chiave dell’ecosistema tecnologico europeo. L’iniziativa si inserisce nel più ampio sforzo dell’Unione di rivedere la propria strategia in ambito tecnologico e di sicurezza, riducendo la dipendenza sia da fornitori cinesi sia da grandi imprese statunitensi. Alcuni funzionari europei hanno espresso preoccupazioni circa il potenziale utilizzo delle tecnologie provenienti da Pechino per la raccolta di dati sensibili, in linea con le posizioni già sostenute dagli Stati Uniti, che hanno vietato l’impiego di apparecchiature Huawei all’interno delle loro reti di telecomunicazione. Indice degli argomenti La proposta, che verrà presentata ufficialmente martedì, mira a rendere obbligatorio per tutti gli Stati membri dell’Unione il regime di restrizione o esclusione dei fornitori ad alto rischio, superando l’attuale approccio volontario. In base a quanto trapelato, l’obiettivo è uniformare le pratiche a livello comunitario, poiché le precedenti raccomandazioni sono state applicate in modo disomogeneo. Alcuni Paesi, infatti, continuano a fare affidamento su fornitori considerati critici. Un caso emblematico è quello della Spagna, che nell’estate del 2025 ha firmato un contratto da 12 milioni di euro con Huawei per la fornitura di hardware destinato alla conservazione delle intercettazioni giudiziarie a uso delle forze di sicurezza e dei servizi di intelligence. Un passaggio chiave della proposta riguarda la necessità di superare le soluzioni frammentate adottate finora a livello nazionale. Secondo una bozza precedente della proposta di Cybersecurity Act, tale frammentazione avrebbe ostacolato la creazione di un clima di fiducia e coordinamento all’interno del mercato interno. Sebbene il testo definitivo sia ancora suscettibile di modifiche, l’orientamento generale appare definito: Bruxelles intende rafforzare il coordinamento tra Stati membri e promuovere un approccio più unitario alla gestione dei rischi tecnologici. La mossa si inserisce in un contesto più ampio di rafforzamento delle misure europee nei confronti della partecipazione cinese nei settori industriali considerati strategici. La Commissione ha avviato indagini su aziende cinesi attive nella produzione di treni e turbine eoliche e ha disposto perquisizioni negli uffici europei del produttore di apparecchiature di sicurezza Nuctech. Le tempistiche esatte per il phase-out dei fornitori cinesi varieranno in funzione del livello di rischio associato al singolo operatore e al settore di appartenenza, tenendo conto anche dei costi e della disponibilità di alternative sul mercato. In alcuni comparti, tuttavia, la dipendenza da fornitori cinesi appare particolarmente elevata. Si stima, per esempio, che oltre il 90% dei pannelli solari installati nell’Unione europea provenga dalla Cina. La situazione si complica ulteriormente per effetto dell’intenzione comunitaria di ridurre contemporaneamente la dipendenza anche da fornitori statunitensi. In questo scenario, alcuni operatori del settore segnalano la mancanza di alternative considerate pienamente viabili per sostituire rapidamente le tecnologie oggi in uso. Le preoccupazioni sono particolarmente forti nel comparto delle telecomunicazioni, dove alcune aziende hanno già avvertito che un divieto diretto potrebbe avere un impatto significativo sui prezzi al consumo. Una transizione troppo rapida potrebbe comportare un aumento dei costi per gli utenti finali, oltre a ritardi nell’implementazione di nuove reti o nell’aggiornamento di quelle esistenti. L’eventuale approvazione della proposta da parte della Commissione rappresenterebbe solo il primo passo di un iter legislativo articolato, che prevede negoziati con il Parlamento europeo e con gli Stati membri. Poiché la sicurezza nazionale resta di competenza degli Stati, è prevedibile una certa resistenza da parte di alcune capitali europee, in particolare per quanto riguarda le tempistiche di applicazione della nuova normativa. Tra gli attori interessati dalla proposta figura anche Huawei, membro del gruppo di pressione industriale SolarPower Europe grazie alla propria attività nel settore degli inverter per pannelli solari. L’eventuale esclusione della società cinese potrebbe generare frizioni interne all’associazione e ripercussioni sull’intero comparto. La Commissione europea non ha rilasciato commenti ufficiali sulla proposta, né ha fornito ulteriori dettagli in merito al contenuto della futura normativa. Anche Huawei, contattata per una dichiarazione, non ha fornito risposte immediate. Dal canto suo, Pechino ha già espresso in passato la propria contrarietà all’orientamento europeo, affermando che l’esclusione delle tecnologie Huawei e ZTE violerebbe i principi di mercato e le regole della libera concorrenza. Un portavoce del ministero degli Esteri cinese ha dichiarato che la rimozione delle apparecchiature prodotte da imprese cinesi, considerate affidabili e di qualità, avrebbe già causato danni economici e ritardi nello sviluppo tecnologico nei Paesi che hanno adottato misure restrittive analoghe. La proposta si inserisce inoltre in una linea di continuità con le iniziative già avviate dall’Unione nel settore delle reti 5G. In quel contesto, la Commissione aveva raccomandato agli Stati membri di limitare o escludere