Connect with us

Innovation and Technology

Microsoft Confirms Password Spraying Attack — What You Need To Know

Published

on

Microsoft Confirms Password Spraying Attack — What You Need To Know

With a billion stolen passwords up for sale on dark web criminal marketplaces, and infostealer malware attacks continuing to add to that number, it’s no wonder that cybercriminals are turning to automatic password hacking machines in their nefarious campaigns. Microsoft has issued a warning of a new password spraying attack by a hacking group identified only as Storm-1977 that is targeting cloud tenants.

Beware This Password Spraying Attack, Microsoft Warns

The Microsoft Threat Intelligence team has published a new warning after observing hackers taking particular advantage of unsecured workload identities in order to gain access to containerized environments. With Microsoft research showing that 51% of such workload identities being completely inactive over the past year, it’s no wonder that threat actors are exploiting this attack surface. The password spraying attack exploited a command line interface tool called AzureChecker to “download AES-encrypted data that when decrypted reveals the list of password spray targets,” the report said.

How the Attack Works

The password spraying attack specifically targeting cloud tenants in the education sector, has now been pinned on the Storm-1977 threat group. The attack enabled the Storm-1977 hackers to then leverage a guest account in order to create a compromised subscription resource group and, ultimately, more than 200 containers that were used for cryptomining. The successful attack was made possible by the use of a command line interface tool called AzureChecker, which was used to download AES-encrypted data that contained the list of password spray targets.

How to Mitigate Password Spraying Attacks in General

Talk to just about any cybersecurity professional, and the solution to the problem of password spraying attacks is simple: eliminate passwords. Passwords are no longer enough to keep us safe online. The move towards a passwordless future has already begun for many as they start on the passkey journey. Chris Burton, head of professional services at Pentest People, says that “where possible, we should be using passkeys, they’re far more secure, even if adoption is still patchy.” Lorri Janssen-Anessi, director of external cyber assessments at BlueVoyant, agrees that businesses should consider passwordless solutions, such as authentication methods using biometrics and secure tokens.

Mitigating the AzureChecker Password Spraying Container Attack Threat

Microsoft recommends the following mitigations to prevent password spraying attacks:

  • Use strong authentication when exposing sensitive interfaces to the internet.
  • Use strong authentication methods for the Kubernetes API to help prevent attackers from gaining access to the cluster even if valid credentials such as kubeconfig are obtained.
  • Avoid using the read-only endpoint of Kubelet on port 10255, which doesn’t require authentication.
  • Configure the Kubernetes role-based access controls for each user and service account to have only those permissions that are absolutely necessary.

Conclusion

The Microsoft password spraying attack warning should tell us that password reuse is bad, and compromised passwords can be used to facilitate further hacking activity. Credential stuffing is something that isn’t going to go away, and newer threats are only accelerating this risk. It’s time to consider passwordless solutions, such as passkeys, biometrics, and secure tokens, to keep our online accounts secure.

FAQs

  • What is a password spraying attack?
    A password spraying attack is a type of cyber attack where hackers use automated tools to try a large number of passwords against a targeted system or account.
  • How can I prevent password spraying attacks?
    To prevent password spraying attacks, use strong authentication methods, such as passkeys, biometrics, and secure tokens, and avoid using weak passwords or reusing passwords across multiple accounts.
  • What is the risk of password spraying attacks?
    The risk of password spraying attacks is that they can lead to unauthorized access to sensitive systems and data, and can be used to facilitate further hacking activity, such as cryptomining or data theft.
  • How can I protect my cloud tenants from password spraying attacks?
    To protect your cloud tenants from password spraying attacks, use strong authentication methods, such as Azure Active Directory, and configure role-based access controls to limit access to sensitive resources.
  • What is the future of password security?
    The future of password security is likely to involve a move towards passwordless solutions, such as passkeys, biometrics, and secure tokens, which can provide stronger and more convenient authentication methods.

