Computer Security Articles

SummaryCryptocurrency is being used every day to facilitate a variety of transactions. It’s unlike the usual banking systems, having its own unique strengths and weaknesses. Attackers have made specialized malware to redirect normal transactions to wallets they control in order to steal money, referred to as “Clipbankers”. Due to the nature of cryptocurrency, these transactions are irreversible. ReversingLabs investigated two malware families of this nature, digging into how they work. This blog

One of the world’s leading AI companies just received an important reminder about cybersecurity: Your security is only as strong as the software you trust. On October 26,The Washington Post reportedthat researchers from cybersecurity startup Cathedral used AI agents to discover pathways into sensitive internal systems at Anthropic, the company behind Claude.The most significant detail wasn’t the sophistication of the AI agents or even the speed of the exercise. The researchers reportedly gained

A malware campaign that was discovered early this year targeting JavaScript and Python developers with cryptocurrency-related fake recruiter tasks has spread to Terraform providers and Go modules, according to research published recently by Aikido.It is the first time the company’s research team has observed malware distributed through Terraform providers. Aikido security researcherOliver Smith wrote in a September postthat the malware overlaps with the Graphalgo npm campaign thatReversingLabs r

Key takeawaysSource scanners, SBOMs, certificate managers, network monitors, and vendor questionnaires each answer a different question, and none of them inspects the cryptography inside the software you actually run.The gap is the final software artifact: compiled binaries, packages, and COTS products where no source, manifest, or vendor disclosure exists.Binary analysis fills that gap and can produce a CBOM that ties each cryptographic asset to the component containing it.You don’t need PQC su

Managed file transfer (MFT) systems, vendor portals, EDI pipelines, and e-signature platforms have something in common that has nothing to do with how they’re built: they concentrate valuable files, privileged access, and trusted connections to dozens or hundreds of external parties in one place.That concentration, not a shared flaw in how these systems are designed, is what makes them recurring targets. Cl0p’s 2023 MOVEit campaign showed the consequences of a compromise at this layer. Emsisoft’