The US Securities and Exchange Commission's (SEC) new Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure ruling took effect last fall. Public companies must disclose whether their boards of directors have cybersecurity experts. Keri Pearlson, executive director of the Cybersecurity at MIT Sloan Research Consortium (CAMS), studies organizational, strategic, management, and leadership challenges in cybersecurity, with her current focus being on the board's role.

Attacks on GPS signals and wider satellite navigation systems, known as GNSS, have increased. Attackers can jam signals, forcing them offline, or spoof signals to make aircraft and ships appear in false locations on maps. Governments and telecommunications organizations, along with airline safety experts, are now warning of disruptions and potential major disasters stemming from such attacks. Attacks against GPS, and the wider GNSS category take two forms.

Panda Restaurant Group, the parent company of Panda Express, Panda Inn, and Hibachi-San, recently disclosed a data breach after attackers compromised its corporate systems in March and stole the personal information of an undisclosed number of individuals. Panda Express is the largest Chinese fast food chain in the United States, with over $3 billion in sales and 47,000 associates working in 2,300 branches.

Phishing campaigns involving Microsoft Azure and Cloudflare lures are now spreading "Latrodectus" malware. Latrodectus, also known as "Unidentified 111" and "IceNova," is a Windows malware downloader that serves as a backdoor, downloading EXE and DLL payloads or executing commands. Researchers have linked the malware to the developers of the IcedID modular malware loader. The newer malware is increasingly being used in phishing campaigns and contact form spam for initial access to corporate networks.

According to a study published by the University of Toronto's Citizen Lab, 1 billion smartphone users are exposed due to digital Chinese-language keyboards that are vulnerable to spying and eavesdropping. The discovered flaws provide a new cyberattack exploit, regardless of whether the device's keyboard is Chinese, English, or another language. Tencent's proprietary Chinese keyboard system was studied by the Citizen Lab last year.

Qantas Airways recently announced that some of its customers were impacted by a misconfiguration in its app that exposed sensitive information and boarding passes to random users. Qantas is Australia's flag carrier and the largest airline by fleet size, operating 125 aircraft and serving 104 destinations. Qantas has 23,500 employees and an annual revenue of almost $12.9 billion.

Gartner reports that 63 percent of organizations worldwide have implemented a zero trust strategy, fully or partially. This investment makes up less than 25 percent of the cybersecurity budget for 78 percent of organizations that have implemented a zero trust strategy. A fourth-quarter 2023 Gartner survey of 303 security leaders found that 56 percent of organizations were pursuing a zero trust strategy because it is considered an industry best practice.

According to the FBI, scammers stole more than $3.4 billion from older Americans last year. Losses from scams reported by Americans over the age of 60 last year were up 11% over the year before. The FBI is warning of a rise in bold schemes to drain bank accounts that involve sending couriers in person to collect cash or gold from victims. Deputy Assistant Director James Barnacle of the FBI's Criminal Investigative Division stated that it can have a devastating impact on older Americans who lack the ability to go out and make money.

Lumen's Black Lotus Labs discovered a new malware platform called "Cuttlefish" that collects public cloud authentication data from Internet traffic, targeting enterprise-grade and Small Office/Home Office (SOHO) routers. Cuttlefish is a platform that steals authentication material from web requests that transit the router from the adjacent Local Area Network (LAN).

Verizon's 2024 Data Breach Investigations Report (DBIR) found that the exploitation of vulnerabilities for initial access increased by 180 percent between 2022 and 2023. This method was used by 14 percent of malicious actors to breach networks. It follows credential theft and phishing as the third most used.