🔴NEW🔴 Thread 🧵 @bylinetimes.bsky.social can now reveal that, during the crucial period when convicted Reform leader Nathan Gill was most active, working directly with Russian President Vladimir Putin’s most senior ally in Ukraine, he was also one of Nigel Farage’s closest confidantes 1/12

Good piece covering a big burst of TA416 activity targeting European governments last week!

NEW: ICE is planning to hire a team of nearly 30 people to surveil social media 24/7, build dossiers on people, and flag them for arrest and deportation. @dell.bsky.social has the scoop: www.wired.com/story/ice-so...

📣 🔥 🛋️ SAVE THE DATE 🛋️ 🔥 📣 The next #PIVOTcon will be on 6-8 May 2026, in Malaga, ES!!! You favorite ;) #ThreatResearch conference is coming back and we are planning to bring you the usual experience and content of utmost quality. Follow us + #StayTuned for more info #CTI #ThreatIntel #PIVOTcon26

A thread of great questions from @greg-l.bsky.social and fantastic answers (and nuance) by @invisig0th.bsky.social, about the legendary APT1 report and way more.

The US 🇺🇸 gov has moved from combatting, to now openly facilitating, transnational repression

ℹ️ Update: Live network data show the partial restoration of internet connectivity in #Afghanistan amid outcry after a two-day national telecoms blackout; the incident comes as the Taliban leadership applies new "immorality" rules on telco operators

NEW: turns out the EU helped finance a bunch of spyware companies with..public money. Extremely bad look. Group of MEPs calls for action.👇 apache.be/2025/10/01/e...

OpenAI employees are very excited about how well their new AI tool can create fake videos of people doing crimes and have definitely thought through all the implications of this

North Korea's IT worker scheme is expanding outside of the U.S. tech sector, likely due to increasing awareness of the scam, according to a new report therecord.media/north-korea-...

“I have seen movies, short films, completely created by artificial intelligence,” Herzog said. “Story and acting and everything, they look completely dead. There are stories, but they have no soul. They are empty and soulless.” Get their ass, Werner.

Samuel Granados, Aaron Boxerman, and @aric.bsky.social (@nytimes.com) showed Friday the extent of Israel's razing operations in Gaza City. Using satellite analysis, they document the rapidly progressing destruction of Zeitoun and surrounding neighborhoods in Gaza's north.

New from 404 Media: landlords are demanding potential tenants hand over employer login credentials so a tool can verify their income. I was sent screenshot of the tool, Argyle, downloading much more data than necessary to approve the renter. Opt-out means no housing www.404media.co/landlords-de...

'You'll never need to work again': Criminals offer reporter money to hack BBC. I recently got offered millions of pounds to give cyber criminals from the Medusa gang my BBC login. I played along to learn about how these 'insider threat' deals work. www.bbc.co.uk/news/article...

Excited to join a discussion on the second edition of The Mythical Beast by Jen Roberts (@atlanticcouncil.bsky.social), exploring the complex networks behind the spyware ecosystem. This kicks off the new Colloquium series by @virtualroutes.bsky.social: virtual-routes.org/event/mythic...

Far-right Facebook groups are engine of radicalisation in UK, data investigation suggests www.theguardian.com/world/2025/s...

Let me tell you a beautiful story about this couch. 🧵 IG msviciousdesign

Hackers are exploiting a recently patched vulnerability in Fortra GoAnywhere MFT file transfer servers. According to WatchTowr Labs, the attacks started a week after patches were release: labs.watchtowr.com/it-is-bad-ex...

Forta, the vendor behind the file-transfer service software, has yet to report exploitation or address evidence of compromise. Independent researchers say otherwise. via @mattkapko.com cyberscoop.com/goanywhere-v...

A lot of free speech absolutist are being awfully quiet about this sort of thing.

Sept 25: Cisco disclosed two ASA/FTD zero-days (#CVE-2025-20333, #CVE-2025-20362). Weeks earlier, GreyNoise saw 25k IPs scanning ASA — another case of recon surges preceding disclosures. Read the update: www.greynoise.io/blog/scannin... #CiscoASA #ZeroDay #Cisco

www.zscaler.com/blogs/securi... - Nice writeup by zscaler on some COLDRIVER malware. I'm talking about this stuff at #FTSCon in a few weeks and will have lots more details there.

The agency, which issued an emergency directive to federal agencies Thursday, said it took months to determine the root cause and mitigate the activity. via @mattkapko.com cyberscoop.com/cisa-emergen...

#ESETresearch has observed #Gamaredon exploiting CVE-2025-8088 (#WinRAR path traversal) in an ongoing spearphishing campaign. This vulnerability allows arbitrary file write via crafted RAR archives. 1/6

Spyware vendors mapped 🌐worldwide. A new 🇸🇪 @sipri.org report reviews sanctions & export controls on #spyware and other cyber-surveillance tools — with an interactive map of vendors active in August 2025. ➡️ Map: www.sipri.org/visualizatio... ➡️ Full report: www.sipri.org/sites/defaul...

