Two weeks ago, there were weird reports online of explosions at KK Park, Myanmar's largest scam compound, and people fleeing the streets. I thought some internal military groups were fighting for control, but it appears the junta is demolishing the park outright www.irrawaddy.com/news/myanmar...

Bad news for human rights and national security, no matter how you spin it NSO Group has a new executive chairman, David Friedman, who's a former U.S. ambassador to Israel and onetime bankruptcy lawyer for President Trump. www.wsj.com/tech/israeli... via @WSJ

Brilliant, essential thread from @doublepulsar.com on hype around AI cyber threats. My summary: 1. Google release a really honest paper saying some malware has used AI to morph into new capabilities but.. 2. …goes on to point out that the capabilities are crap 3. Industry hype ignores part 2

German ISP Aurologic GmbH has Become a Central Nexus for Hosting Malicious Infrastructure

Chinese state-backed hackers suspected in breach of Congressional Budget Office: www.cnn.com/2025/11/06/p...

What makes a satellite a legitimate military target? Fascinating ICRC analysis. "a particular location in the GEO belt may have strategic significance during an armed conflict, as GEO facilitates continuous coverage over a particular area on earth" international-review.icrc.org/articles/hum...

Senior German officials have accused the far-right Alternative for Germany (AfD) party of deliberately abusing parliamentary powers to collect and likely pass secret information about the country's military capabilities and the state of critical infrastructure to Russia. Source: Der Spiegel

The FBI is trying to unmask the owner of infamous archiving site Archive.is, according to a subpoena the site posted. No other information given, the site quietly posted the document a few days ago. FBI telling domain registrar to hand over all sorts of ID'ing info www.404media.co/fbi-tries-to...

BPFDoor found on the network of hacked South Korean telco KT en.yna.co.kr/view/AEN2025...

#ESETresearch has released its latest APT Activity Report (Apr–Sep 2025): China-aligned groups targeted Latin America amid US-China tensions. Russia-aligned groups intensified ops against Ukraine & EU states. Full report: web-assets.esetstatic.com/wls/en/paper...

⚠️ @hennavirkkunen.bsky.social promises to submit a list of #spyware companies that received 🇪🇺EU funding following our @ftm.eu investigation. 💡All applications, she said, are reviewed by a “multidisciplinary team of ethical experts.” 🎥 WATCH: youtu.be/SjSndVxMNXU?... Q: @danielfreund.bsky.social

8/ Femo IT Solutions was allocated a /24 prefix from a /17 network registered to the Iranian Research Organization for Science and Technology (IROST), the same origin seen in allocations to other TAEs such as Global Connectivity Solutions and Aeza Group.

3/ Among the highest risk networks are: The recently sanctioned Aeza Group #AS210644, Railnet LLC #AS214943, Global-Data System IT Corp aka SWISSNETWORK02 #AS42624, and Femo IT Solutions #AS214351.

1/ New report from myself and @whoisnt.bsky.social: “Malicious Infrastructure Finds Stability with aurologic GmbH.” We uncover how German ISP aurologic GmbH has become a central nexus for high-risk hosting networks, sustaining large concentrations of malicious infrastructure.

We're still gathering applications for this job, if you haven't seen it and are interested. Our VI team does a very wide range of work -- it's not all just conflict reporting (though we do plenty of that). A handful of recent stories for an idea of our range of coverage:

NEW: How former Trenchant boss Peter Williams stole zero-days worth millions of dollars, based on court documents and interviews with former colleagues. A former Trenchant employee said “no one had any supervision over [Williams] at all. He was kind of allowed to do things the way he wanted to.”

Received an alert from us? Act! Background on CVE-2023-20198/CVE-2023-20273 & the BadCandy implant from over 2 years ago: blog.talosintelligence.com/active-explo... #CyberCivilDefense

More research being conducted on the Geedge Networks dataset. @domaintools.bsky.social started a series dissecting the Geedge leak and posted their 1st part out of 3. dti.domaintools.com/inside-the-g... #GFWExport

Reform UK, the Russian spy and rolls of Kremlin cash: the inside story of Nathan Gill www.theguardian.com/news/ng-inte...

Russia detains three suspects who are allegedly behind the Meduza infostealer. The malware was used last year in attacks against Russian companies. Their Telegram channel went inactive earlier this year, prompting fears of an exit scam mvdmedia.ru/news/ofitsia...

I was recently talking to someone who worked on tracking Chinese botnets. We talked about ways to impact them and settled on “fixing the IoT ecosystem”. Then we had a good laugh and changed the subject because obviously that’s never going to happen.

Hackers working for an unnamed nation-state breached networks at Ribbon Communications, a key U.S. telecommunications services company www.reuters.com/business/med...

The CIA hacked and disrupted a computer network used by Venezuela’s security service in Trump’s 1st term, one of a series of covert actions US agencies took or considered taking as Trump increased pressure on Maduro: www.cnn.com/2025/10/29/p...

