🚨 👀 New Insikt Group report! As NATO leaders gather in The Hague next week, the upcoming summit comes under threat from adversary activity: state-sponsored espionage, malign influence operations, and a surge of chatter across the dark web. Blog: www.recordedfuture.com/research/thr...

🇨🇳 🤖 New Insikt Group report! This research details how the People’s Liberation Army is rapidly experimenting with generative AI to augment — and potentially transform — its military intelligence capabilities. Blog: www.recordedfuture.com/research/art...

Join me tomorrow for a live briefing on the conflict between Israel and Iran. We’ll address specific geopolitical risks, cybercriminal and hacktivist groups, state-sponsored cyber threats, influence operations, and more. Registration: recordedfuture.registration.goldcast.io/webinar/4b72...

Thank you to everyone who attended my session at our inaugural Insikt After Dark conference in New York City! I spoke on our recent efforts to disrupt traffer teams, infostealer operators, and global scam infrastructure. It’s always an honor to represent Recorded Future!

Outstanding work from @julianferdinand.bsky.social, @lawrencesec.bsky.social, and our Malicious Infrastructure Discovery (MID) team. GrayAlpha shows how financially motivated actors operate with APT-level tradecraft. Time to retire old threat models. Think in terms of ecosystems, not just malware.

Predator isn’t dead — it’s mutating. New reporting from @julianferdinand.bsky.social just dropped. It confirms that Predator C2 is very much alive and attracting new clients. Targets? The same. Activists, politicians, journalists, executives. The spyware economy isn’t slowing — it’s adapting.

New report! Check it out. 🇷🇺 🇹🇯 This research examines a campaign targeting Tajikistan attributed to Russia-aligned TAG-110 — linked to BlueDelta (APT28). This campaign is likely targeting government, educational, and research institutions. Link: www.recordedfuture.com/research/rus...

Good riddance! This should make a sizable dent in the ecosystem. 🪦 Lumma Stealer 🪦 Link: www.europol.europa.eu/media-press/...

New report! Check it out. This research examines US-China AI gap and the drivers of competition. Insikt Group assesses that China is unlikely to sustainably surpass the US on its desired timeline to become the world leader in AI by 2030. Link: www.recordedfuture.com/research/mea...

I had a great time talking with @gregotto.bsky.social from @cyberscoop.bsky.social at RSAC 2025. Always fun! Check out our conversation about my work on cryptoscam gangs, infostealer “traffer” teams, and the “Marko Polo” cybercriminal group. Link: open.spotify.com/episode/70AY...

New report! Check it out. This research uncovers two new malware families — TerraStealerV2 and TerraLogger — linked to the financially motivated threat activity group Golden Chickens (VENOM SPIDER). Link: www.recordedfuture.com/research/ter...

New report! Check it out. This research examines MintsLoader, linked to groups like TAG-124 (LandUpdate808), to deploy capabilities like GhostWeaver and StealC. Link: www.recordedfuture.com/research/unc...

Thank you to everyone who attended my session at RSAC 2025 on cryptoscam gangs, infostealer operators, and the notorious “Marko Polo” traffer team. A lot of friendly faces in the crowd! (Find me roaming around this week, I have stickers!)

See y’all tomorrow! 😎

New Recorded Future report! Check it out. This research examines the critical role of artificial intelligence in the future economic, regional influence, and national security interests of Iran, and the implementation of those capabilities. Link: www.recordedfuture.com/research/ira...

“More than 60 people in Tibetan areas of China have been arrested since 2021 for offenses connected to phone and internet use…” “Many of the arrests have involved the possession of outlawed content on phones… sharing of content on social media…” h/t: therecord.media/tibetans-arr...

🤖 “Artificial Intelligence has supercharged an array of tax-season scams this year, with fraudsters using deepfake audio and other techniques to intercept funds and trick taxpayers into sending them financial documents.” h/t: therecord.media/hackers-use-...

Album of the day. Eclectic, individual, and absorbing. Not everything here works, but that doesn’t matter, because it’s so much fun. Link: open.spotify.com/album/3XFwJR...