i fornitori considerati ad alto rischio dalle parti più sensibili delle infrastrutture, lasciando tuttavia ampia discrezionalità a livello nazionale. Il nuovo intervento legislativo intende superare proprio questo modello, trasformando indicazioni non vincolanti in obblighi giuridici comuni. Non mancano, tuttavia, interrogativi sulla concreta attuazione della misura. Diversi operatori industriali hanno sottolineato che la sostituzione delle apparecchiature esistenti potrebbe richiedere tempi lunghi e investimenti significativi, soprattutto nei settori caratterizzati da cicli tecnologici estesi. In assenza di periodi transitori adeguati, il rischio segnalato è quello di creare colli di bottiglia operativi o di rallentare progetti infrastrutturali già in corso. La proposta della Commissione si colloca quindi in un equilibrio complesso. Da un lato, l’Unione europea mira a rafforzare il coordinamento nella gestione dei rischi legati alle tecnologie critiche. Dall’altro, occorre tenere conto delle implicazioni economiche e geopolitiche di una misura che potrebbe ridefinire l’accesso di interi comparti produttivi al mercato europeo.

EU unveils new plans to tackle Huawei, ZTE as China alleges protectionism European Commission proposals unveiled this week, aimed to bolster cybersecurity across the bloc in the face of a growing tide of digital threats, have drawn ire from China. A draft proposal released on Tuesday, revising the EU’s Cybersecurity Act and its Network Information Systems Directive, would see member states phase out the use of high-risk suppliers within their critical national infrastructure. The move reflects concerns about hostile actors exploiting supply chain vulnerabilities in the context of geopolitical tensions, state-sponsored hacking campaigns and the robust health of the cybercrime ecosystem. Ransomware incidents, cyber espionage and attacks attempting to disrupt essential services are driving the measures, which plan to reduce risks across the IT supply chain by establishing a framework for certifying trusted companies. “In today's geopolitical landscape, supply chain security is no longer just about technical product or service security, but also about risks related to a supplier, particularly dependencies and foreign interference,” the Commission announced. Under the proposed revisions, IT suppliers would face what are intended to be clearer testing and certification requirements before their products can be sold in the EU. It explicitly gives telecommunication network operators up to three years to completely phase out components from suppliers deemed to pose a significant cybersecurity risk. Although the move does not specifically mention either the United States or China, both of which have loomed as geopolitical risks for the continent in recent years, the Chinese foreign ministry responded to caution against the move. "Chinese companies have long operated in Europe in compliance with laws and regulations and have never endangered Europe's national security," said Guo Jiakun, a foreign ministry spokesperson, warning the EU it risked “going further down the wrong path of protectionism.” The potential threat posed by Chinese network equipment suppliers such as Huawei and ZTE had previously resulted in several national decisions to restrict those vendors from contributing to various parts of telecommunications infrastructure. However those measures followed voluntary EU guidance, and some member states such as Spain have provoked concern from allies over their relationship with Chinese companies. Last year, the Spanish government cancelled a €10 million contract with Huawei after U.S. lawmakers said it threatened intelligence sharing with the country. A spokesperson for Huawei said the proposal “to limit or exclude non-EU suppliers based on country of origin, rather than factual evidence and technical standards, violates the EU's basic legal principles of fairness, non-discrimination, and proportionality, as well as its WTO obligations.” The use of U.S. technology and service providers has also prompted concern across the European Union following President Trump’s unpredictable decisions to sanction various political figures — resulting in prohibitions against them using technology provided by companies such as Microsoft — and aggressive comments towards Greenland. The company’s president, Brad Smith, has pledged to take legal action to resist any legal orders by the U.S. government demanding Microsoft suspend or cease its cloud operations in Europe. The threat of such an order has been stressed by competitors as part of ongoing antitrust probes in the bloc. U.S. officials have not yet formally reacted to the EU announcement. Despite generally sharing broad concerns about Chinese supplies, the U.S. has in recent months characterized similar digital laws as disadvantageous to American tech companies. The White House has recently threatened to impose tariffs on several European countries over their response to President Trump’s statements on Greenland. Alexander Martin is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79

