Catalin Cimpanu

Cybersecurity reporter for Risky Business

#infosec #cybersecurity #security

Newsletter:: https://risky.biz/newsletters/
Podcast:: https://risky.biz/podcasts/

Public Key

npub1s69ytgd44h8539aftjc83pfc8w6w35gnmqqje6n42wqkvkepdwcs7mrmen

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsgdzj95x66mn6gj754evrcs5urhd8g6yfasqfvaf648qtxtvskhvgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsspu9t7

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1s69ytgd44h8539aftjc83pfc8w6w35gnmqqje6n42wqkvkepdwcs7mrmen

Show more details

Last Notes

2026-06-11 12:32:25 GMT

Npm will block all auto-running installation scripts starting next month with the release of version 12.0.
The change is meant to counter the rising number of supply-chain attacks taking place on the platform
https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/

2026-05-21 11:44:13 GMT

The Nx Dev Tools CEO confirms that his company's Nx Console VS Code extension served as the initial entry point for the GitHub repo hack: https://x.com/jeffbcross/status/2057236396658811020
Nx incident: https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w
Step Security report: https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised

2026-05-14 14:27:10 GMT

Security researcher Shellsharks has created Vulnerability.Garden, a catalog of named vulnerabilities.
So far, we're 25 vulnerabilities away from 1K branded security bugs.
Don't worry, @npub1z3m…zn2f... we'll get you there!
https://vulnerability.garden/

2026-04-11 19:53:33 GMT

Bitcoin miners have entered the red as it now costs $88,000 to mint a $69,000 bitcoin
https://www.coindesk.com/markets/2026/03/22/bitcoin-miners-are-losing-usd19-000-on-every-btc-produced-as-difficulty-drops-7-8

2026-03-25 10:53:36 GMT

- reply

-Pay2Key returns
-Novel WebRTC skimmer
-DarkSword leaks online
-Russian TikTok info-ops arrive to Hungarian elections (RO, MD, FR, CZ, PL say "hi")
-Half a million IIS servers are EOL online
-AI adoption grows among info-op groups
-KACE bug exploited in the wild
-Less than 1% of vulnerabilities were exploited last year
-Edge devices were most targeted last year
-Citrix security update
-IRGC info-op hits BlueSky
-New tool—OpenClaw Security Platform
-ROCon APAC 2025 videos
https://files.mastodon.social/media_attachments/files/116/289/438/692/888/998/original/a35fcbb9f9730d76.png

2026-03-25 10:51:43 GMT

- reply

-Checkmarx KICS vulnerability scanner hacked
-Trivy supply chain attack expands to Docker images
-Reddit prepares new account verification methods
-Russia to block international calls to seniors
-Will also block SMS OTPs to children numbers
-State Department launches new cyber office
-University professor hacked students in Dublin
-Yanluowang ransomware affiliate sentenced to 81 months
-Operation Atlantic reaches out to crypto-fraud victims
-Silver Fox expands to SE Asia
-New EvilTokens PhaaS
https://files.mastodon.social/media_attachments/files/116/289/418/128/322/012/original/c93052fecc04250d.png

2026-03-25 10:46:24 GMT

-The Intellexa CEO is pissed!!!
-Google launches threat disruption unit
-German police visit companies in the dead of night about software bugs
-FTC bans all foreign-made routers
-Firefox now has a built-in VPN
-Breach at the Dutch Ministry of Finance
-Hackers breach South Korea's top lender
-Breaches also at Mazda, Crunchyroll, HackerOne, InfiniteCampus
-Resolv hacked for $25m
-CSAM at record levels online
Podcast: https://risky.biz/RBNEWS542/
Newsletter: https://news.risky.biz/risky-bulletin-the-intellexa-ceo-is-pissed/
https://files.mastodon.social/media_attachments/files/116/289/399/091/022/059/original/28696f433c2394a2.png

2026-02-15 20:15:55 GMT

Western Digital has recently announced that it sold all of the year's hard-drive inventory to AI companies.
In other words, prepare for huge SSD price surges.
https://wccftech.com/western-digital-has-no-more-hdd-capacity-left-out/

2026-01-24 15:58:50 GMT

There's a cool Mastodon account named Malicious Extension Bot that sends out notifications whenever new malicious Chrome extensions are detected
https://infosec.exchange/@malicious_browser_bot

