Welcome to OpenText Cybersecurity Community | OpenText Cybersecurity Community

Categories
Recently active
Help others

Secure Cloud

Make security simple with Secure Cloud

MDR

9 topics

Endpoint Protection

1150 topics

Email Threat Protection

0 topics

DNS Protection

36 topics

Security Awareness Training

57 topics

Email Continuity

0 topics

Email Encryption

0 topics

Information Archiving

0 topics

Threat Intel Hub

Experts share their insights on protecting against cyber threats and staying ahead of evolving security risks.

Security Industry News

36144 topics

Security Expert Perspectives

14 topics

Threat Reports

17 topics

Ransomware Spotlight

68 topics

Phish Tank

30 topics

Vulnerability Vault

280 topics

Data Protection

Carbonite product portfolio

Cloud to Cloud Backup

1 topic

Endpoint Backup

0 topics

Migrate

3 topics

Core Business Communication Archive

0 topics

Server Backup

1 topic

Availability

2 topics

Webroot

Comprehensive security at your fingertips.

Got a Question?

580 topics

Webroot® SecureAnywhere™ - Home

10796 topics

Webroot® SecureAnywhere™ - Internet Security Plus

1601 topics

Webroot® SecureAnywhere™ - Complete

2079 topics

Webroot Mobile

1239 topics

Webroot® Unity API

124 topics

Webroot® Legacy Products (2011 and Prior)

33 topics

Welcome

News, Announcements, Tech Discussions

Community 101

2080 topics

News & Announcements

1225 topics

Malware Manifesto

73 topics

Events & Conferences

289 topics

Tech Talk

4956 topics

Water Cooler

966 topics

Trivia

49 topics

API

All Things API

Unity API Forum

0 topics

Carbonite Replication API

0 topics

Product Releases

Patch Notes & Software Updates

Business Product Releases

234 topics

Consumer Product Releases

260 topics

What's New

47 topics

Integrations

Webroot Integration Discussions

Nable

1 topic

ConnectWise Automate Integration

13 topics

ConnectWise Manage Integration

1 topic

Kaseya VSA Integrations

16 topics

Crypto Corner

A place to discuss all things cryptocurrency

News

9 topics

Wallet Security

3 topics

Common Scams

3 topics

TripleHelixModerator

Water Cooler

Goodnight Thread - 2

The old thread (10 years) has run it’s course as you can’t post in there anymore so I started a new one! Thanks @Ssherjj

4182822

14 hours ago

Jasper_The_RasperModerator

Security Industry News

New 'Defendnot' tool tricks Windows into disabling Microsoft Defender

May 17, 2025 By Lawrence Abrams A new tool called 'Defendnot' can disable Microsoft Defender on Windows devices by registering a fake antivirus product, even when no real AV is installed.The trick utilizes an undocumented Windows Security Center (WSC) API that antivirus software uses to tell Windows it is installed and is now managing the real-time protection for the device.When an antivirus program is registered, Windows automatically disables Microsoft Defender to avoid conflicts from running multiple security applications on the same device.The Defendnot tool, created by researcher es3n1n, abuses this API by registering a fake antivirus product that meets all of Windows' validation checks.The tool is based on a previous project called no-defender, which used code from a third-party antivirus product to spoof registration with WSC. That earlier tool was pulled from GitHub after the vendor filed a DMCA takedown. >>Full Article<<

18 hours ago

LTH651Fresh Face

Webroot® SecureAnywhere™ - Home

Mac OS Roadmap

I’ve noticed there have not been any updates to the Mac OS version since late 2023. Does Webroot intend to continue to support Mac OS, or is the product on life support only?

19 hours ago

TroyGIllCommunity Manager

Phish Tank

The Evolution of Weaponized QR Codes

Threat actors have been attempting to subvert security measures by hiding malicious URLs withing QR codes for years now. As we know, threat actors are constantly evolving their tactics, and recently, we have observed intriguing new techniques involving QR codes in email attacks. Traditionally, QR codes are found in embedded images, attached as images or within other attachments like PDF. However, one group has started sending HTML-generated versions.For instance, a DHL-branded attack utilized HTML trickery by combining lower half block, upper half block, and full block characters with non-breaking spaces. Both phones and online decoders easily recognized and decoded the QR code, leading would-be victims to the malicious URL. This tactic aims to bypass email filters' image QR recognition and URL extraction capabilities.If the user scans the QR code, they will be directed to a site containing live user verification measures by having the recipient manually type in their first name.Once t

