Catalin Cimpanu

Cybersecurity reporter for Risky Business

#infosec #cybersecurity #security

Public Key

npub1tqfukrqgh928vktkl6vx063ck2c4yn3ek8m44v3txfhztqe65anq63aefw

NIP-05 Address

Profile Code

nprofile1qqs9sy7tpsytj4rkt9m0axr8agut9v2jfcumra66kg4nym39sva2wespz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds50z7ck

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1tqfukrqgh928vktkl6vx063ck2c4yn3ek8m44v3txfhztqe65anq63aefw

Show more details

Last Notes

2026-04-02 20:20:03 UTC

Squiblydoo has released the CertGraveyard, a centralized place to document the abuse of code-signing certificates
https://certgraveyard.org/
https://squiblydoo.blog/2026/04/01/the-certgraveyard/

2026-04-02 20:06:36 UTC

Node.js pauses bug bounty program after a funding lapse
They were sponsored by IBB, a program funded by Microsoft, Meta, Adobe, and a bunch of other tech giants
Unclear what happened there
https://nodejs.org/en/blog/announcements/discontinuing-security-bug-bounties

2026-04-02 18:42:06 UTC

CERT-EU confirms the recent EU breach is ShinyHunters
The group claimed the hack on its dark web portal shortly after it happened
https://cert.europa.eu/blog/european-commission-cloud-breach-trivy-supply-chain

2026-04-02 18:20:16 UTC

The Russian government is set on killing smaller ISPs that have historically failed to censor content and deploy SORM equipment
New rules will give the Ministry of Digital Development the power to revoke licenses without a court order
https://www.rbc.ru/society/02/04/2026/69ce37f49a79479bcb0ecf35

2026-04-02 17:04:38 UTC

New DPRK hacking technique dropped:
"By weaponizing VS Code's tasks.json auto-execution feature, attackers have created a scenario where simply opening a cloned repository in your IDE can compromise your system. No user interaction required beyond a git clone and opening the folder.
https://opensourcemalware.com/blog/tasksjacker-blog-post

2026-04-02 13:56:36 UTC

According to Recorded Future, a skimmer kit known as Sniffer by Fleras was responsible for a quarter of all e-skimmer incidents last year
https://www.recordedfuture.com/blog/industrialization-of-the-fraud-ecosystem-blog
https://files.mastodon.social/media_attachments/files/116/335/456/036/272/351/original/6c65d46e2c31cfe2.webp

2026-04-02 13:40:44 UTC

Cloud security firm Permiso has released SandyClaw, a tool that scans OpenClaw skills and assesses their safety
https://sandyclaw.permiso.io/

2026-04-02 12:57:15 UTC

A new Android malware strain named God Mode is spreading across India distributed via messenger spam and disguised as apps for government services, Indian banks, and utility services
https://the420.in/nctau-android-god-mode-malware-accessibility-permission-cyber-fraud-advisory/
PDF: https://i4c.mha.gov.in/theme/resources/advisories/ADVISORY%20TAU-ADV-012-%20Android%20GOD%20Mode%20Advisory.pdf

2026-04-02 12:56:17 UTC

CheckMarx has spotted new VS Code extensions spreading GlassWorm, in what appears to be the umpteenth flare-up of this campaign
https://checkmarx.com/zero-post/glassworm-targets-developer-ides-again-hiding-staged-malware-behind-runtime-rebuilt-loaders/acc

2026-04-02 10:39:00 UTC

The Qilin ransomware group appears to be running the most powerful EDR killer available today, with the capability to terminate over 300 different EDR drivers from almost every vendor in the market
https://blog.talosintelligence.com/qilin-edr-killer/

2026-04-02 00:34:41 UTC

Following a series of supply chain attacks on GitHub that originated from the abuse of GitHub Actions, GitHub says it is now accelerating the rollout of some Actions security features from its 2026 roadmap.
https://github.blog/security/supply-chain-security/securing-the-open-source-supply-chain-across-github/

