OpenAI disrupted over 20 malicious cyber operations involving ChatGPT, its Artificial Intelligence (AI)-driven chatbot. Threat actors have used ChatGPT to develop malware, evade detection, and more. OpenAI's report is the first to officially confirm that generative mainstream AI tools are being used for offensive cyber operations. In April, Proofpoint reported that "TA547," also known as "Scully Spider," launched an AI-written PowerShell loader for the "Rhadamanthys" infostealer.

The finalization of the latest version of the Cybersecurity Maturity Model Certification (CMMC) program empowers US Department of Defense (DOD) officials to better assess cybersecurity measures implemented by defense contractors. Defense contractors must pass the program to bid on DOD contracts. The CMMC will verify that DOD's thousands of contractors comply with Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) protections. This article continues to discuss the evolution of the CMMC program.

The cyber insurance provider Coalition reported that its customers made fewer claims in the first half of 2024 than in the same period in 2023, but their average loss increased by 14 percent to $122,000. According to the company, the rise in ransomware severity increased losses, and threat actors targeted larger businesses. This article continues to discuss findings regarding the rise in ransomware demands and claim sizes.

Japanese game developer Game Freak, the firm behind the Pokémon franchise, has recently suffered a security breach exposing the data of 2606 employees and partners.  The leak first appeared on forum 4chan in early October and is now circulating on social media and online forums under the name "TeraLeak."  TeraLeak contains multiple gigabytes of information.

Casio has recently revealed that some of its corporate systems and services are still damaged and personal information has been compromised, after a ransomware attack over a week ago.  The Japanese electronics giant said it was alerted to an unauthorized intrusion after a system failure on October 5 rendered several systems unusable.  The full extent of the damage is still under investigation, but the company has set up a task force and is currently working diligently to quickly restore internal systems and resume operations.

Penn State researchers will lead a multi-institution project called "Verified Probabilistic Cognitive Reasoning for Tactical Mixed Reality Systems (VeriPro)" funded by the Defense Advanced Research Projects Agency (DARPA) to identify cognitive threats faced by Mixed Reality (MR) systems as part of the agency's "Intrinsic Cognitive Security" program. The project aims to model risks, human behaviors, and potential attacks and mitigations within MR systems.

In a new art exhibition, Virginia researchers and artists challenge our cybersecurity perceptions. The Commonwealth Cyber Initiative (CCI)-funded "CyberArts 2024 Exhibit" includes projects from Blue Ridge Community College, George Mason University, James Madison University, Old Dominion University, Virginia Commonwealth University, and Virginia Tech. A project named "Hidden Within" delves into steganography, a practice that can be used in a cyberattack. It involves hiding a message within a digital picture or music.

A critical security vulnerability allows ransomware gangs such as "Akira" and Fog" to conduct Remote Code Execution (RCE) on vulnerable Veeam Backup & Replication (VBR) servers. Florian Hauser, a security researcher at Code White, found that the flaw, stemming from a deserialization of untrusted data weakness, can be used in low-complexity attacks. This article continues to discuss the exploitation of a critical Veeam RCE flaw.

The SANS Institute, a leading cybersecurity research, education, and certification authority, has released its annual "Top Attacks and Threats Report." This report delves into the changing threat landscape as it identifies the most common and dangerous cyberattack techniques organizations must be on the lookout for. It also focused on key takeaways from a presentation at SANS Institute's yearly RSA Conference. SANS members identified and discussed five new cyberattacks, as well as suggested responses to them.

A data breach has exposed over 10 million conversations from an Artificial Intelligence (AI)-driven call center platform in the Middle East. According to researchers at Resecurity, the breach involved unauthorized access to the platform's management dashboard, which enabled attackers to collect millions of interactions between consumers, operators, and AI agents. The stolen data could be used for advanced fraud, phishing schemes, and other malicious activities involving AI. This article continues to discuss the AI call center hack.