153

1 day ago

ConnorMThreat Research Analyst

Security Industry News

Cyber News Rundown: Cyberattack exposes Dior customer dataNews

Over the last week, officials for the French fashion brand, Dior, have been investigating a cybersecurity incident that may have resulted in a data breach of stored customer information. It is unclear how many individuals may have been affected, though customers throughout South Korea and China have been receiving breach notifications from the company. As the investigation continues, Dior staff are warning all notified individuals to stay vigilant for suspicious emails and monitor their credit.Interlock ransomware targets global defense corporationsFollowing a recent cyberattack on a defense contractor, it is believed that the threat actors behind Interlock ransomware have gained significant intel on the supply chains used by defense corporations and their customers. Amongst the data that was leaked by Interlock were documents naming many of the world’s largest defense contracting corporations, which could be used nefariously by nation-state actors and other threat groups who may be l

113

1 day ago

Jasper_The_RasperModerator

Ransomware Spotlight

Ransomware gangs increasingly use Skitnet post-exploitation malware

May 16, 2025 By Bill Toulas Ransomware gang members increasingly use a new malware called Skitnet ("Bossnet") to perform stealthy post-exploitation activities on breached networks.The malware has been offered for sale on underground forums like RAMP since April 2024, but according to Prodaft researchers, it started gaining significant traction among ransomware gangs since early 2025.Prodaft told BleepingComputer they have observed multiple ransomware operations deploying Skitnet in real-world attacks, including BlackBasta in Microsoft Teams phishing attacks against the enterprise, and Cactus.The malware promoted on underground forumsSource: Prodaft >>Full Article<<

1 day ago

Jasper_The_RasperModerator

Ransomware Spotlight

Ransomware Roundup – VanHelsing

By Shunichi Imano and Fred Gutierrez | May 16, 2025 FortiGuard Labs gathers data on ransomware variants of interest that have been gaining traction within our datasets and the OSINT community. The Ransomware Roundup report aims to provide readers with brief insights into the evolving ransomware landscape and the Fortinet solutions that protect against those variants.This edition of the Ransomware Roundup covers the VanHelsing ransomware.Affected platforms: Microsoft WindowsImpacted parties: Microsoft WindowsImpact: Encrypts victims' files and demands a ransom for file decryptionSeverity level: High VanHelsing Ransomware OverviewThe first sample of the VanHelsing ransomware was made available on a publicly available file-scanning site in mid-March 2025. Like other ransomware attacks, VanHelsing demands a ransom to decrypt files via dropped ransom notes. Infection VectorInformation on the infection vector used by the VanHelsing ransomware threat actor is unavailable. However, it is not l

1 day ago

Jasper_The_RasperModerator

Security Industry News

Meta plans to train AI on EU user data from May 27 without consent

May 16, 2025 By Pierluigi Paganini Meta plans to train AI on EU user data from May 27 without consent; privacy group noyb threatens lawsuit over lack of explicit opt-in.Meta plans to use EU user data for AI training starting May 27 without explicit consent. Austrian privacy group noyb threatens a class action lawsuit if the social network giant does not desist.In April, Meta announced it will start training its AI models using public data from adults in the EU, after pausing the plan last year over data protection concerns raised by Irish regulators.In June 2024, the social media giant announced it was delaying the training of its large language models (LLMs) using public content shared by adults on Facebook and Instagram following the Irish Data Protection Commission (DPC) request.Meta was disappointed by the DPC request, the company pointed out that this is a step “backwards for European innovation, competition in AI development and further delays bringing the benefits of AI to peopl

1 day ago

Jasper_The_RasperModerator

Security Industry News

Printer maker Procolored offered malware-laced drivers for months

May 16, 2025 By Bill Toulas For at least half a year, the official software supplied with Procolored printers included malware in the form of a remote access trojan and a cryptocurrency stealer.Procolored is a digital printing solutions provider making Direct-to-Film (DTF), UV DTF, UV, and Direct-to-Garment (DTG) printers. It is particularly known for affordable and efficient fabric printing solutions.The Shenzhen-based company has grown quickly since it started in 2018, and is now selling its products in over 31 countries, with a significant operational presence in the United States.Cameron Coward, a YouTuber known as Serial Hobbyism, discovered the malware when his security solution warned of the presence of the Floxif USB worm on his computer when installing the companion software and drivers for a $7,000 Procolored UV printer.An analysis conducted by researchers at cybersecurity company G Data, Procolored’s official software packages delivered the malware for at least six months. &