2026-04-01 23:58:32 UTC

Google will now let you change your username
https://blog.google/products-and-platforms/products/workspace/google-account-username-change/

2026-04-01 22:52:58 UTC

Axios project admin Jason Saayman says he lost access to the project through a social engineering attack where a threat actor lured him to collaborate on another project but infected him with malware that stole cookies, tokens, and credentials from his system
https://github.com/axios/axios/issues/10604#issuecomment-4167784086

2026-04-01 09:13:44 UTC

-Iranian password sprays came first, then the missiles
-Encryption-breaking quantum computers expected within a decade
-npm package Axios got hacked
-Flint24 hackers sentenced to prison in Russia
-Claude source code leaks
-ECH is now RFC 9849
-C++26 is done
-New Aliro security access standard
-Android developer verification rolls out
-Google Workspace ransomware protection is GA
-Major GDPR fine in Italy
Podcast: https://risky.biz/RBNEWS545/
Newsletter: https://news.risky.biz/risky-bulletin-iranian-password-sprays-came-first-then-came-the-missiles/
https://files.mastodon.social/media_attachments/files/116/328/673/150/247/606/original/3d8767bce43552e7.png

2026-03-31 18:57:35 UTC

Email: Google links the Axios supply chain incident to UNC1069 (and not TeamPCP)

2026-03-31 18:50:16 UTC

Suspected Chinese APT leverages a TrueConf zero-day
https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets/
https://files.mastodon.social/media_attachments/files/116/325/286/904/276/623/original/38bf5dd1a7f5558b.png

2026-03-31 17:28:09 UTC

A new standard will allow users to pass identity checks and enter secure buildings using their smartphones and smart wearable devices.
The Aliro standard was released by the Connectivity Standards Alliance and has the backing of vendors like Apple, Google, and Samsung
https://csa-iot.org/newsroom/introducing-aliro-1-0-a-unified-standard-to-transform-the-access-control-ecosystem/

2026-03-31 17:11:43 UTC

Check Point says an Iranian password-spraying campaign targeted municipalities and agencies that respond to missile strikes across the Middle East... then the missiles strikes came after
https://blog.checkpoint.com/research/iran-nexus-password-spray-campaign-targeting-cloud-environments-with-a-focus-on-the-middle-east/

2026-03-31 13:48:21 UTC

Claude's source code has leaked via npm
https://xcancel.com/Fried_rice/status/2038894956459290963

2026-03-31 13:22:52 UTC

Czech journalists claim to have identified another local company part of the Intellexa umbrella—Czech Sigi Consulting. The company's CEO was Juval Rabin, the son of former Israeli PM Yitzhak Rabin.
https://www.investigace.cz/ceska-firma-intellexa-predator-spyware/

2026-03-31 11:46:28 UTC

Ohh... so this is why the FCC banned foreign made routers... it's RFKjr's fault! /sarcasm
https://files.mastodon.social/media_attachments/files/116/323/620/456/886/243/original/4ab81af02ad45bce.png

2026-03-31 11:19:47 UTC

So, while I was looking to refine my Google search results and remove AI garbage news sites, I found that you can now tell Google to rank preferred sources above other results
https://www.google.com/preferences/source?q=risky.biz
https://files.mastodon.social/media_attachments/files/116/323/515/361/961/326/original/47f278522738dd0f.png

2026-03-31 11:06:57 UTC

Magento online stores are being targeted using a recently patched vulnerability known as PolyShell.
According to Sansec, attacks have entered the mass-exploitation phase, with hundreds of stores being hacked every hour.
https://sansec.io/research/polyshell-mass-attack-wave

2026-03-31 10:52:58 UTC

My favorite thing to do over the past months has been to watch Battlefield players and content creators slowly realize that EA, a company known for its predatory p2w games, has turned BF6 into a pay-to-win game
I love watching people slowly falling into despair
https://www.youtube.com/watch?v=tizFmlUvkms

