Skip to content

NordPass Desktop App: Release Notes

NordPass 5.10 (latest)

We’ve waved bye-bye to some pesky bugs and have also spruced up the place a touch. Stay tuned for some big news that’s just around the corner!

NordPass 5.9

Hold on to your seat — we’ve got some very exciting news to announce:

  • Browser Extension: You now have the option to use a new standalone NordPass browser extension that doesn’t require our desktop app! That’s right, you can now enjoy a fast, fully browser-based NordPass experience on Chrome, Firefox, Safari and more.

  • Autofill: You asked, we’ve listened. You can now tweak your app settings to enjoy a better autofill experience on websites with a subdomain.

  • Password Health: When logging in to a website, you’ll now be prompted if your password is weak or reused so that you can quickly act to reduce the risk of your data falling into the wrong hands.

NordPass 5.8

Gather round, folks — we’ve got some exciting updates to share:

  • Data hosting: Organizations using NordPass Business or Enterprise can now choose to store company data in the European Union.

  • Autofill: You can now instantly search for a specific item to autofill on a webpage if it’s not automatically suggested for you.

  • Custom fields: You can now personalize your NordPass experience by adding custom fields to all item types. From passport numbers and bank details to dates of birth, you’re free to securely store exactly what you need.

NordPass 5.7

Here are just a couple of highlights from our latest release:

  • Autofill: As some websites (e.g. facebook.com and messenger.com) require you to use the same login credentials, you can now add multiple web addresses to a single NordPass password item for a smoother autofill experience. Faster account access and a tidier vault — sounds good to us.

  • Passkeys: Already using biometrics to unlock your NordPass vault? Good news — you can now also use your face or fingerprint to verify your identity when using a passkey.

NordPass 5.6

We’ve given our passkey prompts a fresh coat of paint and have also now built them directly into the web browser experience, meaning no more jumping back and forth between our desktop app. Enjoy!

NordPass 5.5

With NordPass Enterprise, you can now instantly share a shared folder with a group! That’s right, instead of having to add teammates one by one to a shared folder, you can now share the folder with a large group of people in one go. Happy updating!

NordPass 5.4

Here’s what’s new in the latest NordPass release:

  • NordPass Business: Users can now move items with two-factor codes to shared folders. If a member has set up NordPass as an authenticator, they will be able to access the item’s two-factor code immediately.

  • Bug fixes: We’ve also fixed a few bugs and improved our app’s performance.

NordPass 5.3

As some web services now require an additional identity check to use a passkey, we’ve added a new authentication step to our passkey creation and login flows so that you can continue using passkeys to securely access your accounts.

NordPass 5.2

You asked, we’ve listened – our latest release is inspired by your valuable feedback:

  • Passkeys: You can now better control how often you see certain NordPass passkey prompts on websites. We’ve also introduced a new button in a couple of our passkey flows so that you can more easily switch to using another passkey solution instead of NordPass.

  • Autofill: You now have the power to change the autofill behavior of website form fields so that you’re suggested exactly the right information you’re looking for. For example, if you’re suggested credit card details on a login page, you can adjust the autofill logic so that you’re correctly suggested a password item in future.

  • File attachments: You can now save time by viewing attached .jpg and .png image files directly in the app, meaning there’s no longer a need to first download them.

Thanks as always for sharing your thoughts with us. If anything else crosses your mind, you can always find us at  support@nordpass.com.

NordPass 5.1

No major updates this time, just a new and improved app release with some under-the-hood performance upgrades – enjoy!

NordPass 5.0

Introducing… file attachments!

That’s right, with NordPass Premium you can now conveniently attach documents and images to any item so that you’ve got access to all-important info when you need it most. Contracts, copies of your IDs, cat photos – you name it, you can securely store it. We hope you enjoy this highly requested feature!

NordPass 4.38

Remember when we said we had some big news to announce soon? Well, here it is… say hello to a new item category: passkeys!

Passkeys are unique, end-to-end encrypted login credentials that are stronger and more convenient to use than passwords.

You can now use NordPass to create passkeys on supported websites. NordPass will also securely store your passkeys so you can use them to instantly log in to your accounts online.

Passwordless authentication: unlocked. Enjoy!

NordPass 4.37

We’ve waved bye-bye to some pesky bugs and have also spruced up the place a touch – enjoy!

NordPass 4.36

We’re starting off 2023 on the right foot with a release that’s faster and more reliable. Stay tuned for some bigger announcements!

NordPass 4.35

No major updates this time, just a new and improved app release with some under-the-hood performance upgrades – enjoy!

NordPass 4.34

We’re happy to present you with a new release. Here’s what we’ve got this time:

  • DESIGN CHANGES TO ITEMS. We updated how your item details are displayed. Hope you’ll like it.

NordPass 4.33

Building good things takes time. So since the last release, we have mainly focused on catching and eliminating pesky bugs.

NordPass 4.32

This time we’ve waved bye-bye to some pesky bugs and have also spruced up the place a touch – enjoy.

NordPass 4.31

We’re happy to present you with a new release. Here’s what we’ve got this time:

  • AUTOFILL DISABLEMENT ON WEBSITES. You can now disable autofill on any page that you don’t want to fill your details. It won’t reset when you refresh the page but you can turn it back on at any time.

  • BUG FIXES.

NordPass 4.30

Here’s what you’ll see in the new NordPass release:

  • ONBOARDING UPDATE. New users will be greeted by a refreshed onboarding experience that will help them familiarize themselves with NordPass.

NordPass 4.29

No major updates this time, just a new and improved app release with some under-the-hood performance upgrades – enjoy!

NordPass 4.28

Building good things takes time. So since the last release, we have mainly focused on catching and eliminating pesky bugs.

NordPass 4.27

This time we’ve waved bye-bye to some pesky bugs and have also spruced up the place a touch – enjoy!

NordPass 4.26

No big announcements from us this time. However, we hope you’ll still enjoy an updated NordPass version with fewer bugs and better autofill.

recovery code

NordPass 4.25

Our bug busters have been working hard since the last time you heard from us. That’s why today we can proudly present another NordPass release with even fewer bugs. We hope you’ll like it.

NordPass 4.24

Building good things takes time. So since the last release, we have mainly focused on catching and eliminating pesky bugs.

NordPass 4.23

We’re happy to present you with a new NordPass release. Here’s what we’ve got this time:

  • UPDATED PASSWORD INFO. Now you’ll get more guidance on making your passwords more secure. Open any of your passwords, and you’ll see whether it’s been reused on other accounts or it’s too old and needs changing.

  • BUG FIXES. Rome wasn’t built in a day. Therefore, we continuously aim to catch pesky bugs and provide you with the best password management experience.

NordPass 4.22

Here’s what you’ll see in the new NordPass release:

  • SWITCH ACCOUNT. A long-awaited feature is here! If you have a few NordPass accounts, like personal and business, switching between them will now be a breeze. Just click on your profile account and look for a “Switch Account” button.

  • LITHUANIAN LANGUAGE. For our Lithuanian friends out there, you can now use NordPass in your mother tongue. Simply head to Settings to change the language.

  • BUG FIXES.

NordPass 4.21

Our bug busters have been working hard since the last time you heard from us. That’s why today we can proudly present another NordPass release with even fewer bugs. We hope you’ll like it.

NordPass 4.20

We’re happy to present you with a new NordPass release. Here’s what we’ve got this week:

  • CARD PIN. From now on, you can also add your PIN when saving card details. Don’t worry; it won’t be autofilled. It’s for your reference only.

  • DELETE CLIPBOARD SETTING. When you copy your password or other item data, it’s normally saved in the clipboard. To avoid pasting it somewhere you didn’t intend; you can now choose the clipboard to clear after a set time.

  • BUG FIXES.

NordPass 4.19

It’s international women’s day! So we want to take this opportunity and say thank you to all the beautiful women who tirelessly work at NordPass. It wouldn’t be the same without you.

P.S. We mainly focused on fixing bugs this time, so we hope you like a better running app.

NordPass 4.18

Here’s what you’ll see in the new NordPass release:

  • SUBDOMAIN SORTING IMPROVEMENTS. From now on, if you have multiple items saved for one domain, the account with the matching subdomain will be shown first.

  • BUG FIXES.

NordPass 4.17

Did you know that January has a Blue Monday – the most depressing day of the year? The good news is it’s over. But if you’re still feeling a little bit blue, here’s a few things we’ve updated to hopefully cheer you up.

  • Safari import. You can now import passwords saved in Safari straight to NordPass.

  • Data Breach Report update. If your password appears in a Data Breach report and you update it on the website, select “Resolve” and the same details won’t appear next time you run the report.

  • Bug fixes. Caught many annoying bugs that hinder your experience.

Some write songs, some dedicate sonnets, some built monuments. We create release notes to honor each update of NordPass app for Windows, macOS and Linux. A single click of that magical “Update” button unlocks the newer, faster, better-performing world of stress-free password management.

NordPass 4.16

As Christmas is over, it’s time to make some New Year’s resolutions. But why wait? We want to become a better, smoother-running, and more user-friendly app now. We have strived for perfection since NordPass was launched, and this week is no exception. So we present you a new NordPass version with fewer bugs and more Autofill fixes.

NordPass 4.15

A good beginning makes a good ending, so why not start a week with a new NordPass release? Here’s what we’ve got this week:

  • BREACH SCANNER UPDATE. If your password was leaked in a data breach and you’ve reused it on other accounts, a new ‘Accounts at risk` tab will appear. There you’ll see a list of accounts that may be vulnerable. Don’t wait for a second and change their passwords to prevent cyber attacks.

  • AUTOFILL UPDATE. We’ve fixed a ton of autofill bugs so you’d have a smoother autofill experience on even more websites.

NordPass 4.14

We know that sometimes life throws challenges right at you. At those times, the last thing you want to think about is how and where to access your passwords.

That’s why from now on, you can give emergency access to your passwords and other items. Choose a person you really trust and invite them to be your emergency contact. Once they accept it, you can give them access immediately or wait for 7 days to be given automatically. Note: You can only give emergency access to another NordPass user with a Personal or Family plan.

NordPass 4.13

Trick or treat? Who are we kidding? It’s always just treated here at NordPass. So here’s our Halloween treat to you – a brand new NordPass release. Don’t worry, nothing to be scared of—just a smoother running version of your password manager.

NordPass 4.12

Tired of too many emails and banners? We get you, and we want to improve our communication with you. That’s why from now on, a lot of important information will appear as in-app notifications. So if you open the app and see a red dot next to a bell icon, just know that it’s something important from us to you.

P.S. We also solved a number of bugs.

NordPass 4.11

Getting your data stolen isn’t nice. But if that happens to you, it’s important to identify the stolen information and act quickly. That’s why with this release, Data Breach Scanner has gone even better. How?