The European Union said Tuesday it plans to phase out gear supplied by companies based in “high risk” countries from critical infrastructure such as high-speed telecom networks, in a move seen as targeting Chinese companies including Huawei and ZTE. Brussels’ proposed measures to tighten up cybersecurity come amid rising concerns that the bloc’s 27 member countries are vulnerable both to the dominance of Chinese high tech manufacturing and U.S. Big Tech services. Under the draft legislation released by the EU’s executive commission, telecom equipment from so-called high risk suppliers in third countries would be phased out within three years. The proposals don’t mention any countries or companies by name, but the term “high risk” has been previously used to refer to countries like China, home to tech giant Huawei. The company is the world’s biggest maker of networking equipment but has long been banned from the United States. The bloc’s executive said in 2023 that EU countries were justified in restricting or excluding Huawei and ZTE, another Chinese tech company sanctioned by the U.S., because they posed higher risks. But previous EU measures for 5G cybersecurity were recommended or voluntary, which resulted in uneven application across the bloc, with some countries buying Chinese gear while others shunned it. Under the new rules, the cybersecurity measures would become mandatory. Huawei said that as a “legally operating company in Europe,” it reserves the right to safeguard its “legitimate interests.” “A legislative proposal to limit or exclude non-EU suppliers based on country of origin, rather than factual evidence and technical standards, violates the EU’s basic legal principles of fairness, non-discrimination, and proportionality, as well as its WTO obligations,” the company said in a statement. The proposed restrictions also cover equipment in other sectors like security scanners used at border checkpoints, water supply systems and health and medical devices. “Our proposal is about protecting EU citizens and businesses by securing the ICT supply chains that support the critical sectors of our economy and society,” European Commission Vice President Henna Virkkunen told lawmakers at the European Parliament in Strasbourg, France, which will need to approve the proposals. Related: Huawei and Supply Chain Security – The Great Geopolitical Debate

The European Commission has proposed new cybersecurity legislation mandating the removal of high-risk suppliers to secure telecommunications networks and strengthening defenses against state-backed and cybercrime groups targeting critical infrastructure. This move follows years of frustration over the uneven application of the EU's voluntary 5G Security Toolbox, introduced in January 2020 to encourage member states to limit reliance on high-risk vendors. Although the proposal does not name specific companies, EU officials have expressed concerns about Chinese tech companies (such as Huawei and ZTE) when the 5G Security Toolbox was implemented. The new cybersecurity package would grant the Commission authority to organize EU-wide risk assessments and to support restrictions or bans on certain equipment used in sensitive infrastructure. EU member states would also jointly assess risks across the EU's 18 critical sectors based onthe suppliers' countries of origin and national security implications. "Cybersecurity threats are not just technical challenges. They are strategic risks to our democracy, economy, and way of life," EU tech commissioner Henna Virkkunen said today. "With the new Cybersecurity Package, we will have the means in place to better protect our critical ICT supply chains but also to combat cyber attacks decisively. This is an important step in securing our European technological sovereignty and ensuring a greater safety for all." The legislation also includes a revised Cybersecurity Act, designed to secure information and communication technology (ICT) supply chains, that mandates removing high-risk foreign suppliers from European mobile telecommunications networks. The revised Cybersecurity Act will also streamline certification procedures for companies, allowing them to reduce regulatory burdens and costs through voluntary certification schemes managed by the EU Agency for Cybersecurity (ENISA). As the Commission further explained, the new legislation empowers ENISA to issue early threat alerts, operate a single entry point for incident reporting, and help companies in responding to ransomware attacks, in cooperation with Europol and computer security incident response teams. ENISA will also establish EU-wide cybersecurity skills attestation schemes and pilot a Cybersecurity Skills Academy to build a European cybersecurity workforce. The Cybersecurity Act will take effect immediately upon approval by the European Parliament and the Council of the EU, with member states having one year to implement cybersecurity amendments into national law. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