According to leaks from the Black Moon hacktivist group, Russia agreed in 2023 to supply the PLA with a full set of weapons and gear for an airborne battalion, plus special infiltration equipment and full training for operators and technicians. www.rusi.org/explore-our-...

Don't get too excited about AI's ability to find software vulnerabilities, @rgblights.bsky.social said today — we'll never be able to keep up w/ the patching, esp. for unsupported & poorly maintained software. My report from Google's Cyber Defense Summit: www.cybersecuritydive.com/news/ai-vuln...

#ESETresearch has uncovered the North Korea-aligned threat actor, DeceptiveDevelopment, targeting freelance developers with trojanized coding challenges and fake job interviews. www.welivesecurity.com/en/eset-rese... 1/6

DomainTools has a good profile on Salt Typhoon, the Chinese APT that hacked over a dozen US telcos at the end of last year. It's actually a very old and sprawling APT, involving everything from MSS supervisors to front companies and contractors. dti.domaintools.com/inside-salt-...

First public report at Recorded Future by yours truly is out! RedNovember (formerly TAG-100, a.k.a. Storm-2077) is a Chinese state-sponsored threat group focused on intelligence collection, especially on flashpoint issues of strategic interest to China. www.recordedfuture.com/research/red...

We are releasing details on BRICKSTORM malware activity, a China-based threat hitting US tech to potentially target downstream customers and hunt for data on vulnerabilities in products. This actor is stealthy, and we've provided a tool to hunt for them. cloud.google.com/blog/topics/...

🚨🚨🚨 Google released a report on "Brickstorm" this morning — a next-level, suspected China-linked campaign targeting U.S. firms. Ultra-stealthy, 400+ day dwell times, focus on stealing IP, finding zero-days, and focused on long-term cyberespionage. cyberscoop.com/chinese-cybe...

Suspected Chinese hackers infiltrate US law firms, software developers amid trade fight with US: www.cnn.com/2025/09/24/p...

Our new and improved Bellingcat Toolkit is one-year-old today! If you haven't used it yet its a one-stop shop for discovering useful open source tools, maintained by an amazing group of volunteers. You can find use cases, guidance and honest reviews for each tool. bellingcat.gitbook.io/toolkit

AttackIQ has published a report on the evolution of the RomCom malware, covering up to v5 of the tool, which others also call SnipBot and SingleCamper. The malware started out as an e-crime MaaS, but is now often used for APT ops against Ukraine and Europe. www.attackiq.com/2025/09/23/e...

Check Point has a report on this same campaign and group, which they track as Nimbus Manticore research.checkpoint.com/2025/nimbus-...

"APT Down - The North Korea Files 공개 자료 상세 분석 보고서" published by ENKI. #APTDown, #Kimsuky, #DPRK, #CTI https://www.enki.co.kr/media-center/blog/in-depth-analysis-of-the-apt-down-the-north-korea-files-leak

LastPass is warning users of a campaign that targets macOS users with malicious software impersonating popular products delivered through fraudulent GitHub repositories.

Reuters has a phenomenal feature out today on the cyber slaves behind all those "Hey is this Anna?" messages you're getting on WhatsApp. www.reuters.com/graphics/SOU... Kudos to Adolfo Arranz, @poppymcp.bsky.social, Devjyot Ghoshal, and Han Huang for this compelling, graphic novel-style treatment.

Something to keep in mind if your threat model includes the possibility that your phone will be seized by ICE. techcrunch.com/2025/09/18/i...

So what exactly do we think ICE is going to be doing with $3m of GrayKey software? techcrunch.com/2025/09/18/i...

The company confirmed to CyberScoop that an unidentified cybercriminal accessed SonicWall’s customer portal through a series of brute-force attacks. via @mattkapko.com cyberscoop.com/sonicwall-cy...

Recorded Future: Insikt Group has observed CopyCop, a Russian covert influence network, creating at least 200 new fictional media websites targeting the United States (US), France, and Canada www.recordedfuture.com/research/cop...

WatchGuard has released security updates to address a remote code execution vulnerability impacting the company's Firebox firewalls.

1/THREAD: @AP has published our investigation into how US tech firms enabled China’s digital police state. We obtained multiple, massive leaks of internal and classified Chinese government and corporate documents running into the tens of thousands: apnews.com/article/chin...

BREAKING UN investigators determine Israel has since October 2023 committed "genocide" in Gaza, with the "intent to destroy the Palestinians". "We came to the conclusion that genocide is occurring in Gaza and is continuing to occur, and the responsibility lies with the State of Israel"

Wave of Akira hacks on SonicWall devices, two alerts on the same day www.cyber.gov.au/about-us/vie... www.rapid7.com/blog/post/dr...