2026-03-31 10:40:52 UTC

A group of North Korean hackers engaged in Contagious Interview campaigns left one of their web consoles exposed on the internet
https://opensourcemalware.com/blog/contagious-interview-comprehensive
https://files.mastodon.social/media_attachments/files/116/323/361/673/560/920/original/fddabeeab90161c8.png

2026-03-31 09:25:30 UTC

One of the most popular JavaScript packages on earth Axios has been compromised
https://opensourcemalware.com/blog/axios-compromised

2026-03-31 00:44:13 UTC

Sekoia looks at a new Phishing-as-a-Service platform named EvilTokens that has been spotted running campaigns since February.
The platform is one of the few that can run device-code phishing operations against Microsoft accounts, so expect this to become very popular in the coming months.
https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/
https://files.mastodon.social/media_attachments/files/116/321/016/295/703/285/original/ba502cfedb390844.png

2026-03-31 00:35:03 UTC

The ISO C++ committee has completed work on the C++26 specification of the C++ programming language.
This will be the biggest overhaul to C++ since the 2011 specification.
https://herbsutter.com/2026/03/29/c26-is-done-trip-report-march-2026-iso-c-standards-meeting-london-croydon-uk/

2026-03-31 00:34:23 UTC

Lorenzo Meacci introduces InsomniacUnwinding, a new technique to hide and sleep malicious code, even from EDR solutions that continuously scan the memory for malicious code
https://lorenzomeacci.com/unwind-data-cant-sleep-introducing-insomniacunwinding

2026-03-30 23:57:01 UTC

CNET is being brought back after the AI articles fiasco
https://www.linkedin.com/posts/david-katzmaier_news-activity-7443045961079160832-YJND/

2026-03-30 23:44:57 UTC

Apple Pay got informally banned in Russia
Starting April 1, Russians won't be able to replenish their Apple ID balances using Russian mobile accounts
https://www.rbc.ru/technology_and_media/30/03/2026/69c913a59a7947e96157b311

2026-03-30 23:14:13 UTC

Despite losing the US and EU market, Kaspersky reported a record revenue of $836 million last year
https://www.kaspersky.ru/about/press-releases/laboratoriya-kasperskogo-predstavila-novyj-rekord-po-razmeru-globalnoj-vyruchki

2026-03-29 19:11:36 UTC

Telegram says it is not affected by a supposed zero-day in its IM client that can be exploited to run malicious code via a malicious custom sticker
https://x.com/telegram/status/2038069726316834994
https://www.zerodayinitiative.com/advisories/upcoming/
https://files.mastodon.social/media_attachments/files/116/314/045/967/870/964/original/8f0495471d65fe24.png

2026-03-29 15:07:53 UTC

Security firm Cybereason has open-sourced owLSM, an EDR-like agent for Linux, an eBPF LSM agent to run Sigma rules
https://github.com/Cybereason-Public/owLSM

2026-03-29 00:56:09 UTC

The Balancer DeFi platform has shut down after hackers stole $110 million last November
https://forum.balancer.fi/t/on-the-future-of-balancer-shutting-down-balancer-labs-supporting-the-path-forward/7002/2

2026-03-28 22:55:21 UTC

If the Trivy, RICS, and LiteLLM incidents have confused you, the team at OpenSourceMalware has published a profile of TeamPCP, the group behind the larger attack (as well on how the attack was carried out)
https://opensourcemalware.com/blog/teampcp-supply-chain-campaign
https://files.mastodon.social/media_attachments/files/116/309/263/654/545/890/original/787c9c8fa5beb3e2.jpeg

2026-03-28 21:50:38 UTC

Apparently, BreachForums had a v5 revival this month and it got immediately hacked by ShinyHunters
https://files.mastodon.social/media_attachments/files/116/309/008/820/961/477/original/21fff365d56857f6.png

