The current ransomware ecosystem is analyzed, focusing on the Tactics, Techniques, and Procedures (TTPs) adopted by ransomware groups. The last two years are considered and compared. The purpose of the research is to enhance the understanding of ransomware operations and to improve defense strategies. The paper investigates the research questions: (1) How has the ransomware ecosystem evolved over the past two years? and (2) What is the impact of these changes on the TTPs adopted by ransomware groups? Using Open Source Intelligence and Dark Web Intelligence, the methodology follows a three-step approach: (1) Identifying active ransomware groups, (2) Profiling threat actors and mapping their TTPs to the MITRE ATT&CK framework, and (3) Prioritizing mitigation strategies based on a heatmap analysis. The research outcomes reveal a shift in top ransomware techniques with an increasing focus on data exfiltration, vulnerability exploitation, and cloud-based exfiltration. This contributes to empirical insights and data-driven mitigation recommendations, supporting cybersecurity professionals, policymakers, and researchers in strengthening resilience against ransomware attacks.

As organizations increasingly adopt cloud technologies, security remains a major concern. Hence, effective cloud security solutions, such as Cloud Security Posture Management (CSPM), are vital. Selecting an optimal CSPM is a challenge for organizations, since every organization has specific security requirements. In order to address this gap, this study proposes a Multi Criteria Decision Making (MCDM)-based method assisting organizations in selecting the best CSPM solution in alignment with their requirements. The proposed evaluation approach is based on the PROMOTHEE II outranking technique, considering both qualitative and quantitative attributes. The method guides organizations through a step-by-step process, starting from identifying their specific security requirements and ending with the selection of an optimal CSPM solution. This assessment framework enables organizations to confidently differentiate between CSPM solutions that equally satisfy their needs and those that over-provision, ensuring optimal resource allocation and security posture.

Smart devices, such as light bulbs, TVs, fridges, etc., equipped with computing capabilities and wireless communication, are part of everyday life in many households. Previous work has already shown that a passive eavesdropper can derive private information, household routines, etc., from the network traffic of smart devices. However, existing attacks rely on capable adversaries with specialized machine learning expertise, labeled training data and reference devices, leaving it unclear how vulnerable ordinary households are to less sophisticated attackers. In this paper, we investigate the extent to which a “casual attacker” with straightforward IT skills and no specialized cybersecurity or ML tooling can reproduce such privacy attacks. Operating from an adjacent room in a real- world apartment building, we constrain our adversary to use only three off-the-shelf Raspberry Pis, Wireshark, and basic Python scripts. Through a three-week study, we demonstrate that this casual attacker can manually identify devices, recognize user states, track smartphone movements through walls via RSSI triangulation, and successfully extract detailed daily routines, including sleep patterns of guests. Our findings show that smart- home privacy leakage is a threat even from low-resourced, straightforward adversaries, e.g., neighbors.

Quantum Federated Learning (QFL) enables dis- tributed training of Quantum Machine Learning (QML) models by sharing model gradients instead of raw data. However, these gradients can still expose sensitive user information. To enhance privacy, homomorphic encryption of parameters has been proposed as a solution in QFL and related frameworks. In this work, we evaluate the overhead introduced by Fully Homomorphic Encryption (FHE) in QFL setups and assess its feasibility for real-world applications. We implemented various QML models including a Quantum Convolutional Neural Net- work (QCNN) trained in a federated environment with param- eters encrypted using the CKKS scheme. This work marks the first QCNN trained in a federated setting with CKKS-encrypted parameters. Models of varying architectures were trained to predict brain tumors from MRI scans. The experiments reveal that memory and communication overhead remain substantial, making FHE challenging to deploy.

In this paper, we introduce a metadata-enriched generation framework (PhishFuzzer) that seeds real emails into Large Language Models (LLMs) to produce 23,100 diverse, structurally consistent email variants across controlled entity and length dimensions. Unlike prior corpora, our dataset features strict three-class labels (Phishing, Spam, Valid), provides full URLs and attachment metadata, and annotates each email with attacker intent. Using this dataset, we benchmark two state-of-the-art LLMs (Qwen-2.5-72B and Gemini-3.1-Pro) under both Basic (body, subject) and Full (+URL, sender, attachment) settings. Using formal confidence metrics (Task Success Rate and Confidence Index), we analyze model reliability, robustness to linguistic fuzzing, and the impact of structural metadata on detection accuracy. Our fully open-source framework and dataset provide a rigorous foundation for evaluating next-generation email security systems. To support open science, we make the PhishFuzzer Dataset, the generation scripts, and prompts available on GitHub: https://github.com/DataPhish/PhishFuzzer

The responsible disclosure ecosystem depends on the rapid development and verification of Proof-of-Concepts (PoCs) for newly disclosed vulnerabilities. Although recent work has explored generative and agentic Artificial Intelligence (AI) for PoC generation, existing approaches are often limited to specific ecosystems and frequently suffer from context drift or brittle processing during multi-step exploitation workflows. This paper presents Ethigen, a platform for autonomous vulnerability research, PoC generation, and verification against controlled vulnerable environments. Ethigen introduces a multi-agent orchestration framework that formalizes a three-stage Research–Implementation–Verification workflow with explicit verification contracts and persistent audit trails. The system enforces a disciplined contract–evidence execution loop through specialized agent roles and deterministic Augments that ground agents in executable environments. To improve reliability across repeated analyses, Ethigen incrementally captures reusable execution strategies through a skill-tree mechanism, where successful workflows are distilled into structured procedural knowledge. In preliminary evaluations across 11 diverse Remote Code Execution (RCE) vulnerabilities, Ethigen successfully generated and verified 9 PoCs, against 6 success cases using Claude Code. The results show that combining machine-checkable verification harnesses with reusable procedural knowledge enables more reliable and reproducible vulnerability validation.