MuddyWater (Iran/MOIS) ran an espionage op disguised as 'Chaos' ransomware. Rapid7 unmasked it — their exfil server + rotation domains sat in our feed since March. 🧵 https://www.dugganusa.com/post/iran-dressed-an-espionage-op-as-chaos-ransomware-we-were-already-watching-the-domains

CISA Exchange CVE-2026-42897 federal deadline tomorrow. Three more crews hit this week: Marquis (400K), Brightspeed via Crimson Collective (1M+), Silent Ransom Group on law firms. All four in our STIX feed: https://analytics.dugganusa.com/stix/register

Verizon DBIR 2026: vulnerability exploitation is now the top breach vector. We shipped Pattern 53 for that shape 48 hours ago. They observe history. We instrument now. https://www.dugganusa.com/post/verizon-dbir-2026-just-made-our-pattern-53-industry-data-vulnerability-exploitation-overtakes-cred

The cyber industry calls 1 thing "the edge." 10,000 edges per minute now. Dev laptop. IDE plugin. CI token. MCP server. OAuth scope. Wall is failing. Decision boundary is the perimeter. https://www.dugganusa.com/post/edges-are-all-over-now-why-the-decision-boundary-is-the-new-perimeter

One npm package this week. GitHub. OpenAI. Mistral. Grafana. All breached through it. CISA admin tokens sat public on GitHub 6 months. Defenders ARE the supply chain. https://www.dugganusa.com/post/the-week-the-defenders-became-the-supply-chain-tanstack-cisa-and-the-pyramid-we-wrote-six-weeks

Your endpoint security tool just shipped 3 KEV entries in 30 days. Defender. Running as SYSTEM. The thing watching the endpoint IS the way in. 5 CVEs. 1 researcher. Brand on box isn't trust. https://www.dugganusa.com/post/defender-is-the-attack-surface-now-five-cves-thirty-days-three-on-kev

Three vendors bled today. VS Code extension. Microsoft's signing service. A security vendor's GitHub. Perimeter held every time. You're not breached at the wall. You're bleeding from seams nobody watches. https://www.dugganusa.com/post/three-soft-surfaces-bled-today-the-perimeter-held-every-time

ShinyHunters hit 3 sectors today: Instructure Canvas 275M, Cushman & Wakefield 500K, NVIDIA Armenia. Our subscribers indexed the operator infra April 2 — 46 days lead time. https://www.dugganusa.com/post/instructure-canvas-cushman-wakefield-nvidia-armenia-all-shinyhunters-today-our-subscribers-hav

MuddyWater (Iran/MOIS) hit US infra with Dindoor + Fakeset. Donald Gay code-sign cert ties to Stagecomp/Darkcomp. Cloudflare rotation mapped hourly since March. https://www.dugganusa.com/post/muddywater-hit-us-infrastructure-with-dindoor-and-fakeset-we-ve-been-mapping-their-cloudflare-rotat

Allianz UK breached today by Clop via Oracle E-Business. The brand impersonation infrastructure was already in our IOC feed weeks ago. https://www.dugganusa.com/post/allianz-uk-got-hit-today-the-brand-impersonation-infrastructure-was-already-in-our-ioc-feed-1 #ransomware

OpenAI got hit today. KongTuke pivoted to Teams today. Our customers were defended against both yesterday. Receipts, not claims. https://www.dugganusa.com/post/openai-got-hit-today-kongtuke-pivoted-to-teams-today-our-customers-were-defended-against-both-yest-1 #supplychain #threatintel

Eight steps in the ClickFix-PySoxy chain. One indicator per step. The whole kill chain mapped, indexed, exportable as STIX. https://www.dugganusa.com/post/shattering-the-clickfix-pysoxy-chain-eight-adversary-steps-one-indicator-apiece-1 #threatintel #clickfix

Allianz UK got hit today — Clop + Oracle E-Business CVE-2025-61882. 41 phishing IOCs targeting Allianz brand were already in our feed. Feed is free. https://www.dugganusa.com/post/allianz-uk-got-hit-today-the-brand-impersonation-infrastructure-was-already-in-our-ioc-feed