2026-03-28 17:12:20 UTC

Censys has discovered a custom-built post-exploitation framework.
Named CTRL, the framework is coded in .NET, was used in the wild, and appears to be the work of a Rsusian-speaking developer
https://censys.com/blog/under-ctrl-dissecting-a-previously-undocumented-russian-net-access-framework/

2026-03-27 10:21:29 UTC

-Russia to use custom crypto in 5G network
-Orban government accused of using Candiru spyware
-Coruna tied to Triangulation
-Malware found on thousands of Luxembourg government phones
-More advanced BPFdoor versions spotted
-Dutch Police disclose breach
-Ajax leaks supporters' details
-Cyberattack hits Puerto Rico govt
-Ransomware at Vigo port
-Politico investigates possible hack
-50 data-wiping incidents reported in Israel
Podcast: https://risky.biz/RBNEWS543/
Newsletter: https://news.risky.biz/risky-bulletin-russia-to-use-custom-crypto-algorithm-for-its-5g-network/
https://files.mastodon.social/media_attachments/files/116/300/612/001/506/782/original/7b84921577543b27.png

2026-03-26 21:59:20 UTC

Ryan Moran has published profiles on members of the Cl0p (former ransomware) data extortion gang
This includes j0nny, AELS, Baddie, Rastafareye, and orlylyly
https://rmoskovy.github.io/posts/who-runs-clop-ransomware-investigation/
https://files.mastodon.social/media_attachments/files/116/297/718/787/438/370/original/4fe110c831cc52b1.png

2026-03-26 21:40:35 UTC

A newly launched ransomware group has listed Chinese hardware vendor Hikvision on its dark web leak site
https://files.mastodon.social/media_attachments/files/116/297/644/997/718/260/original/62d7b13a368dd23d.png

2026-03-26 20:53:22 UTC

EU Chat Control vote fails again
https://howtheyvote.eu/votes/189270

2026-03-26 20:41:40 UTC

Dutch Police disclose breach from phishing incident
https://www.politie.nl/nieuws/2026/maart/25/00-politie-doelwit-van-phishing.html

2026-03-26 20:26:53 UTC

Russian security firm F6 has spotted a new trend in Russia where online fraud and scam groups are targeting children, social-engineering them into taking photos of their parents' e-banking apps and verification codes in exchange for in-game currencies.
https://www.f6.ru/media-center/press-releases/roblox-fraud/

2026-03-26 19:57:56 UTC

Rapid7 links BPFDoor deployments on telco networks to Chinese APT Red Menshen
https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/

2026-03-26 19:43:17 UTC

Four former high-ranking NSA officials warned that the US is losing its advantage in cyberspace as the government is failing to keep up with foreign adversaries
The four cited "brain drain" across the public sector and disintegrating relations with the private sector
https://cyberscoop.com/former-nsa-chiefs-offensive-edge-rsac/

2026-03-26 19:38:55 UTC

Data-wiping attacks were reported at 50 Israeli organizations
Attacks were linked to 20 different groups
https://www.israelnationalnews.com/news/424483

2026-03-26 19:19:53 UTC

Security firm Palo Alto Networks says a threat actor is impersonating its recruiters in a phishing campaign
https://unit42.paloaltonetworks.com/phishing-attackers-pose-as-panw-recruiters/

2026-03-26 18:08:20 UTC

Elastic's security team has come across "a data dump containing source code, compiled binaries, and deployment scripts for the kernel rootkit components of VoidLink, a cloud-native Linux malware framework first documented by Check Point Research in January 2026."
https://www.elastic.co/security-labs/illuminating-voidlink

2026-03-26 16:29:50 UTC

The WikiMedia Foundation has banned editors from using AI tools to write or rewrite Wikipedia articles
https://en.wikipedia.org/wiki/Wikipedia:Writing_articles_with_large_language_models

2026-03-26 15:41:16 UTC

That hack of the National Super Computer Center of China (NSCC) is becoming more real by the day
"the overall details we received so far seem like that this operation is more in the realm of "real” than “fake"."
https://netaskari.substack.com/p/nscc-hack-update