ai and ML AI slop is good for business if you know what you're doingYour irresponsibility is someone else's opportunity SAAS Salesforce partners not seeing meaningful revenue from Agentforce AI platform, report saysShow us the money ai and ml AI companies are burning books, advocates complain to FTCFahrenheit 203, the temperature GPUs stop gorging on literature DEVOPS Go updates may delight diehard gophers but displease AI overlordsv 1.27 expands generics to support methods EDGE AND IOT Waymo has designed a robocar chip to stay ahead of Tesla5 nm ML accelerators promise 1,000+ TOPS, ultra-low latency Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

ai and ML AI slop is good for business if you know what you're doingYour irresponsibility is someone else's opportunity SAAS Salesforce partners not seeing meaningful revenue from Agentforce AI platform, report saysShow us the money ai and ml AI companies are burning books, advocates complain to FTCFahrenheit 203, the temperature GPUs stop gorging on literature DEVOPS Go updates may delight diehard gophers but displease AI overlordsv 1.27 expands generics to support methods EDGE AND IOT Waymo has designed a robocar chip to stay ahead of Tesla5 nm ML accelerators promise 1,000+ TOPS, ultra-low latency Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

Cybersecurity jobs available right now: September 23, 2025 Application Security Engineer PayPal | USA | On-site – No longer accepting applications As an Application Security Engineer, you will apply security best practices to enhance and optimize systems, ensuring protection and efficiency, while beginning to understand and align security solutions with business objectives. Analyze and resolve security challenges by adapting standard processes and exploring alternative approaches to address threats. Application Security Testing Manager Netcracker Technology | UAE | On-site – No longer accepting applications As an Application Security Testing Manager, you will lead a team of testers to conduct comprehensive security assessments across web, API, and mobile. You will plan and prioritize testing activities to ensure timely delivery of assessments and remediation plans, and perform hands-on testing using SAST, DAST, MAST, and Software Composition Analysis (SCA). CISO Fuse Energy | United Kingdom | Hybrid – No longer accepting applications As a CISO, you will define and lead Fuse’s security strategy across infrastructure, applications, and data. Lead hands-on development of security roadmaps, maturity models, and control frameworks tailored to Fuse’s risk profile. Directly contribute to architecture reviews, threat modelling sessions, and key design decisions across product and platform teams. Get weekly updates on new cybersecurity job openings. Subscribe here! CISO Solidus Labs | Israel | Hybrid – No longer accepting applications As a CISO, you will review and update information security controls to align with industry standards and regulatory expectations. Lead SOC 2 and ISO 27001 audit preparation, evidence collection, and ongoing process improvements. Coordinate penetration testing activities, from vendor engagement and planning through execution and remediation oversight. Cloud Security Architect Sopra Steria | Canada | Hybrid – No longer accepting applications As a Cloud Security Architect, you will design, build, implement, secure, and support international cloud infrastructure. Align organizational security strategy and cloud infrastructure with overall business and technology strategy. Identify security design gaps and recommend changes or enhancements. Cloud Security Expert (GCP) Leadtech Group | Italy | Remote – No longer accepting applications As a Cloud Security Expert (GCP), you will monitor networks and systems for suspicious activity, analyze security alerts and investigate incidents, conduct threat hunting to address potential risks, perform vulnerability assessments to find system weaknesses, and carry out penetration testing to evaluate security measures. Cyber Governance Consultant Sydney Airport | Australia | Hybrid – No longer accepting applications As a Cyber Governance Consultant, you will lead and manage supplier security assessments, ensuring quality and transparency of vendor risks. Coordinate compliance activities across ISO 27001, PCI-DSS, ASD Essential 8, and internal/external audits. Manage and maintain the Information Security Management System (ISMS) aligned to ISO and NIST standards. Contribute to vulnerability management and cyber-related risk reporting. Cybersecurity Engineer Hitachi Rail | Italy | Hybrid – View job details As a Cybersecurity Engineer, you will implement security measures to protect computer systems, networks, and information by assigning cybersecurity requirements to subsystems. You will configure and troubleshoot security infrastructure devices during factory and site testing. You will perform cyber risk assessments to identify sensitive data, evaluate vulnerabilities, and assess r Identity and Access Management Oversight State Street | Ireland | Hybrid – No longer accepting applications As an Identity and Access Management Oversight, you will serve as the primary SME on all aspects of CIAM related controls. Coordinate CIAM related response for audit, regulatory and other reviews, identify and address any gaps or inconsistencies between CIAM practices and standards. Assign and delegate tasks related to CIAM control implementation and remediation to IAM staff. Information Security Analyst, Security Audit & Awareness Essity | Germany | Hybrid – No longer accepting applications As an Information Security Analyst, Security Audit & Awareness, you will conduct internal audits of IT services, monitor compliance with security standards, and follow up on remediation activities. Plan and prioritize annual security services, make decisions based on standards and risk exposure, and report on security posture to IT management. Maintain security documentation, monitor emerging threats and technologies, and handle security-related requests. Information Security Architect SHVA | Israel | Hybrid – No longer accepting applications As an Information Security Architect, you will guide and advise on cybersecurity across business, infrastructure, and application projects. You will write and specify security requirements for company-wide initiatives, identify and manage risks, and monitor the implementation of security policies across systems and projects. Information Security and Compliance Lead Monolith | United Kingdom | Remote – No longer accepting applications As an Information Security and Compliance Lead, you will act as the primary owner for information security within Monolith, maintaining policies, controls, and frameworks. Manage technical security across our cloud infrastructure, ensuring best practices for access, monitoring, and data protection. Information System Security Officer SCCI | USA | On-site – No longer accepting applications As an Information System Security Officer, you will validate implemented controls, maintain RMF documentation, and assist in developing and reviewing accreditation documents, including security plans and hardware/software diagrams. You will support business plans and procedures such as IT strategic plans, contingency plans, incident response plans, and SOPs. You will also manage and document the ATO/IATT package process using eMASS. IT Security & Compliance Engineer Airties | France | Hybrid – No longer accepting applications As an IT Security & Compliance Engineer, you will lead vulnerability assessments and oversee remediation efforts to address identified vulnerabilities promptly. Coordinate penetration tests with external partners and oversee internal remediation efforts based on test results. Monitor and ensure adherence to compliance requirements across the organization, providing guidance and support as needed. Head of Application & Cloud Security MarketAxess | USA | Hybrid – No longer accepting applications As a Head of Application & Cloud Security, you will define and execute the security strategy for application and cloud environments, aligned to business priorities, delivery timelines, and compliance requirements. identify, assess, and track vulnerabilities, control gaps, and architectural risks across products and cloud platforms Prioritize remediation efforts based on risk, business impact, and threat intelligence—partnering with engineering teams to drive resolution. Malware Analysis Researcher C3iHub | India | On-site – No longer accepting applications As a Malware Analysis Researcher, you will analyze malware samples (PE, PDF, ELF, APK) using static, dynamic, and reverse engineering techniques. You will automate tasks with Python or Bash, maintain sandbox environments like Cuckoo Sandbox, and use open-source tools such as YARA, Volatility, Ghidra, and Radare2. You will also curate malware datasets for machine learning and perform source code analysis with SAST and DAST tools. Product Security Engineer Pluralsight | India | Hybrid – No longer accepting applications As a Product Security Engineer, you will support engineering teams with threat modeling, provide guidance, and mentor engineers. You will apply knowledge of common risks and vulnerabilities to help build secure products and maintain security tools and processes, including SAST/DAST and vulnerability reporting. Security Engineer, Application Security OpenAI | USA | Hybrid – No longer accepting applications As a Security Engineer, Application Security, you will be responsible for identifying and mitigating security vulnerabilities within software applications through building security tools, code reviews, penetration testing, and security assessments. Security Operations Analyst Huntress | Australia | Remote – No longer accepting applications As a Security Operations Analyst, you will triage, investigate, respond to, and remediate alerts generated by the Huntress platform. Perform dynamic analysis of malware where required to extract indicators of compromise or determine malicious intent of a file. Contribute to and refine detection capabilities by crafting and tuning signals to address emerging threats. Senior Cybersecurity Engineer ZTE Corporation | Germany | On-site – No longer accepting applications As a Senior Cybersecurity Engineer, you will perform cybersecurity assessments and penetration testing on IoT products, telecom systems, and network/OT equipment, and prepare assessment reports for stakeholders. Identify and evaluate cybersecurity vulnerabilities, support mitigation planning, and p