2026-01-23 10:41:21 GMT

-Improperly patched bug exploited again in Fortinet firewalls
-Hackers go after security testing environments
-Jordan used Cellebrite against activists
-new Cisco and SmarterMail zero-days
-China accuses Taiwan of 4,000 hacks
-Kazakhstan to tighten data breach laws
-Spain dismisses NSO case
-Dutch want to avoid US clouds for govt data
-€3.5m fine for mysterious company
-Grok generated 23k sexualized images of kids
Podcast: https://risky.biz/RBNEWS516/
Newsletter: https://news.risky.biz/risky-bulletin-improperly-patched-bug-exploited-again-in-fortinet-firewalls/
https://files.mastodon.social/media_attachments/files/115/943/982/993/750/631/original/55fa429a8b2be4a8.jpg

2026-01-22 12:17:20 GMT

Iran is trying to use cryptocurrency to stabilize its fiat rial currency... that's a first
https://www.elliptic.co/blog/iran-has-acquired-us-dollar-stablecoins-worth-at-least-half-a-billion-dollars

2026-01-18 10:15:24 GMT

Five malicious Chrome extensions are targeting the users of popular HR and ERP platforms
-steal cookies
-hijack sessions
-block access to the platform's security and admin pages
Targeted services:
-Workday
-NetSuite
-SuccessFactors
https://socket.dev/blog/5-malicious-chrome-extensions-enable-session-hijacking

2026-01-14 21:32:06 GMT

The Australian cybersecurity agency has warned local businesses against uploading customer data and files to AI chatbots or genAI platforms
https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/artificial-intelligence-for-small-business

2026-01-14 11:33:32 GMT

Beijing tells Chinese firms to stop using US and Israeli cybersecurity software, sources say
https://www.reuters.com/world/china/beijing-tells-chinese-firms-stop-using-us-israeli-cybersecurity-software-sources-2026-01-14/

2026-01-08 10:18:31 GMT

Cloudflare says that BGP routing anomalies right before the US intervention and arrest of Nicolas Maduro appear to have been just "an accident"
https://blog.cloudflare.com/bgp-route-leak-venezuela/

2026-01-04 13:42:37 GMT

"Flights across Greece were grounded on Sunday after a collapse of radio frequencies crippled air traffic communication, stranding thousands of travellers and bringing airport operations to a halt."
https://www.reuters.com/world/europe/greek-airports-halt-flights-due-radio-frequency-issues-2026-01-04/

2025-12-25 13:31:30 GMT

Christmas Eve miracle: Fortinet admits new exploitation of a 2020 bug
https://www.fortinet.com/blog/psirt-blogs/product-security-advisory-and-analysis-observed-abuse-of-fg-ir-19-283

2025-12-25 09:44:56 GMT

David Stern, the CISA official behind the agency's Pre-Ransomware Notification Initiative (PRNI), has quit the agency after he was forced to relocate to FEMA's Boston office by the new DHS leadership
https://www.cybersecuritydive.com/news/cisa-ransomware-warning-program-key-employee-left/808589/

2025-12-18 10:54:10 GMT

French authorities said they arrested the man who hacked their Ministry of Interior email servers.
He's a known hacker who was already convicted this year. Anyone has any ideas who this could be?
https://www.rfi.fr/en/france/20251218-france-detains-suspect-over-interior-ministry-cyberattack-as-probe-widens

2025-12-17 10:14:49 GMT

-Most smart devices run outdated web browsers
-Ukraine hacks major Russian defense contractor
-Ransomware hits Venezuela's oil company
-Hackers are trying to extort PornHub with stolen user data
-SoundCloud has a data breach
-Ribbon Finance hacked for $2.7m
-Prosper data breach exposes 17.6m users
-Iranian hackers put out bounties on Israelis
-Russian hackers breach Dutch public fountain (yes, you read it right)
Podcast: https://risky.biz/RBNEWS509/
Newsletter: https://news.risky.biz/risky-bulletin-most-devices-run-outdated-web-browsers/
https://files.mastodon.social/media_attachments/files/115/734/369/122/464/175/original/fc0034e425759dc8.png

2025-12-16 17:57:03 GMT

"Microsoft Scales Back AI Goals Because Almost Nobody Is Using Copilot"
:thinkerguns:
https://www.extremetech.com/computing/microsoft-scales-back-ai-goals-because-almost-nobody-is-using-copilot

2025-12-14 17:41:01 GMT

The GNOME project has banned developers from including AI-generated code in its shell extensions
https://blogs.gnome.org/jrahmatzadeh/2025/12/06/ai-and-gnome-shell-extensions/

