Kenya CyberSecurity & Forensics Association: KCSFA

Cyber Safety for the weekend: Ensure that you have a working backup Activate the proactive cyber monitoring Have automatic updates for your computers Remind people to be alert to cyber issues Test drive your disaster recovery sites Automate your cyber monitoring processes

Russian threat actor Midnight Blizzard is conducting widespread traffic manipulation attacks at hotels worldwide. Result: delivering malware or redirecting auth flows at their discretion, globally. Since early May 2026, we saw this subcluster manipulate DNS and HTTP traffic from networks served by captive portals to redirect user traffic through actor-controlled infrastructure. We’re calling the campaign CaptiveCrunch. “We have observed notable commonalities in the equipment and management systems used across multiple affected networks.” We break down the malware & techniques, but the most important part is how dynamic all of it is: Midnight Blizzard is using AI to support a significant portion of these operations. They are moving and changing quickly. Feedback welcome on the suggested mitigations: microsoft.com/en-us/security… Help spread the word to VIPs in governments, diplomatic entities, non-governmental organizations (NGOs) in the US and Europe (probably also those traveling to Black Hat)

These are our key activities makes us unique as an association: Cyber for specialized groups Cyber Swahili dictionary Cyber digest magazine Cyber awareness for the public Institute of Cyber and Forensics Cyber and Digital Forensics center of excellence Cyber awareness marathon

⚠️ Two compromised joyfill npm beta packages run malware as soon as Node.js imports them. No install hook needed. The implant fetches a DEV#POPPER-linked RAT through three blockchains, while a detached branch can keep running after builds or tests exit. Read the full story: thehackernews.com/2026/07/two-co…

How do you comply with the Data Protection Act Appoint a Data Protection Officer (DPO) Register as a data controller or processor with ODPC Data Protection Impact Assessment (DPIA) Develop data protection policies Train employees Establish data breach response procedures

Vulnerabilities in AI Systems: Data Poisoning: Injecting malicious inputs during training to corrupt model accuracy Prompt Injection: Manipulating language models via text inputs to extract confidential logic Model Inversion: Observing system outputs

Open source cyber solutions for SME: eramba.org (Eramba) for GRC wazuh.com (Wazuh) for Threat intelligence misp-project.org (MISP) for Threat sharing github.com/telekom-securi… (T-Pot) Honeypot wireshark.org (Wireshark) Network traffic

🚨 The malware arrives in pieces. The victim’s browser puts it together. SourTrade malvertising delivers a legitimate Bun runtime, malicious bytecode, and PE components separately, then uses the browser to build the final Windows executable with a different hash each session. See how the browser-assembled malware chain works: thehackernews.com/2026/07/malver…

How do you become an experienced cyber court expert witness in Kenya: Invest in the IT / Cyber concepts & fundamentals for foundational purpose Identify an established expert witness, request their support and volunteer if possible For more: linkedin.com/feed/update/ur…

🚨 Researchers say one short message let Claude Cowork escape its Linux VM and access files across the host Mac. The SharedRoot chain used CVE-2026-46331 to gain guest root, then crossed through Cowork’s read-write host mount. Read how it worked: thehackernews.com/2026/07/claude…

🔥 OpenAI says its own AI models broke out of a sandbox, exploited a zero-day, and targeted Hugging Face’s production infrastructure to cheat a security benchmark. The incident showed how long-running models can learn and work around approval-system blind spots. Read the full story: thehackernews.com/2026/07/openai…

Demystifying myths in CyberSecurity, especially in KE: Only technical people can excel in CyberSecurity You need a huge investment to secure your information as an SME Africa has no sufficient skills in CyberSecurity You cannot consider Cyber as an entry level career

Kama wataalamu wa #Cybersecurity, hili ni somo kubwa kwa taasisi za kimkakati Binafsi nashauri haya :- 1️⃣ Msilipe Fidia: Kulipa Bitcoin hakuhakikishi usalama wa data na kunachochea uhalifu zaidi. Rejesha mifumo kupitia offline backups. 2️⃣ WAF & Monitoring: Weka Web Application Firewall imara kuzuia wadukuzi kubadilisha maudhui (defacement). 3️⃣ MFA kwa Ma-Admin: Linda akaunti zote za wasimamizi wa tovuti kwa uthibitisho wa hatua mbili (Multi-Factor Authentication). 4️⃣ Forensic Audit: pafanyike uchunguzi wa udhaifu (vulnerability) uliotumika kabla ya kuwasha tena seva. Usalama wa kidijitali wa nchi unapaswa kuwa kipaumbele cha kwanza wakati wote. @StateHouseKenya | @Kenyans | @ntvkenya | @kcsfa

The President's website being hacked is a pointer to several things: There is an urgent need to collaborate amongst cyber stakeholders for solutions Cyber criminals are sharpening their tools & leveraging the emerging technology to wreak havoc No one is exempt from attacks

Proton VPN just shared that it received 47 legal orders through June this year, all seeking to identify users behind specific server IPs and timestamps. Every one was denied, because its no-logs policy leaves no connection data to hand over. Per its transparency report, updated July 14, that brings the total since 2019 to 458 orders, with zero fulfilled. The company keeps no connection logs under Swiss law, so there is nothing to produce even when an order is binding.

Once we have completed our review for security vulnerabilities, we will make the entire codebase of 𝕏 open source, with no exceptions. Moreover, we will invite third party reviewers to examine the system that is running to confirm that the open source code is what is running. Trust through total transparency is the only thing that should be believed.

SIM Swap Fraud Case against @SafaricomPLC and @dtbKE This is a major victory for the Kenyan citizen, who has been a victim for a long time It sets a precedent on how such losses are supposed to be handled and prosecuted Cyber Safety techweez.com/2026/07/13/saf…

Cyber is a collective responsibility. What is your role as a Kenyan citizen: To be informed on cyber matters To know how / where to report cyber breaches To be protected as per the law To be aware of the prevailing cyber threats To keep your devices safe from cyber criminals

🚨 Zimbra has fixed a critical stored XSS flaw in its Classic Web Client. A crafted email could run malicious code when opened and expose mailbox information, session data, or account settings. Read the full story on THN 🠖 thehackernews.com/2026/07/critic… Zimbra has not reported in-the-wild exploitation. Update to version 10.1.19.