2026-03-26 15:28:13 UTC

Cisco now has semiannual security updates for IOS and IOS XE
"In direct response to customer feedback, Cisco releases bundles of Cisco IOS and IOS XE Software Security Advisories on the fourth Wednesday of the month in March and September of each calendar year."
https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75297

2026-03-26 15:17:37 UTC

Redline infostealer developer was extradited to the US this week
https://www.justice.gov/usao-wdtx/pr/armenian-man-extradited-us-faces-charges-role-infostealing-malware-scheme

2026-03-26 14:22:10 UTC

Russian intelligence managed to install a wire-taping device as part of a thermostat at a Ukrainian drone factory
https://en.interfax.com.ua/news/general/1153997.html

2026-03-26 13:26:17 UTC

Hungarian opposition leader Peter Magyar has accused the ruling government of using the Candiru spyware against his TISZA party
https://x.com/magyarpeterMP/status/2037113263238840702
https://files.mastodon.social/media_attachments/files/116/295/697/852/716/494/original/c28c56c105a223e4.png

2026-03-26 10:24:23 UTC

Kaspersky ties Operation Triangulation to Coruna exploit kit
https://securelist.com/coruna-framework-updated-operation-triangulation-exploit/119228/

2026-03-26 01:44:54 UTC

Probably the best account on Instagram right now: https://www.instagram.com/reel/DWVBRGZolJp/
You're welcome!

2026-03-26 01:26:35 UTC

The EU and Chat Control is like a toddler insisting they want to touch the hot stove
#nevent1q…el5h

2026-03-26 01:10:06 UTC

Infosec news cycle:
CVE is in danger
CVE is saved
CVE is in danger
CVE is saved
CVE is in danger
CVE is saved
CVE is in danger
CVE is saved
CVE is in danger
CVE is saved
CVE is in danger
CVE is saved
CVE is in danger
CVE is saved
CVE is in danger
CVE is saved
CVE is in danger
CVE is saved

2026-03-25 23:45:58 UTC

Soccer/football club Ajax Amsterdam leaked supporters' personal data, including stadium bans
https://www.ajax.nl/artikelen/informatie-over-datalek-bij-ajax/

2026-03-25 22:54:19 UTC

The Russian government will expand the bandwidth of its national firewall system to 954 Tbps
The new bandwidth will be rolled out by 2030 and will be 2.5 times than what the system can handle today
https://www.kommersant.ru/doc/8533998

2026-03-25 19:02:19 UTC

TA551 operator sentenced to two years in prison
The group was also known as Shathak, GOLD CABIN, Monster Libra, ATK236, and G0127.
They used malware such as Qakbot, IcedID, and Ursnif.
https://www.justice.gov/usao-edmi/pr/russian-cybercriminal-sentenced-prison-using-botnet-steal-millions-american-businesses

2026-03-25 10:46:24 UTC

-The Intellexa CEO is pissed!!!
-Google launches threat disruption unit
-German police visit companies in the dead of night about software bugs
-FTC bans all foreign-made routers
-Firefox now has a built-in VPN
-Breach at the Dutch Ministry of Finance
-Hackers breach South Korea's top lender
-Breaches also at Mazda, Crunchyroll, HackerOne, InfiniteCampus
-Resolv hacked for $25m
-CSAM at record levels online
Podcast: https://risky.biz/RBNEWS542/
Newsletter: https://news.risky.biz/risky-bulletin-the-intellexa-ceo-is-pissed/
https://files.mastodon.social/media_attachments/files/116/289/399/091/022/059/original/28696f433c2394a2.png

2026-03-24 19:05:21 UTC

That drama between Intellexa and the Greek government has finally escalated
Intellexa CEO Tal Dilian has accused Greek officials of a criminal conspiracy to frame him and his staff for their illegal spying
He says he's willing to testing in court and at the UN about the Greek government's abuses
https://insidestory.gr/article/dilosi-dilian-intellexa-predator

