Tristan De Backer

💙 Healthcare deserves the strongest protection, not just from illnesses, but also from cyber threats 😉 ⚡ With rules like NIS2 and hackers always on the move, it’s no small challenge. 🔐 Together they’re keeping systems safe, staying compliant and making sure doctors can focus on what matters most: patients. 🏥✨ #SecureAndConnected #NomiosGuardian #HealthcareIT #NIS2

4

Last week, Robin Bruynseels and I had the opportunity to represent Easi at BE-Cyber, hosted by the Belgian Cyber Security Coalition It was a fantastic experience to take the stage and share our perspective with such an engaged audience. Our talk focused on the idea of an Offensive SOC — how applying offensive techniques and adopting an attacker’s mindset can help strengthen security operations by proactively detecting, simulating, and understanding real-world threats before they ever become incidents. I’m really proud that we had the chance to speak about a topic we’re both so passionate about, and even more so to see how much interest it sparked among fellow professionals. A big thank-you to Pascal Champagne and Christian Mathijs for the invitation and warm welcome, and to everyone involved in organizing such a strong event for the Belgian cybersecurity community. 🎥 Catch a glimpse of the event in the video below!

73

📢 SERMA Safety and Security lab is accredited EUCC FR and NL. The game changes: Serma is the first lab to be double-accredited by two major EUCC schemes French and Dutch. We are pleased to offer the choice to our customers and futures one 😉 . TrustCB, Rijksinspectie Digitale Infrastructuur, ANSSI - Agence nationale de la sécurité des systèmes d'information, European Union Agency for Cybersecurity (ENISA)

22

Summary: FreePBX Servers Infected with Webshell Through Recent Vulnerability Attackers are actively exploiting a recently discovered security vulnerability in FreePBX software to install malicious webshells on servers. The vulnerability, tracked as CVE-2025-64328, was first patched in November 2025, but many servers remain unprotected. Security firm Fortinet detected attackers using this flaw to install the "EncystPHP" webshell on vulnerable FreePBX servers. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation and added this vulnerability to its catalog of known exploited vulnerabilities, though they haven't provided specific details about the attacks. This attack campaign is significant for several reasons: Widespread Impact: FreePBX is widely used software for managing phone systems (VoIP servers) in organizations of all sizes, from small businesses to large enterprises and government agencies Critical Infrastructure Risk: Phone systems are essential communication infrastructure, and compromising them could disrupt business operations or enable eavesdropping on sensitive communications Persistent Access: The webshell gives attackers a backdoor to maintain long-term access to compromised systems, even after the initial vulnerability is patched. The Bottom Line Hackers are actively breaking into business phone systems by exploiting a security flaw in popular FreePBX software. Even though a fix has been available since November 2025, many organizations haven't applied it yet, leaving their phone systems vulnerable. Once attackers get in, they install a webshell—essentially a hidden remote control tool—that lets them maintain access and potentially launch further attacks. This is particularly concerning because phone systems are critical business infrastructure, and compromising them could allow attackers to disrupt communications, steal sensitive information from calls, or use the compromised servers as launching points for additional attacks. The fact that U.S. government cybersecurity agencies are warning about this threat underscores its seriousness. https://lnkd.in/dmh-z_wS

1

🔐 Physical security and IT infrastructure go hand in hand. Just signed a new contract with Telenet to manage access control for the building. One more step in the full structuring of our IT infrastructure — covering everything from: the network, to workstations, Microsoft 365, and now physical access security. Because PME don’t need a technician. They need a trusted IT partner who understands the real business challenges. Lots of work ahead — but each brick matters. #IT #Security #AccessControl #Telenet #ITPartner #Microsoft365 #Infrastructure #SMB #PME

6

Last week I attended a Tech and Meet hosted by HOWEST Hogeschool West-Vlaanderen where we were given a presentation on the lives of different cybersecurity professionals at Easi. The sessions were comprehensive and clearly highlighted the subtle differences in the roles one can play within Defensive Cyber Security. While Raf Coulier focused on monitoring alerts using the various tools in his toolkit, Pieter Verheye demonstrated his responsibilities in configuration. It was insightful to see how these responsibilities complement each other while requiring different skill sets. I also appreciated the honest advice from Felix De Smet on how students can start preparing from where they are. This advice included improving language skills as an international student and showing genuine interest in the areas you claim to enjoy. Seeing these nuanced differences within the same domain really widened my perspective on what’s possible and the kind of role I can grow into. Big thanks to everyone involved for the demos, the detailed insights, and the honest, encouraging guidance on how I can prepare myself as a student.