Cybersecurity jobs available right now: August 12, 2025 Cloud Platforms Engineering Manager Mozn | UAE | Remote – No longer accepting applications As a Cloud Platforms Engineering Manager, you will lead the design, implementation, and lifecycle management of scalable, secure, and highly available cloud infrastructure. Embed security best practices across infrastructure, ensuring compliance with internal policies and industry standards. Oversee IAM, network segmentation, and infrastructure hardening to protect critical assets and environments. Cybersecurity Engineer Genomics | United Kingdom | Hybrid – No longer accepting applications As a Cybersecurity Engineer, you will design and implement technical security architecture across IT systems, cloud platforms, and customer-facing services Lead advanced security operations including penetration testing, forensic analysis, threat hunting, and incident response Drive security automation initiatives and integrate DevSecOps best practices into company’s CI/CD pipelines. Cybersecurity Engineer Autoliv | France | Hybrid – View job details As a Cybersecurity Engineer, you will be responsible for authoring, collaborating, and reviewing the execution of activities necessary to achieve compliance with product-related Functional Safety and Cybersecurity Goals. Get weekly updates on new cybersecurity job openings. Subscribe here! Cybersecurity Senior Engineer UniCredit | Italy | On-site – No longer accepting applications As a Cybersecurity Senior Engineer, you will scout and evaluate emerging cybersecurity technologies, focusing on innovation and market trends. You will draft and review RFIs and RFPs, manage POCs/POVs to select optimal solutions, and lead the technical setup and initiation of implementation projects in collaboration with a Project Manager. Cyber Identity – Data Protection and Encryption Senior Consultant Deloitte | USA | Hybrid – No longer accepting applications As a Cyber Identity – Data Protection and Encryption Senior Consultant, you will assist clients to manage the deployment and lifecycle of PKI systems, ensuring robust and scalable certificate management processes. Monitor and maintain the health of certificate infrastructures to prevent downtime and security breaches. Cyber Strategy GRC Senior Manager Dunnes Stores | Ireland | On-site – No longer accepting applications As a Cyber Strategy GRC Senior Manager, you will lead the development, implementation, and maintenance of cybersecurity policies, standards, and guidelines. Oversee the cybersecurity risk management program, including risk assessment, risk treatment, and risk monitoring activities. Ensure compliance with relevant laws, regulations, and standards such as GDPR, PCI DSS, and ISO 27001. Conduct risk assessments of third parties to identify potential risks associated with their products, services, or business relationships. Detection Engineering Lead AXA Group Operations | France | Hybrid – No longer accepting applications As a Detection Engineering Lead, you will lead the creation, refinement and delivery of detection strategies that address both current and emerging threats across the global organization. Design, implement, and optimize detection use cases, rules, and algorithms within SIEM, EDR, and other detection platforms. Lead efforts to automate detection processes and integrate advanced detection techniques using SOAR platforms. Director, Identity Lifecycle Management Scotiabank | Canada | On-site – No longer accepting applications As a Director, Identity Lifecycle Management, you will monitor and enforce SLAs to ensure timely response and resolution of requests and incidents. You will partner with GIAM and Cybersecurity teams to align ILM operations with security goals and risk mitigation. Additionally, you will drive automation and continuous improvement to reduce operational overhead and enhance the user experience. Head of Cyber Operations The Star Entertainment Group | Australia | Hybrid – No longer accepting applications As a Head of Cyber Operations, you will design and maintain the incident response framework, including processes and plans that align with business needs and regulatory obligations. Oversee analysis and investigation of security events including antivirus, IPS, firewall alerts, DLP incidents, proxy logs, and threat intelligence feeds. Drive continuous improvement of SOC tooling and automation, including SIEM, EDR, and related platforms. Junior Cybersecurity Auditor White Hat | Israel | On-site – No longer accepting applications As a Junior Cybersecurity Auditor, you will conduct penetration tests on web applications and perform infrastructure and Active Directory assessments simulating real-world attacks. You will also collaborate with the team to deliver clear technical findings and actionable remediation advice. Junior Cybersecurity Engineer ZTE Corporation | Germany | On-site – No longer accepting applications As a Junior Cybersecurity Engineer, you will conduct security assessments of communication and IoT products, including vulnerability scans, penetration tests, and risk evaluations. You will help prepare security testing reports and documentation for stakeholders, and learn laboratory security testing processes, methodologies, and standards under senior guidance. Lead – Information Security Risk & Assurance Chalhoub Group | UAE | On-site – No longer accepting applications As a Lead – Information Security