“Talos assesses… that multiple threat actors are operating the toll road smishing campaign by leveraging a smishing kit developed by the actor known as ‘Wang Duo Yu’ … used by the organized cybercrime group known as the ‘Smishing Triad.’” h/t: blog.talosintelligence.com/unraveling-t...

👀 🇷🇺 “The Russia-backed threat group Gamaredon, typically known for spreading malware via phishing emails, recently appeared to have used an infected removable drive to target a Ukraine-based military mission of an unnamed Western country…” h/t: therecord.media/gamaredon-re...

“Deceptive websites hosted on newly registered domains are being used to deliver AndroidOS SpyNote malware… mimic the Google Chrome install page on the Google Play Store…” “While no definitive attribution is currently available, a China nexus is suspected.” h/t: dti.domaintools.com/newly-regist...

Album of the day. This rocks. Callback to Swedish blackened death metal. I hear echoes of Sacramentum, Necrophobic, and Dissection here. Riffs, solos, and Lovecraftian aesthetics? Count me in. Link: youtu.be/KUqppuhKVWI?...

🇬🇧 “British police on Wednesday announced that a 38-year-old Romanian man has been arrested on suspicion of assisting a foreign intelligence service.” “…identified as part of an investigation into a fire at a DHL warehouse in Birmingham.” h/t: therecord.media/romanian-man...

PowerModul: BE1D0FAF1C253FAACBA1059971B01D1D646256D7B2E557DA55ED059542AFDBCD Mythic HTA: AFC7302D0BD55CFC603FDAF58F5483B0CC00D354274F379C75CFA17F6BA6F97D

🇷🇺 “A little-known hacking group is using custom malware to steal sensitive files from flash drives connected to Russian computers…” “The group… has deployed a tool dubbed PowerModul that includes components designed specifically to target removable media.” h/t: therecord.media/goffee-espio...

New album of the day. A tad disappointing that Elderwind lost most of its Summoning-like folk, atmospheric, and dungeon synth roots. I played The Magic of Nature so much in high school. This is a far cry from that. Link: open.spotify.com/album/0MwCR0...

🇲🇦 “Morocco’s national social security agency is investigating a cyberattack… the leak of sensitive personal data… belonging to millions of citizens.” 🇩🇿 “…a politically motivated campaign by Algerian hackers.” h/t: therecord.media/morocco-inve...

Interesting blog from Trustwave on new evasion techniques associated with the Tycoon 2FA phishing kit. Concur with the JavaScript findings. Something I’ve recently observed: “prevents right-click … redirects to another site if analysis is suspected.” h/t: www.trustwave.com/en-us/resour...

This is a strong contender for AOTY. Blood Abscission’s 2023 debut was part of my rotation for months, but I think this takes it to the next level. Check it out, if you’re into this kind of thing. Link: youtu.be/7u7cwTnvPUg?...

“slopsquatting” is hilarious… new favorite term “…a surprisingly effective type of software supply chain attack that emerges when LLMs ‘hallucinate’ package names that don’t actually exist.” h/t: socket.dev/blog/slopsqu...

If you haven’t seen the news… I’ll be speaking at #RSAC 2025 in a few weeks on my investigations into cryptoscam gangs, infostealer operators, and the notorious “Marko Polo” (“ZeroDay”) traffer team. It’s going to be an exciting session! If you can’t make it, it’ll be recorded. Find me after!

🇲🇦 🦁 “Researchers have discovered a novel tactic used by Moroccan cybercrime group Atlas Lion [Storm-0539] to attack big-box retailers, apparel companies, restaurants and more.” 🔑 “…enroll its own virtual machines into an organization’s cloud domain…” h/t: therecord.media/atlas-lion-g...

🇺🇦 “Ukraine recorded at least three cyberattacks in March targeting government agencies and critical infrastructure...” 👀 “The attacks were carried out using previously unknown malware — dubbed Wrecksteel — deployed through phishing emails…” h/t: therecord.media/hackers-ukra...

It’s painful that I have to keep reiterating this, but I’ll say it again… Criminals lie. All the time. They’re looking for a reaction. I’ve dealt with a dozen events this week — ranging from this “Babuk” nonsense to random BreachForums skids — that were all fake. Don’t fall for it.

