Attacker interest in the vulnerability is magnified by an unparalleled number of publicly available exploits, earning the defect the highest verified public exploit count of any CVE ever. via @mattkapko.com cyberscoop.com/react2shell-...

Hey everybody @lindseywilkinson.bsky.social has joined the FedScoop team (and Bluesky)! Give her a follow

Attackers of different origins and motivations swiftly exploited a critical vulnerability dubbed React2Shell, affecting one of the most extensively used application frameworks. Unit 42 has confirmed more than 30 organizations across various sectors are impacted. cyberscoop.com/attackers-ex...

The attacks, which have impacted dozens of organizations, date back at least three years, lasting an average of 393 days. And that’s just what’s been uncovered in the last four months. via @mattkapko.com cyberscoop.com/china-bricks...

SCOOP: Sean Plankey's nomination to lead CISA is seemingly over, after DHS partially terminated a Coast Guard contract with Florida-based Eastern Shipbuilding Group. Plankey had been an adviser to CG. Sen. Rick Scott became a hurdle to Plankey's confirmation. cyberscoop.com/sean-plankey...

The open-source code library is one of the most extensively used application frameworks. Wiz found vulnerable versions in around 39% of cloud environments. via @mattkapko.com cyberscoop.com/react-server...

Details about the attack are scattered, and discrepancies remain about the number of companies impacted and the extent to which they are compromised. via @mattkapko.com cyberscoop.com/gainsight-ce...

China’s ‘autonomous’ AI-powered hacking campaign still required a ton of human work by @derekbjohnson.bsky.social at @cyberscoop.bsky.social. cyberscoop.com/anthropic-ai...

I took a look at how Trump officials' comments on cyber deterrence contrast with the man himself, and what it means or reflects for the global scene. cyberscoop.com/trump-cyber-...

An incredibly sad loss for Computerworld, the larger tech journalism community, and for me personally....

The emails, which are littered with broken English, aim to instill fear, apply pressure, threaten public exposure and seek negotiation for a ransom payment. via @mattkapko.com cyberscoop.com/extortion-em...

CYBERSCOOP AFTER DARK: Attackers appearing to be aligned with the Clop ransomware group have sent emails to Oracle customers seeking extortion payments, claiming they stole data from the tech giant’s E-Business Suite. Early signs point to it being legit cyberscoop.com/clop-claims-...

New from me. CyberScoop after dark. cyberscoop.com/clop-claims-...

The DOJ recently announced it seized $2.8M from an alleged ransomware operator living in California back in early 2024. The Russian national was arrested and charged a year ago, but released on bail the same day. He's still out, despite multiple run-ins with police. cyberscoop.com/ianis-antrop...

Likewise, and your story on this is fantastic.

21-year-old former Army soldier pleaded guilty Tuesday to charges stemming from a series of attacks and extortion attempts last year on telecommunications companies, including AT&T. tip @techmeme.com cyberscoop.com/cameron-wage...

Scattered Spider weaves web of social-engineered destruction. The cybercrime ring has infiltrated more than 100 businesses since 2022, including more than a dozen since it regrouped earlier this year. via @mattkapko.com cyberscoop.com/scattered-sp...

NEW: The head of the FBI's cyber div told @timstarks.bsky.social that Salt Typhoon is “largely contained” and “dormant” in the networks, “locked into the location they’re in” and “not actively infiltrating information" in an exclusive intv with @cyberscoop.bsky.social cyberscoop.com/top-fbi-cybe...

Hacker helped kill FBI sources, witnesses in El Chapo case, according to watchdog report cyberscoop.com/hacker-helpe...

Supposed experts and mainstream media have spent the past few days hyperventilating over reports of a colossal data breach that exposed more than 16 billion credentials. There’s just one inconvenient detail: evidence to support its sensational claim is lacking. cyberscoop.com/colossal-dat...

Cybercrime crackdown disrupts malware, infostealers, marketplaces across the globe. A burst of global law enforcement actions during the past few weeks marked by a flurry of successful takedowns gives cybercrime experts a jolt of hope. via @mattkapko.com cyberscoop.com/cybercrime-c...

The Com’s chaotic, sprawling network, composed of mostly teenagers and young adults, are committing their crimes primarily for notoriety amongst their peers on the internet, @nixonnixoff.bsky.social said during a presentation @sleuthcon.bsky.social. cyberscoop.com/the-com-subc...

CrowdStrike and Microsoft announced an agreement Monday to formally connect the different names each company uses for the same threat groups in their attribution analysis. via @mattkapko.com cyberscoop.com/crowdstrike-...

Treasury sanctions crypto scam facilitator that allegedly stole $200M from US victims. The Philippines-based company Funnull operated a large cybercrime platform encompassing more than 332,000 domains, the FBI said. via @mattkapko.com youtu.be/ytmg-jbyl6o?... | cyberscoop.com/funnull-cryp...

This is good news! Just as ransomware has a whole ecosystem built up around it, so do these scam call centers, but at a much larger scale. Taking down one of the bigger ecosystem players will, hopefully, have a disruptive effect. via @mattkapko.com & @cyberscoop.bsky.social

Multiple attackers are raiding Ivanti customers’ systems again by exploiting a pair of closely intertwined vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) to achieve unauthenticated remote code execution. via @mattkapko.com cyberscoop.com/ivanti-epmm-...