OpenAI got hit in the TanStack supply chain today. We indexed the TanStack variant April 29 — sixteen days before the breach surfaced. Receipts public. Feed free. https://www.dugganusa.com/post/openai-got-hit-today-kongtuke-pivoted-to-teams-today-our-customers-were-defended-against-both-yest

Twelve mechanisms that make DugganUSA structurally faster and cheaper than commercial threat intel. Each with a receipt. 24.57M docs. $384/30d. 275+ STIX consumers. Zero AI vendor rent. https://www.dugganusa.com/post/twelve-mechanisms-twelve-receipts-the-dugganusa-edge-in-threat-intelligence

MN Cup just announced 90 semifinalists from 1,300+ apps. We back-tested the last 10 years of High Tech Division winners. One Branch. One Inspectorio. Eight question marks. https://www.dugganusa.com/post/ten-years-of-mn-cup-high-tech-winners-one-branch-one-inspectorio-eight-question-marks

Yesterday we called your Lovable app a spreadsheet. Today we audited 30 of them. RLS held. Three security headers missing across the board. Eight-item checklist to harden the spreadsheet: https://www.dugganusa.com/post/protect-your-lovable-spreadsheet-we-audited-30-of-yours-here-is-what-to-fix

Your Lovable 'app' is a VLOOKUP wrapped in dark-mode CSS pointed at a Supabase free tier you have never logged into. Production is a different sport. https://www.dugganusa.com/post/your-lovable-app-is-a-spreadsheet-mine-has-crons

Fortinet patched pre-auth RCE in FortiSandbox AND FortiAuthenticator today. The box that examines your malware. The box that issues your identity. Both, same day. Last Fortinet pattern we tracked: disclosure → CISA KEV → mandatory patch in 60 days. Clock starts now.

Google caught the first AI-generated zero-day before the mass hack. 2FA bypass in an open-source admin tool, criminal cluster running OpenClaw. Detection signal: hallucinated CVSS + educational docstrings + LLM-tutorial Python. Closes in 90 days. The floor just moved.

Shai-Hulud V3 hit npm today. 416 packages — TanStack, Mistral, Bitwarden, SAP — every one with valid SLSA Build L3 attestations from npm's signing infra. Chain of trust held. They hijacked the keys. We've been on this family since December.

Nitrogen hit Foxconn Wisconsin. 8TB stolen. Apple/NVIDIA/Dell schematics + Google/Intel DC topology. Foxconn took the breach. Customers lost the IP. https://www.dugganusa.com/post/from-fake-google-ads-in-2023-to-eleven-million-files-on-the-dark-web-in-2026-how-nitrogen-walked-th

BreachSense still lists Capgemini as Feb 9 0APT victim. KryBit's Apr 14 leak proved every claim fake. Assume breach cuts both ways. https://www.dugganusa.com/post/breachsense-still-lists-capgemini-as-a-february-9-0apt-victim-krybit-leaked-the-access-logs-proving

Zero-result May 9: 'Khmeimim'. Russian air base in Syria. Krasukha-4 spoofs GPS across eastern Med. We don't cover Russian EW. Iran war + EW share airspace. https://www.dugganusa.com/post/the-gps-spoofer-at-khmeimim-air-base-has-been-affecting-commercial-aviation-for-years-someone-searc

Capgemini hit twice in 18mo. Sept 2024: 20GB on BreachForums. Feb 2026: 0APT claim. MSPs are the soft surface. We don't have a Capgemini post yet. This is the gap. https://www.dugganusa.com/post/capgemini-got-hit-twice-in-eighteen-months-while-sitting-inside-their-clients-networks-we-don-t-ha

Healthcare threat intel, indexed. 50 healthcare brand queries hit our IOC endpoint May 8. Zero results. 16 posts on Handala, ShinyHunters, Storm-2561, Iran cyber wings. https://www.dugganusa.com/post/healthcare-sector-threat-intelligence-indexed-sixteen-posts-five-operators-every-brand-in-your-m

