Cloud Computing
Azure Cloud HSM adds hardware-generated audit logging for compliance
Microsoft announced Hardware Audit Logging for Azure Cloud HSM, a feature that collects audit records generated directly by the hardware security module itself for supported management operations. The logs capture authentication events, user changes, policy updates, backup operations, and key lifecycle activity. Unlike traditional platform or application logs, these records originate from the HSM’s cryptographic boundary, providing regulated organizations with hardware-originated evidence for monitoring, compliance reporting, and forensic investigations.
Why it matters: This capability gives security and compliance teams a tamper-resistant audit trail tied to the physical device protecting cryptographic keys, reducing reliance on software-layer logs that could be altered. For regulated workloads, hardware-generated evidence simplifies audit preparation and strengthens incident forensics by showing exactly which authenticated administrators performed sensitive HSM configuration changes.
Source: Azure Cloud HSM Hardware Audit Logging: Verifiable audit trails for security and compliance
Cybersecurity
VOLTA infostealer uses an LLM to rank stolen victim data for monetization
Researchers have identified a Windows infostealer called VOLTA-AUTODOXER that harvests credentials, session tokens, cryptocurrency wallet seeds, cloud keys, and screenshots, then sends a structured evidence bundle to a large language model to rank the victim’s assets by monetization value. If the model refuses, the malware falls back through a chain of three models. The implant is self-deleting and operates without attacker-owned infrastructure, using the LLM as an automated intelligence analyst to prioritize which stolen data is most valuable.
Why it matters: This represents a shift where AI directly performs post-exploitation triage for cybercriminals, automating the labor-intensive process of sifting through bulk stolen data to identify high-value targets. The fallback model chain shows operators anticipating and engineering around safety guardrails. Because the malware leaves no persistent infrastructure, detection relies on endpoint behavior rather than network indicators, complicating defense for organizations managing diverse device fleets and cloud identities.
Source: Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
Career & Learning
Linux Foundation launches EU CRA course for embedded systems
Linux Foundation Education, together with AC6, has released an intermediate course titled EU Cyber Resilience Act (CRA) for Embedded Systems (AC6403). The training teaches engineers how to translate CRA requirements into concrete design and compliance choices for products sold in the EU. It covers product classification, secure firmware and update practices, vulnerability management using SBOMs and CVE monitoring, and preparation of technical documentation for conformity assessment.
Why it matters: The course gives embedded developers a practical path to meet new EU cybersecurity rules that become mandatory for any device placed on the market. By learning to classify products, implement secure boot and update mechanisms, and maintain SBOM-driven vulnerability processes, teams can reduce compliance risk and avoid costly redesigns late in the lifecycle. It also signals growing demand for security-focused firmware expertise.
Source: Just Launched: EU Cyber Resilience Act (CRA) for Embedded Systems (AC6403)