2026-03-24 16:08:52 UTC

What the actual hell! German police knocked on people's doors at 3am to warn them about unpatched vulnerabilities in some no-name software?
Ha?!?!?!
https://www.heise.de/en/news/WTF-Police-responded-on-Saturday-night-due-to-a-zero-day-11221590.html

2026-03-24 15:44:03 UTC

An assistant professor at University College Dublin has been accused of hacking more than 140 of his students
He is accused of installing malware in the university campus and offices that collected passwords
https://www.thejournal.ie/university-college-dublin-ucd-cyber-hack-data-breach-malware-6990279-Mar2026/

2026-03-24 15:13:42 UTC

It's ok. I'm sure the US tech bros will find a way to blame this on EU regulations by the end of the day
#nevent1q…qlzs

2026-03-24 15:11:30 UTC

Mozilla has released Firefox 149
The biggest feature in this release is the addition of a built-in VPN service and support for Split View-ing tabs
https://files.mastodon.social/media_attachments/files/116/284/790/258/251/574/original/4c31b6fb57a0dcf4.png
https://files.mastodon.social/media_attachments/files/116/284/790/275/828/740/original/6c580a1823b1aebe.png

2026-03-24 14:32:10 UTC

Sansec has discovered a novel web skimmer that steals credit card form data from infected e-stores using a hidden WebRTC channel
https://sansec.io/research/webrtc-skimmer

2026-03-24 11:58:02 UTC

After Aqua Security's Trivy vulnerability scanner got hacked last week, security firm Checkmarx says its KICS code scanner was also hacked
🫣
https://checkmarx.com/blog/checkmarx-security-update/

2026-03-24 11:40:09 UTC

In the wake of our last newsletter edition, Netskope found more malware uploaded and disguised as legit GitHub repos. What a surprise!
https://www.netskope.com/blog/openclaw-trap-ai-assisted-lure-factory-targets-developers-gamers
https://news.risky.biz/risky-bulletin-github-is-starting-to-have-a-real-malware-problem/
https://files.mastodon.social/media_attachments/files/116/283/957/227/578/426/original/770057198624bed3.png
https://files.mastodon.social/media_attachments/files/116/283/958/387/262/051/original/0f4f5d167d0c5f46.png

2026-03-24 10:53:02 UTC

So... rage-baiting rules the world these days?
https://www.bbc.com/news/articles/cqj9kgxqjwjo
https://files.mastodon.social/media_attachments/files/116/283/773/973/068/602/original/605bcbc7ee7ddd1c.png

2026-03-24 10:38:55 UTC

A quarter of disinfo content last year used genAI tools, becoming a routine task for operators after previously experimenting with the tech in previous years
https://www.eeas.europa.eu/eeas/4th-eeas-annual-report-foreign-information-manipulation-and-interference-threats_en

2026-03-24 10:25:50 UTC

Apparently there's been a Citrix security update yesterday: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300
Something changed on their website. Is there an RSS feed or URL that I can scan for security updates now?

2026-03-24 02:53:54 UTC

Yanluowang ransomware affiliate sentenced to 81 months
https://www.justice.gov/opa/pr/russian-citizen-sentenced-prison-hacking-us-companies-and-enabling-major-cybercrime-groups

2026-03-24 02:24:52 UTC

Russia is using "COVID" as excuse to block public protests for "free internet"
https://meduza.io/news/2026/03/23/v-podmoskovie-zapretili-mitingi-za-svobodnyy-internet-vam-nelzya-potomu-chto-kovid

2026-03-24 00:22:22 UTC

Dutch Ministry of Finance got hacked
https://www.rijksoverheid.nl/actueel/nieuws/2026/03/23/ministerie-van-financien-onderzoekt-ongeautoriseerde-toegang-tot-systemen