If your data has ever appeared in any breach, you can now use the Breach Scanner to identify not just what type of data was leaked, but also see it in plain text. This includes passwords, your address, social security number, birth date, and other data types.

In addition to all this, we are continually working to improve one of our core features – Autofill. So expect to see more websites working flawlessly with NordPass.

NordPass 4.10

Can’t find tools to improve your password security? We got you. You’ll find security tools such as Password Generator, Data Breach Scanner, and Password Health in the sidebar from this release. More accessible to access and easier to use.

We also solved some pesky bugs to make your NordPass experience more enjoyable.

NordPass 4.9

What do you have in the box this time NordPass? Well, let me see…

  • Title and website address suggestion. That’s right, now when creating a new item, you only need to enter a few letters in the Title or Website address fields, and NordPass will suggest filling it with one of the thousand popular websites.

  • Spanish and Italian languages are now available on the NordPass extension.

  • Bug fixes, bug fixes, and more bug fixes.

NordPass 4.8

It’s August my friend. And you know what August is good for? Learning new languages.

Hablas español? Parli italiano? If you do, lucky you. Because you can now use NordPass in Spanish and Italian. Enjoy!

NordPass 4.7

Did you know that no one else has the same fingerprint as you? That’s why it’s the most unique password you can have. Dedicated Mac users, this release is for you. Yes, you can now sign in to your NordPass app with a fingerprint. Feeling like James Bond yet? We are!

P.S. We also solved a ton of pesky bugs to make your experience smoother than ever.

NordPass 4.6

Dear bugs, it’s time. Time to say goodbye. It won’t be the same without you. It will be better. The password managing experience will be much greater now.

NordPass 4.5

It’s officially summer, NordPass people! (Or winter, if you live in the southern hemisphere.) Wherever you are, we hope it’s sunny so that you can enjoy the brand new release. Here’s what we’ve got:

  • MULTIPLE ITEM SHARING. Sharing is caring, right? Well, now you can select multiple items and share them all at once. Easy peasy. Just always make sure you trust the people you share your credentials with.

  • PASSWORD GENERATOR HISTORY. You know that moment when you create a super-strong password with the NordPass Generator and forget to save it? Yeah, we’ve been there too. That’s why you’ll now see a little clock icon in your Generator where you can check your previously generated passwords.

  • BUG FIXES. And, of course, we won’t release a new NordPass version without getting rid of as many bugs as possible.

NordPass 4.4

“Speed” was the main keyword at NordPass this week. So what to expect in this release?

  • Updated designs so you could find your passwords or any other items at the speed of light.

  • Tons of bug fixes and maintenance work so that your app would work faster than ever and would be as pretty on the inside as it is on the outside.

NordPass 4.3

Don’t worry if you missed the chance to get NordPass Premium for less. The Summer Kick-Off Sale is here! Use this offer to get access to all the amazing Premium features.

Also, we have a little something for our Business users. From now on, all members who are added or removed from groups will be notified by email.

NordPass 4.2.18

Hello, world! We’ve prepared a nice little juicy pack of updates – just for you. Please give a warm welcome to:

  • Double EXTENSION-upgrade: from now on, not only it speaks German fluently but also is available in Dark Mode. Ready to give some rest for those sore eyes?

  • A new ge-ne-ra-tion for stronger passwords! Check out the PASSWORD GENERATOR to enjoy shiny new looks and (finally!) PASS-PHRASES for nice-and-strong-memorable-passwords.

NordPass 4.1

We are working hard on bringing Dark Mode to the NordPass extension. In the meantime, we are also doing some good old maintenance work. So expect to see some design changes in the browser extension and forget the existence of annoying bugs.

NordPass 4.0

Today is the day! You know what we are talking about. You asked for it; we delivered it. And oh boy, how good it looks! You’ll believe it once you see it.

OK, we recommend sitting down for this one. Then open your NordPass app, update it to the newest version and enjoy the shiny new DARK MODE.

And if that doesn’t impress you, well, then we have more news. You can now use NordPass in German. Whether it’s your mother tongue or just want to polish your German skills, you can now change your language preference in Settings.

NordPass 3.31

This time we’ve got many design changes to make your life easier. So let’s get to it. Here’s what you’ll see in this release.

  • TOAST MESSAGES UPDATE. Some of the success messages, such as when you import items or update your app, were outdated, so we made them easier to understand.

  • MULTISELECT REWORK. We noticed that the sorting option was missing when multiple items were selected. We introduced this option and changed long-winded buttons to visually pleasing icons.

  • BROWSER EXTENSION UPDATE. You can now access Tools from the NordPass extension, including the Password Health and the Data Breach Scanner.

NordPass 3.30

Are you ready to switch off the lights? Because Dark Mode is coming very very soon. We are working hard to make sure everything looks perfect for the release. A few more things, and we are done. Keep your eyes peeled.

In other news, we fixed some annoying bugs we found in Groups and took care of other bugs.

iconless styling

NordPass 3.29

Sometimes what we do is either too difficult to explain or too difficult to see. Yes, you guessed it. This week we put all our effort into finding and getting rid of bugs. We hope we’ll have something more exciting for you next week.

NordPass 2.34

NordPass has gone through some serious spring cleaning with this release. Why do we say so? Here’s what we did:

  • B2B GROUPS BUG FIXES. It’s new, fresh, and now with fewer bugs.

  • APP BUG FIXES. We’ll never give up on perfecting NordPass.

  • EXTENSION DESIGN REWORK. So much better looking now! You have to see it to believe it.

And something exciting is coming up very soon. So stay tuned. 😉

NordPass 2.33

This time, we’ve got good news for Business users. Let us introduce GROUPS. Admins and Owners can now assign members to groups and share passwords with a number of people instantly. Think, your finance department sharing login details every accountant needs to access.

Anything else? Of course, we got rid of more nasty bugs.

NordPass 2.32

Happy April Fool’s! Stay vigilant, and don’t get tricked by any hackers. Keep your passwords safe with an updated NordPass app. Here’s what we’ve got this time:

  • CHANGES TO MASTER PASSWORD CREATION. Now it’s easier to understand what that mysterious Master Password is and how it is different from your Nord Account password. BUG FIXES as usual.

NordPass 2.31

It’s spring! Flowers are blooming, birds are chirping, and NordPass is releasing another update. In this release, you’ll find: KEYBOARD SHORTCUTS. You can now use CTRL + F to search your items and CTRL + L to lock your app instantly. BUG FIXES. No bugs allowed here.

keyboard shortcuts

NordPass 2.30

NordPass bug hunters strike again. Yes, you guessed it. We got rid of more pesky bugs so you could enjoy an even smoother experience with NordPass. That’s it for now!

NordPass 2.29

“Could NordPass be any better?” asks our team every single week. And the answer never changes. YES, it can!

But it’s not always about new features and crazy advancements. Sometimes it’s all about perfecting those nitty-gritty details. So this week, we say another goodbye to a bunch of bugs. Bye, we won’t miss you.

NordPass 2.28

Another week, another release of a better, faster, and more secure NordPass app. And for this we say a BIG thank you to our bug hunters (aka developers). You guys rock.

NordPass 2.27

If NordPass was a dog, what would he say to a flea?

  • Stop bugging me.

The good news NordPass doesn’t need to endure nasty bugs. Bye-bye, bugs. We don’t wanna see you no more.

NordPass 2.26

Ready, set, new release! What can you expect to see in the new and shiny NordPass 2.26?

EXTENSION REWORK. Updated, upgraded, and overall better-looking browser extension. But what did we actually do? Well, we just made it even more similar to your desktop app, meaning more functional and easier to use. Voila!

BUG FIXES. Can you tell we don’t like insects? No bugs are allowed in our app. Yuck.

NordPass 2.25

It’s a very special day today. We thought about it over and over again. We were constantly considering, overthinking, and having sleepless nights about it. We even visited a fortune teller to ask if you’ll like it, or not. Yet still, our developers were nervously (but carefully!) coding that code.

And here it comes. A sincere love letter. In PDF format. Containing your Recovery Code. Save it, delete it, save it again, print it – do whatever you want, but please, keep it safe. And don’t show to anyone else! It was created from the bottom of our hearts to express how much we LOVE YOU.

Take care!

And don’t forget to update the app to get those extra bug fixes.

NordPass 2.24

Once upon a time, in a faraway land, a password manager named NordPass lived. His goal was to become the best password manager that there ever was. And he did it one release at a time.

He proudly presents his latest achievements:

  • AUTOSAVE AND PASSWORD EDIT UPDATES. Now it will be easier to understand when NordPass is prompting to update an old password or when it is offering to save a new one automatically.

  • HELP SECTION ADDED TO SETTINGS. If you need help using NordPass, head to Settings to be directed to the Help Center.

  • COPY CHANGES. Salvador Dali might have said not to fear perfection as we’ll never reach it, but we’ll still give it a good go.

  • BUG FIXES. No need to call the pest control officer; we got it fixed.

NordPass 2.23

AbraCadabra boom! No, it’s not magic. It’s just your passwords and personal information filling in quicker and smoother than ever before. Bye-bye, annoying bugs who tried to stop you. What else can you expect in this release?

  • ONLINE/OFFLINE INDICATOR appears in the NordPass extension.

  • COPY CHANGES to make the app easier to navigate.

  • MORE BUG FIXES.

NordPass 2.22

New Year, new NordPass release. Here’s what you’ll see in the latest version:

  • EASIER LOG IN WITH NORD ACCOUNT. We tweaked the steps you take logging in to NordPass for a smoother experience.

  • BUG FIXES, because no one likes bugs.

  • RECOVERY CODE PDF. You will now be able to download your Recovery Code in PDF. Keep it somewhere safe. 😉

recovery code

NordPass 2.21

Yeah, Christmas will be different this year. But we’ve still got something to spread a little cheer.

In this release, you will see:

  • ICONLESS ITEMS STYLING. Your passwords that don’t have dedicated icons will light up in a variety of colors.

  • BUG FIXES. Well, it cannot be called a release without bug fixes, right?

iconless styling

NordPass 2.20

“You guys give up? Or are you thirsty for more?” – Kevin, Home Alone, 1990

That’s the NordPass spirit, Kevin! We’ve got more:

  • Design changes. Yes, the sky’s the limit for our designers, sorry.

  • Password Generator update. Did we mention that it’s important to have long and unique passwords?

  • Browser extension update. Easier to understand, prettier to look at.

desktop instagram

NordPass 2.19

I don’t want a lot for Christmas
There is just one thing I need
I don’t care about the presents
Underneath the Christmas tree

Don’t want NordPass for my own
More than you could ever know
Making this wish come true
Giving a bug-free NordPass for you

P.S. Thanks Mariah Carey for inspiration.

