x.com/RnaudBertran... Interesting pivot; this tells me... Open-weight sovereign deployment stack is a real product category. Nvidia (compute), edge inference vendors, open model labs, and integration middleware players all benefit, regardless of who wins the model-quality race.

Colleagues of mine at Insikt Group just released new research on the Iran-nexus cluster #TAG-182, deploying #MarkiRAT, a malware family previously observed in use by #FerociousKitten, for internal and external surveillance: www.recordedfuture.com/research/nex...

#CopyFail #CVE-2026-31431... The world's answer to all of the people who forgot to save the su password on that one old VPS. Your patience has been rewarded, my friend 🫡

www.dbreunig.com/2026/04/14/c... one of the strongest post mythos articles in the game right now

After reading about Mythos and remembering the Sora shutdown pressures. I have a strange feeling these pure-play frontier providers (OpenAI, Anthropic) will be like Amazon in the near future.

Working on #malware analysis #AI #agents reminds me of playing with a #Tamagotchi 😆. Repetitive, sometimes frustrating, but you love to see it evolve! 🤩. Pro Tip: If you are just pointing Claude/Codex/OpenCode at a bunch of analysis tool MCPs... you are doing it wrong and expensively.

Wow! SMCI dropped 33% on this news. That reaction is telling. The market understood immediately that export controls on AI compute are serious business, not theater. The AI race has a resource constraint, and everyone's been watching how aggressively it gets enforced. lowendbox.com/blog/supermi...

I'm super excited for this to finally be out!! A TON OF CONTENT for CTI Pros!

October infostealer 🗝️. March extortion emails 📧. 5 months of dwell time. This is what undetected credential compromise looks like in practice. And with AI tools lowering the automation barrier, expect that timeline to speed up fast 🏃. www.bleepingcomputer.com/news/securit...

Recorded Future’s Insikt Group uncovered four GrayBravo activity clusters. TAG-160 impersonates logistics firms, while TAG-161 impersonates Booking.com, employing ClickFix to deliver CastleLoader and Matanbuchus. www.recordedfuture.com/research/gra...

"There is a lack of consensus regarding the current state of AI malware maturity." So we put together #AIM3 to help #malware researchers describe the maturity level of an #AI_Malware Threat. www.recordedfuture.com/blog/ai-malw...

We all spent the last year vibe coding the shit out of web apps in React without knowing a single thing about JavaScript. Then enters #CVE-2025-55182 #React2Shell... poetry. “The spirits that I summoned I now cannot rid myself of again.”

Excited to join a discussion on the second edition of The Mythical Beast by Jen Roberts (@atlanticcouncil.bsky.social), exploring the complex networks behind the spyware ecosystem. This kicks off the new Colloquium series by @virtualroutes.bsky.social: virtual-routes.org/event/mythic...

Great blog post from @briankrebs.infosec.exchange.ap.brid.gy on #StarkIndustries. Makes a great point by highlighting it's links to MIRHosting. Where there are Dutch prefixes under these providers, there is usually always MIRHosting upstream.

Not a lot of public reporting on this, but we are seeing a mountain of activity 👀

1/ Today @whoisnt.bsky.social, Marius, and I release a report on a new threat actor, #TAG-150, active since at least March 2025, which stands out for its rapid development, sophistication, responsiveness to reporting, and a large, evolving infrastructure: www.recordedfuture.com/research/fro...

Big report from our team at Recorded Future around #ThreatActivityEnablers (all of the hostings and services that power malicious infrastructure). Great Research on #StarkIndustries!

Please give me the strength not to buy this hotswap GPU framework laptop with maxed-out specs. 😬

1/ We just released a new report on TAG-144 (also known as Blind Eagle), where we identified five distinct activity clusters that have been active throughout 2024 and 2025, primarily targeting the Colombian government at multiple levels. Link to the report: www.recordedfuture.com/research/tag...

🔎 A day in the life of a #Lumma malware operator... this is a must-read! 💪

1/ We've just released a new report uncovering new infrastructure tied to multiple activity clusters linked to the Israeli spyware vendor #Candiru across several countries. Full report: www.recordedfuture.com/research/tra...

"By 2025, 96% of companies are expected to use public cloud services, and 84% will adopt private cloud services. Additionally, 92% of organizations are projected to implement a multicloud strategy, reflecting the growing trend of cloud adoption across various industries." - Nextwork

Amazing DDoSia Project Research by @calwarez.bsky.social, great work!!! www.recordedfuture.com/research/ana... NoName057(16) had thousands of targets in their crosshairs 🎯, and they utilized their DDoSia Project and a crowdsourced army 🪖 to take them down... This is a must-read Report!

simonwillison.net/2025/Jul/6/s... This is likely the beginning of the new "open S3 bucket" wave of attacks. MCP is awesome and a greatly needed standard, but we know how this will go for the next year or two. 🫤

#Remcos #malware is now at v7.0. No significant changes to the payload side, but improvements to enhance reliability and address bugs based on operator experience added. Samples: tria.ge/250709-3vxwa... tria.ge/250710-vba87... Looks to be distributed via email campaigns from reboundue[.]com emails

Today we are releasing a report on new infrastructure and tooling linked to GrayAlpha, a financially motivated threat actor overlapping with FIN7 🧵 www.recordedfuture.com/research/gra...

Today we’re publishing new findings on Predator spyware, still active despite global sanctions, now with a new client and ties to a Czech entity. Here’s what we found 🧵 www.recordedfuture.com/research/pre...

Another report by Insikt Group on newly identified malware families #TerraStealerV2 as well as #TerraLogger, both attributed to the threat actor Golden Chickens: www.recordedfuture.com/research/ter...

Oh my god, they just unintentionally wrecked a ton of red team playbooks at the NSA popular.info/p/the-nsas-b...

Today was the first day I reflexively went to Bsky for a quick check-in on the world of social media. Post-Twitter, as someone who does not use other platforms, I missed seeing authentic commentary without all the other madness.

time.com/7210296/chin... But where is Mistral.AI?

Threat model around controlling an AI-driven IDE like Cursor and now Trae (Bytedance) www.trae.ai Imagine being a MiTM of code generation and shipment to git repos. You could lean the developer toward vulnerabilities and Just-in-time code injection for PRs. We will still be busy, that's for sure.

therecord.media/kristi-noem-... - Give someone a fish... they eat for a day 🍴 - Teach someone to fish... they eat for a lifetime 💪 - Convince someone that fish are evil, and you should not listen to fish or eat anything in general... they starve 💀

When top Infostealers do the press rounds 🎬... it's a good reminder for me. Cybercrime isn’t lurking in the shadows anymore—it’s running PR campaigns. The game has changed so much and is probably driving the disruption ops that LE has been doing. 🤔 g0njxa.medium.com/lumma-steale...

The last @returnonsecurity.com newsletter (great stuff, btw) posed an interesting question on the #cybersecurity #talent-gap. But... I think there is population bias because maybe more experienced leaders read this newsletter than #entry-level; so, of course, that's the perceived gap