9

💡 What is an Application Load Balancer (ALB) in Azure? In Azure, it’s called the Azure Application Gateway — a Layer 7 (Application Layer) load balancer. It helps to distribute web traffic (HTTP/HTTPS) across multiple servers or web apps — so that no single server is overloaded. ⸻ 🧠 Simple Analogy: Think of it like a traffic police officer standing at a busy junction: • Cars = user requests (like people visiting your website) • Roads = your web servers or app instances • The officer (Application Gateway) directs cars to the least busy or healthiest road to keep traffic flowing smoothly. ⸻ ⚙️ How It Works — Step by Step: Let’s say you have a website like www.myshop.com hosted on multiple servers. 1. User Request Comes In A customer types www.myshop.com in their browser. 2. DNS → Application Gateway The DNS directs the user’s request to the public IP of your Application Gateway (the load balancer). 3. Application Gateway Checks Rules It looks at: • URL (e.g., /products, /login) • HTTP headers • Hostname Based on these, it decides which backend server or pool should handle it. 4. Health Probe Check Before sending traffic, it keeps checking all backend servers to ensure they’re healthy and running (like ping tests). If one is down, traffic is not sent to it. 5. Request Forwarded to Backend Pool It forwards the request to one of the healthy web servers or app services (based on load-balancing rules). 6. Response Sent Back The selected server processes the request and sends the response back to the user through the Application Gateway. 💻 Example Use Case: You run an online shopping site with: • Frontend: Application Gateway • Backend Pool: 3 web servers running the site When 10,000 customers visit: • The gateway splits the traffic evenly (e.g., 3,333 requests per server) • If one server fails → traffic automatically redirected to healthy ones • WAF protects your site from malicious requests #Azure Networking #Cloud #Networking

8

In the last months, I've been focusing on NIS2, and one thing stands out: most boards of directors underestimate the shift from policy to personal accountability. April 2026 is not about documentation. It’s about evidence. If NIS2 is even remotely on your radar, this is the moment to act, not when auditors knock at your door.

7

Thank you for the overwhelming interest in my last post on cybersecurity job roles! 🙌 Many of you commented “Interested” — and I hear you. So here’s a starter roadmap to the cybersecurity World: ✅ Step 1: Choose a Domain Are you more analytical (Blue Team)? Creative and curious (Red Team)? Love cloud or compliance? Pick a direction: • SOC Analyst / Security Analyst • Penetration Tester / Ethical Hacker • Cloud Security Engineer • Privacy Analyst / GRC ✅ Step 2: Build the Basics 🧠 Learn networking, Linux, and cybersecurity fundamentals 💻 Platforms: TryHackMe, PortSwigger, Hack The Box 📚 Courses: Google Cybersecurity Cert, Cybrary, YouTube (NetworkChuck, John Hammond) ✅ Step 3: Hands-On Practice & Certifications 💥 Practice labs (TryHackMe, DVWA, Juice Shop) 🎓 Entry certs: CompTIA Security+, CEH, CC, AZ-900 depending on role ✅ Step 4: Build a Lab or Portfolio 💡 Document your practice. Post walkthroughs, findings, or blogs. 🛠 Tools to try: Nmap, Burp Suite, Wireshark, Metasploit #CyberSecurityJourney #CyberSec #InfoSec #CyberSecurity #HackerInProgress #WomenInCybersecurity #BreakingIntoCyber #CyberSecurityJourney #CyberSkills