-HackingTeam successor linked to Chrome zero-days -Charming Kitten server budget is just $10k/y -Twitter will prompt users to re-enroll security keys -Chrome goes HTTPS-first next year -People died after UK MoD Afghan leak Podcast: risky.biz/RBNEWS497/ Newsletter: news.risky.biz/risky-bullet...

to keep it short: @jls.bsky.social and I are starting a newsletter about #journalism and coding. If you're interested in either #OSINT or reporting (or both!), this one might be for you. More details here buttondown.com/readwrite

Weekly summary is out.. ctoatncsc.substack.com/p/cto-at-ncs...

1/5 🇺🇦 Ongoing campaign targeting Ukrainians: EML->PDF->URL->ZIP->JS->NetSupport RAT Email 55ffcf6f4df8ab3f11a405794aa5f4d8

Yo! Kinda forgot to post here but I created irchaos.club. I'll let yall discover it :)

-iOS 26 change deletes clues of old spyware infections -Starlink disables 2.5k scam compound terminals -Caribbean hospital still down 5 months after ransomware attack -Poland charges officials in Pegasus scandal Newsletter: news.risky.biz/risky-bullet... Podcast: risky.biz/RBNEWS495/

Proofpoint threat researchers have designed an open-source tool—named PDF Object Hashing—to track and detect the unique characteristics of PDFs used by threat actors... similar to a digital fingerprint. 🫆 We use this tool internally to help track multiple threat actors with high confidence.

"Recorded Future intelligence shows that the Russian government’s relationship with cybercriminals has evolved from passive tolerance to active management" www.recordedfuture.com/research/dar...

NEW: The U.S. govt accused Peter Williams, ex general manager of hacking tool maker L3Harris Trenchant, of stealing trade secrets and selling them to buyer in Russia. As we reported earlier, Trenchant investigated a leak of internal tools this year. It's unclear if that investigation is related.

Live streams from the Ekoparty 2025 security conference are available on YouTube. All the talks are in Spanish. www.youtube.com/@EkopartyCon...

Recorded Future just published Dark Covenant 3.0, revealing how global crackdowns and shifting Russian enforcement are reshaping the cybercriminal underground, exposing ties to state actors and turning cybercrime into a geopolitical tool: www.recordedfuture.com/research/dar...

We saw Earth Estries, an advanced #APT intrusion set, sharing its access to Earth Naga (Flax Typhoon). We introduce the term "Premier Pass" to describe this behavior, and propose a four-tier classification framework for collaboration types among advanced groups www.trendmicro.com/en_us/resear...

Michał Woś, a member of 🇵🇱Poland’s right-wing populist party Law and Justice (PiS) & former deputy justice minister, has been formally charged with abuse of power in connection with the illegal purchase of Pegasus #spyware using public funds. www.polskieradio.pl/395/7784/Art...

-Clever worm hits the VS Code scene -F5 was breached via its own devices -KT CEO to resign after security breach -Boy Scouts to award cybersecurity merit badges -Russia looking at age verification, too -TARmageddon vuln Podcast: risky.biz/RBNEWS494/ Newsletter: news.risky.biz/risky-bullet...

Researchers have documented for years that eating beef, pork and chicken has a significant environmental impact. But what you eat, and where you eat it, can have a big effect on how much you’re contributing to climate change, according to a new study.

Italian prosecutors reportedly interrogated the heds of the country's two intelligence agencies (AISI and AISE.) Prosecutors are investigating the alleged targeting of journalists Francesco Cancellato and Ciro Pellegrino, among others. At this point, it's unclear who hacked them.

SCOOP: A man who worked on developing hacking and surveillance tools for defense contractor L3Harris Trenchant was notified by Apple that his iPhone was targeted with mercenary spyware. The developer believes he was targeted after he was wrongly accused of leaking zero-days developed by Trenchant.

Spanish internet service providers are blocking access to the No-IP dynamic DNS service with an HTTP error code 451. The error is usually shown when sites are taken down due to legal reasons. It's probably LaLiga-related antipiracy enforcement, as usual torrentfreak.com/isp-blocking...?

Great opinion piece by my colleague @lawrencesec.bsky.social on an extremely timely and important topic!

I published a Wide World of Cyber edition today about the f5 incident with @stamos.org and @thekrebscycle.bsky.social No video for this episode… our video platform is AWS dependent 🤦‍♂️ risky.biz/WWC11/

Spyware maker NSO group previously told the judge that an injunction could “put NSO’s entire enterprise at risk” because it relies on vulnerabilities in widely-used software like WhatsApp to target individuals therecord.media/judge-bars-n...

A hacking group has told 404 Media that it's made a dossier containing the private information of thousands of government officials constructed from stolen Salesforce data.

cloud.google.com/blog/topics/... I wrote some more on COLDRIVER - specifically about their recent malware they have been using since at least May. If you’re on the COLDRIVER target list keep an eye out for this stuff. They have been more active with it than previous malware.

We are honored to be hosting the Computer Emergency Response Team of Ukraine (CERT-UA) to get an updated picture on the threat landscape in Ukraine in their talk “FIFTY SHADES OF CYBER DURING THE WAR TIME” Read more of CERT-UA's work on their website: cert.gov.ua

Follow this thread 👇 With the inaugural SOS just 18 days away, we'll be highlighting a few of the amazing talks you'll be hearing on October 28 in Brussels! stateofstatecraft.com/agenda Get a ticket while you still can! 🎟️🎟️🎟️