1 day ago

Jasper_The_RasperModerator

Security Industry News

New botnet HTTPBot targets gaming and tech industries with surgical attacks

May 16, 2025 By Pierluigi Paganini New botnet HTTPBot is targeting China’s gaming, tech, and education sectors, cybersecurity researchers warn.NSFOCUS cybersecurity discovered a new botnet called HTTPBot that has been used to target the gaming industry, technology firms, and educational institutions in China.HTTPBot is a Go-based botnet first detected in August 2024, however, its activity surged by April 2025. The botnet was employed in highly targeted attacks, using a periodic, multi-stage strategy to launch continuous assaults on specific victims.HTTPBot uses an “attack ID” for precise control and employs advanced DDoS tactics like HTTP Floods and obfuscation to bypass traditional detection methods.“HTTPBot has taken a different approach by developing a range of HTTP-based attack methods to conduct transactional (business) DDoS attacks. Attackers can use these methods to precisely target high-value business interfaces and launch targeted saturation attacks on critical interfaces, su

1 day ago

LTH651Fresh Face

Webroot® SecureAnywhere™ - Home

Mac OS Roadmap

I’ve noticed there have not been any updates to the Mac OS version since late 2023. Does Webroot intend to continue to support Mac OS, or is the product on life support only?

19 hours ago

daddycrNew Member

Webroot® SecureAnywhere™ - Internet Security Plus

Webroot expired early without explanation!

Webroot tech support have confirmed my subscription has until Feb 2027 BUT in 12 days, have not been able to rectify it from Expiring!It's a real pain & very disappointing. I asked for it to be escalated when the ticket was a week old but still no resolution!I've been using Webroot for close to 20 years.Anyone else had this problem?

171

3 days ago

cestlavie53New Member

Webroot® SecureAnywhere™ - Internet Security Plus

Can't access webroot console, cannot get opentext to send code

I renewed my Webroot Internet Security Plus through Amazon. After downloading, the new keycode does not show up in my list of subscriptions. However, yesterday I was able to access the console and the the new keycode showed there. Came back to review things today and cannot access the console now. The only thing I did differently with this renewal was to opt in for 2 factor authorization. When attempting to access the console, Opentext doesn’t send me me a code.

151

3 days ago

mborgeaudFresh Face

Webroot® SecureAnywhere™ - Home

Internet restarting

Webroot appears to be causing my internet connection to continually restart or reset at least a dozen times a day. Sometimes it does it once and I have connection back after 20 seconds and other times I have waited for up to 15 minutes before I can use the internet again.The only way I can get continual and uninterrupted internet connection is to disable Webroot entirely. I have changed my DNS setup from “auto” to manual and am using Google’s DNS servers.I have also removed WR and reinstalled - same result.Has anyone else experienced this - I cannot seem to find it in the various threads posted here.

12212

16 days ago

dm661New Member

Endpoint Protection

How to edit keycode on all domain PCs?

Is there a supported method for mass updating the keycode on many PCs on a domain via GPO or otherwise?

280

2 months ago

MajorHavocBronze VIP

Webroot® SecureAnywhere™ - Home

WSA holding onto volumes from DMG or USB when trying to eject.

Anyone else see this issue and hopefully have a work around:When I mount a DMG disk image, or plug in a USB drive to my MacBookPro, I cannot eject it because I am told one or more programs may be using it. This even happens if NO programs are shown as running. I have noted that if I quit WSA (shut it down) I can then eject these drives But WSA scanning the drives it seems leaves some process open that still has an active pin to the drives. I do not want to force eject an HD, or even a DMG as it can damage the image or drive. Suggestions anyone? (FYI: Webroot Customer Service suggested I shut down WSA, eject the drive, and then turn it back on. WORST SOLUTION EVER.)

21718

3 months ago

chrisroseNew Voice

Webroot® Unity API

DNS ProtectionPolicy mapping via UnityAPI

Good day,I am working on enabling DNS Protection and setting some of its options using Unity API. I can successfully enable and disable the module using Unity API and I can set the site policy to one that includes DNS Protection on our endpoints, and the network wide DNS Protection Policy for a Static IP. However, I cannot see a way to set the Agent/Endpoint DNS Protection Policy. It does not even seem this is possible with the current set of commands.Am I missing something? Or is this not possible? Might it be an option that will be enabled in the future?Thanks,Chris

704

6 months ago

Events Calendar

User leaderboard

Show full leaderboard

Join the Conversation

Tweets by OpenTextSec

Consumer Common KB Articles

Business Common KB Articles

Check out this year's Threat Report

Featured Topics

Recent Articles

Upcoming Events

Events Calendar

User leaderboard

Join the Conversation

Sign up

Login to the community

Scanning file for viruses.

This file cannot be downloaded