Cyber Security
Amazon-Related Phishing Sites Approach 900 on Amazon Prime Day

Amazon’s annual Prime Day event is already in motion, which is one of the most profitable days for Amazon, together with Black Friday, Cyber Monday, and the holiday season. At the same time, it’s one of the most opportune moments for criminals to dupe consumers into visiting fake sites, which can look nearly identical to the real ones. Fraudsters can even use Google Ads to rank well in Google searches.
According to data presented by Atlas VPN, Amazon is the most impersonated retail brand in phishing websites, with over 1,633 suspicious sites detected in the last 90 days. Notably, some of those sites have already been taken down, either by scammers themselves or by various security measures. However, as of July 12, as many as 897 websites are still live.
The data for the research was extracted from CheckPhish, a phishing and fraud site scanner, which uses deep learning, computer vision, and NLP to simulate how a person would examine, comprehend, and reach a verdict on a suspicious website.
The following most imitated retail brand is Walmart, with 427 phishing sites detected in the last 90 days, out of which 109 are still up and running on July 12, 2022.
Alibaba, one of the largest e-commerce companies globally, is the third most mimicked brand in phishing websites, with 398 detections in the last 90 days, out of which nearly half – 174 are still alive.
Interestingly, UGG, an American footwear company, is the fourth most impersonated retailer. The site scanner detected 98 suspicious websites using the UGG brand name. Only 6 of those sites have been taken down so far.
Target is fifth on the list, and that is no surprise since it’s one of the largest corporations in the US. As many as 75 websites mimicking Target were detected since April 13, 2022. Today, 46 of those sites are still accessible.
The biggest sports brand in the world – Nike, also makes a list, with 49 suspicious sites identified, out of which only 1 ceased its activity.
Finally, The Home Depot, another US corporate giant, closes off the list of the most impersonated retail brands. This retailer was imitated on 31 websites, with 26 of them still accessible online as of July 12, 2022.
How to detect dubious websites
With Amazon Prime day in play, it’s much easier for cybercriminals to mix in their emails and ad’s among thousands of legitimate ones. Consumers should be especially wary of dubious sites in the upcoming days. Atlas VPN shares some of the most important tips on how to recognize phishing websites.
- Please pay attention to Google Ads because scammers might use them to rank well in Google searches.
- Check the website’s URL (address); leave immediately if it contains mistakes or strange symbols. Fraudsters might use alphabets with similar-looking letters representing the authentic website, so make sure to scrutinize the URL.
- Grammar and spelling issues should be an immediate red flag, so keep an eye out for them. Scammers hardly ever employ expert writers to proofread the content of their copycat website.
Cyber Security
Beyond Blocklists: How Behavioural Intent Analysis Can Safeguard Middle East Businesses from Rising AI-Driven Bot Threats

The Middle East is facing an unprecedented surge in AI-driven bot attacks, with malicious automation now outpacing traditional defenses. Mohammad Ismail, Vice President for EMEA at Cequence Security, warns that legacy tools like IP blocklists and rate limiting are no match for today’s sophisticated threats (more…)
Cyber Security
Sophos Boosts Firewall with New Protection and Incident Response Features

Sophos has announced a significant update to its Sophos Firewall software, introducing enhanced protection and incident response capabilities. This update notably includes Sophos NDR Essential, a new feature now available free of charge to all customers holding an XStream Protection license for Sophos Firewall.
This integration empowers Sophos Firewall with two dedicated artificial intelligence (AI) engines specifically designed to detect both malware communications and those utilizing algorithmically generated domain names. This advanced functionality, derived from the Sophos Network Detection and Response (NDR) probe, aims to identify sophisticated malware communications even if they are previously unknown or not yet indexed. It serves as a powerful complement to the Active Threat Response capabilities already embedded within Sophos firewalls.

Chris McCormack, Senior Product Marketing Manager at Sophos
Addressing the technical demands of such advanced detection, Chris McCormack, Senior Product Marketing Manager at Sophos, explained the strategic approach, “NDR traffic analysis requires substantial processing power. That’s why we’ve adopted a new approach by deploying an NDR solution in Sophos Cloud to offload the heaviest tasks from the firewall.” This cloud-centric design ensures optimal performance without burdening the firewall’s on-device resources.
Beyond network detection, the update also brings significant improvements to connectivity and user authentication. Sophos Connect now integrates EntraID for Single Sign-On (SSO). This new feature for the VPN client, bundled with Sophos Firewall, is set to enhance both the security and user experience for SSL and IPsec VPN connections. The integration with EntraID (Azure AD) enables users to authenticate and leverage multi-factor authentication for both Sophos Connect and access to the user portal hosted by the firewall, streamlining secure access.
Further VPN-related enhancements include:
- Improved user interface and usability: Connection types have been renamed for greater clarity, with “site-to-site” now referred to as “policy-based” and tunnel interfaces as “route-based,” making configurations more intuitive.
- Dynamic validation of the IP address pool: For VPN connections (SSL VPN, IPsec, L2TP, and PPTP), the system now dynamically validates the allocated IP address pool, helping to better resolve potential IP address conflicts.
- Strict profile enforcement: IPsec profiles now exclude default values to ensure algorithm synchronization, effectively eliminating potential fragmentation of session negotiation packets that could otherwise prevent site-to-site VPN tunnels from being established.
- Route-based VPN and SD-RED scalability: The system has been optimized to support up to 3,000 simultaneously established tunnels. Specifically, Sophos Firewall solutions can now manage up to 1,000 SD-RED site-to-site tunnels and connect up to 650 concurrent SD-RED devices.
Additional management improvements enhance administrative flexibility and search capabilities:
- More flexible DHCP Prefix Delegation (IPv6 DHCP-PD): The system now supports a broader range of prefixes, from /48 to /64, improving compatibility with various internet service providers.
- Router Advertisement (RA) and DHCPv6 server: These features are now enabled by default, simplifying IPv6 network setup.
- Resizable table columns: The web admin interface continues its adaptation for ultra-wide screens, with many configuration pages now allowing users to resize columns as needed for improved usability.
- Enhanced object search functionality: The search field within the SD-WAN routing configuration screen now supports more granular criteria, including route name, ID, objects, and object values like IP addresses and domains. Similarly, local ACL rules now also support object name and value searches, extending to content-based searches for more precise results.
- Default configuration changes: To streamline initial setups, default firewall rules and rule groups previously created during new firewall deployments have been removed. The initial configuration now only includes the default network rule and MTA rules. Furthermore, the default firewall rule group and the default gateway probe for custom gateways are now set to “None” by default.
Sophos continues its commitment to cybersecurity through a “Secure by Design” approach, enhancing the intrinsic security of its firewalls. This methodology involves the containerization of specific features and rigorous integrity checks on critical operating system files using mathematical checksums. Any detected checksum mismatch triggers a potential compromise alert, enabling monitoring teams to proactively identify possible security incidents affecting the firewall OS integrity. This proactive detection allows incident response and development teams to react swiftly to critical security events.
This update is now available for manual download and deployment by customers with any Sophos Firewall equipped with a valid license.
Cyber Security
Honeywell Report Reveals 46% Quarterly Spike in Industrial Ransomware