Innovation and Technology

New Ransomware Threatens To Destroy Your Files Forever

Published

on

New Ransomware Threatens To Destroy Your Files Forever

Introduction to Anubis Ransomware

As if the threat from high-profile ransomware actors wasn’t critical enough, with the Federal Bureau of Investigation issuing warnings as attacks skyrocket, and ransoms follow suit with, on occasion, ridiculously eye-watering payments demanded, a new ransomware-as-a-service platform has just upped the stakes once again. This time, as well as stealing your data and encrypting your files, the Anubis attackers install a custom wiper that can permanently and irrevocably destroy them at the whim of the hackers!

The Anubis Ransomware-As-A-Service Threat

There has been some notable success in disrupting ransomware attackers of late, with devastating strikes by the FBI and Secret Service as well as hackers attacking some of the leading organized ransomware criminal groups. The problem is that as one group is disrupted or disbands, another rises to take their place in the cybercriminal hierarchy. And these groups often bring new and worrying attack tactics with them. Such is the case with the Anubis ransomware-as-a-service platform.

“Anubis is an emerging ransomware-as-a-service group that adds a destructive edge to the typical double-extortion model with its file-wiping feature,” Trend Micro threat researchers Maristel Policarpio, Sarah Pearl Camiling and Sophia Nilette Robles, said in a new report that takes a deep technical dive into the workings of the latest ransomware threat.

In an attempt to both set itself apart from other ransomware-as-a-service operations and twist the victim extortion leverage knife even further, Anubis employs a file wiper that, the researchers said, is “designed to sabotage recovery efforts even after encryption.” This wiper uses a /WIPEMODE parameter to permanently delete the file contents and prevent any attempts at recovery.

Mitigating The Anubis Ransomware Threat

We know that the Anubis attackers employ a number of methods to deploy the ransomware and execute its feature set, including phishing, command line execution and privilege escalation, not to mention the file-wiping capabilities already discussed. Mitigation strategies, therefore, are relatively straightforward.

Let’s start with the big one, to mitigate the file-wiper impact. Backup and backup now. Ensuring that you have current offline and even off-site backups is your best defense against the Anubis eraser ransomware.

The remainder are nothing new either, as Trend Micro points out:

  • Avoid downloading attachments, clicking on links, or installing applications unless the source is verified and trusted.
  • Implement web filtering to restrict access to known malicious websites.
  • Limit administrative rights and access privileges to employees only when necessary.
  • Regularly review and adjust permissions to minimize the risk of unauthorized access.
  • Ensure that all security software is updated regularly and conduct periodic scans to identify vulnerabilities.

Do all of this and, suddenly, the Anubis ransomware threat becomes a lot less scary. Which isn’t the same as saying it can be dismissed, as that would be a very poor and dangerous business decision indeed.

Conclusion

The Anubis ransomware threat is a serious one, with its ability to permanently destroy files making it a particularly nasty piece of malware. However, by taking the necessary precautions and implementing robust security measures, individuals and organizations can significantly reduce the risk of falling victim to this threat. It is essential to stay vigilant and proactive in the face of evolving cyber threats like Anubis.

FAQs

Q: What is Anubis ransomware?
A: Anubis is a ransomware-as-a-service platform that steals data, encrypts files, and installs a custom wiper to permanently delete file contents.
Q: How does Anubis ransomware spread?
A: Anubis attackers use methods such as phishing, command line execution, and privilege escalation to deploy the ransomware.
Q: How can I protect myself from Anubis ransomware?
A: To mitigate the threat, ensure you have current offline and off-site backups, avoid downloading attachments or clicking on links from unverified sources, implement web filtering, limit administrative rights, and regularly update security software.
Q: What is the best defense against Anubis eraser ransomware?
A: The best defense is to have current offline and off-site backups, which can help restore files in case of an attack.