2026-03-23 21:06:50 UTC

These hacks in South Korea aren't slowing down.
Now, it's the country's largest lender:
https://biz.chosun.com/en/en-finance/2026/03/22/QN57OMWVMJG6BP6VIBN6IA42XI/

2026-03-23 10:13:34 UTC

-GitHub is starting to have a real malware problem
-Russian intelligence services compromise thousands of Signal accounts
-Trivy vulnerability scanner compromised for supply chain attack
-FBI takes down Aisuru, Kimwolf botnets
-Ransomware shuts down California city
-Europol takes down CSAM netwrok\
-Three sentenced for helping DPRK IT workers
-ClayRAT author detained in Russia
-Music streamer fraudster pleads guilty
Newsletter: https://news.risky.biz/risky-bulletin-github-is-starting-to-have-a-real-malware-problem/
Podcast: https://risky.biz/RBNEWS541/
https://files.mastodon.social/media_attachments/files/116/277/948/779/024/281/original/00d05f0355e7c7ef.png

2026-03-22 16:26:27 UTC

Russian authorities have arrested a student from the city of Krasnodar for developing the ClayRAT Android spyware
https://rt-solar.ru/solar-4rays/blog/6472/

2026-03-22 15:27:43 UTC

NetAskari believes a recent hack and leak from China's National Super Computer Center of China (NSCC) might be real
https://netaskari.substack.com/p/chinas-massive-data-leak-of-military

2026-03-22 14:46:16 UTC

The Tycoon2FA phishing service has restored its server infrastructure after a law enforcement takedown at the start of the month.
Phishing activity is now at pre-takedown levels, according to CrowdStrike telemetry
https://www.crowdstrike.com/en-us/blog/tycoon2fa-phishing-as-a-service-platform-persists-following-takedown/

2026-03-22 12:01:18 UTC

A vulnerability in a Linux enterprise app can allow attackers root access over devices
The issue impacts Himmelblau, an interoperability suite to integrate Linux with Entra ID and Intune networks.
https://www.akamai.com/blog/security-research/2026/mar/cve-2026-31979-symlink-root-privilege-escalation-himmelblau

2026-03-22 11:13:41 UTC

Internet's outage has now reached 3 weeks, is state-mandated and not a result of the strikes, per new reports
https://www.kentik.com/blog/internet-and-airstrikes-tracking-irans-extended-communication-blackout/
https://krypt3ia.wordpress.com/2026/03/16/intelligence-assessment-report/
PDF: https://insights.nccgroup.com/l/898251/2026-03-19/31myn1q/898251/1773936226AmWpHs8F/Middle_East_Crisis_Cyber_Update_19_03_2026.pdf

2026-03-22 10:52:16 UTC

Foster City in California has shut down all public services after a ransomware attack last week
https://www.fostercity.org/community/page/foster-city-services-impacted-cyber-security-breach

2026-03-22 10:45:19 UTC

A popular open-source vulnerability scanner (Trivy) was compromised last week in a supply chain attack
https://www.aquasec.com/blog/autonomous-runtime-security-turning-runtime-intelligence-into-agentic-response-2/
https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise
https://github.com/aquasecurity/trivy/discussions/10425
https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise
https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release
https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack
https://www.crowdstrike.com/en-us/blog/from-scanner-to-stealer-inside-the-trivy-action-supply-chain-compromise/

2026-03-21 20:10:25 UTC

I went down a rabbit hole for Monday's newsletter and I'm still falling
Why does there have to be so much malware on GitHub... lol

2026-03-21 12:03:30 UTC

Google search results are now more dangerous than torrent sites
#nevent1q…7qq8

2026-03-20 22:18:15 UTC

Android will require a 24-hour wait before sideloading apps
https://android-developers.googleblog.com/2026/03/android-developer-verification.html

2026-03-20 21:39:37 UTC

LOL... did they ever?
https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/4chan-fined-450000-for-not-protecting-children-from-online-pornography
https://files.mastodon.social/media_attachments/files/116/263/667/392/014/075/original/7eb60a7ffe8cc21e.png

