-Russia to use custom crypto in 5G network -Orban government accused of using Candiru spyware -Coruna tied to Triangulation -Malware found on thousands of Luxembourg government phones -More advanced BPFdoor versions spotted Podcast: risky.biz/RBNEWS543/ Newsletter: news.risky.biz/risky-bullet...

83% of observed Ivanti EPMM exploitation (CVE-2026-1281) traces to one bulletproof IP that isn't on any published IOC list. The IPs that are? VPN exits with zero Ivanti activity. We broke down who's actually doing this ⬇️ #Ivanti #ThreatIntel #CVE20261281 #InfoSec

Weekly summary is out.. ctoatncsc.substack.com/p/cto-at-ncs...

We have started to report webshells (or other artifacts) found on Ivanti EPMM devices, likely compromised via CVE-2026-1281. 56 IPs found on 2026-02-06 Data in shadowserver.org/what-we-do/n... Tree Map view: dashboard.shadowserver.org/statistics/c... Thank you to the KSA NCA for the heads up!

This has been confirmed today: operation-endgame.com Europol took down servers for the Rhadamanthys infostealer, the VenomRAT, and the Elysium botnet

Que "The Final Countdown" by Europe 🎶 and lock in 💻-- it's time for final submissions for #FIRSTCTI26 #lastcall #timesup 🔗 go.first.org/EHUnv

🚨 New research: ShinyHunters teamed up with Scattered Spider for vishing attacks on cloud application users, bribed employees for insider access, and targeted engineering users to compromise CI/CD tools. blog.eclecticiq.com/shinyhunters... @likethecoins.bsky.social @campuscodi.risky.biz #CTI

Yep, I've been pwned. 2FA reset email, looked very legitimate. Only NPM affected. I've sent an email off to @npmjs.bsky.social to see if I can get access again. Sorry everyone, I should have paid more attention. Not like me; have had a stressful week. Will work to get this cleaned up.

New, by me: The hackers who breached Allianz Life earlier this month and stole the personal information belonging to the "majority" of its 1.4 million customers, also took Social Security numbers during the breach, per new filings with U.S. states.

LOL... someone scrapped celebrity Spotify accounts/playlists and leaked their music preferences The *chef's kiss* here is the name of the site: Panama Playlists 😆 panamaplaylists.com

This is by far the coolest part in the UK's proposed ransomware ban and mandatory reporting proposal www.gov.uk/government/n...

"This report presents the first detailed study of China’s cyber militia system since 2015. It draws from an analysis of 136 individual militia units, as well as authoritative Chinese-language military writings and mobilization documents." margin.re/mobilizing-c...

Ohhh…I smell a takedown coming! Via @jgreig.bsky.social & @therecordmedia.bsky.social

GreyNoise observed a major spike in scanning against Ivanti products weeks before two zero-days were disclosed in Ivanti EPMM. Full update: www.greynoise.io/blog/surge-i... #Ivanti #GreyNoise #Cybersecurity #ZeroDays

Victoria’s Secret website down as company investigates security incident via @jgreig.bsky.social & @therecordmedia.bsky.social

Microsoft has discovered a cluster of worldwide cloud abuse activity by new Russia-affiliated threat actor Void Blizzard (LAUNDRY BEAR), whose cyberespionage activity targets gov't, defense, transportation, media, NGO, and healthcare in Europe and North America. https://msft.it/63324S9Jkp

Dutch intelligence discover a new Russian APT—LAUNDRY BEAR www.aivd.nl/documenten/p... Microsoft calls it Void Blizzard. Their report is here: www.microsoft.com/en-us/securi...

Ivanti patches two zero-days under active attack as intel agency warns customers

Never a dull day in cybersecurity. Check out today's Metacurity for the critical infosec developments you need to know. www.metacurity.com/russias-apt2...

"A global law enforcement operation coordinated by Europol has struck a major blow to the criminal underground, with 270 arrests of dark web vendors and buyers across ten countries" www.europol.europa.eu/media-press/...

A Chinese APT (UNC5221) is behind recent attacks exploiting an Ivanti zero-day (CVE-2025-4427) This is a known Chinese APT group that seems to be specialized in Ivanti and other Western enterprise products... they have a long list of past zero-days in their name blog.eclecticiq.com/china-nexus-...

🇨🇳 UNC5221 China-Nexus Threat Actor Actively Exploiting Ivanti EPMM (CVE-2025-4428).Targets critical networks like US airports and Telecommunications companies in EU. Exfiltrating sensitive data from managed mobile devices. #cyber Here is the full report: blog.eclecticiq.com/china-nexus-...

-Ransomware IAB spreads trojanized KeePass installer -APT28 targets email servers with XSS attacks -Good report on DPRK cyber and IT worker schemes -Russia uses USAID shutdown in info-op targeting Moldova -RU disinfo group Storm-1516 is behind the Macron coke memes

Storm-1516, a pro-Kremlin 🇷🇺 disinformation group, launched an AI-driven influence operation to discredit European leaders. 🇪🇺 blog.eclecticiq.com/storm-1516-d... @hatr.bsky.social

🎉 Happy to share that my talk has been accepted at Virus Bulletin! I’ll be presenting in 🇩🇪 Berlin on Friday, September 26 at VB2025: Details: www.virusbulletin.com/conference/v... See you there! #vbconference #VB2025

The FBI is awaiting signals from telecom victims that Salt Typhoon is fully excised from their systems. My Q&A with Deputy Assistant Director for Cyber Operations Brett Leatherman about Salt Typhoon and other topics at #RSAC2025 below: www.nextgov.com/cybersecurit...