2025-12-11 02:16:19 GMT

The Justice Department charged a former product manager at Accenture Federal Services with falsely misleading government customers about the security posture of a cloud product offered by the company.
https://www.nextgov.com/cybersecurity/2025/12/us-charges-former-accenture-employee-misleading-feds-cloud-platforms-security/410085/

2025-12-09 11:49:56 GMT

Per Sysdig, North Korean hackers are now exploiting React2Shell to drop EtherRAT, a remote access trojan that uses Ethereum smart contracts as C2
https://www.sysdig.com/blog/etherrat-dprk-uses-novel-ethereum-implant-in-react2shell-attacks

2025-12-08 23:59:53 GMT

Meta told the EU it will use less personal data for ads
...and those dummies believed it!!!
https://ec.europa.eu/commission/presscorner/detail/en/mex_25_2966

2025-11-25 14:32:16 GMT

"A cross-party group of lawmakers will urge the European Parliament to ditch internal use of Microsoft’s ubiquitous software in favor of a European alternative, according to a letter obtained by POLITICO."
https://www.politico.eu/article/get-us-off-microsoft-eu-lawmakers-press-parliament-to-change-in-house-it/

2025-11-24 12:38:11 GMT

Shai-Hulud Returns: Over 300 NPM packages infected via fake Bun runtime within hours
https://helixguard.ai/blog/malicious-sha1hulud-2025-11-24

2025-11-20 18:03:10 GMT

Cisco has announced Resilient Infrastructure, a project to improve the security of its products.
This includes:
-increase default protections
-remove legacy insecure features
-reduce the attack surface
-enable better detection and response
https://blogs.cisco.com/news/doubling-down-on-resilient-infrastructure

2025-11-18 16:38:44 GMT

Danish officials have found a new way to push for the Chat Control encryption-breaking legislation without the proposed law going through a public debate
https://www.patrick-breyer.de/en/posts/chat-control/#councilpositions:~:text=19%20November%202025%3A%20COREPER%20II%20meeting%20to%20endorse%20chat%20control%202%2E0%20without%20debate

2025-11-13 10:13:27 GMT

AWS dug through its honeypot data and confirmed that CVE-2025-5777 (Cisco ISE RCE) and CVE-2025-5777 (memory leak in Citrix NetScaler) were exploited as zero-days before their patches.
Nothing new here except the confirmation that an APT was behind the attacks
https://aws.amazon.com/blogs/security/amazon-discovers-apt-exploiting-cisco-and-citrix-zero-days/

2025-11-11 01:03:53 GMT

Yo Mandiant... if exploitation starts in August and the vendor patches this in October... that's what the infosec genZ kids call a "zero-day"
https://files.mastodon.social/media_attachments/files/115/528/367/495/177/134/original/c275fb26ad29ddb8.png

2025-11-10 23:19:36 GMT

Looks like the need to fire staff to cover AI costs has hit the Windows team
RIP Windows Insider
https://files.mastodon.social/media_attachments/files/115/527/960/135/055/669/original/2bd00c1d8b47d4a1.png

2025-11-10 23:01:38 GMT

Bank of England has confirmed the Jaguar Land Rover ransomware attack impacted the UK's GDP growth, as the government first claimed back in August
https://www.bankofengland.co.uk/monetary-policy-report/2025/november-2025
https://files.mastodon.social/media_attachments/files/115/527/885/404/078/930/original/ad43732d54b88e66.png

2025-11-09 12:33:20 GMT

Google Chrome will deprecate and remove XSLT support (the XML CSS thing) by late-2026
Cites security reasons
https://developer.chrome.com/docs/web-platform/deprecating-xslt

2025-11-06 01:10:52 GMT

Repeat after me: Do not fill in and sync your government ID data to your Google account
https://blog.google/products/chrome/enhanced-autofill/

2025-11-05 22:56:43 GMT

CISA's election day monitoring room was not stood up yesterday for the first time in years
According to Bloomberg, remaining CISA election security staff, who have not been fired, have been "prohibited" from contacting state election officials.
https://www.bloomberg.com/news/articles/2025-11-03/us-elections-face-security-test-as-dhs-cuts-local-cyber-support

