"...the seeds of the attack were planted in February when a Context.ai employee’s computer was infected with Lumma Stealer malware after they searched for Roblox game exploits, a common vector for infostealer deployments." cyberscoop.com/vercel-secur...

Inside the FBI’s router takedown that cut off APT28’s ‘tremendous access’: FBI cyber chief Brett Leatherman told CyberScoop the Russian GRU campaign was unique in how it could propagate from routers to beyond. cyberscoop.com/fbi-operatio...

A systemic numbness to cyberattacks has exposed the U.S. economy and its institutions to ever-widening threats. Retired four-star military officials worry the worst day in cyber is yet to come. via @mattkapko.com www.youtube.com/watch?v=Kv-h... | cyberscoop.com/former-nsa-c...

A systemic numbness to cyberattacks has exposed the U.S. economy and its institutions to ever-widening threats. Retired four-star military officials worry the worst day in cyber is yet to come. via @mattkapko.com cyberscoop.com/former-nsa-c...

Four former NSA chiefs worry that a systemic numbness to cyberattacks has exposed the U.S. economy and its institutions to ever-widening threats. The retired four-star military officials worry the worst day in cyber is yet to come. cyberscoop.com/former-nsa-c...

Second drop from the RSA Conference in San Francisco.

My first drop from this week’s RSA conference is out. Leaders from various cybersecurity institutions were quick to defend and evangelize the administration’s strategic pivots in cyberspace, claiming the freshly-released document is already paying off. cyberscoop.com/cyber-strate...

Thank you, @ransomwaresommelier.com! That’s very kind of you.

Good morning to everyone but botnet admins! Great piece from @mattkapko.com, appreciate having a few of my comments in it! 🖖🌩️⚖️ cyberscoop.com/botnet-disru...

A difficult but necessary story. www.nytimes.com/2026/03/18/u...

Maybe a criminal convicted of computer fraud and aggravated identity theft shouldn't have access to a computer while they're in prison for those crimes? Am I missing something here? cyberscoop.com/nba-nfl-athl...

Nice one from @lindseywilkinson.bsky.social! (I lent a hand.)

Angelo Martino is accused of playing both sides — committing attacks and conducting ransomware negotiations on some of the same cases on behalf of his former employer. www.youtube.com/watch?v=MlK6... | cyberscoop.com/digitalmint-...

Some stories are so strange and so wild, they defy imagination. My latest digs into how a cybersecurity professional allegedly moonlighted as a cybercriminal -- committing attacks and conducting ransomware negotiations for his employer on some of the same cases. cyberscoop.com/digitalmint-...

The administration also released an executive order on cybercrime and fraud. via @timstarks.bsky.social cyberscoop.com/trump-cybers...

In this episode of Safe Mode, @gregotto.bsky.social dives in with @timstarks.bsky.social to unpack what’s happened inside CISA—and what it could mean for the country’s ability to withstand the next major cyber crisis. www.youtube.com/watch?v=ZUDX... | cyberscoop.com/cisa-personn...

Seeing the lengthy list of changes/cutbacks to CISA catalogued in this one piece makes it clear there is little left of it. The agency is less than a decade old and struggled for years to find its footing before it started to make progress. But all advances it made have been gutted in last 12 months

Gottumukkala out, Andersen in as acting CISA director cyberscoop.com/cisa-leaders...

The global campaign marks the second series of multiple actively exploited zero-day vulnerabilities in Cisco edge technology since last spring. The similarities don’t end there. via @mattkapko.com cyberscoop.com/cisco-zero-d...

Tim dug up all the dirt on CISA. His reporting captures the agency's decline and serves stark warnings about the messes that could unravel when the next major crisis hits.

Cybercrime groups, including one that identifies as ShinyHunters, are targeting single sign-on services to gain access to victim networks and steal data. via @mattkapko.com cyberscoop.com/shinyhunters...

Ransomware negotiators dish on being in a ‘moral gray zone,’ unrestricted by accountability or industrywide rules of engagement. @mattkapko.com @gregotto.bsky.social www.youtube.com/watch?v=iAMe... | cyberscoop.com/ransomware-n...

Ransomware negotiators dish on being in a ‘moral gray zone,’ unrestricted by accountability or industrywide rules of engagement. via @mattkapko.com cyberscoop.com/ransomware-n...

Attacker interest in the vulnerability is magnified by an unparalleled number of publicly available exploits, earning the defect the highest verified public exploit count of any CVE ever. via @mattkapko.com cyberscoop.com/react2shell-...

Hey everybody @lindseywilkinson.bsky.social has joined the FedScoop team (and Bluesky)! Give her a follow

Attackers of different origins and motivations swiftly exploited a critical vulnerability dubbed React2Shell, affecting one of the most extensively used application frameworks. Unit 42 has confirmed more than 30 organizations across various sectors are impacted. cyberscoop.com/attackers-ex...