Microsoft Teams appears to have been used as part of the cyber kill chain in the Co-Op hack. I've recently seen similar tactics, where threat actors employed voice phishing via Teams calls. It’s a threat worth watching.

Podcast: risky.biz/RBNEWS418/ Newsletter: news.risky.biz/risky-bullet... -French government grows a spine and calls out Russia's hacks -Marks & Spencer sends staff home after ransomware attack -China accuses US of hacking cryptography provider -AirBorne vulnerabilities impact Apple's AirPlay

As RSA 2025 gets into full swing, stay ahead of the curve by checking out today's Metacurity for the most critical infosec developments you should know. www.metacurity.com/france-accus...

🚨 Erlang SSH RCE (CVE-2025-32433) is a significant supply chain risks to ICS and OT devices, particularly critical networking equipment like routers, switches, and smart sensors. The public availability of a POC makes this vulnerability especially concerning, as it is straightforward to exploit.

Since April 15, 2025, BreachForums 2 was offline. Admin “Normal” confirmed its return at breached[.]fi, with no prior data restored. The new site faces skepticism, with some calling it a potential honeypot, likely pushing threat actors toward other platforms.

Sri Lanka’s Foreign Ministry hit by phishing email posing as peacekeeper notice sent from Pakistan’s Naval Uni (likely breached) “[email protected].” Malicious link led to fake Gmail login via Railway-hosted page "gs23-production.up.railway[.]app", stealing user credentials and OTPs.

Telephone-oriented attack delivery (TOAD) should be part of your threat model. We're seeing a rise in phishing where real human voices trick IT admins or helpdesks. Threat actors even run affiliate programs, paying people to guide victims into RMM installs or password reset.

I’m speaking up in support of @thekrebscycle.bsky.social & @sentinelone.com Cybersecurity should be a non-partisan issue that unites us in our shared mission to defend our country. National security can’t afford the chilling effect on both public & private sector www.lutasecurity.com/post/in-supp...

Rakesh Krishnan has published an in-depth report on the evolution of the HelloKitty ransomware, analyzing samples going as far back as the group's inception back in 2020. The group doesn't have a leak site active, but new samples are still in the wild. theravenfile.com/2025/04/10/h...

Ransomware brands come and go, but affiliates stay active, favoring repeatable/high-ROI tradecrafts. Many work with multiple RaaS crews at once. Their playbooks aren’t static, affiliates adapt to tech shifts like cloud adoption. Focus on affiliate behavior and hunt the tradecraft. #Ransomware

Confirming other reports: CISA is expected to initiate efforts to significantly reduce its workforce in the coming days, including vast cuts to its industry contracting teams, according to four people familiar with the moves. w/ @notamazonalexa.bsky.social www.nextgov.com/people/2025/...

Gen. Paul Nakasone says China is now our biggest cyber threat | therecord.media/nakasone-int... @therecordmedia.bsky.social "Consider Volt Typhoon. There is absolutely no intelligence to be gathered by putting malicious code in [critical infrastructure] networks..."

Cloudflare has open-sourced OPKSSH (OpenPubkey SSH), a tool to support single sign-on (SSO) for SSH blog.cloudflare.com/open-sourcin...

We’re thrilled to announce that the second edition of fwd:cloudsec Europe will take place on September 15-16 in Berlin! fwdcloudsec.org/conference/e...

EclecticIQ's Arda Büyükkaya looks into an espionage campaign by Sandworm (APT44, UAC-0145) against Ukrainian Windows users, likely ongoing since late 2023. Pirated Microsoft KMS activators & fake Windows updates are leveraged to deliver a new version of BACKORDER. blog.eclecticiq.com/sandworm-apt...

The Cloak ransomware gang has taken credit for breaching the Virginia Attorney General's Office last week www.securityweek.com/ransomware-g...

🚨Only 5 days left! Don't miss our FREE webinar on how Sandworm (APT44) is targeting the critical infrastructure. - Actionable intelligence on nation-state tactics Register now! 👉 hubs.ly/Q03b4ZTG0 #Cybersecurity #ThreatIntel #Cyber #Webinar

Afternoon, my fellow Saturday cyber-sloggers. By me @forbes.com: Automated brute-force VPN and firewall ransomware attack framework revealed. #kudos @whichbufferarda.bsky.social #infosec www.forbes.com/sites/daveyw...

🚨 Leaked Black Basta chat logs have helped EclecticIQ analysts uncover BRUTED, a previously undocumented automated brute-forcing framework used to compromise Edge Network devices. blog.eclecticiq.com/inside-brute... #CyberSecurity @likethecoins.bsky.social @GossiTheDog.cyberplace.social.ap.brid.gy

I highly recommend this session to organizations across all industries seeking to strengthen their defenses against nation-state actors, specially to cybersecurity teams and policymakers from government agencies and critical infrastructure sectors. hubs.ly/Q03b4ZTG0

🎤 For those who missed the live SANS CTI 2025 conference 🇺🇸 , my recorded talk is now available. It's packed with valuable insights on Phishing-as-a-Service (PhaaS) and Attribution. youtu.be/F4d1MMs1L1A @likethecoins.bsky.social @k8em0.bsky.social @bigbadw0lf.bsky.social #Cyber #Phishing

"Treating Russia like an ally on cybersecurity would be a grave mistake that could very well cost American lives," @wyden.senate.gov told me via @theregister.com

Podcast: risky.biz/RBNEWS393/ Newsletter: risky.biz/risky-bullet... -Trump administration stops treating Russian hackers as a threat -Meta seeks permanent NSO ban -New Cellebrite 0-days come to light -3rd-party breaches are now a headache for cyber insurers -WazaWaka and Ermakov get home detention