Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Beginning in early April 2025, Kroll has observed a large wave of malicious activity surrounding "PDFast" software. Initial access for the campaign appeared to begin either through a new install of the application, through drive-by compromise on the site pdf-fastcom, or via pre-installed versions of the application that have since been updated with a malicious version.

Kroll continues to observe widespread attempted initial access through CLEARFAKE via fake CAPTCHA pop-ups across a wide range of industry sectors. As detailed in previous Kroll reporting, CLEARFAKE is a malicious in-browser JavaScript framework deployed on compromised webpages as part of drive-by compromise campaigns. Although CLEARFAKE continues to show the same themes surrounding its use alongside fake CAPTCHA pop-ups, there are also a wide range of nuances that have appeared in the past few months.

A merger or acquisition is one of the most critical steps a company can take. However, alongside the opportunity it presents for business growth, it also poses significant security threats. A target company—or even its supply chain—may bring with it a host of hidden security risks.

In today’s interconnected world, the convergence of cyber and physical security has become increasingly critical, particularly for high-profile individuals. The recent breach of Gravy Analytics’ geolocation data highlights the emerging threat of geolocation vulnerability and its potential impact on physical security.

A major investor services firm recognized that it required expert support to meet the deadline for complying with the Digital Operational Resilience Act (DORA), the EU regulation that aims to improve the cybersecurity and operational resilience of financial services firms.

As macOS becomes more prevalent in businesses, ensuring an application does not expose a user to vulnerabilities or your organization to business risk, is an important part of managing an organization’s risk. These apps often handle sensitive data, manage authentication and access system resources, making them attractive targets for cyber criminals to exploit. MacOS has unique security features that allow developers to build secure applications, but they must be correctly leveraged.

Trends observed by Kroll in Q4 confirm that 2024 was a year of fragmentation and fast-moving evolution for cyber threats, and they suggest that 2025 is likely to be similar. A key trend was the ongoing development of phishing techniques and approaches, as phishing’s continuation as a dominant method for initial access in 2024 illustrated. Aligning with trends from last year and previous years, professional services stands out as 2024’s most targeted sector.

Threat-led penetration testing brings together specialist offensive (red team) security skills and threat intelligence to enable businesses to proactively test and identify any weaknesses, deficiencies or gaps in their controls and counteractive measures that could be exploited by threat actors. In this article, we set out what threat-led pen testing is, how it relates to the Digital Operational Resilience Act (DORA) and the testing requirements included as part of the new EU regulation.

Organizations are under constant pressure to ensure that their security defenses adapt effectively to evolving threat actor methodologies. Extended detection and response (XDR) has the potential to significantly advance these efforts thanks to its ability to accelerate and streamline investigation, threat hunting and response. However, successfully adopting XDR to achieve comprehensive visibility demands some important considerations.

The deadline for European Union member states to pass the new EU NIS2 regulation into national law was October 17, 2024, yet only a few countries have transposed it into law, leaving others lagging behind, with regulations in draft or public consultation phases, or not at all. In the absence of certainty for firms (or what NIS2 calls entities), confusion is understandable, but steps can be currently taken considering what we already know.