The attacks, which have impacted dozens of organizations, date back at least three years, lasting an average of 393 days. And that’s just what’s been uncovered in the last four months. via @mattkapko.com cyberscoop.com/china-bricks...

SCOOP: Sean Plankey's nomination to lead CISA is seemingly over, after DHS partially terminated a Coast Guard contract with Florida-based Eastern Shipbuilding Group. Plankey had been an adviser to CG. Sen. Rick Scott became a hurdle to Plankey's confirmation. cyberscoop.com/sean-plankey...

The open-source code library is one of the most extensively used application frameworks. Wiz found vulnerable versions in around 39% of cloud environments. via @mattkapko.com cyberscoop.com/react-server...

Details about the attack are scattered, and discrepancies remain about the number of companies impacted and the extent to which they are compromised. via @mattkapko.com cyberscoop.com/gainsight-ce...

China’s ‘autonomous’ AI-powered hacking campaign still required a ton of human work by @derekbjohnson.bsky.social at @cyberscoop.bsky.social. cyberscoop.com/anthropic-ai...

I took a look at how Trump officials' comments on cyber deterrence contrast with the man himself, and what it means or reflects for the global scene. cyberscoop.com/trump-cyber-...

An incredibly sad loss for Computerworld, the larger tech journalism community, and for me personally....

The emails, which are littered with broken English, aim to instill fear, apply pressure, threaten public exposure and seek negotiation for a ransom payment. via @mattkapko.com cyberscoop.com/extortion-em...

CYBERSCOOP AFTER DARK: Attackers appearing to be aligned with the Clop ransomware group have sent emails to Oracle customers seeking extortion payments, claiming they stole data from the tech giant’s E-Business Suite. Early signs point to it being legit cyberscoop.com/clop-claims-...

New from me. CyberScoop after dark. cyberscoop.com/clop-claims-...

The DOJ recently announced it seized $2.8M from an alleged ransomware operator living in California back in early 2024. The Russian national was arrested and charged a year ago, but released on bail the same day. He's still out, despite multiple run-ins with police. cyberscoop.com/ianis-antrop...

Likewise, and your story on this is fantastic.

21-year-old former Army soldier pleaded guilty Tuesday to charges stemming from a series of attacks and extortion attempts last year on telecommunications companies, including AT&T. tip @techmeme.com cyberscoop.com/cameron-wage...

Scattered Spider weaves web of social-engineered destruction. The cybercrime ring has infiltrated more than 100 businesses since 2022, including more than a dozen since it regrouped earlier this year. via @mattkapko.com cyberscoop.com/scattered-sp...

NEW: The head of the FBI's cyber div told @timstarks.bsky.social that Salt Typhoon is “largely contained” and “dormant” in the networks, “locked into the location they’re in” and “not actively infiltrating information" in an exclusive intv with @cyberscoop.bsky.social cyberscoop.com/top-fbi-cybe...

Hacker helped kill FBI sources, witnesses in El Chapo case, according to watchdog report cyberscoop.com/hacker-helpe...

Supposed experts and mainstream media have spent the past few days hyperventilating over reports of a colossal data breach that exposed more than 16 billion credentials. There’s just one inconvenient detail: evidence to support its sensational claim is lacking. cyberscoop.com/colossal-dat...

Cybercrime crackdown disrupts malware, infostealers, marketplaces across the globe. A burst of global law enforcement actions during the past few weeks marked by a flurry of successful takedowns gives cybercrime experts a jolt of hope. via @mattkapko.com cyberscoop.com/cybercrime-c...

The Com’s chaotic, sprawling network, composed of mostly teenagers and young adults, are committing their crimes primarily for notoriety amongst their peers on the internet, @nixonnixoff.bsky.social said during a presentation @sleuthcon.bsky.social. cyberscoop.com/the-com-subc...

CrowdStrike and Microsoft announced an agreement Monday to formally connect the different names each company uses for the same threat groups in their attribution analysis. via @mattkapko.com cyberscoop.com/crowdstrike-...

Treasury sanctions crypto scam facilitator that allegedly stole $200M from US victims. The Philippines-based company Funnull operated a large cybercrime platform encompassing more than 332,000 domains, the FBI said. via @mattkapko.com youtu.be/ytmg-jbyl6o?... | cyberscoop.com/funnull-cryp...

This is good news! Just as ransomware has a whole ecosystem built up around it, so do these scam call centers, but at a much larger scale. Taking down one of the bigger ecosystem players will, hopefully, have a disruptive effect. via @mattkapko.com & @cyberscoop.bsky.social

Multiple attackers are raiding Ivanti customers’ systems again by exploiting a pair of closely intertwined vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) to achieve unauthenticated remote code execution. via @mattkapko.com cyberscoop.com/ivanti-epmm-...

Laundry Bear, a group recently identified by Dutch intelligence and security services, stole work-related contact details on the Netherlands’ national police force in September 2024, Microsoft researchers said. via @mattkapko.com www.youtube.com/watch?v=b53l... | cyberscoop.com/laundry-bear...