Windows Security | Breaking Cybersecurity News | The Hacker News

Your team needs elevated privileges to perform tasks such as installing software, troubleshooting endpoints, running approved tools, and managing servers. But do they need those privileges all the time? The dilemma is that standing access makes work easy, but it leaves unnecessary privilege in place. Removing it entirely often creates delays and a flood of elevation requests. PEDM offers a different approach: just-in-time elevation for a specific action, for a limited time, under rules your security team sets. This article explains how such a model works and how you can reduce standing privileges without overloading your helpdesk. Why standing privileges create unnecessary exposure Standing privileges stay active whether or not users need them. Local admin rights on a Windows workstation are a common example, but the same issue appears with broad server access, shared administrative accounts, or elevated rights kept "just in case." The problem starts when access outlives it...

For years, cybersecurity has operated on a simple premise: detect malware, stop the attack. That model is starting to break down. Attackers are no longer relying primarily on malicious files or obvious payloads. Instead, they're increasingly turning to what already exists inside your environment — trusted tools, native binaries, and legitimate administrative utilities. These are used to move laterally, escalate privileges, and maintain persistence, often without triggering traditional security alerts. The problem? Most organizations don't recognize this exposure until after the damage is already done. To better understand how this risk manifests in real environments, Bitdefender offers a complimentary free Internal Attack Surface Assessment — a practical, low-friction way to uncover where trusted tools may be working against you. Here's what's really happening inside modern environments — and why attackers prefer to use your own tools against you. 1. Attacks Are Designed Not to ...

While emerging risks like AI-generated malware capture headlines, the reality of today's threat landscape is more straightforward. Most modern attacks, including ransomware, are backed by manual hacking operations. Attackers carefully navigate systems, using a "Living Off the Land" (LOTL) approach, to exploit legitimate system utilities. To figure out exactly how common these LOTL binaries are, we analyzed 700,000 security incidents from our Bitdefender GravityZone platform along with telemetry data (legitimate usage) from the last 90 days. Security incidents were not simple alerts, but correlated events, and we analyzed the whole chain of commands to identify how frequently attackers are using LOTL binaries. The result? 84% of major attacks (incidents with high severity) involved the use of LOTL binaries. For validation, we also examined our MDR data and found a consistent trend: 85% of incidents involved LOTL techniques. While this was our internal research to suppor...