ISG Cybersecurity Report 2025
For the second year running!
CyberProof is recognized as a leader in three categories:
- Next-Gen SOC/MDR Services
- Strategic Security Services
- Technical Security Services
CyberProof 2025 Mid-Year Cyber Threat Landscape Report
1H 2025 Analysis
Key insights into Ransomware Groups, Top Trends, and 2024 Predictions vs 2025 Reality
Defend The Threats That Matter Most!
CyberProof is the only company in the industry to deliver an integrated threat-led platform (powered by Interpres) for managing your real-estate of assets, risk exposure and defense services together within your enterprise.
Better Security, Together
Our worldwide security operations teams work closely with your enterprise security organization, collaborating to deliver better security together, to protect you today against tomorrow’s threats.
Cloud First Security
CyberProof is a cloud first security operations company, enabled through key cloud partners, to help deliver the most cutting edge security services to help protect your enterprise.
Today’s Cybersecurity Dilemma: Analyzing over 100,000 security incidents daily from more than 150 distinct threat actors
The Challenges:
- Security teams struggle to keep up with threats
- Uncertainty about relevant and significant threats
- Blind spots from ineffective, scattered cybersecurity tools
The Solution: Defend Against the Threats That Matter Most
CyberProof provides an integrated threat-led platform that combines:
- Estate (Asset) Management: Tag, classify, and prioritize known and unknown assets to understand your exposure – continuously
- Exposure Management: Focus on relevant threats using CTEM and ASCA frameworks – continuously
- Defense Management: Optimize detection and response playbooks – continuously
- Resulting in GRC Transformation: Mitigate Global Risk, Define Business Outcomes & ROI, Mature Security Posture
Partners
“Today I have complete visibility into the entire environment, in real time”
Jamil Farshchi | Equifax CISO
Case Studies
Retail Company Reduces Data Costs by 85% with SIEM Transformation
90% increase in visibility after deploying Microsoft XDR with CyberProof
Enterprise saves millions on data ingestion & storage following cloud migration.
SOC unification streamlines enterprise insurance company’s security & network monitoring operations.
Global medical devices company gains visibility and meets stringent compliance standards across global geos
Pharmaceutical organization significantly enhances threat detection and response times
Recognised as industry leaders
Start the journey today
Threat Alerts
Russian APT28 Deploys Sophisticated Backdoor NotDoor
Russian intelligence-linked APT28 has deployed a sophisticated new backdoor called NotDoor, targeting multiple companies through Microsoft Outlook. The attack chain begins with a carefully orchestrated infection chain that exploits DLL side-loading techniques using the legitimate Microsoft OneDrive executable. The malicious SSPICLI.dll is loaded to install the VBA backdoor and disable macro security protections, while establishing persistence through registry modifications. Once deployed, NotDoor monitors incoming emails for specific trigger words like “Daily Report” and activates when such emails are received. The backdoor supports four primary commands: executing system commands with output capture, silent command execution, file exfiltration, and file uploads to the victim’s machine.
The malware employs custom encryption techniques and obfuscation methods to evade detection, using random alphanumeric characters prepended to Base64 strings to create the appearance of sophisticated encryption. Exfiltrated data is sent via email to attacker-controlled addresses, with files temporarily stored in system folders before transmission and deletion. The backdoor also includes verification mechanisms through DNS hooking services and webhook requests to confirm successful execution on target systems.
TinkyWinkey Trojan Threatens Windows Security
A new keylogger malware called TinkyWinkey poses a major threat to Windows systems with its stealth and data exfiltration capabilities. It uses a dual-component design: a service component that ensures persistence by registering as a legitimate Windows service with auto-start, and a keylogger component that intercepts system-wide keystrokes via low-level hooks. The logger captures special keys, function keys, and Unicode across multiple language layouts, while also performing system profiling to collect CPU, memory, OS, and network details.
For evasion, TinkyWinkey employs DLL injection into trusted processes like explorer.exe, blending with legitimate activity. It monitors foreground windows to link keystrokes with applications, revealing when victims use banking portals, email, or sensitive tools. Logged data is saved in UTF-8 encoded files with timestamps in the temp directory, giving attackers detailed user activity timelines. This mix of persistence, process injection, profiling, and app-aware monitoring makes it extremely difficult for traditional antivirus tools to detect or remove.
Start the journey today