2025-11-05 09:32:27 GMT

-US indicts two rogue cybersecurity employees for ransomware attacks
-Hackers extort massage parlor visitors
-Balancer hacked for $128 million
-Cargo thieves use hackers to go after trucking and freight companies
-UPenn hack gets feisty
-Major breach in Poland, at SuperGrosz
-Australia expands kids social media ban to Reddit and Kick
-SMS blaster detained in Cambodia
-Scammers arrested in Europe
Podcast: https://risky.biz/RBNEWS500/
Newsletter: https://news.risky.biz/risky-bulletin-us-indicts-two-rogue-cybersecurity-employees-for-deploying-ransomware/
https://files.mastodon.social/media_attachments/files/115/496/388/163/164/822/original/2be1fac1a20766d5.png

2025-11-04 17:28:29 GMT

Chipmaker AMD has confirmed a major security bug in the RDSEED entropy generator impacting Zen 5 processors.
The RDSEED process has been failing to produce random numbers on Linux systems.
AMD is planning to release patches through November for all affected CPU models.
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7055.html

2025-11-03 09:33:39 GMT

- reply

-Germany to pay for its stupidity (again), to pay to replace all Huawei gear
-Russia blocks new Telegram and WhatsApp registrations
-Russia may force companies to replace foreign software
-Thai police arrest fleeing scammers
-Cambodia raids scam compound
-Singapore seizes $115m of scam tycoon's funds
-764 group leader charged in US
-AFP stands up two cybercrime task forces
-Woman stuck in Mauritius for 5 years after cyber charge
-Couple loses fortune to scammers
-BadCandy flourishes in Australia
https://files.mastodon.social/media_attachments/files/115/485/074/887/848/666/original/4a38542cc25f6cc6.png

2025-11-03 09:30:06 GMT

-Norway finds remote control features in its Chinese electric buses
-CyberCorps program freeze threatens students with huge loans
-Chrome gets a scareware blockers
-Conti member extradited to US
-BlueSky to test dislike button
-arXiv will block AI slop in its computer science cateogry
-Iranian hackers leak Israeli defense contractor data
-Garden hacked for $10.8m
-CFPB ends Meta investigation
Newsletter: https://news.risky.biz/risky-bulletin-norway-skittish-of-its-chinese-electric-buses/
Podcast: https://risky.biz/RBNEWS499/
https://files.mastodon.social/media_attachments/files/115/485/055/658/214/796/original/666c8e5d5f5f7e0d.png

2025-11-02 00:11:30 GMT

Russian telecom operators are blocking calls and SMS messages used by Telegram and WhatsApp two-factor authentication service.
The blocking is also affecting new user account registrations
https://kod.ru/telegram-i-whatsapp-bez-sms

2025-10-31 09:31:23 GMT

-Russia arrests Meduza Stealer group
-L3Harris manager pleads guilty
-US hacked Venezuela in 2020
-Windows 11 Administrator Protection goes live
-Loads of ICS hacks in Canada
-New NSA & CyberCom chief favorites emerge
-APT behind Ribbon Communications breach
-US TP-Link ban getting closer
-FCC blocks additional Chinese gear
-FCC to vote down new telco cybersecurity rules
-Israel had a "winking system" with AWS and GCP
Podcast: https://risky.biz/RBNEWS498/
Newsletter: https://news.risky.biz/risky-bulletin-russia-arrests-meduza-stealer-group/
https://files.mastodon.social/media_attachments/files/115/468/072/648/826/419/original/549e2ddacc21e4b8.png

2025-10-30 19:47:44 GMT

Close to 90% of Windows Steam games can now run on Linux
https://boilingsteam.com/windows-games-compatibility-on-linux-is-at-a-all-time-high/
https://files.mastodon.social/media_attachments/files/115/464/841/650/294/309/original/e1dd75fd6a985d93.png

2025-10-30 14:35:41 GMT

The Israeli govt used a secret system with AWS and Google to get notifications when foreign courts requested Israeli data
The system used return-payments, where the sum started with the telephone dialing code of the country that requested data
https://www.theguardian.com/us-news/2025/oct/29/google-amazon-israel-contract-secret-code
https://files.mastodon.social/media_attachments/files/115/463/613/413/307/482/original/78dab98dd24d803d.png

2025-10-28 18:52:30 GMT

Socket Security has spotted 10 malicious npm packages.
The thing that stands out about them is the use of a CAPTCHA challenge in the npm CLI as they're being installed, most likely as a fake-out to convince victims they're installing a legitimate and actively maintained package.
https://socket.dev/blog/10-npm-typosquatted-packages-deploy-credential-harvester
https://files.mastodon.social/media_attachments/files/115/453/306/631/508/730/original/a3cadd1a2b731431.png