💰 🇰🇵 “OKX is temporarily shutting down a popular tool after discovering North Korean hackers were attempting to use it to launder funds stolen from other platforms.” (via @jgreig.bsky.social / @therecordmedia.bsky.social) h/t: therecord.media/crypto-okx-s...

“…since the beginning of 2022, MI5 has responded to 20 plots by [Iran] ‘presenting potentially lethal threats to British citizens and UK residents.’” Not great. Consider similar plots from Russia and China, and it’s even worse. (via @alexmartin.bsky.social) h/t: therecord.media/iran-britain...

🇵🇼 “Palau has recovered from a ransomware attack launched by [Qilin] … known for targeting prominent healthcare institutions.” 🇺🇸 “A U.S. Cyber Command ‘defend forward’ team is now on-site conducting forensics collection and analysis…” h/t: therecord.media/palau-health...

🛰️ 🇵🇱 “Poland’s space agency announced on Sunday it had suffered a cyberattack…” 🔑 “Poland has become a prime target for pro-Russian hackers… a potential breach… could expose sensitive defense-related information…” (via @therecordmedia.bsky.social) h/t: therecord.media/poland-space...

Progress. Great work @europol-eu.bsky.social. 👏 “More than two dozen suspected members of a criminal group were recently arrested for allegedly distributing sexual images of minors generated by artificial intelligence.” (via @therecordmedia.bsky.social) h/t: therecord.media/csam-ai-arre...

It gets worse. “…analysts at [CISA] were verbally informed that they were not to follow or report on Russian threats…” “The person said work that was being done on something ‘Russia-related’ was in effect ‘nixed’.” h/t: www.theguardian.com/us-news/2025...

All that work… down the drain. 🔑: “Russia is also a bastion for cybercrime, with state-linked and criminal ransomware actors striking targets around the globe. The command has become a key player in countering the malicious activity.”

Insane scoop from @martinmatishak.bsky.social and @therecordmedia.bsky.social. “Defense Secretary Pete Hegseth last week ordered U.S. Cyber Command to stand down from all planning against Russia, including offensive digital actions…” h/t: therecord.media/hegseth-orde...

🚨 - The Recorded Future 2024 Malicious Infrastructure Report is here! I know many of you have been looking forward to this! Insikt Group significantly expanded its tracking of malicious infrastructure over the past year. Findings below! Blog: www.recordedfuture.com/research/202...

🇷🇸 “Cellebrite announced Tuesday that it will no longer allow Serbia to use its software…” “Cellebrite has been ‘systematically deployed’ in Serbia and regularly targets members of civil society, [Amnesty International] said in its report.” h/t: therecord.media/cellebrite-s...

I’ve been laughing at this all day. That’s where I’m at. Shocked it isn’t parody.

🇺🇦 “UAC-0173… has been distributing phishing emails since mid-January, posing as regional offices of Ukraine’s Ministry of Justice…” 🔑 “…the group is likely conducting the attacks for hire and receiving a financial reward from an unnamed source.” h/t: therecord.media/hackers-ukra...

A tale as old as time. 🇷🇺 “Suspected Russian-speaking hackers are using malicious versions of popular pirated games to install cryptomining software known as XMRig on their victims' devices…” h/t: therecord.media/xmrig-crypto...

I’ve skimmed the leaked Black Basta chat log dump. It’s legit. There’s a lot to unpack, thus running the risk of jumping to premature conclusions. I’ve already seen some off-base stuff. Initial thoughts won’t do it justice, so expect more detailed analysis and commentary in the coming days.

It’s been… quite the news day. More coherent thoughts tomorrow on these compounding disasters. In the meantime, I’ve found blacksmithing in Kingdom Come: Deliverance II to be cathartic. I’ve been demolishing the same axe over and over all night.

🇲🇲 “Around 7,000 people rescued from illegal call centers in Myanmar are awaiting transfer to Thailand amid a crackdown on cross-border scam operations…” h/t: therecord.media/thailand-to-...