2026-03-20 15:48:39 UTC

Oracle issues an out-of-band security update for a pre-auth RCE in Oracle Identity Manager
https://www.oracle.com/security-alerts/alert-cve-2026-21992.html

2026-03-20 09:07:50 UTC

- reply

-Hacker leaks law enforcement tips platform
-ODNI releases annual threat assessment
-Patel admits buying US citizens' data
-Azure got FedRAMP approval despite issues
-FBI seizes Handala websites
-29m secrets leaked last year
-Interlock ransomware had a Cisco zero-day
-New Keitaro TDS
-Apple pushes a background security update
-Beast ransomware returns
-APT28 behind new Zimbra bug
-Unpatched telnet and IP KVM bugs
-Ubiquiti patches 10/10 bug
-Kaspersky researcher Sergey Mineev passes away
https://files.mastodon.social/media_attachments/files/116/260/695/689/360/889/original/bce58df15ae8881a.webp

2026-03-20 09:03:45 UTC

-AWS kills bucketsquatting
-Second iOS hacking framework found in the wild
-Belgium launches its own secure app
-Cyberattack cripples car breathalyzers in the US
-1/5 suspended Telegram channels are cybercrime related
-Fake security firm linked to crypto-heists
-Venus Protocol hacked for $3.6m
-Bitrefill blames North Korea for hack
-Japan active cyber defense to begin in Oct
-Congress seeks private comms of EU officials
Podcast: https://risky.biz/RBNEWS540/
Newsletter: https://news.risky.biz/risky-bulletin-aws-kills-bucketsquatting/
https://files.mastodon.social/media_attachments/files/116/260/686/313/920/443/original/06c2c61b805aebaa.jpg

2026-03-19 20:00:04 UTC

Gen Digital has spotted the VoidStealer infostealer using a new method to bypass Chrome's credentials encryption system to steal passwords and cookies
"The technique relies on attaching to the browser process as a debugger and setting breakpoints at carefully selected locations to extract the v20_master_key directly from the browser process memory."
https://www.gendigital.com/blog/insights/research/voidstealer-abe-bypass

2026-03-19 17:50:15 UTC

The Belgian government has launched its own secure messaging app named Beam.
The app was designed for internal government and military use.
https://www.demorgen.be/snelnieuws/belgie-lanceert-eigen-beveiligde-berichtenapp-voor-defensie-en-ambtenaren~b9d46ccb/

2026-03-19 17:49:49 UTC

Japan will begin to carry out offensive cyber operations in October this year.
The ruling Cabinet approved the law after evaluating its conformity with the country's constitutional principles of non-aggression.
https://www.nippon.com/en/news/yjj2026031701011/

2026-03-19 17:22:15 UTC

DPRK hackers breached Bitrefill, an online platform that allows users to buy gift cards and refill SIMs using cryptocurrency
They compromised an employee laptop, and then stole crypto assets, customer records, and attempted to alter the gift card inventory
https://x.com/bitrefill/status/2033931580352221656

2026-03-19 14:46:22 UTC

Palo Alto takes another look at how threat actors are using AI for their malware operations
The conclusion is that many groups are still at the experimentation phase, with samples showing "superficial and ultimately ineffective use of LLMs as AI theater"
https://unit42.paloaltonetworks.com/ai-use-in-malware/

2026-03-19 13:50:26 UTC

APT28 is now exploiting a Zimbra XSS bug patched last November in attacks against Ukrainian government entities:
https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/
Added to CISA KEV this week: https://www.cisa.gov/news-events/alerts/2026/03/18/cisa-adds-one-known-exploited-vulnerability-catalog

2026-03-19 13:49:10 UTC

The East Asia Forum warns that Russian cybersecurity companies are expanding their presence in Southeast Asia through exports, training programs, and partnerships with local governments
https://eastasiaforum.org/2026/03/19/russias-cyber-push-tilts-southeast-asias-strategic-balance/