2025-10-28 13:35:39 GMT

Fifteen individuals are expected to plead guilty this month in Italy to a complex hacking and extortion scheme.
The individuals worked for Equalize, an Italian company that hacked government databases to create dossiers on the country's elite
https://www.politico.eu/article/italy-milan-hackers-carmine-gallo-enrico-pazzali-samuele-calamucci-equalize-mercury-advisors/

2025-10-28 12:40:07 GMT

lol
https://www.linkedin.com/feed/update/urn:li:activity:7386770853973147648/

2025-10-27 08:53:30 GMT

-Russian bill would require researchers to report bugs to the state/FSB
-WSUS bug under attack
-US charges poker hacking group
-Data breach at Iran's top hacking school
-Thailand revokes citizenship of scam-linked businessman
-WazirX resumes trading 15 months after hack
-Toys 'R' Us Canada breach
-FFTir breach
-Hack cost TfL £39m
-NNSA campus hacked
-TfL hackers trial set for Jun '26
-Russia's food safety watchdog hacked again
Newsletter: https://news.risky.biz/risky-bulletin-russian-bill-would-require-researchers-to-report-bugs-to-the-fsb/
Podcast: https://risky.biz/RBNEWS496/
https://files.mastodon.social/media_attachments/files/115/445/261/723/352/653/original/1d2e042da8f358ea.webp

2025-10-26 12:57:32 GMT

A ransomware attack against Transport for London at the start of September has cost the organization £39 million
Two teens were arraigned in court last Friday for it
https://www.bbc.com/news/articles/cj97ekz07ezo

2025-10-26 11:14:44 GMT

Ransomware payment rates have dropped below 25% for the first time in history.
Coveware says cyber defenders, law enforcement, and legal specialists should take this as a validation of their efforts.
https://www.coveware.com/blog/2025/10/24/insider-threats-loom-while-ransom-payment-rates-plummet
https://files.mastodon.social/media_attachments/files/115/440/175/247/120/696/original/795cbdefdc284567.png

2025-10-26 09:15:17 GMT

A new Microsoft Teams feature will let organizations track employees based on nearby WiFi networks.
According to privacy experts, the new feature will allow companies to crack down on workers who dodge return-to-office mandates.
https://www.microsoft.com/en-us/microsoft-365/roadmap?searchterms=488800

2025-10-21 09:33:50 GMT

The breach at American tech company F5 began in late 2023, far earlier than previously thought.
The hackers breached the company after exploiting its own products.
F5 staff allegedly failed to follow the cybersecurity guides it passed to customers.
https://www.bloomberg.com/news/articles/2025-10-18/hackers-had-been-lurking-in-cyber-firm-f5-systems-since-2023

2025-10-19 19:24:27 GMT

Lame excuse, mister criminal!
https://www.ft.com/content/6cfaa72b-67e2-4f48-9521-cb7262bf35d9
https://files.mastodon.social/media_attachments/files/115/402/464/672/261/341/original/d81957abddfc6c2d.png

2025-10-19 10:52:59 GMT

Ten....
Ten is the number of PR people who have reached out this month to ask me why I'm not covering their clients, when their customers block site scraping and don't have an RSS feed
It's the 19th. That means one PR person every 2 days writes to me to whine about shooting themselves in the foot

2025-10-17 12:08:25 GMT

- reply

Well, if Trump doesn't wanna give those Tomahawks to Ukraine, I know where to put them /s
https://files.mastodon.social/media_attachments/files/115/389/425/500/621/099/original/cf99a31b31095f86.png

2025-10-17 11:09:36 GMT

- reply

Vulnerability exploits and Risky Business... always reliable! 🫡
https://files.mastodon.social/media_attachments/files/115/389/194/233/826/781/original/019b06cc57760d7b.png

2025-10-17 06:56:15 GMT

Is the cyber mercenary interested in a used laptop at ten times the price too? 😆 :KEKW:
https://files.mastodon.social/media_attachments/files/115/388/196/988/531/910/original/9ec256186c64b95b.png

2025-10-16 17:02:30 GMT

The Tor Browser will remove all of the Firefox AI features that Mozilla has been recently adding
https://blog.torproject.org/new-alpha-release-tor-browser-150a4/

