Michael Hoffmann

Your email gateway can see the PDF. It just can't open it. We've been tracking an AiTM phishing campaign across our managed Australian environments that chains together compromised business email accounts, password-protected PDF lures, and adversary-in-the-middle infrastructure hosted on hijacked Australian domains. The result: a single attack chain that bypasses email gateway scanning, MFA, and domain reputation checks simultaneously. In our latest blog post, we break down the full kill chain we observed and disrupted, including: - How the attacker weaponised encrypted PDFs to blind email security gateways - Why the phishing infrastructure carried trusted domain reputation scores - The specific persistence mechanism that survives a password reset - The remediation step order that matters (get it wrong and the attacker keeps access) - KQL hunting queries your team can run today We detected and contained this attack within minutes because we baseline ISP behaviour per user, not just IP addresses and countries. Read the full breakdown: https://lnkd.in/gvzieJCV #CyberSecurity #AiTM #Phishing #ThreatHunting #KQL #Sentinel #BlueTeam #IncidentResponse #MFA #InfoSec

6

Patch Management Australia: 5 Mistakes SMBs Make in 2026 Patch management Australia: discover 5 critical mistakes Australian SMBs make leaving systems exposed — and how to fix them before attackers exploit the gaps.

7

After monitoring the threat actor's dark web leak site, Rivanorth observed that Scattered LAPSUS$ Hunters has removed Telstra as a victim. No data was published contrary to their initial claims of releasing 100GB of data if the ransom wasn't paid. This incident underscores why having accurate and trusted data on your third parties is critical to correctly understanding your risk exposure. In the initial stages of this threat, organisations needed to quickly assess whether Telstra was part of their supply chain and what their potential exposure could be. Rivanorth Oko provides real-time dark web and third-party security monitoring, where initial alerts that are not backed by actual findings are listed as low risk first. Only if confirmed does the risk get adjusted depending on what is found. This approach helps organisations avoid unnecessary panic while remaining vigilant to genuine threats. While threats continue to evolve, it's crucial to balance early warnings with accurate intelligence to make informed decisions about your cybersecurity posture. https://lnkd.in/g5hQZc8N

2

👥 𝐌𝐅𝐀 𝐟𝐨𝐫 𝐊𝐢𝐝𝐬: 𝐒𝐨𝐥𝐮𝐭𝐢𝐨𝐧𝐬 𝐟𝐨𝐫 𝐏𝐫𝐢𝐦𝐚𝐫𝐲 𝐒𝐜𝐡𝐨𝐨𝐥𝐬 👥 MFA is not just a best practice, it is a core requirement under widely adopted cybersecurity frameworks, including the Australian Cyber Security Centre’s Essential Eight and the NIST Cybersecurity Framework (CSF). These standards emphasise MFA as a critical control for protecting user identities. In today’s increasingly digital education landscape, cybersecurity is no longer a luxury, it’s a foundational requirement. Yet, many primary schools, particularly those serving students in Years 1 to 6, continue to face a persistent and unresolved challenge: implementing multi-factor authentication (MFA) for students who do not have access to mobile phones or personal email accounts. 𝘞𝘩𝘺 𝘛𝘳𝘢𝘥𝘪𝘵𝘪𝘰𝘯𝘢𝘭 𝘔𝘍𝘈 𝘋𝘰𝘦𝘴𝘯’𝘵 𝘞𝘰𝘳𝘬 𝘧𝘰𝘳 𝘠𝘰𝘶𝘯𝘨 𝘚𝘵𝘶𝘥𝘦𝘯𝘵𝘴 ⁉️ The key challenges include: 🔷 Phones and emails are uncommon: Most students in this age group do not own smartphones or have personal email accounts, and in many schools, mobile phone use is restricted or prohibited on campus. This makes standard MFA channels like SMS codes or email verification inaccessible for younger learners. 🔷 Digital literacy is still developing: Young children may struggle with complex login procedures, especially those involving multiple steps. 🔷 Privacy concerns are paramount: Schools and families are cautious about exposing children to unnecessary data collection or requiring them to manage personal credentials. 𝘛𝘩𝘦 𝘙𝘪𝘴𝘬𝘴 𝘰𝘧 𝘚𝘬𝘪𝘱𝘱𝘪𝘯𝘨 𝘔𝘍𝘈 ⚠️ ❎ Compromised learning platforms ❎ Theft or manipulation of student records ❎ Exposure of sensitive health or behavioural data ❎ Disruption of classroom operations Read the full article https://lnkd.in/gwpdV2tW written by Awni Fallouh - MBA, CISA, CISM, CRISC. He has explained the Affordable MFA Alternatives for Schools 𝐒𝐩𝐚𝐫𝐭𝐚𝐧𝐬 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲  is an Australian cybersecurity provider that helps schools build robust, standards-aligned security programs. We offer a customised approach to MFA implementation, starting with a needs assessment to find the right solution for students, staff, and your school's IT environment. ✍ 𝐆𝐞𝐭 𝐢𝐧 𝐭𝐨𝐮𝐜𝐡 𝐚𝐭 𝐈𝐧𝐟𝐨@𝐬𝐩𝐚𝐫𝐭𝐚𝐧𝐬𝐬𝐞𝐜.𝐜𝐨𝐦 #CyberSecurity #InfoSec #CyberResilience #InfosecCommunity hashtag #Spartanssec #Australianbusiness #CNA #CVENumberingAuthority #ZeroTrust #SecurityBestPractices #MicrosoftSecurity #MFA

8

🚨 AppSec AU Melb #13 - Open Source Supply Chain Malware: Lessons from NX, Chalk & the Shai-Hulud Worm by Cameron Townshend 🧩 ➡️ Event rego: https://lnkd.in/gsGme_bx Open source software has become the backbone of modern development — but it’s also the newest attack surface. Join us for a deep dive into three real-world malware incidents — NX, Chalk, and Shai-Hulud — that exposed how easily trust can be weaponised in developer ecosystems. We’ll explore: 🔍 How attackers infiltrated open source supply chains ⚙️ Why traditional defences failed to detect them 🛡️ Practical steps to protect your CI/CD and dependencies If you care about securing your build pipelines, package registries, or developer environments — this is one session you don’t want to miss. ➡️ Event rego: https://lnkd.in/gsGme_bx Event hosts: Kaif Ahsan, Kumar Soorya & Liz B. Big thanks to Atlassian, Sonatype & HCLSoftware for supporting our events as always. 🫡 #meetup #cybersecurity #infosec #community #supplychain #tech

11