Recorded Future’s Insikt Group uncovered four GrayBravo activity clusters. TAG-160 impersonates logistics firms, while TAG-161 impersonates Booking.com, employing ClickFix to deliver CastleLoader and Matanbuchus. www.recordedfuture.com/research/gra...

"There is a lack of consensus regarding the current state of AI malware maturity." So we put together #AIM3 to help #malware researchers describe the maturity level of an #AI_Malware Threat. www.recordedfuture.com/blog/ai-malw...

We all spent the last year vibe coding the shit out of web apps in React without knowing a single thing about JavaScript. Then enters #CVE-2025-55182 #React2Shell... poetry. “The spirits that I summoned I now cannot rid myself of again.”

Excited to join a discussion on the second edition of The Mythical Beast by Jen Roberts (@atlanticcouncil.bsky.social), exploring the complex networks behind the spyware ecosystem. This kicks off the new Colloquium series by @virtualroutes.bsky.social: virtual-routes.org/event/mythic...

Great blog post from @briankrebs.infosec.exchange.ap.brid.gy on #StarkIndustries. Makes a great point by highlighting it's links to MIRHosting. Where there are Dutch prefixes under these providers, there is usually always MIRHosting upstream.

Not a lot of public reporting on this, but we are seeing a mountain of activity 👀

1/ Today @whoisnt.bsky.social, Marius, and I release a report on a new threat actor, #TAG-150, active since at least March 2025, which stands out for its rapid development, sophistication, responsiveness to reporting, and a large, evolving infrastructure: www.recordedfuture.com/research/fro...

Big report from our team at Recorded Future around #ThreatActivityEnablers (all of the hostings and services that power malicious infrastructure). Great Research on #StarkIndustries!

Please give me the strength not to buy this hotswap GPU framework laptop with maxed-out specs. 😬

1/ We just released a new report on TAG-144 (also known as Blind Eagle), where we identified five distinct activity clusters that have been active throughout 2024 and 2025, primarily targeting the Colombian government at multiple levels. Link to the report: www.recordedfuture.com/research/tag...

🔎 A day in the life of a #Lumma malware operator... this is a must-read! 💪

1/ We've just released a new report uncovering new infrastructure tied to multiple activity clusters linked to the Israeli spyware vendor #Candiru across several countries. Full report: www.recordedfuture.com/research/tra...

"By 2025, 96% of companies are expected to use public cloud services, and 84% will adopt private cloud services. Additionally, 92% of organizations are projected to implement a multicloud strategy, reflecting the growing trend of cloud adoption across various industries." - Nextwork

Amazing DDoSia Project Research by @calwarez.bsky.social, great work!!! www.recordedfuture.com/research/ana... NoName057(16) had thousands of targets in their crosshairs 🎯, and they utilized their DDoSia Project and a crowdsourced army 🪖 to take them down... This is a must-read Report!

simonwillison.net/2025/Jul/6/s... This is likely the beginning of the new "open S3 bucket" wave of attacks. MCP is awesome and a greatly needed standard, but we know how this will go for the next year or two. 🫤

#Remcos #malware is now at v7.0. No significant changes to the payload side, but improvements to enhance reliability and address bugs based on operator experience added. Samples: tria.ge/250709-3vxwa... tria.ge/250710-vba87... Looks to be distributed via email campaigns from reboundue[.]com emails

Today we are releasing a report on new infrastructure and tooling linked to GrayAlpha, a financially motivated threat actor overlapping with FIN7 🧵 www.recordedfuture.com/research/gra...

Today we’re publishing new findings on Predator spyware, still active despite global sanctions, now with a new client and ties to a Czech entity. Here’s what we found 🧵 www.recordedfuture.com/research/pre...

Another report by Insikt Group on newly identified malware families #TerraStealerV2 as well as #TerraLogger, both attributed to the threat actor Golden Chickens: www.recordedfuture.com/research/ter...

Oh my god, they just unintentionally wrecked a ton of red team playbooks at the NSA popular.info/p/the-nsas-b...

Today was the first day I reflexively went to Bsky for a quick check-in on the world of social media. Post-Twitter, as someone who does not use other platforms, I missed seeing authentic commentary without all the other madness.

time.com/7210296/chin... But where is Mistral.AI?

Threat model around controlling an AI-driven IDE like Cursor and now Trae (Bytedance) www.trae.ai Imagine being a MiTM of code generation and shipment to git repos. You could lean the developer toward vulnerabilities and Just-in-time code injection for PRs. We will still be busy, that's for sure.

therecord.media/kristi-noem-... - Give someone a fish... they eat for a day 🍴 - Teach someone to fish... they eat for a lifetime 💪 - Convince someone that fish are evil, and you should not listen to fish or eat anything in general... they starve 💀

When top Infostealers do the press rounds 🎬... it's a good reminder for me. Cybercrime isn’t lurking in the shadows anymore—it’s running PR campaigns. The game has changed so much and is probably driving the disruption ops that LE has been doing. 🤔 g0njxa.medium.com/lumma-steale...

The last @returnonsecurity.com newsletter (great stuff, btw) posed an interesting question on the #cybersecurity #talent-gap. But... I think there is population bias because maybe more experienced leaders read this newsletter than #entry-level; so, of course, that's the perceived gap