NordPass 2.18

NordPass has turned 1 year old this week. Just on time for Thanksgiving, can you believe it? And we can honestly say this year we are the most grateful for YOU, our dear NordPass user. You, who believed in us and drove us to release one update after another.

So here’s one more. Full of even more design edits, bug fixes, and love:

  • LOGINS TURN TO PASSWORDS. Now all across the app, you’ll see the term “Password” instead of “Login” because it’s just easier to understand.

  • CHOOSE FOLDER WHEN AUTOSAVING to organize your passwords there and then.

  • RENEWED IMPORT. Importing passwords in bulk is now easier than ever.

  • MINOR DESIGN CHANGES because, let’s be honest, who doesn’t like a good-looking app.

  • NORD ACCOUNT DEEPLINK FIXES. No more accidental logouts when you use NordVPN and change your IP.

NordPass 2.17

Xmas is in less than 35 days. You’re welcome.

In other news, our designers, developers, and copywriters are presenting you with another brand new update. This time we fixed the annoying-forever-loading spinner, made minor changes to the way you see your items’ details, and updated the copy to make your app even more easier to navigate. Until next time 😉

NordPass 2.16

We know you have better things to do (like keep up with the news on the current presidential election. Yikes, so intense!). So we thought, ‘who are we to bombard you with more messages?’. Poof! Your login and logout messages are gone.

To make your day a little bit brighter, we also made some improvements to your items layout. And we can describe it with just one word – SLEEK. You’ll believe it when you see it 😉

And NordPass update wouldn’t be an update without bug fixes. We did the dirty work and crushed them once again.

NordPass 2.15

Trick or treat? Treat, always. We might be a few days late to any online Halloween party, but, to make up for it, we are bringing new treats to your desktop app:

  • ADD ITEM IN FOLDER. You can now add items straight from your folders. Easy, breazy, and all your items are organized.

  • ITEM DETAILS FIXES. “There is no limit to perfection!” screams the NordPass design team. Your items will now look more beautiful than ever.

  • OTHER LITTLE BUG FIXES. Little bugs and spiders might fit the Halloween theme, but they don’t look good in your NordPass app. We got rid of them to make your experience smoother and safer.

NordPass 2.14

Providing high-quality password-managing experience, routine maintenance and working under-the-hood is just as essential as releasing a new shiny feature. So nothing grand this time — just the usual bug-fixing and design-improving business. We’re packing and sending best wishes along with app improvements your way!

NordPass 2.13

  • BUG FIXES. Sometimes you couldn’t scroll down to the end of your passwords list. You simply couldn’t. The good news is that we did some magic tricks, so now you can.

  • BUG FIXES. We’ve also changed the font style, the button style, and the spacing style in the context menu of your passwords list (not exactly a bug, but we wanted to keep the release notes in style).

  • BUG FIXES for everyone.

  • BUG FIXES. Sometimes you couldn’t scroll down to the end of your passwords list. You simply couldn’t. The good news is that we did some magic tricks, so now you can.

NordPass 2.12

When life gives you Monday, we release the app update. Let’s see what we’ve got:

  • IN-APP NOTIFICATIONS sometimes were over-competitive and tried to overlap each other. Someone smart once said that the best way to kill competition is to partner it. So after some inspiring conversations about team spirit, the attitude was fixed – all notifications now act super friendly.

  • DESIGN BUG FIXES. Yes, sometimes bugs may look stylish. Even pretty. They are still bugs – and they are out now.

  • PASSWORD HEALTH IMPROVEMENTS. The development department was very excited about changing something with the algorithm. All I know is that the health of your passwords will be calculated even more accurately. I only write release notes – please don’t judge me. And have a nice day!

NordPass 2.11

Hey there! How are you? Ready for the update? Let’s go:

  • BREACH REPORT. This one feels like a lottery. By clicking a ‘Scan’ button, you can find out if any of your accounts were ever caught in data breaches. However, it probably is the first lottery where it’s better not to ‘win’ anything.

  • DESIGN IMPROVEMENTS. They see you scrollin’, they hatin’, – because scrolling with that new scroll bar has never felt so good. Just give it a go.

NordPass 2.1

Another week – another update. Let’s roll!

  • DESIGN IMPROVEMENTS. Yes, we did it again. We’ve played with UI, got lost in perfecting the details. Oh, baby baby. Yes, the item lists now look neat, the font is sent from above. It all looks perfect now!

  • PERFORMANCE IMPROVEMENTS. Let’s be honest – after entering your Master Password to unlock the vault, the app window was getting overexcited and moved all over the place. Not that it was a bad thing – but those moves really weren’t good. So, we’ve sent the app to some dancing classes. The result – the app learned some solid, stylish but still moves – more like JLo style.

NordPass 2.9

Faster than light.
Supersonic.
Fleet-footed.
Pronto.
Winged.

We’ve spent hours trying to find the right word to describe the improved speed of opening your passwords (and other items) in the vault, but none of them was good enough. They say that action speaks a thousand words, so enjoy viewing your items at full speed.

NordPass 2.8

Passwords are more human-natured than you could possibly think. They need a safe and cozy place to stay. Most of them eat well (cheat days included 😉 ) and constantly work out to become faster and stronger. However, sometimes they also may feel weak and unwell, so regular health check-ups are crucial. Luckily, we’ve found an easy way to maintain their well-being – set up a password health checker in the app. Take a chance to make your precious passwords happier (and accounts safer) without leaving the house.

Stay safe, everyone!

NordPass 2.7

The idea of throwing this party came out of thin air. Why not, we thought – work hard, party harder, right?

So we’ve ordered lots of food and drinks (everyone was curious seeing what new employees look like when they’re drunk), brought in a magical photo booth (making selfies was too mainstream), and prized trivia (to avoid awkward silences), and live music by our beloved DJ “Vibe Manager”.

Time flew, the party’s got in full swing (no one seemed to be running out of things to talk about – phew). Even NordVPN and NordLocker stopped by. After a not-work-related heated discussion about data privacy and online security, they promised to join our “Tools” department. Like, forever.

Autofill department surprised everyone with funky moves – those icons felt like dancin’ till the break of dawn. It was fun until the ‘fun’ went out of control – and out of login fields. Luckily, after taking a chill pill, everything’s got back in order.

By the way, some unwanted URL spaces were trying to crash both the party and the app. That’s kind of rude, so we’ve asked them to leave.

We’ve finished with a small team-building session with cleaning the office – it’s now nice and clean – and so is the app (we hope so).

That’s it – peace out!

NordPass 2.6

Our engineers are all about perfection. They literally were calculating coordinates for pixel-perfect autofill icons placement. However, some “wind of change” has happened, and those icons ended up finding their home OUTSIDE the login fields. Sorry for that – this unforgivable mistake was fixed.

Also, some sneaky, crawly, totally gross bugs were caught and removed. The app is much better without them – enjoy!

NordPass 2.5

This release contains some behind-the-scenes magic, usual tinkering-under-the-hood and minor design tweaks. By hitting the “Update” button, you will get one step closer to top-notch password-managing experience. Stay well!

NordPass 2.4

They say – small changes make a big difference. Behold – the update with a bunch of app upgrades is here. Let’s see what we’ve got here:

  • VISUAL IMPROVEMENTS. Mirror mirror on the wall, who is prettiest of them all? Well, our designer’s brush made some magic tweaks, so the answer is clear now – it’s those tiny cute little app icons. Lookin’ good!

  • APP LOADING FASTER. Need for speed? You’re welcome! Fasten your seatbelt and put the pedal to the metal – the project “Make the app faster” was completed successfully.

  • BUG FIXES. Dear sneaky bugs, thanks for visiting, farewell, let’s never meet again.

New to NordPass?

You don’t need to be a rocket scientist to start using NordPass on a desktop device. Just add the standalone extension and you’re all set — no need to download or install the app!

Check out our detailed support guide for getting started with NordPass quickly and easily.

Once you have the new extension running on your browser, you can start using NordPass to its fullest extent.

If you have any further questions regarding the changes or NordPass in general, do not hesitate to contact our tech-minded support team at support@nordpass.com — they’re ready to take care of any issues you might have. Also, if you have any suggestions or feedback, simply submit a request for our team — we’re all ears, all the time.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

NordLayer’s 2023 wins: 7 prestigious awards and G2 recognition

In 2023, NordLayer earned seven major awards, showcasing its growth in cybersecurity and network solutions. The awards include honors from the American Business Stevie® Awards, Globee® Cybersecurity Awards, and Cyber Defense Magazine’s Top InfoSec Innovator Awards. These prizes demonstrate that NordLayer is truly stepping up its tech game. The company also received 25 G2 award badges in fall 2023, confirming its rising industry status.

Awards 1400x5700

US business recognition: the American Business Stevie® Awards

Known as “The Stevies,” the American Business Awards symbolize US business excellence. Since 2002, they have recognized achievements in various sectors like marketing, IT, and customer service. The awards welcome entries from all US organizations, regardless of their size or type.

The Stevies’ judging involves over 230 global professionals annually. Judges from various fields assess each entry for excellence. The awards feature Gold, Silver, and Bronze levels, reflecting different achievement tiers.

quote 1 1400x7040

NordLayer’s win in the Stevie® Awards’ Best Business Technology Pivot category, showcases our innovation and adaptability. This achievement places us in a prominent spot within the US business sector. It also confirms our effective approach to business technology and cybersecurity.

Global recognition at the Globee® Cybersecurity Awards

The 19th annual Globee® Cybersecurity Awards are a key global platform for cybersecurity excellence. They cover numerous categories, highlighting important advancements in this area. Over 250 experts rigorously evaluate entries, underscoring the competitive aspect of cybersecurity innovations.

NordLayer’s NordLynx received recognition, demonstrating our impactful role in cybersecurity. This highlights NordLayer’s significant position in the field and our commitment in digital security.

Top InfoSec Innovator Awards by Cyber Defense Magazine

In its 11th year, the Top InfoSec Innovator Awards by Cyber Defense Magazine represent a key accolade in the cybersecurity field. These awards recognize notable advancements in information security, with categories that span threat detection, risk management, and cyber defense strategies. Established in 2012, Cyber Defense Magazine provides a platform for these awards.

quote 2 1400x7040

NordLayer’s achievement as the Most Innovative Zero Trust highlights our role in developing crucial security measures like the Zero Trust approach.

The SaaS Awards: spotlight on software-as-a-service excellence

The SaaS Awards, established in 2015, have become a key global benchmark in the software industry. They focus on Software as a Service achievements, attracting a diverse range of global companies. The awards span numerous categories, reflecting the diversity and innovation within the SaaS sector.

An international panel of industry experts judges these awards, focusing on innovation, usability, and performance. This guarantees a thorough review of all entries. NordLayer’s finalist position in the Best Security Innovation in a SaaS Product category marks significant industry recognition and underscores the importance of a forward-thinking approach to security in SaaS solutions.