2025-10-16 10:33:00 GMT

MEP targeted by spyware files complaint against Hungary’s Viktor Orbán
“There are indications that the Hungarian secret service is behind the attack,” German MEP Daniel Freund said.
https://www.politico.eu/article/spyware-targeted-mep-sues-hungarys-viktor-orban/

2025-10-14 19:37:31 GMT

Synacktiv looks at LinkPro, a new Linux eBPF-based rootkit it found deployed on a customer's hacked AWS infrastructure
https://www.synacktiv.com/en/publications/linkpro-ebpf-rootkit-analysis

2025-10-14 13:26:21 GMT

Infosec drama, part 283,293: FuzzingLabs accuses Gecko Security of stealing two CVEs and backdating blogs
https://x.com/FuzzingLabs/status/1977720899114606745

2025-10-12 14:32:58 GMT

Trend Micro's ZDI has reported 13 vulnerabilities in the Ivanti Endpoint Manager that are still unpatched after the vendor requested an extension until March next year
https://www.zerodayinitiative.com/advisories/published/

2025-10-09 10:58:29 GMT

Azure outage on the way?
https://azure.status.microsoft/en-gb/status?_=07:40%20UTC%20on%2009%20Oct%202025
https://files.mastodon.social/media_attachments/files/115/343/852/037/330/053/original/6d38c604de8f29a6.png

2025-10-08 08:10:15 GMT

- reply

-EU companies sign open letter against Chat Control
-France investigates Apple over Siri recordings
-ICE to hire a social media investigations team
-ICE buys surveillance vans
-Pentagon cuts back cybersecurity training
-US thinking of reactivating anti-disinfo teams
-Netherlands asks citizens to update IoT devices
-Estonia trains Ukraine cyber specialists
-Russia temporarily blocks foreign SIMs
-Iran getting good at censoring internet traffic
https://files.mastodon.social/media_attachments/files/115/337/526/957/653/719/original/419db3249acdc104.png

2025-10-08 08:07:55 GMT

-Redis vulnerability impacts all versions released in the last 13 years
-Oracle zero-day used in recent extortion campaign
-New MSS front company discovered
-North Korean hackers have stolen $2 billion this year
-Medusa gang behind GoAnywhere attacks
-Abracadabra hacked for the third time
-DraftKings discloses another credential stuffing attack
-India's tax portal has a leak
-Google releases CodeMender
Podcast: https://risky.biz/RBNEWS488/
Newsletter: https://news.risky.biz/risky-bulletin-redis-vulnerability-impacts-all-versions-released-in-the-last-13-years/
https://files.mastodon.social/media_attachments/files/115/337/498/868/501/517/original/d1207ad73f89844d.png

2025-10-07 10:29:02 GMT

RediShell security flaw in Redis:
-remotely exploitable
-CVSSv3 10/10
-impacts all versions released over the past 13 years
-impacts 75% of cloud instances
https://www.wiz.io/blog/wiz-research-redis-rce-cve-2025-49844
https://redis.io/blog/security-advisory-cve-2025-49844/

2025-10-05 15:17:45 GMT

Gary Warner looks at "the Four Great Families" that ran most of the scam compound operations in Myanmar's Kokang region: https://garwarner.blogspot.com/2025/10/scam-compound-operators-members-of-four.html
China sentenced members from each family last week, with some receiving death sentences: https://news.risky.biz/risky-bulletin-scam-compound-operators-sentenced-to-death-in-china/

2025-10-05 11:20:11 GMT

An academic study found that LLMs were used to write almost a quarter of all corporate press releases
https://bsky.app/profile/dianecoyle1859.bsky.social/post/3m2bljmg3qs2l

2025-10-02 18:34:53 GMT

So... Chrome 141 is basically just security upgrade goodness... so much good stuff in there
-Origin Isolation (former Site Isolation, but stricter)
-new Digital Credentials API
-new feature to detect malicious extensions hijacking user searches
-21 security updates, largest batch yet

2025-09-30 16:32:04 GMT

South Korea has raised its national cyber alert level following a fire at a state data center.
The Caution level is the second in a four-tier system.
https://www.koreaherald.com/article/10586140https://www.koreaherald.com/article/10586140

2025-09-30 15:16:37 GMT

Looks like some Linux eBPF vulnerabilities presented at this year's Black Hat are made-up AI slop
https://www.openwall.com/lists/oss-security/2025/09/25/1