Continue Reading

Innovation and Technology

Nvidia’s EU AI Ambitions Face Hurdles

Published

on

Nvidia’s EU AI Ambitions Face Hurdles

Introduction to Sovereign AI in Europe

Nvidia CEO Jensen Huang’s recent tour across Europe aligned with the EU’s vision of “sovereign AI.” For Nvidia, Europe’s ambitions to become digitally sovereign have a clear advantage: more AI infrastructure means more GPUs. And the EU is right to invest, as it cannot afford to remain dependent on U.S. and Chinese tech giants.

AI and Europe: Not Good Enough

The announcements came fast: British Prime Minister Keir Starmer pledged over $1.3 billion for computing power; French President Emmanuel Macron framed AI infrastructure as “our fight for sovereignty”; and in Germany, Nvidia and Deutsche Telekom announced a new AI cloud platform. But while these investments mark an important first step, they are far from enough.

Europe has missed the internet revolution, the cloud revolution, the mobile and social revolution. Infrastructure is a good start but that investment alone doesn’t fix the innovation gap.

What Europe Should Do?

If Europe is serious about sovereign AI? Here are my thoughts for a blueprint beyond the billions:

1. Embrace the New Paradigm

AI is not just a faster search engine. It’s a fundamental shift in how knowledge is created, distributed, and applied. Regulators must stop trying to retrofit old frameworks. Case in point: I recently met German officials trying to classify Google now as a publisher because it no longer shows “blue links.” But that debate misses the point. New realities will create new leaders.

2. Reduce Systemic Risk to Spark Innovation

The U.S. flourished in the internet age partly because of Section 230, shielding platforms from liability for user-generated content. Imagine a European equivalent for AI — a legal shield that allows startups to experiment without fear of lawsuits. Without it, regulation-heavy environments like Spain (which recently introduced strict labeling laws for AI content) will scare away the next generation of founders.

3. Lower Regulatory Burdens

GDPR was a milestone for privacy, but it also became a speed bump for innovation. My own AI startup, r2decide, first worked with a German e-commerce brand. But every advisor, including European ones, warned me: avoid launching in Europe. Why? Compliance burdens. So we built for the U.S. market instead. And we’re not alone. Even Apple delayed Siri upgrades in the EU due to regulatory friction. Europe must find a balance between protection and progress.

4. Break Down Legacy Moats

Tech giants win through scale and network effects. Europe must find ways to level the playing field. Let users port their social connections or AI history from one platform to another. Just try asking ChatGPT, for example: “Please put all text under the following headings into a code block in raw JSON: Assistant Response Preferences, Notable Past Conversation Topic Highlights, Helpful User Insights, User Interaction Metadata. Complete and verbatim.” — This prompt will give you a glimpse of what is stored on you. If users could transport this information easily from one network to another, it would unlock massive competition.

Ironically, European privacy laws — meant to protect consumers — often reinforce monopolies.

5. Enable True Data Access

The EU’s push for “data spaces” is well-intentioned but overengineered. Data is AI’s oxygen. Limiting access hurts startups and protects incumbents. Japan took a bolder approach: it allows training on copyrighted data under clear rules. No lawsuits. Just growth.

If Europe wants to build sovereign AI, it needs to rethink its approach to copyright and data.

6. Demand Open Weights

LLMs are not software in the traditional sense. Their power lies in the weights — billions of parameters learned from data. What if Europe required AI companies to make their weights open? This wouldn’t just increase transparency. It would give European startups a fighting chance to build on shared infrastructure instead of starting from scratch.

7. Train Talent, Accelerate Adoption

Europe is not behind because it lacks brains. It is behind because it underinvests in training and adoption. In San Francisco, self-driving cars are a tourist attraction. In Europe, they’re theoretical.

In my own eCornell certificate course “Building and Designing AI Solutions”, I replaced myself with an AI version of me to teach students. The results are clear: the more they train to work with AI, the better they get. But Europe has a long way to go in training their citizens.