Technological advancement in security: the Computing Security Awards

The Computing Security Awards are a key event in the cybersecurity industry, recognizing excellence in network and information security. These awards attract entries from a wide range of global companies.

NordLayer’s 2023 finalist status for Network Security Solution of the Year highlights our cybersecurity effectiveness.

Effective remote working environments: the RemoteTech Breakthrough Awards

The RemoteTech Breakthrough Awards, part of Tech Breakthrough, honor excellence in remote work technologies. In the digital and remote work era, these awards have become increasingly relevant.

NordLayer’s win as the Best Overall Remote Work Security Solution of the Year in 2023 from over 1,250 nominees showcases our prowess in remote work cybersecurity. This award highlights our commitment to secure and efficient remote work solutions.

Merit Awards: recognizing technological innovation

Founded in 2022, the Merit Awards honor global industry achievements with a focus on technology. These awards recognize leaders in innovation and technological progress, assessing cutting-edge technology submissions. Marie Zander, the executive director, emphasizes that the 2023 Technology Award winners have set new standards in technology use.

The selection process involves a diverse panel of industry experts and educators. Winners, categorized into gold, silver, and bronze levels, receive digital badges and promotional tools for recognition. NordLayer’s cybersecurity win at these awards highlights its significant role in driving technology innovation.

Users’ recognition: NordLayer’s achievement in G2 awards fall 2023

G2, a top software marketplace, is known for authentic user reviews on various products and services. With over 90 million users annually, including Fortune 500 employees, G2 is a key software resource. In fall 2023, NordLayer earned 25 G2 awards, showing its excellence in multiple software categories. This user-driven recognition makes NordLayer a top performer in the software landscape.

Business VPN Leader category

In the highly competitive BusinessVPN Leader category, NordLayer won nine awards, demonstrating its strong market position. These awards focus on partnership quality, multi-device usage, customer support, and protocol choices, key to user satisfaction. The range of awards includes:

  • Business VPN Momentum Leader

  • Business VPN Leader

  • Business VPN Leader: Americas

  • Business VPN Leader: Asia-Pacific

  • Business VPN Leader: Europe

  • Business VPN Mid-Market Leader

  • Business VPN Mid-Market Leader: Americas

  • Business VPN Small-Business Leader

  • Business VPN Small-Business Leader: Americas

Best Secure Access Service Edge (SASE) platforms

SASE platforms unify various security solutions into a cloud-native service for modern computing needs. These platforms, evolving from secure web gateways and cloud access security broker (CASB) software, include Zero-Trust networking and secure perimeters. NordLayer stands out on the following categories:

  • Cloud Security Leader

  • Cloud Security Leader: Americas

  • Cloud Security Small-Business Leader

  • Cloud Security Small-Business Leader: Americas

Network Access Control (NAC) leader category

In the Network Access Control (NAC) category, NordLayer’s awards demonstrate our prowess in policy control and data protection. G2 evaluates factors like partnership quality and security. So, G2’s recognition reinforces NordLayer’s position with titles like:

  • Network Access Control (NAC) Momentum Leader

  • Network Access Control (NAC) Leader: Americas

Significance of NordLayer’s diverse awards

NordLayer’s varied awards across different sectors highlight our dedication to solving cybersecurity challenges. These recognitions affirm the effectiveness of our approach, in line with our mission to simplify cybersecurity for organizations. With user appreciation as a key indicator of success, each award marks NordLayer’s progress in the cybersecurity field.

Organizations seeking to strengthen their cybersecurity can rely on NordLayer’s recognized solutions. For more information or assistance, please contact our sales team.

Genetic data leak, 23andMe point to credential stuffing

Hackers are selling genetic data stolen from users of the company 23andMe. The company itself says they weren’t breached, although their users’ data was used by what seems to be a single threat actor stealing personal details and genetic data. This data was then published or advertised online. 23andMe suggested that the threat actor(s) gained unauthorized access with “recycled login credentials”, a technique known as credential stuffing.

The logic is simple: Keep trying stolen username/password combinations, and eventually, they’ll work on another site. An easy solution to credential stuffing attacks? You guessed it: Multi-factor authentication (MFA). While 23andMe has offered an MFA feature since 2019, it was not made mandatory for users. With genetic and personal data at stake and up to 7 million users affected by these recent breaches, it might be time for a change in policy.

The Bleach Breach: Clorox revenue and supply chain hit

Clorox, the household cleaning giant, predicts a more than 20% drop in quarterly sales due to a cyberattack (thought to be ransomware) that caused product shortages and operational disruptions. Manufacturing, often kept running by legacy systems and sprawling workforces, suffers more cyberattacks than any other industry.

The Clorox incident is being linked to the same group responsible for the MGM and Caesars Palace hacks, discussed in our previous episode, which occurred around the same time in August 2023. “Scattered Spider” is notorious for using social engineering methods to gain access to internal systems. The Clorox Company’s share price has dropped by over 7 percent in the last month.

Wearable AI: Trendy or just trending?

Tech companies are rushing to secure the lead in wearable AI products. Meta has collaborated with Ray-Ban on a pair of high-tech glasses, enabling wearers to live stream directly from the glasses to Facebook or Instagram and voice activate Meta AI, “an advanced conversational assistant”. Jony Ive, Apple’s legendary former design lead, and OpenAI are reportedly teaming up to design the “iPhone of AI”.

Rewind.ai unveiled a neck-worn pendant that records conversations to your smartphone and creates a searchable database of life moments. Humane, imagining “a world where you can take AI everywhere”, have developed a smart device that resembles a badge or lapel pin.

The common goal here seems to be for technology to rely less on screens, to fade from view, and become all but invisible.

Stay tuned for the next episode of Cyberview.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

When an employee’s social mindset becomes a threat to business

In today’s business environment, where innocent GIFs and shared documents can be weaponized, protecting cloud-based collaboration from the spread of malware should be a priority.

As our lives settle ever deeper into online environments and digital behaviors, cybercriminals are leveraging new vectors that allow for phishing, data theft, and spreading malware. Recent incidents show that mixing people’s professional and personal minds (an ever-present human factor) can create new weaknesses in a business’s cybersecurity.

Imagine your employees browsing their favorite social media platform on their personal time; they might find an interesting picture or emoji and its embedded link, which they then share — no one would mind such a distraction. Now, imagine your employees checking their various professional chats and threads; something between their personal and professional interests sparks their minds. Hence, they react by sharing an article, an interesting picture, or an emoji and its embedded link. This time, they share with their colleagues on a cloud-based platform such as Microsoft Teams . . . just for fun or even for professional inspiration.

A pretty common thing in an office, right? Well, bad actors can abuse even these everyday activities. Putting it simply, behaviors common to navigating and enjoying social media platforms can raise risks for business platforms, which have now become ubiquitous for small and medium businesses (SMBs) and enterprises alike.
Fortunately, multilayered ESET cybersecurity technology has an answer for such incidents with ESET Cloud Office Security (ECOS), which is now expanding beyond Microsoft 365 applications to include the Google Workspace.


Image 1. ECOS Dashboard with an overview of protected apps

Sharing reports, jokes, and malware

Let’s start with weaponized pictures, GIFs, and emojis. The technique of concealing a file, message, image, or video within another file, message, image, or video is called digital steganography, and it is nothing new in cybersecurity.

The first documented case of its use in a cyberattack dates back to 2011, when the Duqu malware was discovered. This malware gathers data about the infected device and transmits them back to the command-and-control (C&C) server hidden in a JPEG file meant to look like an innocent picture.

Since then, ESET researchers have analyzed numerous similar attacks.

In 2022, BleepingComputer reported about a new attack technique called GIFShell that allows threat actors to abuse Microsoft Teams for phishing attacks and executing commands to steal data using GIFs.

Using numerous Teams vulnerabilities, GIFShell allows an attacker to create a reverse shell. This technique tricks users into installing malware that connects the victim’s device to the attacker’s command-and-control server. After the connection is established, the command-and-control server delivers malicious commands via weaponized GIFs in Teams. These commands can, for example, scan the device for sensitive data and then exfiltrate the output, again, through GIFs retrieved by Microsoft’s own infrastructure.

Large cloud-based platforms like Microsoft 365 with its Teams app saw rapid growth during the pandemic and, by Q1 2023, had approximately 280 million users. With such growth and new online behaviors, the scope for abuse on large platforms has only grown.

However, increasing attention has been shown to these threat vectors by researchers. In June 2023, UK-based security services provider Jumpsec’s Red Team discovered an easy way to deliver malware using Microsoft Teams via an account outside the target organization. Even though Microsoft Teams has client-side protection preventing file delivery from external sources, Red Team’s members bypassed it by changing the internal and external recipient ID in the POST request of a message.

That way, researchers were able to fool the system into thinking that an external user was, in fact, an internal account. Specifically, they successfully delivered a command-and-control payload into a target organization’s inbox. If this attack had happened in a real-life environment, bad actors could have taken over the control of a business’s devices.

Users shielded via multilayered protection

To deal with threats coming from increasingly popular cloud-based applications, ESET created its Cloud Office Security (ECOS) solution. It is a powerful combination of spam filtering, anti‑malware scanning, anti‑phishing, and advanced threat defense capabilities able to mitigate even never-before-seen threat types.

With this multitenant and scalable product, businesses can protect their entire Office 365 suite, including Exchange Online, MS Teams, OneDrive, and SharePoint Online. For example, one of the things that ECOS does is that it scans all files transmitted through MS Teams and those uploaded or downloaded to SharePoint Online, scanning it regardless of who the author of the content is.

ECOS effectivity in numbers:

  • In the first ten months of 2023, ECOS detected and blocked over 1 million email threats, over 500,000 phishing emails, and over 30 million spam emails.
  • Thousands of never-before-seen detections were made by the cloud analysis component of ESET LiveGuard Advanced.
  • ECOS detected and stopped tens of thousands of threats in cloud storage and collaboration tools like OneDrive, Teams, and SharePoint.

In its latest offering, ESET goes even further, integrating ECOS with Google Workspace to protect users from the aforementioned threat types. This means that ESET now protects the major cloud email providers.

Adding more protection

The many functions outlined here are critical for security in large part because they scale easily and provide concrete improvements for businesses. However, ESET has sought to do even more for SMBs. In October 2022, ESET endpoint security solutions integrated with Intel® Threat Detection Technology (Intel® TDT), which went live for select vPro 9th Gen (and higher) powered laptops, with integrated functionalities providing improved hardware-based ransomware detection.