A new report from Honeywell reveals a significant escalation in cyber threats facing the industrial sector, with ransomware attacks surging by 46% from Q4 2024 to Q1 2025. The company’s 2025 Cybersecurity Threat Report indicates a widespread increase in both malware and ransomware activity, notably including a 3,000% spike in a specific trojan designed to steal credentials from industrial operators.
The allure of industrial targets for cybercriminals is clear, as explained by Paul Smith, director of Honeywell Operational Technology (OT) Cybersecurity Engineering and author of the report, “Industrial operations across critical sectors like energy and manufacturing must avoid unplanned downtime as much as possible – which is precisely why they are such attractive ransomware targets.” He further emphasized the agility of attackers, stating, “These attackers are evolving fast, leveraging ransomware-as-a-service kits to compromise the industrial operations that keep our economy moving.”
The urgency of these threats is underscored by definitions from the Cybersecurity and Infrastructure Security Agency (CISA) in the United States, which classifies incidents as “substantial” if they lead to unauthorized access causing significant operational downtime or impairment. Industry analyses corroborate the severe financial impact, showing that unplanned downtime—whether from cyberattacks or equipment failure—costs Fortune 500 companies approximately $1.5 trillion annually, representing a substantial 11% of their revenue.
To compile these critical findings, Honeywell’s researchers undertook an extensive analysis, reviewing over 250 billion logs, 79 million files, and blocking 4,600 incident events across the company’s global installed base. Their detailed examination yielded several concerning trends:
- Ransomware’s Relentless Ascent: The first quarter of 2025 alone saw 2,472 potential ransomware attacks, already accounting for 40% of the entire annual total recorded in 2024, signaling a rapid acceleration of this threat.
- Trojan Exploitation Targeting OT: A particularly dangerous trojan, identified as W32.Worm.Ramnit, was responsible for 37% of files blocked by Honeywell’s Secure Media Exchange (SMX). This figure represents an alarming 3,000% increase in this specific trojan compared to the preceding quarter, indicating a concerted effort to exploit industrial access.
- Persistent USB-Based Risks: Despite awareness campaigns, external media continues to pose a significant threat. Honeywell’s SMX detected 1,826 unique USB threats in Q1 2025, with 124 of these being entirely new and previously unseen. This follows a 33% increase in USB malware detections in 2023 and an astounding 700% year-over-year surge in 2022, highlighting the enduring vulnerability posed by removable devices.
The scope of the report’s analysis also expanded to include threats introduced via other plug-in hardware, known as Human Interface Devices (HIDs). This encompasses commonly used items such as mice, mobile device charging cords, laptops, and various other peripherals, which are frequently connected to on-premise systems for software updates or patching, creating additional vectors for potential compromise.
In light of these escalating risks and evolving regulatory landscapes—such as new SEC reporting regulations requiring the disclosure of material cybersecurity incidents—industrial operators face increasing pressure to enhance their defenses. As Smith concluded, “Leveraging Zero Trust architecture and AI for security analysis can speed detection and enable smarter decision making and proactive defense in an increasingly complex digital landscape.” His recommendation underscores the need for decisive action and advanced security strategies to mitigate costly operational downtime and safety-related risks in the industrial environment.
-
Artificial Intelligence1 week ago
Help AG and F5 Collaborate on Managed App and API Security
-
News1 week ago
Reolink Launches Smart Security Solutions in Middle East
-
Cyber Security2 days ago
Beyond Blocklists: How Behavioural Intent Analysis Can Safeguard Middle East Businesses from Rising AI-Driven Bot Threats
-
Artificial Intelligence1 week ago
As Adversarial GenAI Takes Off, Threat Intel Must Modernize
-
Channel Talk1 week ago
Dynatrace Names DXC Global Partner of the Year
-
Events7 days ago
Matrix to Exhibit NDAA Compliant Surveillance at ESX North America 2025
-
Cyber Security2 days ago
Honeywell Report Reveals 46% Quarterly Spike in Industrial Ransomware
-
News6 days ago
BlueCat to Show Off Next-Gen Network Operations at Cisco Live