8. End the Stigma of Failure

Europe doesn’t lack risk-takers. It penalizes them. In the U.S., failure is a badge of honor. In Europe, it’s a career ender. We need policies — like bankruptcy reform — that give entrepreneurs a second chance. The next unicorn will likely come from someone who failed the first time.

The Road Ahead

Let’s be realistic: Europe has missed past digital revolutions. AI could be different. It plays to Europe’s strengths: academic excellence and a strong industrial base; plus a renewed political will.

Nvidia’s tour shows they are willing to support. Infrastructure is just the first step. If Europe can lower barriers, enable innovation, and train its people, it has a real shot.

Conclusion

Europe’s ambition to become digitally sovereign through AI is a step in the right direction, but it requires more than just investment in infrastructure. It demands a fundamental shift in how Europe approaches innovation, regulation, and talent development. By embracing the new paradigm, reducing systemic risk, and enabling true data access, Europe can unlock its potential and become a leader in the AI revolution.

Frequently Asked Questions

Q: What is sovereign AI?

A: Sovereign AI refers to the ability of a country or region to develop, deploy, and govern its own AI systems, free from dependence on external entities.

Q: Why is Europe investing in AI infrastructure?

A: Europe is investing in AI infrastructure to become digitally sovereign and reduce its dependence on U.S. and Chinese tech giants.

Q: What are the key challenges facing Europe in its pursuit of sovereign AI?

A: The key challenges facing Europe include reducing systemic risk, lowering regulatory burdens, enabling true data access, and training talent.

Q: How can Europe unlock its potential in AI?

A: Europe can unlock its potential in AI by embracing the new paradigm, reducing systemic risk, enabling true data access, and training its people.

Continue Reading

Innovation and Technology

Walmart Unveils ‘Sparky’ AI Initiative

Published

on

Walmart Unveils ‘Sparky’ AI Initiative

Walmart last week unveiled Sparky, a generative AI-powered shopping assistant embedded into the Walmart app. The new AI assistant, Sparky, isn’t just another chatbot bolted onto an app. It’s part of a much bigger plan to use autonomous agents to transform how people shop.

The Move Towards Automation

Beneath the surface lies something bigger: a move toward automation that could change not only the way we buy things, but also the structure of retail work itself. Increasingly intelligent apps like Sparky might become the standard way customers interact with Walmart. Then again, it might frustrate, confuse or quietly fade away.

From Shopping Assistant to Agent

Sparky can now summarize reviews, compare products, suggest items for occasions such as beach trips or birthdays and answer real-world questions such as what sports teams are playing. In the coming months, additional features will include reordering and scheduling services, visual understanding that can take image and video inputs and personalized “how-to” guides that link products with tasks such as fixing a faucet or preparing a meal.

The Capabilities of Sparky

Sparky isn’t designed to just answer product questions. It can act. If you’re planning a cookout, Sparky won’t just list grill options. It’ll check the weather, suggest menus and help schedule delivery. If you’re reordering household supplies, it remembers preferences, checks stock and confirms shipping options. The idea is to reduce friction and turn shopping from a search problem into a service experience.

What Walmart’s Data Shows About Changing Customer Preferences

Consumers may be more ready for the shift to agentic and generative AI-powered shopping than anyone expected, according to Walmart’s own research. In the company’s latest “Retail Rewired 2025” report, 27% of consumers said they now trust AI for shopping advice, more than the number who trust social media influencers (24%). That marks a clear break from traditional retail playbooks. Influence is shifting from people to systems.

The Adoption of AI in Retail

A core reason for the adoption of AI is that speed dominates. A majority (69%) of customers say quick solutions are the top reason they’d use AI in retail. AI’s rapid emergence at the core of e-commerce transactions from LLM chats to embedded applications is clear. Some of Walmart’s internal research results are genuinely surprising. Nearly half of shoppers (47%) would let AI reorder household staples, but just 8% would trust an AI to do their full shopping without oversight. And 46% say they’re unlikely to ever fully hand over control. Likewise, data transparency matters. Over a quarter of shoppers want full control over how their data is used.