This year has seen further improvements to the integration with the higher performance of the newly launched 13th Gen Intel® Core™ processors, which further enable unique ransomware detections shared between ESET endpoint security and its layers, and Intel’s performance monitoring unit (PMU) sitting beneath applications, the operating system, and virtualization layers gathering CPU telemetry as threats attempt to execute.

This solution is especially advantageous for SMBs because it further expands the comprehensive nature of our multilayered solution without the need for any direct management.

Preparing for attacks doesn’t have to be complicated

Techniques that allow the breach of a business’s security through its employees and their (in-app) behaviors demonstrate that cybercriminals use every possibility to circumvent standard cyber defenses.

Via an ECOS’s easy-to-use dashboard, its Cloud Management Console, businesses can not only manage their security but also rapidly detect, assess, and respond to cyber incidents, making it a perfect solution for businesses of any size.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

23.11.2 ‘Saturn’ released

Changes compared to 23.11.1

Bug Fixes

  • Fixed an issue with remote registration failing to authenticate users when being used by a tenant admin

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Comet
We are a team of dedicated professionals committed to developing reliable and secure backup solutions for MSP’s, Businesses and IT professionals. With over 10 years of experience in the industry, we understand the importance of having a reliable backup solution in place to protect your valuable data. That’s why we’ve developed a comprehensive suite of backup solutions that are easy to use, scalable and highly secure.

Understanding defense in depth: A comprehensive guide

Navigating digital security threats can sometimes feel like crossing a minefield. With new dangers arising, it’s not enough to rely on a single tool to keep all sensitive data in an organization secure. That’s where defense in depth comes in – an approach that combines physical and digital security measures for an all-encompassing protection strategy.

However, this approach doesn’t mean using random tools – there’s a system to how each defense layer is implemented. Let’s see how setting up a defense in depth strategy benefits organizations.

What is defense in depth?

Defense in depth (DiD) is the strategy of layering different physical and digital resources to reinforce the security measures in an organization. It’s a preventative approach aiming to decrease the odds that sensitive data will be breached or stolen.

Defense in depth shares its name with a Roman military strategy. This tactic saw the Roman military taking a defensive approach rather than going after targets themselves. If the enemies reached the Roman Empire’s borders, the Romans would allow them to cross. Once on their native soil, the Roman military would attack the enemy from within the border provinces. This made it more difficult for enemy forces to reach cities and cause significant damage to land.

Centuries later, this layered strategy has become what we now know as defense in depth cybersecurity. The principle is simple — an organization sets up a range of digital and physical protective barriers that discourage attackers from striking in the first place. Even if a hacker manages to crack one of the layers, they still have to face the rest of the defensive system. With enough varied layers, an organization may establish an impenetrable line of defense.

You might be eager to cut into this defensive cake and see each of its layers. So let’s take a closer look at how this approach works in practice.

Defense in depth architecture

To visualize the concept of defense in depth, you can think of concentric castles – medieval structures that were fortified with multiple inner and outer walls. Each wall added challenge to attacking forces and helped fend off threats longer. At its core, defense in depth works the same – each layer makes it more difficult to breach the system.

Defense in depth mechanisms are generally grouped into three categories:

  • Administrative controls

  • Physical controls

  • Technical controls

Each of the categories consists of different tools and strategies. The range of tools used in defense in depth varies based on the needs and resources available to an organization. Typically, technical controls make up half the architecture, with physical and administrative controls accounting for the rest.

Administrative controls concern the procedures and policies that your company employs. This encompasses processes in practically all areas of the organizational structure. The processes of hiring and how much information is revealed to a candidate, onboarding and offboarding, and data processing regulations all contribute to administrative controls. You can also think of company-wide initiatives such as safety training or protocols that are set in place in case of a data-related incident.

Physical controls refer to a hands-on approach to security. The security guards patrolling the building, cameras installed on the premises, and the locks protecting the entrances and exits all count as physical security measures in a defense in depth infrastructure. Remember that while many attacks occur exclusively online, it doesn’t mean that someone won’t try to break in or snoop around the headquarters. Protecting your physical data storage is as crucial as the digital side.

Finally, technical controls encompass a broad range of digital tools that help ensure the protection of your sensitive information. When we talk about technical controls, we typically discuss software, although hardware storage can also be used for data storage and protection. Antivirus and anti-spyware tools, cloud storage, virtual private networks, password managers – anything that can act as an extra layer of security works.

Essential principles of the defense in depth security strategy

There’s a philosophy behind every strategy. At their core, the defense in depth principles are simple – layering different security measures to optimize the protection of a database. The more layers a system encompasses, the more discouraged malicious attackers are from striking it. If they manage to rip off one security layer, they encounter a new one deeper down.

The goal of defense in depth is to account for potential failures in all areas and minimize loss if a successful breach were to occur. While software breaches and corrupt hardware can be the culprits of a vulnerable system, the weakest link is often the employees themselves.

Negligent behavior, such as insecure file sharing, use of weak passwords, and reuse of the same login credentials for different accounts, can lead to easy targeting and subsequent damage. As such, combining the three types of defense in depth controls aims to protect the company from attackers as much as from human error.

The power of layered security in cyber defense

Despite an overlap and the tendency to use both terms interchangeably, defense in depth and layered security aren’t the same. While defense in depth is an all-encompassing structure that aims to protect the security of all crucial data in your organization, layered security is focused on using different measures to withhold a particular threat or protect one area of the organizational structure.

As you can imagine, setting up layered security or defense in depth layers is an intricate process. After all, you’re essentially building defensive walls to protect sensitive data at your company’s core. It’s about finding the right people and tools for your company, dedicating your resources to keeping things running smoothly, and blocking attackers before they even strike.

Defense in depth – in practice

Hypothetically, here’s what defense in depth cybersecurity infrastructure can look like in an organization:

  • The physical headquarters of a company are patrolled by on-site security 24/7.

  • Each employee is issued a unique keycard to access the premises.

  • All employee accounts are protected by login credentials.

  • All passwords are changed at regular intervals according to company policy.

  • All employees must use a password manager and enable two-factor authentication.

  • Remote employees connect to the company’s virtual private network to avoid using insecure public Wi-Fi.

  • All computers are equipped with antivirus software.

  • All operating systems and software must be kept up to date.

  • All employees should complete digital safety training.

  • The company should undergo regular auditing to ensure all security measures are in place.

  • All sensitive company and client data must be stored in secure servers.

  • A dedicated team should have an established action plan in case of a data breach.

  • A support team should be on call in case of an emergency.

Notice which of these measures fall under technical, administrative, and physical controls. As you implement your own strategy, you’ll see that, in some instances, the strategies and tools overlap and support each other, reinforcing the effectiveness of your layered defense mechanism.

Best practices of defense in depth implementation

The key tip for maintaining a successful defense in depth approach is keeping everything up to date. After all, cyber crooks are working on new strategies and tools to get past your defenses, and you want to ensure you stay ahead of the threats.

Ensure that all software you’re using is regularly updated. Outdated software often contains security gaps that hackers can exploit, so make sure the patches are installed. This also goes for online platforms – if services you rely on are breached or become obsolete, you need to relocate your data securely.

Don’t forget hardware – have an action plan if your devices are damaged or stolen. The same goes for in-house security and measures like setting up protocols in case an employee’s or guest’s entrance card is stolen or lost.

Of course, updating your own knowledge is essential. Hold regular training sessions, follow the latest data breach news, keep yourself informed about lurking threats, and learn the strategies that you can implement to fend off the attacks.

How NordPass can help

As we’ve seen, the technical layer holds the most weight in a successfully resilient defense in depth structure. That means amping up your technical toolkit is priority number one for your organization. Improving the company’s password protection is not something to overlook.

Human error is among the leading causes of data breaches. Whether it’s negligence, bad password management, or malicious intent, humans are usually at fault. As such, organizations need to work on policies and tools to reduce the risk of incidents caused by employees. Despite the growing popularity of passkeys, passwords are still the most common security tool that each member of the organization relies on, making them equally vulnerable and valuable.

Here’s where NordPass comes in. As a business-optimized password manager, it helps you keep all of your organization’s sensitive information secure, whether it’s login credentials, company bank accounts, or client information. With NordPass, you can create, store, and manage strong passwords that are difficult to crack. Two-factor authentication ensures that you’re the only one who can access your password vault.

Secure password sharing can often be a point of contention because people use the easy yet insecure option to pass along login credentials via email, non-encrypted messages, or Post-It notes. NordPass eliminates this risk, allowing you to share your saved items with your colleagues in-app securely. Additionally, administrators can set up company-wide password policies that require all employees to update their passwords at regular intervals, bringing the best practices of technical and administrative controls into one.

Bottom line

Setting up defense in depth for your organization might take some time, but the rewards are long term – you can rest assured that your sensitive data is under lock and key and incredibly difficult for unwanted actors to access.

If you’re unsure where to start, setting up NordPass for your organization is the perfect first step. Have your team follow secure password practices and keep their credentials updated. You won’t have to worry about coming up with new, unique ideas for each reset – simply use our Password Generator and autofill the details whenever you log in to an account. There’s no easier way to start building the defense walls around your data.

New to NordPass?

You don’t need to be a rocket scientist to start using NordPass on a desktop device. Just add the standalone extension and you’re all set — no need to download or install the app!

Check out our detailed support guide for getting started with NordPass quickly and easily.

Once you have the new extension running on your browser, you can start using NordPass to its fullest extent.

If you have any further questions regarding the changes or NordPass in general, do not hesitate to contact our tech-minded support team at support@nordpass.com — they’re ready to take care of any issues you might have. Also, if you have any suggestions or feedback, simply submit a request for our team — we’re all ears, all the time.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Predatory SpyLoan apps — loan sharks expand their range to Android, ESET Research finds

  • Deceptive SpyLoan apps analyzed by ESET researchers request various kinds of sensitive information from their users and exfiltrate it to the attackers’ servers.
  • This data is then used to harass and blackmail users of these apps and, according to user reviews, was used even where a loan was not provided.
  • ESET telemetry shows a discernible growth in these apps across unofficial third-party app stores, Google Play, and websites since the beginning of 2023.
  • Malicious loan apps focus on potential borrowers based in Southeast Asia, Africa, and Latin America.

BRATISLAVA, KOŠICE — December 5, 2023 — This year, ESET researchers have observed alarming growth in deceptive Android loan apps, which present themselves as legitimate personal loan services, promising quick and easy access to funds. Despite their attractive appearance, these services are in fact designed to defraud users by offering them high-interest-rate loans endorsed with deceitful descriptions, all while collecting their victims’ personal and financial information in order to blackmail them. ESET products therefore recognize these apps using the detection name SpyLoan, which directly refers to their spyware functionality combined with loan claims. SpyLoan apps are marketed through social media and SMS messages, and are available for download from dedicated scam websites, third-party app stores, and also Google Play.