Laundry Bear, a group recently identified by Dutch intelligence and security services, stole work-related contact details on the Netherlands’ national police force in September 2024, Microsoft researchers said. via @mattkapko.com www.youtube.com/watch?v=b53l... | cyberscoop.com/laundry-bear...

A newly discovered Russian state-sponsored threat group has targeted a large swath of industries, especially in #NATO member states and #Ukraine, part of a global #espionage campaign in support of Moscow’s interests, Microsoft Threat Intelligence said in a Tuesday blog post. via @mattkapko.com

The successful break-up of DanaBot marks the second high-profile law enforcement disruption of a widespread malware operation in as many days. via @mattkapko.com cyberscoop.com/danabot-malw...

Lumma Stealer, a widely used infostealer malware linked to cybercrime sprees and multiple high-profile attacks, was dismantled through a coordinated global operation meant to seize its core infrastructure. via @mattkapko.com cyberscoop.com/lumma-steale...

An extensive investigation by #Sophos X-Ops, pulled from thousands of posts on two Russian-language and three English-language cybercrime forums, uncovered the dark underbelly of illegal schemes #cybercriminals use to reinvest their money. via @mattkapko.com youtu.be/DVCEMR0hc_4?...

Great story from @mattkapko.com and @sophossecurity.bsky.social on what cybercriminals do with their money: it's not all lambos and bottle service, its often laundered through legit businesses (with forums featuring guides on how to bury cash in the ground) cyberscoop.com/what-cybercr...

Vulnerabilities are proliferating in SonicWall devices and software this year. The company is among many network security device vendors targeted by cybercriminals. Yet, unlike almost all of its competitors, SonicWall hasn't signed CISA's secure-by-design pledge. cyberscoop.com/sonicwall-ex...

#CrowdStrike is cutting 5% of its #workforce, about 500 positions, telling its staff that it’s shifting resources and realigning its operating model for growth in new market segments, according to a Wednesday filing with the SEC. via @mattkapko.com cyberscoop.com/crowdstrike-...

Five months after education software vendor PowerSchool paid an unnamed threat actor a #ransom in exchange for the deletion of sensitive stolen data, some of the company’s customers are now receiving #extortion demands. via @mattkapko.com cyberscoop.com/powerschool-...

Amazon, CrowdStrike, Google and Palo Alto Networks claim no change to threat intel sharing under Trump. Top security leaders at some of the largest tech and cybersecurity vendors said public-private collaborative work continues, despite budget cuts and personnel changes. via @mattkapko.com

Security leaders at Mandiant and Google Cloud say nearly every major company has hired or received applications from North Korean nationals working on behalf of the country’s regime. via @mattkapko.com cyberscoop.com/north-korea-...

🎙️ Ready for #RSA 2025? CyberScoop’s @mattkapko.com joined the latest episode of Pressing Matters to preview the conference—and yes, #AI talk is inevitable. 🔗 Listen here: www.buzzsprout.com/2028393/epis...

Cyber threat wonks and incident response firms don't have to release all of their research during the chaos of RSA. Yet, without fail, they do this year after year. Good luck cutting through the noise.

I usually ask the questions, but not this time. It was an honor to join Big Valley Marketing's Pressing Matters podcast. We covered a lot of ground, maybe too much. This is my story and I'm grateful for the thought and care Dave Reddy put into our conversation. www.buzzsprout.com/2028393/epis...

Attackers have exploited 16 vulnerabilities in Ivanti products since 2024. That’s more than any other vendor in the network edge device space. cyberscoop.com/ivanti-explo...

On the latest episode of the Safe Mode podcast, @gregotto.bsky.social speaks with @mattkapko.com about the latest investigations into the growing threat of North Korean remote workers infiltrating global enterprises. www.youtube.com/watch?v=PaNX...

Fascinating story about North Korean tech workers: they never log off, and they generate hundreds of millions in salaries for the regime. By @mattkapko.com of @cyberscoop.bsky.social #infosec cyberscoop.com/north-korea-...

A Canadian citizen is one step closer to standing trial in the U.S. for his alleged involvement in a series of attacks targeting as many as 165 Snowflake customers, one of the most widespread and damaging attack sprees on record. via @mattkapko.com cyberscoop.com/connor-mouck...

On the latest episode of #SafeMode, @gregotto.bsky.social talks with @mattkapko.com about who is sending those massively annoying #scam text messages about unpaid toll violations. youtu.be/OSjEn_MgXuQ?...

Trend Micro researchers discovered and reported the eight-year-old defect to Microsoft six months ago. The company hasn’t made any commitments to patch or remediate the issue. via @mattkapko.com cyberscoop.com/microsoft-wi...

It’s not just you. Seemingly everyone is getting those text messages that serve as a notification of an unpaid toll road violation. cyberscoop.com/toll-road-te...

The only thing the internet can seemingly agree on is that X was in fact hit with a DDoS attack on Monday. That's really where the agreements end. @mattkapko.com talked to researchers cyberscoop.com/x-ddos-attac...

On the latest episode of #SafeMode, @gregotto.bsky.social speaks with @mattkapko.com about the Justice Department’s indictment of 12 Chinese nationals accused of running an extensive hacker-for-hire operation on behalf of China’s #intelligence and #security services. youtube.com/shorts/4oBUd...