Risk & Assurance, you will be responsible for establishing and leading Chalhoub Group’s enterprise-wide security risk and assurance capabilities. This role drives the development of risk frameworks, control assurance, ISO 27001 and PCI DSS compliance, and IAM governance, while serving as a strategic advisor to executive leadership. Manufacturing Cybersecurity Lead Bridgestone | Italy | Hybrid – No longer accepting applications As a Manufacturing Cybersecurity Lead, you will be responsible for safeguarding the organization’s OT environments, including ICS, SCADA, PLCs, and other industrial systems, from cyber threats. You will lead a team of cybersecurity specialists to design and implement processes, policies, and solutions based on industry-leading practices, supporting the secure deployment of industrial control systems and applications across manufacturing plants. Principal Information Security Specialist NVISO Security | Germany | Hybrid – No longer accepting applications As a Principal Information Security Specialist, you will lead IT or security teams in implementing strategic programs, develop and refine governance, policies, and processes, design security architectures, define strategies based on risk and threat assessments, ensure compliance, and create action plans with stakeholders. Security Engineer, Applications Foundation Medicine | USA | Remote – No longer accepting applications As a Security Engineer, Applications, you will implement and maintain in-house security tools to support zero-trust and defense-in-depth architectures. You will evaluate custom software for vulnerabilities and recommend countermeasures. Additionally, you will conduct penetration testing, static and dynamic analysis, and fuzzing to identify and address security flaws. Security Gen AI Researcher ActiveFence | Israel | Hybrid – View job details As a Security Gen AI Researcher, you will simulate advanced attacks on generative AI models and their environments to find vulnerabilities. You will assess the security of AI systems, identify weaknesses and threats, and conduct risk analysis to prioritize mitigation efforts. Senior Cyber Security Engineer Bread Financial | India | Hybrid – No longer accepting applications As a Senior Cyber Security Engineer, you will responsible for designing, coding/configuring, and administering Cyber Security systems. Develop KPIs and mature reporting structures through data analysis using Excel, database queries, etc. Create actionable metrics and produce tailored presentations using Microsoft PowerPoint, Visio, or similar tools. Senior Cyber Security Engineer Arc Infrastructure | Australia | Hybrid – No longer accepting applications As a Senior Cyber Security Engineer, you will take ownership of establishing and maintaining security policies, procedures, and operational standards to protect both IT and OT assets. You will be responsible for the design, implementation, and administration of security tools and processes, as well as managing cyber risks across various projects. Senior Cyber Threat Intelligence Analyst Bupa | United Kingdom | Hybrid – No longer accepting applications As a Senior Cyber Threat Intelligence Analyst, you will lead threat-driven cybersecurity efforts, coordinate tactical and strategic actions, and work with leadership to maintain a proactive defense. You’ll also ensure all technology and services meet Threat Management standards. Senior Engineer, Maritime Cybersecurity Royal Caribbean Group | USA | On-site – No longer accepting applications As a Senior Engineer, Maritime Cybersecurity, you will develop technical standards, architectural/engineering diagrams, and procedures for shipboard and newbuild I.T. and marine operations units regarding how to securely configure and implement IT, ET and OT technology. Define and track assigned remediation tasks to ensure that shipboard IT, ET and OT vulnerabilities and defects are mitigated in a timely manner to reduce risk to systems and information. Senior Product Security Engineer CoStar Group | USA | On-site – No longer accepting applications As a Senior Product Security Engineer, you will enforce cloud security posture (AWS, GCP, Azure), secure Kubernetes runtime, manage federated IAM at scale. Enable incident response teams to hunt for threats, build run-time monitoring on cloud-native workloads, incident response escalation paths. Shift Lead Security Operations Arctic Wolf | Ireland | On-site – No longer accepting applications As a Shift Lead Security Operations, you will oversee daily escalations, manage shift handovers, and coordinate the shift teams handling inbound and outbound triage. You will serve as the escalation point for tactical issues, including customer concerns and internal communications. Additionally, you will develop and use metrics to improve shift efficiency, team cohesion, and compliance with service level objectives (SLOs). Specialist Information Security Independent Electricity System Operator | Canada | Hybrid – No longer accepting applications As a Specialist Information Security, you will support the IAM roadmap and governance, advise stakeholders, run phishing simulations and training, and track security metrics to identify trends and improvements.