2025-09-30 10:43:21 GMT

Censys has spotted a phishing campaign targeting crypto-wallet owners that misunderstood how the robots.txt file works and thought that by adding the phishing pages to the file, security scanners would not be able to see and detect them.
https://censys.com/blog/disallow-security-research-crypto-phishing-sites-failed-attempt-to-block-investigators

2025-09-25 13:40:09 GMT

More than 10,600 Ollama LLM-hosting servers are exposed on the internet: https://censys.com/blog/ollama-drama-investigating-the-prevalence-of-ollama-open-instances-with-censys
Almost 4,800 Firebase databases exposed on the internet and leaking their data: https://ice0.blog/docs/openfirebase

2025-09-25 10:26:13 GMT

Here's some crypto-stealing malware on Rust's Crates package repo.... just in case you're waiting for the PyPI and npm ones to show up
https://blog.rust-lang.org/2025/09/24/crates.io-malicious-crates-fasterlog-and-asyncprintln/
https://socket.dev/blog/two-malicious-rust-crates-impersonate-popular-logger-to-steal-wallet-keys

2025-09-23 17:00:44 GMT

Poland has threatened to hack back any country that cripple its critical infrastructure.
Minister of Digital Affairs Krzysztof Gawkowski says the country has the possibilities to respond.
https://www.portalsamorzadowy.pl/polityka-i-spoleczenstwo/minister-cyfryzacji-polska-nie-padla-ofiara-sobotniego-cyberataku-ale-mamy-zdolnosci-skutecznego-ich-odpierania,630395.html

2025-09-23 12:13:19 GMT

The press release for that Secret Service UN SIM farm raid is here: https://www.secretservice.gov/newsroom/releases/2025/09/us-secret-service-dismantles-imminent-telecommunications-threat-new-york
Some images are below:
https://files.mastodon.social/media_attachments/files/115/253/547/701/981/603/original/7988e138bc020bcc.png
https://files.mastodon.social/media_attachments/files/115/253/547/870/870/473/original/3cdbbfaf788250b6.png

2025-09-20 20:44:34 GMT

There's been a hostile takeover of the RubyGems package repository, with some rando dude having full control of everything now
https://old.reddit.com/r/ruby/comments/1nkzszc/comment/nf1tn1d/
https://files.mastodon.social/media_attachments/files/115/238/571/939/718/386/original/64fbe2d823ef1a25.png

2025-09-20 11:38:11 GMT

Cyberattack disrupts European airports including Heathrow, Brussels
https://www.reuters.com/en/cyberattack-causes-flight-delays-cancellations-brussels-airport-2025-09-20/

2025-09-18 00:15:40 GMT

That Shai-Hulud npm worm has now reached 500 packages: https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages
Also, doesn't seem to run on Windows (via Step Security)
https://files.mastodon.social/media_attachments/files/115/222/415/862/700/294/original/a9cc0b19dbdef642.png

2025-09-16 16:16:37 GMT

- reply

This should be a CYBERWARCON admittance test.
List all the APT28 aliases in alphabetical order while standing on a foot and touching your nose!

2025-09-16 16:13:50 GMT

APT28 has "no fewer than 28 aliases"
Nice job, infosec!
https://blog.sekoia.io/apt28-operation-phantom-net-voxel/
https://files.mastodon.social/media_attachments/files/115/214/856/682/662/878/original/acd09cbf3c68bfe7.png

2025-09-16 15:54:05 GMT

Infoblox linked an ad fraud botnet named Vane Viper to a Cyprus-based AdTech Holding, which owns PropellerAds
The company claims that despite becoming one of the largest ad networks in the world, PropellerAds is an accidental front for its real purpose—ad fraud
https://blogs.infoblox.com/threat-intelligence/deniability-by-design-dns-driven-insights-into-a-malicious-ad-network/

2025-09-12 22:38:32 GMT

The "ShinyHunters/ScatteredSpider/LAPSUS$" group (or whatever name they claim to have) announced they would retire... and then immediately post a screengrab from a DOJ portal
Tempting fate, I see
https://databreaches.net/2025/09/11/going-dark-shinyhunters-scatteredspider-lapsus-say-goodbye/
https://files.mastodon.social/media_attachments/files/115/193/717/426/415/217/original/3c17c98e4622baa5.png

2025-09-11 20:33:04 GMT

A university campus in Amsterdam has shut down its laundry room after its five smart washing machines were hacked in July.
Students were able to wash clothes for free for months, but the campus is now declining to cover the washing costs.
https://www.folia.nl/nl/actueel/167893/wasmachines-spinozacampus-gehackt-duwo-wil-niet-opdraaien-voor-kosten