ESET is a member of the App Defense Alliance (ADA) and an active partner in the malware mitigation program, which aims to quickly find Potentially Harmful Applications and stop them before they ever make it onto Google Play. As an ADA member, ESET identified 18 SpyLoan apps and reported them to Google, who subsequently removed 17 of these apps from their platform. These apps had a total of more than 12 million downloads from Google Play before their removal. The final app listed changed its behavior; ESET therefore no longer detects it as a SpyLoan app.

Every instance of a particular SpyLoan app, regardless of its source, behaves identically due to its identical underlying code. It doesn’t matter whether the download came from a suspicious website, a third-party app store, or even Google Play — the users will experience the same functions and face the same risks, regardless of where they got the app.

According to ESET telemetry, the enforcers of these apps, who blackmail and harass their victims, even with death threats, operate mainly in Mexico, Indonesia, Thailand, Vietnam, India, Pakistan, Colombia, Peru, the Philippines, Egypt, Kenya, Nigeria, and Singapore. ESET researchers believe that any detections outside of these countries are related to smartphones that have, for various reasons, access to a phone number registered in one of these countries. There are currently no active campaigns targeting European countries, the USA, or Canada.

Apart from data harvesting and blackmail, these services present a form of modern-day digital usury, which refers to the charging of excessive interest rates on loans, taking advantage of vulnerable individuals. Victims of these apps claim the total annual cost (TAC) of such loans is much higher than stated, and the loan tenure is much shorter than stated. In some cases, borrowers were pressured to pay off their loans in five days, instead of the stated 91 days, and the TAC of a loan was anywhere between 160% and 340%.

“These malicious applications exploit the trust that users place in legitimate loan providers, using sophisticated techniques to deceive people and steal a very wide range of personal information,” says ESET researcher Lukáš Štefanko, who uncovered many of the SpyLoan apps. “It is crucial for individuals to exercise caution, validate the authenticity of any financial app or service, and rely on trusted sources. By staying informed and vigilant, users can better protect themselves from falling victim to such deceptive schemes,” he adds.

ESET Research has traced the origins of the SpyLoan scheme back to 2020. Once a user installs a SpyLoan app, they are prompted to accept the terms of service and grant extensive permissions to access sensitive data stored on the device. According to the privacy policies of these apps, if those permissions are not granted, the loan will not be provided. To complete the loan application process, users are also compelled to provide extensive personal information.

The data that is usually exfiltrated to the Command and Control (C&C) server includes the user’s list of accounts, call logs, calendar events, device information, lists of installed apps, local Wi-Fi network information, and even information about files on the device. Additionally, contact lists, location data, and SMS messages are vulnerable. To protect their activities, the perpetrators encrypt all the stolen data before transmitting it to the C&C server. While legitimate financial institutions are required to collect personal information about their customers, identity verification and risk assessment can be done using much less intrusive data collection methods. ESET Research believes the real purpose of the permissions requested by SpyLoan apps is to spy on their users and harass and blackmail them and their contacts

After such an app is installed and personal data is collected, the app’s enforcers start to pressure their victims into making payments, even if — according to the reviews — the user didn’t apply for a loan or applied but the loan wasn’t approved. Such practices have been described in the reviews of these apps on Facebook and on Google Play.

“There are several reasons behind the rapid growth of SpyLoan apps. One is that the developers of these apps take inspiration from successful FinTech — financial technology — services, which leverage technology to provide streamlined and user-friendly financial services,” explains Štefanko.

For more technical information about deceptive SpyLoan apps, check out the blog post “Beware of predatory fin(tech): Loan sharks use Android apps to reach new depths.” Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

Heatmap of SpyLoan detections seen in ESET telemetry between January 1 and November 30, 2023

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Breakdown of the 11 most significant 2023 data breaches

2023 witnessed a series of impactful data breaches, each leaving a unique mark on cybersecurity. This retrospective dives into these incidents, offering insights and underscoring the evolving challenges in data security.

This article will overview the most intriguing and widely escalated data breaches of every month of 2023. We will also look at the tendencies of cyber-attacks and the forecast for the next year (spoiler alert: it’s going to be hot!).

Key facts of 2023’s data breaches we know so far

The year still has a few weeks to go, but everyone is already busy thinking about the holiday season and next year’s plans. Hopefully, malicious actors are also humans and as busy with end-of-the-year errands as possible, leaving businesses some space to breathe and relax, not thinking about cyber-attacks (unlikely, but we all can dream).

KonBriefing Research does a colossal job of collecting information about ransomware and cyber-attacks on businesses worldwide. The data they have so far reveal the scope and impact that follows every month.

Looking into data breach statistics specifically, the total number of breached accounts since 2004 reached a number of over 16.5 billion. According to this Surfshark research, a single email address is breached approximately 3 times.

The average cost of a data breach worldwide continues to rise steadily, reaching 4.45 million U.S. dollars in 2023. According to Statista, the healthcare sector has the highest average cost of a data breach.

IBM Cost of a Data Breach research revealed that the healthcare industry had been the leading sector in data breach costs for 12 years in a row. In 2022, the average cost of a data breach was $10.10 million. Notably, the overall global cost of such breaches has increased by 15% over 3 years.

The United States is at the top of the list of countries most affected by data breach costs, with an average total cost of  $9.48 million per breach. The Middle East follows second with $8.07 million per data breach.

1 U.S. dollar—this is how much higher the average data breach per record cost will be in 2023, reaching $165/record compared to last year’s average cost.

The same IBM research suggests that, on average, companies with incorporated AI and automation solutions save $1.76 million compared to organizations that don’t apply similar measures to mitigate data breach risks.

Organizations that don’t follow compliance requirements tend to pay a 12.6% higher average cost than companies that have a high level of compliance.

Verizon’s 2023 Data Breach Investigations Report revealed that financially motivated external actors induced 83% of breaches. Human error, the most common reason behind successful cyber-attacks, remains a consistent factor in 2023, with a human element present in 74% of breaches.

Verizon research also listed system intrusion as the most popular pattern of breaches. Basic web application attacks, social engineering, miscellaneous errors, privilege misuse, and lost and stolen assets follow it.

Let’s dive into the latest data breach news that happened in 2023. This overview is based on publicly available information about data breaches and is subject to change as more new findings are discovered and revealed over time.

January 2023

MailChimp data breach

01 Data-breach-profiles 1400x1036

MailChimp, an Intuit-owned email marketing platform, suffered a data breach. The breach occurred on January 11, 2023, when an unauthorized actor accessed Mailchimp’s tools used by teams interacting with customers.

  • The actor gained access to a tool used for internal customer service and account management, compromising the data of 133 customers​​.

  • The breach was executed through a social engineering attack on MailChimp employees and contractors, enabling attackers to obtain employee credentials.

  • This incident was first detected when MailChimp noticed an unauthorized person accessing their support tools on January 11. MailChimp temporarily suspended access for accounts exhibiting detected suspicious activity to protect users’ data.

  • MailChimp notified the primary contacts for all affected accounts on January 12, less than 24 hours after the initial discovery​​​​.

  • MailChimp assured that no credit card or password information was compromised in this incident.

One of the notable customers affected by this breach was WooCommerce, a popular eCommerce plugin for WordPress. WooCommerce informed its customers that the breach exposed their names, store URLs, and email addresses.

Although there was no indication that the data stolen had been misused, there was a concern. Such data could be used for targeted phishing attacks to steal credentials or install malware​​​​.

February 2023

Activision data breach

Activision, a video game publisher known for games like Call of Duty and World of Warcraft, experienced a data breach in early December 2022, which surfaced only in February 2023.

  • Attackers gained access to the company’s internal systems through an SMS phishing attack on an employee. Supposedly, the targeted employee belonged to the Human Resources department and had access to a significant amount of sensitive employee information​​.

  • Bad actors were able to obtain sensitive employee information, such as full names, email addresses, phone numbers, and financial data like salaries, work locations, and more. The compromised data also included details about upcoming content for the Call of Duty Modern Warfare II franchise.

  • This breach was not publicly or internally disclosed until screenshots of the stolen data, including the schedule of planned content for Call of Duty, were shared by the cybersecurity and malware research group vx-underground several months after the accident​​​​.

  • Activision’s response to the breach involved swiftly addressing the SMS phishing attempt and conducting a thorough investigation.

The company initially asserted that no sensitive employee data, game code, or player data was accessed. However, the evidence provided by vx-underground and ‘Insider Gaming’ contradicted this claim, showing that sensitive workplace documents and employee information had indeed been exfiltrated​​.

This delay in notification raised questions about whether Activision complied with data breach notification laws. This is particularly relevant as California, where Activision is headquartered, has specific laws requiring companies to notify victims of data breaches when a significant number of state residents are affected​​.

March 2023

ChatGPT data breach

In March 2023, ChatGPT, an AI-driven chatbot developed by OpenAI, experienced a significant data breach.

  • The data breach was caused by a bug in the Redis open-source library, which led to the exposure of other users’ personal information and chat titles. This bug allowed certain users to view brief descriptions of other users’ conversations from the chat history sidebar.

  • The breach wasn’t directly caused by a threat actor but resulted from a vulnerability in the Redis open-source library. This vulnerability was inadvertently exploited due to a server-side change introduced by OpenAI. This changed to a surge in request cancellations and increased the error rate.

  • The breach potentially revealed information about 1.2% of ChatGPT Plus subscribers. It included the active user’s first and last name, email address, payment address, the last four digits of a credit card number, and the expiration date. However, it’s emphasized that full credit card numbers were not exposed.

  • The first message of a newly-created conversation might have been visible in someone else’s chat history if both users were active around the same time. Additionally, viewing other users’ chat history and conversation titles was possible.

OpenAI promptly addressed the bug soon after its discovery and temporarily shut down the ChatGPT service to manage the issue. The company announced a bug bounty program in April to help detect future issues and prevent similar incidents.

The incident highlighted the potential risks for chatbots and AI technologies and the importance of robust security measures, especially when using open-source libraries.

April 2023

Shields Healthcare Group data breach

Shields Healthcare Group is a Massachusetts-based medical services provider. It specializes in MRI and PET/CT diagnostic imaging, radiation oncology, and ambulatory surgical services. In 2023, the company experienced a significant data breach.

  • The data breach involved unauthorized access to Shields’ systems. The breach was detected when suspicious activity suggesting a data compromise was observed.

  • The exact method used by the attackers to gain access is unclear, but possibilities include exploiting a network software weakness or using a phishing attack to compromise an employee account​

  • The attackers accessed a wide range of sensitive patient information and confidential data. This included full names, Social Security numbers, dates of birth, home addresses, provider information, diagnoses, billing information, health insurance information, medical record numbers, patient IDs, and other medical or treatment information.