CVE-2026-7458: WP plugin 'User Verification' by PickPlugins. Submit 'true' as OTP, log in as admin. CVSS 9.8. PHP loose comparison. Again. 2nd WP plugin 9.8 in 5 days. https://www.dugganusa.com/post/cve-2026-7458-a-wordpress-plugin-authenticates-you-as-anyone-who-submits-true-for-the-otp-php-lo

Zero-result query on our endpoint: 'iranian apt plc critical infrastructure 2026'. We have 8 posts on it. Handala, MuddyWater, 28 Kittens, ABB AWIN, MOIS/IRGC. https://www.dugganusa.com/post/eight-posts-on-iran-s-ics-war-indexed-we-found-you-in-our-zero-result-queue-and-this-is-what-you-w

ShinyHunters reset the Canvas deadline. "Data destroyed" lasted 48 hours. Register confirms double-intrusion. Penn + Duke negotiating. Don't pay ransomware. https://www.dugganusa.com/post/shinyhunters-reset-the-canvas-deadline-data-destroyed-lasted-forty-eight-hours-our-may-12-hedge

Mini Shai-Hulud doubled in 12hrs: 170 pkgs, 518M dl, Claude Code persistence. We checked. Zero exposure. Direct API keys + pinned deps. 8min check. https://www.dugganusa.com/post/mini-shai-hulud-doubled-in-twelve-hours-170-packages-518-million-downloads-claude-code-persistenc

Two more for the ledger. Mini Shai-Hulud: indexed Apr 29, npm hit May 11. 12 days early. Canvas: watch list May 8, ransom May 11. 4 days early. 7 entries now. https://www.dugganusa.com/post/mini-shai-hulud-hit-npm-may-11-we-indexed-the-variant-april-29-canvas-paid-may-11-we-named-the-wa

162 files. 22 real. 18 are sub-sections of ONE 2011 FBI Vault file the Pentagon split apart and counted separately. The curation is the cover-up. 🔺 Vol. 48: https://www.dugganusa.com/post/conspiracy-theory-newsletter-vol-48-the-curation-is-the-cover-up #UAP #PURSUE #AARO

OpenAI revoked macOS cert yesterday. Axios npm compromise. Actor: TeamPCP. We tracked them through Trivy, LiteLLM, Telnyx, Cisco. Now Mercor + OpenAI. https://www.dugganusa.com/post/teampcp-just-took-out-openai-s-macos-code-signing-certificate-we-ve-been-tracking-this-crew-since-m

Hard perimeter holds. Soft surfaces bleed. 7 supply-chain compromises in 30 days. Zero perimeter breaks. All soft-surface: npm, MDM, OT, signed updates, deps. The defender model is wrong: https://www.dugganusa.com/post/hard-perimeter-holds-soft-surfaces-bleed-seven-receipts-from-thirty-days

713 IOCs in our index tied to actively-exploited (KEV) CVEs. Top 3 = 59% of volume: Linux Kernel (271), cPanel (110), React (44). Fortinet has 2 on the list. Patch tonight, ranked guide: https://www.dugganusa.com/post/713-iocs-tied-to-actively-exploited-cves-in-our-index-patch-these-first

PURSUE UAP scored 69/95 on a 20-point PsyOps framework. 18 of 161 records are sub-sections of one FBI Vault file public since 2011. Apollo "UAP" photos = archives with circles drawn on. 14% is gold. dugganusa.com/post/we-ran-the-pentagon-s-ufo-drop-through-a-20-point-psyops-framework

400K Epstein DOJ docs. 161 PURSUE UAP records. Same VM, same search, same graph. The internet's best Epstein analysis is also the best UFO release analysis. Day Zero on both. https://epstein.dugganusa.com/

CISA AA26-097A: Iran's IRGC-CEC hitting Rockwell PLCs across US water + energy. Same lineage as Stryker, Lockheed, Dubai. Two Iranian wings, one quiet ICS war. https://www.dugganusa.com/post/iran-s-two-cyber-wings-are-running-ics-campaigns-at-the-same-time-cisa-just-confirmed-it

