At the end of November 2025, Germany initiated the most far-reaching cybersecurity reform of the past decade, following the Bundesrat’s adoption of the NIS2 implementation law. As a result, regulatory obligations effectively entered into force immediately, without any transitional periods — a development legal experts are calling a “compliance shock” for the business sector. At the same time, European supervisory authorities activated a key mechanism of the DORA regulation and published the first list of critical IT third-party providers, who now fall under direct EU oversight.

The Federal Network Agency (BNetzA) has already presented a draft of a new security catalogue, introducing stricter requirements for safeguarding the telecommunications supply chain. The law firm Dentons reminds that all obligations apply the moment the law takes effect, including mandatory registration with the BSI and the implementation of comprehensive cyber risk-management measures. The scope of regulated entities is expanding dramatically — from around 4,500 to almost 30,000 companies — now including logistics, food supply, and digital service providers.

DORA further tightens supervision over cloud providers, analytics companies, and software vendors serving the financial sector, introducing mandatory on-site inspections and new channels for reporting IT incidents. The common priority of both regulations is strengthened third-party risk management, meaning that suppliers can no longer rely on simple declarations of conformity but must provide evidence of their security reliability.

Regulators stress that the era of postponements is over, and companies that were counting on extended deadlines now face severe penalties and increased personal liability for management. All indicators suggest that the period leading into early 2026 will be a race to close compliance gaps across all sectors.

Amazon has released details on two cases in which Iranian threat actors combined digital espionage with physical attacks, a practice the company refers to as “cyber-enabled kinetic targeting.” The first case involves the group Imperial Kitten (also known as Tortoiseshell), linked to Iran’s IRGC, which over a two-year period progressed from cyber reconnaissance to a physical strike. According to Amazon, the group compromised a ship’s AIS system in December 2021 and, by August 2022, had gained access to additional maritime platforms and onboard CCTV cameras to collect real-time visual intelligence. In January 2024, they searched AIS location data for a specific vessel, which just days later, on February 1, became the target of a Houthi missile attack. Amazon says the link between the cyber reconnaissance and the subsequent strike is “unmistakable,” even though the attack itself was unsuccessful.

The second case concerns MuddyWater, a group tied to Iran’s MOIS, which in May 2025 prepared a server for cyber operations and, by June 17, used the same infrastructure to access a compromised CCTV server streaming live footage from Jerusalem. Researchers believe the footage was used to support the planning of a June 23 missile attack, after which Israeli authorities warned citizens to immediately disconnect internet-exposed cameras. Amazon stresses that existing terms such as “cyber-kinetic operations” or “hybrid warfare” lack precision, and proposes a new definition for campaigns where cyber activities directly support physical strikes. The company warns that this type of operation will become increasingly common as nation-states recognize the strategic advantage of combining digital reconnaissance with kinetic attacks.

Amazon urges companies to adjust their security strategies and expand threat models, noting that even entities that previously considered themselves uninteresting to attackers may now be targeted for tactical intelligence collection.

The Dubai Electronic Security Center (DESC) launched the “Scan Smart” campaign, which took place from 24 to 30 October as part of Cybersecurity Awareness Month, with the goal of raising public awareness about QR code–related risks. As QR codes become increasingly common in restaurants, hotels, shops, events, and other public spaces, the risk of tampering or malicious replacement continues to grow. In the first half of 2025 alone, more than 4.2 million global attempts to forge QR codes were recorded, underscoring the urgent need for public education. Through the initiative, DESC aimed to empower citizens and businesses to recognize legitimate codes, avoid compromised ones, and report suspicious activity.

DESC Chief Executive H.E. Yousuf AlShaibani stated that the campaign reflects the center’s commitment to building a safer digital environment for Dubai’s residents and visitors. As part of the campaign, DESC introduced interactive kiosks and an educational microsite, along with RZAM — a free browser extension that detects risky websites triggered after scanning QR codes.

Dozens of F&B venues across the city participated as “Scan Smart Partners,” displaying branded materials and offering visitors free coffee and exclusive discounts. These partners helped create everyday “micro hubs” of digital awareness, where the public could learn about safe QR scanning in a relaxed environment. DESC encouraged users to always verify QR codes before scanning and to report any suspicious attempts, strengthening community cyber resilience and supporting the wider vision of a safer digital ecosystem in the UAE.

According to the cybersecuritynews.com portal, Google has filed a lawsuit against a criminal operation known as “Lighthouse,” a sophisticated phishing-as-a-service platform that has reportedly affected more than one million people across over 120 countries. Google’s security researchers determined that this is one of the most damaging scam networks in recent years, structured to exploit well-known brand identities in order to deceive victims.

The platform enables attackers to launch large-scale “smishing” campaigns — phishing attacks delivered via SMS messages instead of email. Fraudsters impersonate companies such as E-Z Pass, USPS, and other toll service providers, sending links that direct victims to fraudulent websites. These websites are designed to look legitimate, tricking users into revealing passwords, financial information, and other sensitive data.

Google analysts uncovered at least 107 malicious website templates featuring Google’s branding on fake login screens, further increasing the risk of credential theft. In the United States, the operation has, according to the same source, facilitated the theft of data from tens of millions of credit cards, resulting in a massive financial impact.

Google’s lawsuit cites multiple laws, including RICO, the Lanham Act, and the Computer Fraud and Abuse Act. At the same time, the company is implementing additional security measures — from AI-powered systems that detect suspicious messages to enhanced account recovery options — to help users regain control of compromised accounts more quickly and safely.

Acronis Cyber Protect Cloud, a SaaS-based, multi-tenant platform, delivers award-winning protection from cyber threats, including next-generation antivirus, email security, data loss prevention (DLP), and endpoint and extended detection and response (EDR/XDR). Security professionals who use Acronis spend less time juggling tools thanks to its natively integrated solution that integrates cybersecurity, endpoint, and posture management, data protection, automated backups, and disaster recovery. Acronis also proudly aligns with NIST cybersecurity functions, helping users identify, protect, detect, respond to, and recover from threats more effectively.

“Cyber protection must be natively integrated and AI-powered to address modern cyber threats,” said Gaidar Magdanurov, President at Acronis. “Our collaboration with Intel empowers MSPs and corporate IT to deliver real-time security at the endpoint with minimal impact to system performance, protecting the productivity of users. Our collaboration with Intel takes the headache out of IT security for users and IT administrators.”

“Together, Intel and Acronis are delivering fast, AI-powered security right on the device,” said Carla Rodríguez, Vice President and General Manager, Client Software Enabling at Intel. “By running complex security tasks on an AI PC with Intel Core Ultra processors, we enable partners like Acronis to deliver breakthrough protection with lower latency and improved performance and privacy.”

Traditional antimalware software often struggles to detect modern threats and can consume excessive system resources, resulting in slowdowns, increased support tickets, and reduced productivity.

Fragmented security solutions further strain overburdened IT teams while increasing operational complexity. Acronis Cyber Protect Cloud addresses this with natively integrated cyber protection, minimizing the impact on system performance. And with Intel technology, it runs even more efficiently.

To learn more about AI PCs powered by Intel and Acronis Cyber Protect Cloud, visit: https://solutions.acronis.com/en-us/integrations/ai-pcs-powered-by-intel-and-acronis-cyber-protect-cloud/