Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

Microsoft: Iranian State Hackers Increasingly Target IT Sector

Microsoft: Iranian State Hackers Increasingly Target IT Sector

Microsoft says Iranian-backed hacking groups have increasingly attempted to compromise IT services companies this year to steal credentials they could use to breach the systems of downstream clients.

According to security analysts at Microsoft Threat Intelligence Center (MSTIC) and Digital Security Unit (DSU), this activity is part of a wider espionage objective to compromise entities of interest to the Iranian regime.

“This activity is notable because targeting third parties has the potential to exploit more sensitive organizations by taking advantage of trust and access in a supply chain,” Microsoft said.

Also Read: NDA Data Protection: The Importance, Its Meaning And Laws

“Microsoft has observed multiple Iranian threat actors targeting the IT services sector in attacks that aim to steal sign-in credentials belonging to downstream customer networks to enable further attacks.”

Redmond has sent over 1,600 notifications to alert more than 40 IT companies of hacking attempts coordinated by Iranian APT groups.

This shows a staggering increase compared to 2020 when Microsoft only sent only 48 notifications the whole year.

Most of these attacks are focused on Indian IT services firms, with some of them also targeting several companies based in Israel and the United Arab Emirates.

Notifications sent to IT services companies
Notifications sent to IT services companies (Microsoft)

As Microsoft revealed, two Iranian hacking groups tracked as DEV-0228 and DEV-0056 successfully breached IT companies from Israel and Bahrain in July and September:

  • In July 2021, a group that MSTIC tracks as DEV-0228 and assesses as based in Iran compromised a single Israel-based IT company that provides business management software. Based on MSTIC’s assessment, DEV-0228 used access to that IT company to extend their attacks and compromise downstream customers in the defense, energy, and legal sectors in Israel. 
  • In September, we detected a separate Iranian group, DEV-0056, compromising email accounts at a Bahrain-based IT integration company that works on IT integration with Bahrain Government clients, who were likely DEV-0056’s ultimate target. DEV-0056 also compromised various accounts at a partially government-owned organization in the Middle East that provide information and communications technology to the defense and transportation sectors, which are targets of interest to the Iranian regime. DEV-0056 maintained persistence at the IT integration organization through at least October.

Iranian threat actors have been in the spotlight during the last two weeks, with several advisories and reports warning of Iranian activity targeting organizations worldwide.

Also Read: Invasion Of Privacy Elements And Its Legal Laws To Comply

US, UK, and Australian cybersecurity agencies warned Thursday of ongoing exploitation of Microsoft Exchange ProxyShell and Fortinet vulnerabilities linked to an Iranian-sponsored hacking group and ransomware attacks.

One day earlier, the Microsoft Threat Intelligence Center (MSTIC) revealed that six Iranian hacking groups have started deploying ransomware and exfiltrating data from victims’ systems starting in September 2020.

The FBI also warned in a TLP:AMBER private industry notification (PIN) of an Iranian threat actor attempting to buy stolen info associated with US and worldwide organizations from clear and dark web sources that could be used to breach their systems again.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us