PURSUE Release 1: 161 records, 116 PDFs, indexed Day Zero. 18 are recycled FBI Vault sub-sections (file 62-HQ-83894, public since 2011). Pentagon split one file to pad the count. Search / Map / Graph / Gallery: https://epstein.dugganusa.com/uap/

--text Aegis pre-alpha is live. We deliver what others promise. The methodology that flagged Medtronic 39 days early, live on today's F500 set. Public, refreshing every 60s. $99/mo Pro. RESCUEME = $59.40 first month. https://analytics.dugganusa.com/brands-under-attack.html

--text Shipped RFC 9116 across all properties. CF flagged us as compromised WordPress. Honeypots working too well. $99/mo Pro. RESCUEME = $59.40 first month. https://www.dugganusa.com/post/cloudflare-thinks-we-re-a-compromised-wordpress-site-our-honeypots-are-working-too-well-the-indica

--text Sent: GE Healthcare, Moderna, Express Scripts, Optum. CVS, Comcast, Kaiser, Nike: no RFC 9116, no channel. Half the watch list can't receive a vuln report. https://www.dugganusa.com/post/half-the-shinyhunters-watch-list-cannot-receive-a-vulnerability-report-we-checked-we-added-securit

--text Predicted Medtronic 6 weeks early. Today: GE Healthcare 2,124 IOCs. Blackboard 180. Moderna 164. Plus 7 more. If you're on this list, the email is coming today. https://www.dugganusa.com/post/warning-eight-names-on-our-shinyhunters-watch-list-ge-healthcare-has-2-124-pre-staged-iocs-modern

--text HHS Sec: brain worm, bear cub, whale head, raccoon. Anti-pharma. That epistemology applied to cyber = skip the patch. We sell the daily pill. https://www.dugganusa.com/post/maha-says-eat-a-raccoon-we-sell-the-daily-pill-a-brain-worm-caucus-position-paper-on-threat-intell

--text We sell the daily pill. Doppel sells the surgery. Every enterprise has the same architecture as 2/3 of humans: latent infection, erupts at Q-end. https://www.dugganusa.com/post/we-prevent-cold-sores-dugganusa-threat-intelligence-as-daily-antiviral-and-quarterly-vaccination-n

--text ShinyHunters has Canvas. 275M records. 9,000 schools. All 8 Ivies, MIT, Oxford. Ransom: May 12. Hunt tonight: rotate SSO, reset passwords, brace for phishing. https://www.dugganusa.com/post/shinyhunters-hit-canvas-275-million-records-across-9-000-schools-may-12-ransom-deadline-here-s-th

--text Mythos: 271 zero-days in Firefox. 17-year RCE in FreeBSD. 99% unpatched. Mean time to exploit: -7 days. Before patch exists. We built the remediation layer. https://www.dugganusa.com/post/claude-mythos-finds-zero-days-in-hours-most-teams-aren-t-ready-for-the-remediation-side-we-built-i

05:16 UTC today: Doppel — an AI "brand protection" company — sent us a trademark takedown demand under penalty of perjury. For our post warning Medtronic about the breach Microsoft Security confirmed three days ago. They CC'd Medtronic on it. Thread 🧵 1/5

58 Tor relays. One Dutch /24. Registered as a 'Church.' RIPE doesn't check sincerity — state actors can run this exact playbook. https://www.dugganusa.com/post/a-real-dutch-church-beat-us-to-docker-moreskin-and-ripe-doesn-t-ask-if-you-re-sincere?utm_source=bluesky&utm_campaign=cyberology

DigiCert got got by a Windows screensaver. CrowdStrike + EDR blocked four delivery attempts. The fifth landed in support chat — disguised as a customer screenshot in a ZIP. 10-day attacker dwell. 60 EV code signing certs revoked. Eleven already used to sign Zhong Stealer. 🧵