2025-09-09 15:46:00 GMT

New Salesloft Drift victims disclosed:
-Qualys: https://blog.qualys.com/misc/2025/09/06/salesloft-drift-supply-chain-incident
-Dynatrace: https://www.dynatrace.com/news/blog/salesloft-drift-incident-dynatraces-response/
-Fastly: https://www.fastlystatus.com/incident/377884

2025-09-09 09:41:36 GMT

More than 500 researchers from 34 countries published an open letter against the EU's proposed Chat Control regulation
https://csa-scientist-open-letter.org/Sep2025

2025-09-07 18:46:47 GMT

There are many reasons why you never see Cyble in my newsletter... and this is one of them
Now taking down security research on behalf of big corps
https://bobdahacker.com/blog/rbi-hacked-drive-thrus/
Wayback Machine of original research: https://web.archive.org/web/20250906150322/https://bobdahacker.com/blog/rbi-hacked-drive-thrus/
https://files.mastodon.social/media_attachments/files/115/164/499/185/990/651/original/b3a195844c2c26d9.png

2025-09-03 23:13:12 GMT

Would it have been ok if it was same-race? 🫣
Also... wtf is going on at the DHS with these press releases...
https://files.mastodon.social/media_attachments/files/115/142/889/766/319/057/original/4f6a8fe7ef482c6a.png

2025-09-02 11:14:22 GMT

Talks from the Positive Hack Days 2025 security conference, which took place in May, are available on YouTube.
PHDays is Russia's largest cybersecurity conference, and all the talks are in Russian.
https://www.youtube.com/@positiveevents5242/playlists

2025-09-02 10:46:35 GMT

Your company just got hacked! What do you do?

2025-09-01 22:59:37 GMT

TP-Link failed to patch a vulnerability in its routers for more than a year.
The bug is in a protocol that allows ISPs to manage routers deployed at customer premises, also known as CWMP or TR-069.
TP-Link was notified of the bug in May last year.
https://medium.com/@mehrrun/zero-day-alert-automated-discovery-of-critical-cwmp-stack-overflow-in-tp-link-routers-0bc495a08679

2025-08-29 16:11:09 GMT

Meta says it patched a zero-click exploit (CVE-2025-55177) that appears to have been used together with a recent iOS zero-day (CVE-2025-43300)
https://www.whatsapp.com/security/advisories/2025/
https://files.mastodon.social/media_attachments/files/115/112/925/624/834/067/original/c9f963b88cb1f558.png

2025-08-27 21:02:13 GMT

A novel npm supply chain attack used hidden prompts to instruct local AI CLI tools to find and exfiltrate credentials and crypto-wallet keys
~1,400 users got hacked this way
https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware
https://www.wiz.io/blog/s1ngularity-supply-chain-attack
https://socket.dev/blog/nx-packages-compromised

2025-08-27 19:45:25 GMT

He prolly crashed it to get out of the meeting
https://files.mastodon.social/media_attachments/files/115/102/443/431/924/029/original/abfbab373dc75f71.png

2025-08-26 13:30:56 GMT

- reply

so... the DeelbXirtic vulnerability?

2025-08-24 11:40:16 GMT

Threat intelligence analyst Marco A. De Felice has published an interview with the "legal department" of the Qilin ransomware group. It's quite the laugh.
https://www.suspectfile.com/qilin-and-their-alleged-legal-department-criminal-propaganda-disguised-as-legitimacy/
https://files.mastodon.social/media_attachments/files/115/083/548/274/135/680/original/fb3b16d0e106d254.png

2025-08-21 13:03:34 GMT

LOL: Europol Says Qilin Ransomware Reward Fake
https://www.securityweek.com/europol-says-qilin-ransomware-reward-fake/

2025-08-20 22:33:09 GMT

After Orange Romania and Orange France... Orange Belgium had a breach this year too:
https://corporate.orange.be/nl/node/57971

2025-08-19 17:52:49 GMT

Europol is offering a $50,000 reward for information on two administrators of the Qilin ransomware group:
-Haise
-XOracle
https://the420.in/europol-reward-qilin-ransomware-investigation/

2025-08-19 12:38:43 GMT

Security researcher Eaton Zveare has discovered two ways to break into Intel backend systems and even more ways to dump and exfil the data of all Intel employees
https://eaton-works.com/2025/08/18/intel-outside-hack/