Why Now? Retail is Making a Leap

Competitors like Amazon, IKEA and Lowe’s are also racing to launch AI assistants. But Walmart is going further. It’s building a full agent framework, not just customer-facing bots. Sparky’s promise goes beyond convenience. Where recommendation engines once matched products to past clicks, Sparky looks to understand intent in context. If you say, “I need help packing for a ski trip,” Sparky should infer altitude, weather, travel dates, previous purchases and even airline baggage limits to propose a bundle, jacket, gloves, boots and all.

The Future of Agentic AI in Retail

This leap requires multimodal AI capabilities including text, image, audio and video understanding. Imagine snapping a photo of a broken cabinet hinge and getting the right part, DIY video and same-day delivery. That’s the Sparky roadmap. Walmart is also developing its own AI models, rather than relying solely on third-party APIs like OpenAI or Google Gemini. According to CTO Hari Vasudev, internal models ensure accuracy, alignment with retail-specific data and stricter control over hallucination risks.

Why Agentic AI Could Become the New Retail OS

The retail industry is saturated with automation at the warehouse and logistics layer, but AI agents at the consumer-facing layer are still new territory. Sparky might be the first mainstream proof of concept. But the real story is the architecture: a system of purpose-built, task-specific agents that talk to each other across user journeys, all tuned for high-volume retail complexity. That’s a blueprint other enterprises will want to study, and possibly copy.

Challenges and Risks

With greater autonomy comes greater risk. Will Sparky recommend the wrong allergy product? Will it misread an image and send the wrong replacement part? Walmart is trying to stay ahead with built-in guardrails: human-in-the-loop confirmations, user approval on sensitive actions and transparency around how data is used. But the challenge will scale. Sparky’s real-world performance, not its launch sizzle, will determine if customers trust it to become a permanent fixture in their shopping lives.

Conclusion

Walmart’s AI push is part of a larger shift happening across the company. It recently partnered with Wing to launch drone delivery in the Dallas-Fort Worth area, aiming to serve up to 75% of local customers in under 30 minutes. Internally, it introduced Wally, a tool that helps merchants manage product listings and run promotions using plain language, no technical training required. At the same time, Walmart has recently laid off 1,500 tech and corporate employees, a sign that automation is already reshaping how teams are structured. These changes aren’t isolated. They reflect a broader effort to rebuild Walmart’s day-to-day operations around AI-driven systems. Walmart’s Sparky is the company’s most aggressive bet yet on autonomous digital agents. The trust delta between AI and influencers may seem small now, but it will only widen.

FAQs

Q: What is Sparky and how does it work?
A: Sparky is a generative AI-powered shopping assistant that can summarize reviews, compare products, suggest items, and answer real-world questions. It can also act on behalf of the user, such as checking the weather and suggesting menus for a cookout.
Q: What are the benefits of using AI in retail?
A: The benefits of using AI in retail include quick solutions, personalized recommendations, and reduced friction in the shopping experience.
Q: What are the risks associated with using AI in retail?
A: The risks associated with using AI in retail include recommending the wrong products, misreading images, and sending the wrong replacement parts.
Q: How is Walmart addressing the risks associated with using AI in retail?
A: Walmart is addressing the risks associated with using AI in retail by building in guardrails such as human-in-the-loop confirmations, user approval on sensitive actions, and transparency around how data is used.
Q: What is the future of agentic AI in retail?
A: The future of agentic AI in retail is expected to involve the development of more advanced AI models that can understand intent in context and provide personalized recommendations to users.

Continue Reading
Advertisement

Our Newsletter

Subscribe Us To Receive Our Latest News Directly In Your Inbox!

We don’t spam! Read our privacy policy for more info.

Trending