  • Approximately 2.3 million people were affected by this breach. Shields’ business model, which involves partnerships with hospitals and medical centers, meant the breach had far-reaching consequences, impacting 56 facilities and their patients.

Upon discovering the breach, the healthcare provider took immediate steps to contain the incident. They initiated a thorough investigation with the help of third-party forensic specialists. They secured their systems, including rebuilding certain systems, to prevent further unauthorized access.

Shields has continued reviewing the potentially impacted information and notifying individuals and regulators. Additionally, they have committed to enhancing their data security measures and protections.

May 2023

MOVEit data breach

05 Data-breach-profiles 1400x1036

MOVEit Transfer software, a file transfer tool developed by Progress Software, transfers large amounts of often-sensitive data over the internet. It’s employed by organizations worldwide to manage file transfers, including pension information, social security numbers, medical records, and billing data. The MOVEit data breach of May 2023 was a significant cybersecurity incident.

  • The breach involved a zero-day vulnerability in MOVEit Transfer. This critical-rated vulnerability allowed attackers, particularly the “cl0p”, a ransomware and extortion gang, to raid MOVEit Transfer servers and steal customers’ sensitive data stored within​.

  • The attackers, identified as the group “cl0p”, exploited the MOVEit software vulnerability starting around May 27, 2023. Progress Software became aware of the compromise in the computer systems the next day after a customer noticed strange activity.

  • As of August 2023, over 1,000 victim organizations and more than 60 million individuals were impacted by this high-profile data breach.

  • Victims ranged from New York public school students to Louisiana drivers to California retirees, indicating the vast variety of data compromised​​. Other significant victims included the French government’s unemployment agency, Pôle emploi, multiple federal agencies, and U.S. state departments.

  • Approximately one-third of hosts running vulnerable MOVEit servers belonged to financial service-related organizations, with significant percentages in the healthcare, IT, government, and military sectors.

  • The estimated total cost of the MOVEit mass-attacks so far is about $9.9 billion, based on the average cost of data breaches and the number of individuals affected. This figure could potentially scale to at least $65 billion.

Progress Software acknowledged the cyber-attack and focused on supporting its customers. They issued a patch to fix the vulnerability and alerted users to the issue​​.

Not all organizations could deploy the patch in time, resulting in varying levels of data compromise​. The breach is notable for its scale and the variety of victims affected, demonstrating how a flaw in a single piece of software can trigger a global privacy disaster​.

June 2023

JumpCloud data breach

JumpCloud, an identity and access management firm, experienced a data breach incident in June 2023. The company offers a directory platform that enables enterprises to authenticate, authorize, and manage users and devices.

  • The breach was the result of a sophisticated nation-state actor’s intrusion. The attackers gained access to JumpCloud’s systems to target a small and specific set of customer accounts. The attack vector was a data injection into the commands framework, and it was highly targeted.

  • The exact number of affected customers and the types of organizations targeted have not been disclosed. However, JumpCloud provides its software to more than 180,000 organizations and counts over 5,000 paying customers, indicating a potentially large impact.

  • The initial attack was traced back to a spear-phishing campaign initiated on June 22, 2023. The adversaries leveraged domains such as nomadpkg[.]com and nomadpkgs[.]com, likely related to a Go-based workload orchestrator used to deploy and manage containers.

  • The extent of the damage and the specific details about the customers impacted have not been fully disclosed, but the breach highlights the importance of robust cybersecurity measures against sophisticated and persistent nation-state actors​

JumpCloud reset customers’ API keys as a precaution. The company took security steps to shield its network, rotating credentials and rebuilding systems. After detecting unusual activity, JumpCloud forced the rotation of all admin API keys and started notifying affected customers​​​​.

The company has published a list of indicators of compromise (IoCs) to help other organizations identify similar attacks and is enhancing its own security measures​

July 2023

Indonesian Immigration Directorate General data breach

The Indonesian Immigration Directorate General is responsible for managing immigration-related matters in Indonesia, including issuing and managing passports. In July of 2023, the institution fell victim to a major data breach.

  • The data breach involved the unauthorized access and leakage of passport data of more than 34 million Indonesian citizens. The leaked data included the full names, passport numbers, expiry dates, dates of birth, and genders of the passport holders​.

  • The breached data of 34.9 million Indonesian passport holders was offered for sale for $10,000. A sample of the stolen data was also made available on a hacker platform, showcasing passport data from 2009 to 2020. The data is considered valid based on the given sample.

  • The leaked data potentially included National Identity Community Identity Card (NIKIM) information, a digital identity used to secure electronic passports containing personal data such as names, addresses, and identity numbers​.

  • The specifics of how the breach was achieved were not detailed in the available sources. However, the data was reportedly leaked and sold on the bjork.ai website, indicating that it may have been a sophisticated cyber attack or hacking incident​.

  • The ministry noted differences in the data structure between the breached data and the data in the national data center, indicating ongoing investigations to understand the extent and nature of the breach​.

The available sources did not fully detail the outcome of the investigation and the broader impact of the breach. However, the breach underscores the importance of robust cybersecurity measures for government databases, particularly those containing sensitive personal information like passport details.

August 2023

UK Electoral Commission data breach

The Electoral Commission, an independent body overseeing elections and regulating political finance in the UK, fell victim to hostile actors in August 2023. This complex cyber-attack involved unauthorized access to internal emails, control systems, and copies of electoral registers, which contain voter data.

  • A malicious actor gained access to the Electoral Commission’s systems in August 2021, but the breach was only identified in October 2022 after suspicious activity was detected.

  • The accessed registers held the names and addresses of UK voters registered between 2014 and 2022, including those registered as overseas voters. Notably, the details of anonymous voters were not included in these registers.

  • Predicting the exact number of people impacted is challenging, but it’s estimated that the register for each year includes details of about 40 million individuals.

  • While the full extent of the damage is not conclusively known, the Electoral Commission acknowledged that they could not determine exactly what files may have been accessed.

  • The attack is considered to be sophisticated, with hostile actors attempting to use software to evade the systems.

  • In response to the breach, the Electoral Commission collaborated with the National Cyber Security Centre (NCSC), law enforcement officials, and external experts to investigate and secure its systems. Subsequently, they have made improvements to the security of their IT systems.

The outcome of this breach reiterates the vulnerability of democratic institutions to cyber threats. It emphasizes the importance of robust cybersecurity measures, especially for bodies involved in the electoral process.

September 2023

T-Mobile data breach

In September 2023, T-Mobile, one of the largest mobile carriers in the United States, experienced a significant data breach. This incident is part of a series of security lapses that have affected the company in recent years.

The breach in September 2023 involved two separate security incidents:

  • Employee data exposure: on September 21, 2023, 89 gigabytes of data primarily related to T-Mobile employees, including email addresses and partial Social Security Numbers, were posted on a hacker forum.

  • This data was tied to an earlier breach in April of Connectivity Source, a T-Mobile retailer. T-Mobile itself denied being directly hacked as part of this incident, indicating the breach occurred at a third-party service provider. The exposed employee confidential data could pose risks of identity theft or fraud.

  • Customer data exposure: the second data breach occurred later in September when a system error in the T-Mobile app exposed customer payment data of fewer than 100 customers. Users of the app inadvertently accessed other customers’ personal information, including phone numbers and billing addresses. T-Mobile attributed this to a glitch related to a technology update.

  • The glitch in the T-Mobile app exposed the personal information of several customers, including names, phone numbers, physical addresses, account balances, and partial credit card details.

  • Though the company initially claimed the breach affected fewer than 100 individuals, later reports suggested the personal information of millions could have been exposed. However, the company has not released the exact number of T-Mobile customers affected.

The September 2023 T-Mobile data breach underscores the ongoing cybersecurity challenges faced by large corporations, especially in sectors handling vast amounts of personal data. This incident, stemming from a system glitch rather than a direct hack, reveals the multifaceted nature of data security threats. It also emphasizes the importance of robust and continuously updated security measures to protect against both external attacks and internal vulnerabilities.

October 2023

23andMe data breach

The 23andMe is a genetics testing company that offers DNA testing services to help users learn more about their ancestry. Users can discover their ethnic backgrounds and connect with relatives through shared DNA. A data breach in October 2023 was a significant event, revealing vulnerabilities in the protection of sensitive genetic and personal information.

  • The breach involved unauthorized access to the “DNA Relatives” feature of 23andMe, where users can share personal data, including ancestry reports and matching DNA segments, with other users globally.

  • The breach exposed personal information, including display names, birth years, sex, and details about genetic ancestry results. Initially, data of one million users of Ashkenazi Jewish descent and another 100,000 users of Chinese descent were claimed to be stolen. This later expanded to include records of four million more general accounts. However, genetic data itself was not included in the breach.

  • Bad actors likely used a technique called ‘credential stuffing attack,’ where actors tried combinations of usernames and passwords from previous data breaches on other websites, hoping people had reused passwords.

  • 23andMe responded by requiring all customers to utilize email two-step verification (2SV), temporarily disabling some features within the DNA Relatives tool for added security, and advising users to change their login information and enable multi-factor authentication.

The company launched an investigation with third-party forensic experts. 23andMe also emphasized its commitment to security, highlighting its ISO certifications and continuous monitoring and auditing of the company’s systems. They assured us they would notify customers directly if their data were accessed without authorization.

November 2023

Idaho National Laboratory (INL) data breach

The Idaho National Laboratory (INL), a key component of the U.S. Department of Energy, suffered one of the most recent data breaches in November 2023. As part of the U.S. Department of Energy, INL is one of the country’s premier advanced nuclear energy testing labs. Its work includes research and development in nuclear and non-nuclear energy sources, national security, and related fields​.

  • The breach involved the compromise of INL’s Oracle Human Capital Management servers, which are used for human resources applications. It was executed by the SiegedSec hacking group. The attackers managed to access “hundreds of thousands of user, employee, and citizen data.”

  • The leaked data included sensitive personal information like Social Security numbers, bank account and routing numbers, health care details, marital status, and account types. This data related to current, former, and retired employees of the laboratory.

  • The attackers targeted a federally approved third-party vendor system outside INL that supports the lab’s cloud-based human resources services.

  • INL took swift action to bolster employee data protection following the breach. They also communicated with federal law enforcement agencies, including the FBI and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, to investigate the breach’s impact​.

The investigation into the breach is ongoing. INL is working with federal law enforcement to fully grasp the extent of the impacted data and implement measures to prevent similar security incidents.

December 2023

Soon to be updated.

What to expect in 2024?

The latest data breaches served as stark reminders of cyber threats’ dynamic and relentless nature for gaining access to sensitive data. They reinforced the necessity for businesses and organizations across all sectors to prioritize and continuously update their cybersecurity measures, ensuring their data protection and stakeholders’ trust.