217

9 Comments

🚨 BREAKING: Tridentlocker Ransomware Claims Belgian Postal Giant bpost Critical infrastructure is under fire again. The Tridentlocker ransomware group has listed bpost — Belgium’s national postal service — as its latest victim, claiming to have exfiltrated 800GB+ of sensitive corporate data. This isn’t just another breach. It’s a direct strike at one of Europe’s key logistics arteries. Tridentlocker is escalating with aggressive double-extortion tactics, including threats to leak internal employee contracts and client invoices — a move designed to create maximum operational and reputational damage. I’ve published a detailed breakdown covering: 🔹 Attack Pathway: Tridentlocker’s operations + their BYOVD (Bring Your Own Vulnerable Driver) evasion methods 🔹 Target Profile: Why logistics and postal networks have become priority targets for threat actors 🔹 Defense Stack: Practical, high-impact actions security teams must prioritise right now 📌 Full threat analysis: https://lnkd.in/gd7Rma8h If you follow cybersecurity, threat intel, or incident breakdowns, this is a case you’ll want to track closely. More real-time analysis and threat insights drop regularly on my page. #CyberSecurity #Ransomware #Tridentlocker #bpost #ThreatIntel #InfoSec #SupplyChainSecurity #TheHGTech

8

📢 Heads up for NIS2-impacted organizations! 🛡️ You'll want to familiarize yourself with the updated CyberFundamentals Framework from the Centre for Cybersecurity Belgium, which is expected to be released next month. Last Tuesday, we received an exciting preview from Chris A. De Vuyst at our Data Protection Institute "Security Leader Stay Tuned" event. The 2025 release changes: ·      Aligned with NIS2 and NIST CSF 2.0. ·      Expanded focus on supply chain security and Operational Technology (OT). ·      Enhanced clarity and auditability with reformulated controls, specific control goals, and "Governance Measures." Stay ahead of the curve! The best way to stay informed is to join our Stay Tuned program—you're going to get access to this important recording and all upcoming master classes! https://lnkd.in/eAgA8r3S #CybersecurityStrategy #NIS2Compliance #RiskManagement #SecurityOutsourcing #DataProtectionInstitute

28

Great evening at the latest AZUG meetup! 🚀 The MS Platform Engineering team of delaware BeLux had an inspiring session diving into Deployment Stacks and Azure Arc at the latest AZUG meetup.  Key takeaways? Deployment Stacks are changing the game for infrastructure lifecycle management, and Azure Arc continues to expand the possibilities for hybrid and multi-cloud scenarios. Questions? Don't hesitate to reach out! #Azure #AZUG #PlatformEngineering #Microsoft

53

1 Comment

Guarding Our Data: A Wake-Up Call Are we paying enough attention to potential security threats? Recently, Dutch authorities revealed that cyber attackers exploited vulnerabilities in Ivanti Endpoint Manager, leading to a breach of sensitive employee data. This incident isn't just a headline – it’s a reminder that even established organizations can fall victim to cyber threats. Why is this significant? It shows that no one is immune from cyber risks, and the impact can go beyond just data loss. When personal information is compromised, it can lead to identity theft, financial loss, and damage to an organization’s reputation. So, what can we do to protect ourselves? Here are a few straightforward steps: 1. Regularly update your software to patch any vulnerabilities. Safeguarding your systems is crucial in staying one step ahead of attackers. 2. Invest in employee training. Make sure everyone understands the importance of data security and how to spot potential threats. 3. Implement strong access controls. Limit data access to only those who need it to minimize potential risks. What steps are you taking in your organization to strengthen cybersecurity? Let’s share and learn from each other’s experiences!

13

2 Comments

Proud to be featured in this month’s Risky Business Magazine, where we shine a spotlight on what it really means to be part of the Security Operations (SecOps) team at KPMG Belgium. From penetration testing and red teaming to incident response, our SecOps team works hands-on to uncover vulnerabilities, simulate realistic cyberattacks, and support clients during high-stakes security incidents. In this edition, we had the chance to talk about: How we approach engagements from black box to white box scenarios What makes our work both impactful and rewarding And what it’s like to grow your career as part of this technical team Together with my colleague Shawn Vervaeke, I share a behind-the-scenes look at our work on the front lines of cybersecurity. For a closer look at how SecOps helps preventing, identify, respond to, and recover from cyber threats, this edition delivers expert insights from the field. Special thanks to Bart Vertommen and Freya Covens for the great interview and for putting together this edition, your work really captures the essence of what we do in SecOps! Check out the full Risky Business Magazine – June 2025 below! #KPMG #RiskyBusiness #SecOps #Cybersecurity #RedTeaming #Pentesting #IncidentResponse #DigitalRiskManagement

22

2 Comments