To prevent a potential data leak or breach, think two steps ahead and implement a robust cybersecurity strategy to protect sensitive data and avoid reputational and financial consequences that follow the breach.

Comprehensive network access security solutions like NordLayer provide organizations with the best in the industry-based security frameworks and models known as Security Service Edge (SSE) and Zero Trust Network Access (ZTNA). Choose simple and effective security by design and protect your network and teams in all ways of working.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Iran-linked OilRig attacks Israeli organizations with cloud service-powered downloaders, ESET Research discovers

  • Iran-linked advanced persistent threat (APT) group OilRig actively developed and used a series of downloaders with a similar logic throughout 2022. There are three new downloaders – ODAgent, OilCheck, and OilBooster – and newer versions of the SC5k downloader.
  • The targets, all in Israel, included an organization in the healthcare sector, a manufacturing company, and a local governmental organization. All targets were previously affected by multiple OilRig campaigns.
  • The downloaders use various legitimate cloud services for command and control communications and data exfiltration; namely, Microsoft Graph OneDrive API, Microsoft Graph Outlook API, and Microsoft Office EWS API.

BRATISLAVA, MONTREAL — December 14, 2023 — ESET researchers analyzed a growing series of new OilRig downloaders that the group used in several campaigns throughout 2022 to maintain access to target organizations of special interest, all located in Israel. They include an organization in the healthcare sector, a manufacturing company, and a local governmental organization. OilRig is an APT group believed to be based in Iran, and its operations, as are these latest downloaders, are aimed at cyberespionage. The new lightweight downloaders – SampleCheck5000 (SC5k v1-v3), OilCheck, ODAgent, and OilBooster – are notable for using legitimate cloud storage and cloud-based email services for command and control (C&C) communications and data exfiltration, namely, the Microsoft Graph OneDrive or Outlook Application Programming Interfaces (API), and the Microsoft Office Exchange Web Services API.

“On par with the rest of OilRig’s toolset, these downloaders are not particularly sophisticated. However, the continuous development and testing of new variants, experimentation with various cloud services and different programming languages, and the dedication to re-compromise the same targets over and over again, make OilRig a group to watch out for,” says ESET researcher Zuzana Hromcová, who analyzed the malware along with ESET researcher Adam Burgher.

ESET attributes SC5k (v1-v3), OilCheck, ODAgent, and OilBooster to OilRig with a high level of confidence. These downloaders share similarities with the MrPerfectionManager and PowerExchange backdoors – other recent additions to OilRig’s toolset that use email-based C&C protocols – with the difference that SC5k, OilBooster, ODAgent, and OilCheck use attacker-controlled cloud service accounts rather than the victim’s internal infrastructure.

The downloader ODAgent was detected in the network of a manufacturing company in Israel – interestingly, the same organization was previously affected by OilRig’s SC5k downloader, and later by another new downloader, OilCheck, between April and June 2022. SC5k and OilCheck have similar capabilities to ODAgent but use cloud-based email services for their C&C communications. Throughout 2022, ESET observed the same pattern being repeated on multiple occasions, with new downloaders being deployed in the networks of previous OilRig targets: For example, between June and August 2022, ESET detected the OilBooster, SC5k v1, and SC5k v2 downloaders and the Shark backdoor, all in the network of a local governmental organization in Israel. Later, ESET detected yet another SC5k version (v3) in the network of an Israeli healthcare organization, also a previous OilRig victim.

OilRig has used these downloaders only against a limited number of targets, according to ESET telemetry, and all of them were persistently targeted months earlier by other OilRig tools. As it is common for organizations to access Office 365 resources, OilRig’s cloud service-powered downloaders can thus blend more easily into the regular stream of network traffic – apparently also the reason why the attackers chose to deploy these downloaders to a small group of especially interesting, repeatedly victimized targets.

OilRig, also known as APT34, Lyceum, Crambus, or Siamesekitten, is a cyberespionage group that has been active since at least 2014 and is commonly believed to be based in Iran. The group targets Middle Eastern governments and a variety of business verticals, including chemical, energy, financial, and telecommunications.

For more technical information about the latest OilRig downloaders, check out the blogpost “OilRig’s persistent attacks using cloud service-powered downloaders” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

Timeline of OilRig’s downloaders

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Defending Your Network from 1xBet

1xBet is an online betting platform offering sports betting, casinos, and other games. It is recognized as illegal in many countries, including France, Italy, Spain, the Netherlands, Israel, the US, etc. That means internet service providers across the world (especially in areas where gambling in general is beyond the law) face such an online security challenge as restricting access to 1xBet resources.

The Elusive Nature of 1xBet

Blocking 1xBet is quite a difficult task since the platform operates in a unique way, adapting its functionality based on various factors, including user location and app version. This adaptability makes it challenging to employ traditional blocking mechanisms, requiring a more sophisticated approach.


The major aspect of
1xBet
is that it
has spawned numerous resources with similar themes and functions,
operating under different names.
However, it is important not to get confused and understand that all these resources are connected with or derived from the core 1xBet platform. This understanding is essential for crafting effective defense strategies.

 

Log Analysis

Our team analyzed the logs to identify the domains the app accesses. The impressive part of the way the platform works is its ability to bypass domain blocking. When certain domains or even lists of domains are blocked, the 1xBet app resumes its operation within minutes. It either gets new sources during updates or requests domains from specific sources.

Location-Based Adaptability

The app’s behavior is also influenced by the user’s location. By checking the device’s location, 1xBet selects the appropriate display language. We must say that changing the language doesn’t significantly affect the domains the app accesses. In cases where the device’s location differs from the Geo IP-based one, the app requests permission to access data from Geo IP or GPS, and depending on the location, it accesses different domain names.

Domain Generation Algorithm

During research, it was discovered that all identified domains constantly change depending on the app version and are generated using a domain generation algorithm. Besides, similar or previously used domains were found to be utilized by other apps that resemble or relate to 1xBet.

SafeDNS’s Proactive Approach


It is essential to highlight that
SafeDNS is able to block both the web version of the site and the mobile app.
At the moment, our team has fully developed an automated process to detect the domain names that the 1xBet app accesses.

We are also actively researching the ways used by the service to bypass blocking mechanisms. This is done as a proactive measure to stay ahead and anticipate any changes made to the app’s mechanisms. It’s important to mention that since the service generates many different domains in various regions to prevent blocking, not every filtering service can recognize and classify these newly created domains as gambling. However, SafeDNS is different. Our technology, powered by AI and machine learning, is capable of instantly identifying and blocking these types of sources.

If you have any questions or require assistance regarding the blocking of 1xBet, our team is always ready to help.

Stay protected with SafeDNS!

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

ESET Threat Intelligence data feeds join the hunt with Microsoft Sentinel integration

ESET Threat Intelligence data feeds set to increase visibility for users operating Microsoft Sentinel SIEM/SOAR platform.

BRATISLAVA — December 8, 2023 —ESET, a global leader in cybersecurity, today announced that its long-standing collaboration with Microsoft now includes the integration of ESET’s six threat intelligence data feeds with Microsoft Sentinel, a scalable, cloud-native solution providing security information and event management (SIEM) and security orchestration, automation, and response (SOAR) capabilities. ESET’s integration utilizes Microsoft Sentinel’s built-in TAXII client, helping security operations center (SOC) analysts in any organization hunt and investigate customers’ threat environments. This marks a new effort to extend the benefit of ESET’s unique data to organizations seeking to improve existing comprehensive threat intelligence solutions and rapid response capabilities.

The ESET data in question is built on the back of its renowned Malware and Threat Research pedigree, which benefits from unique telemetry fed from its substantial installed user base, among them regions underserved by most competitors. This unique value-add is best demonstrated by the many notable research pieces and exclusive detections, including GreyEnergy, BlackEnergy, Industroyer, NotPetya and many of the wiper malware discovered at the start of Russia’s invasion of Ukraine.

ESET’s data and its research cadre also regularly feature in large botnet takedowns and disruptions. These discoveries were pursued by more than 160 researchers and software engineers working in Core Research and Threat Detection at ESET.

The threat data feeds featured in this integration comprise only relevant, curated data that has already received in-house data evaluation, curation, sorting, scoring and processing. The data feeds include APT feed, malicious files feed, botnet feed, domain feed, URL feed and IP feed. The quality of the data is also reflected in the strong standing of #ESETResearch in the cybersecurity community and the contributions of its experts in partnership with MITRE ATT&CK, CISA, EUROPOL, FBI and a number of government entities.

With global concerns intensely focused on threats vectoring from Russia’s war in Ukraine and other hotspots going global, ESET prioritized rapid support for enterprises via its threat data in an agnostic approach to users’ chosen threat intelligence (TI) platforms. This acknowledges the diversity of software and technology stack choices. The integration also signals ESET’s path toward supporting seamless interaction between our data and internal tools and third-party SIEM and SOAR tools — starting with Microsoft Sentinel. This approach supports simplified workflows and reductions in manual effort and enhances efficiency. The collaboration between the two companies also demonstrates a strong market position, with two industry leaders combining their strengths.

“Integrating with Microsoft Sentinel allows us to demonstrate focus on strengthening security now. With our security-first, customer-centric mindset front and center, the integration will allow ESET and Microsoft’s joint customers to immediately benefit from a more holistic view of their security posture by combining ESET’s real-time threat data with customers’ wider security operations,” said Trent Matchett, ESET Director of Global Strategic Accounts.

“This announcement is also a proof point for ESET’s journey towards utilization of industry standard APIs (TAXII 2.1 and STIX 2.1) to deliver Threat Intelligence products. With the Microsoft Sentinel integration, ESET further demonstrates the unique value-add we’ve brought to the cybersecurity community for more than 30 years. So, for SOC teams, CERTs, MSSPs or TIPs that come across this integration, they should know that ESET data is highly actionable, and with ESET’s storied low false positive rates, can have immediate impact when countering threats that ESET has unique detections for,” Matchett continued.

Microsoft Sentinel users can now benefit from unique, diverse, actionable feeds from ESET. They can enrich their TI in a very useful and valuable way, and significantly improve their security posture and prevent ransomware attacks, malware campaigns, etc. These benefits are built upon the strong foundations of ESET threat intelligence (data feed) and its endpoint protection products (ESET PROTECT), which collectively include:

  • Enhanced analysis
  • Cloud native deployment
  • Intelligence-driven data (highly curated)
  • Dedicated team of threat researchers tracking all major APT groups
  • Unique data sources
  • Deeper visibility
  • Protection from botnets, precursors to ransomware attack
  • Advanced context of IOCs
  • Early-stage detection and protection
  • Protection against threats with automated intelligence in real time

Find further information about the ESET threat data feed and integration with Microsoft Sentinel here. Additional detailed information about ESET Threat Intelligence, our API project and other related topics is available on our corporate website, or make a direct inquiry. 

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.