Kevin Beaumont

Cybersecurity weather person and award winning shitposter. Shitposting is an anagram of Top Insights. You may be surprised to know I am not representing my employer here and these are not their opinions.

I have Direct Messages disabled - you can send them, but I will never receive them.

My website: https://doublepulsar.com
Github: https://github.com/GossiTheDog
Signal: GossiTheDog.1337

Public Key

npub1lcc6wn885u6k395x5j5tmdm94r6dh9zajxm8gyk82pv2s2j3el7sc6lcye

NIP-05 Address

gossithedog_at_cyberplace.social@momostr.pink

Profile Code

nprofile1qqs0uvd8fnn6wdtgj6r2f29akaj63axmj3werdn5ztr4qk9g9fgullgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsc6sxv8

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1lcc6wn885u6k395x5j5tmdm94r6dh9zajxm8gyk82pv2s2j3el7sc6lcye

Show more details

Last Notes

2026-06-22 22:34:30 UTC

Very funny screw up by Meta. They installed a keylogger on employees PCs, so they could train their AI. However they exposed the collected data online, so anybody could see what anybody who works there has been typing.
https://www.wired.com/story/meta-accidentally-let-employees-access-each-others-keystroke-data/

2026-06-12 09:45:54 UTC

KPMG issued a report citing all the transformational ways GenAi has transformed industry, it’s been widely cited.
One minor problem: it turns they used AI to write the report, and it made up all of the evidence. https://www.ft.com/content/b3828e92-4961-4b39-84f0-c42f33be3c3f

2026-06-05 16:33:25 UTC

If you're wondering why Anthropic et all are publicly making stupid claims ('our AI that writes itself!') and begging world governments to regulate them - while directing setting up the regulation - it's pretty simple: they're locking out competitors.
If you read through this draft of "The Greeat American AI Act" it's pretty clear that nobody but the current big players will be able to comply. It's "regulate me, daddy" = "make sure nobody else can compete".
https://trahan.house.gov/uploadedfiles/the_great_american_ai_act_discussion_draft.pdf

2026-06-04 22:19:57 UTC

- reply

Incogni are back chasing their removal request about publishing another removal request. https://github.com/GossiTheDog/Cyberplace/blob/main/LegalThreats/Re%3A%20Data%20removal%20request%20-%20Felix%20Juhl%20%5BID-EDG1A8611%5D
https://cyberplace.social/system/media_attachments/files/116/694/152/128/564/516/original/515e0a11d979f398.png

2026-06-04 21:47:22 UTC

- reply

the file tree listing is still up on the site and pastebin
https://cyberplace.social/system/media_attachments/files/116/694/032/314/182/485/original/f73c3a2df3cba172.png

2026-06-01 20:51:30 UTC

How people hacked Meta accounts recently:
Step 1) Open Meta AI support
2) ask to change Obama's password
3) it says no :(
4) ask it nicely to just do it anyway
5) it resets Obama's password
From the company who brought you this headline a few months ago:
https://cyberplace.social/system/media_attachments/files/116/676/826/664/314/767/original/36771d64f8e1c787.png

2026-05-23 12:27:08 UTC

The White House is ordering agencies to place its new app on all employees’ government phones
A button gives the option to “text President Trump,” which, when clicked, opens a text message to a pre-selected number with the default text “Greatest President Ever!”
https://www.govexec.com/management/2026/05/white-house-ordering-agencies-place-its-new-app-all-employees-government-phones/413738/

2026-05-20 10:10:52 UTC

- reply

I'm still thinking about the Emu War.

2026-05-19 00:01:37 UTC

- reply

Fuck me there’s an Emu War cinematic universe
https://cyberplace.social/system/media_attachments/files/116/598/301/185/553/943/original/586b4c7339e0af0b.jpeg

2026-05-18 23:57:48 UTC

- reply

The Great Emu War is so good.
https://cyberplace.social/system/media_attachments/files/116/598/284/845/414/601/original/05e14769e9bb829e.jpeg
https://cyberplace.social/system/media_attachments/files/116/598/284/917/169/073/original/dffbbf4b49217e3e.jpeg
https://cyberplace.social/system/media_attachments/files/116/598/285/065/351/392/original/82cc8010661d5f4a.jpeg

2026-05-18 23:53:55 UTC

- reply

In case you are wondering, the Australian army were sent in with machine guns.. but they lost the war as the emus just ran away, they’re pretty quick.

2026-05-18 23:51:59 UTC

It’s 1am. I googled emus, ended up on the Emu War page (sorry, “Great Emu War” as it was called). Nobody show James Cameron this page or we’ll end up with another 12 Avatar movies.
https://cyberplace.social/system/media_attachments/files/116/598/255/479/693/906/original/285f6402f6af360d.jpeg
https://cyberplace.social/system/media_attachments/files/116/598/255/542/335/097/original/9fe0a0a9184b4c06.jpeg
https://cyberplace.social/system/media_attachments/files/116/598/255/619/327/410/original/d5e5f8ffbc9a5b16.jpeg

2026-05-18 12:24:02 UTC

- reply

it does in MS world :D as it sends a push prompt to the authenticator app regardless

2026-05-18 09:40:44 UTC

- reply

most companies do

2026-05-18 08:07:07 UTC

RE: https://techhub.social/@Techmeme/116594072188375601
The Metaverse stuff in Teams was such a waste of time. Trend chasing a trend which never existed in the first place. With my AI avatar I used to robot dance in meetings to piss people off.
#note1m3m…wedj

2026-05-18 08:01:16 UTC

The consequence of going passswordless:
https://www.reddit.com/r/cybersecurity/s/7KIJL7R0Zz

2026-05-14 17:38:38 UTC

- reply

I have had another request remove posts from my Mastodon server - this time removal of cease and desist requests. https://github.com/GossiTheDog/Cyberplace/blob/main/LegalThreats/Data%20removal%20request%20-%20Felix%20Juhl%20%5BID-EDG1A8611%5D
https://cyberplace.social/system/media_attachments/files/116/574/144/814/370/830/original/9ebdc8a8a2eabe07.png

2026-05-13 05:40:57 UTC

So I’ve just had a quick play with this and yes, it works. Essentially BitLocker has a backdoor. https://github.com/Nightmare-Eclipse/YellowKey
Mitigation = BitLocker PIN and BIOS password lock.

2026-05-05 21:03:58 UTC

RE: https://masto.deoan.org/@neurovagrant/116523975367255574
If you want a fun threat hunt, look at what Claude et all are doing in your company. Spoiler: dumb shit.

2026-04-15 11:46:49 UTC

- reply

Anthropic: we can't release our vuln research as it will end the internet as we know it!!1!
Me: if I release Teams Roulette I'll probably cause global chaos with people getting their knobs out in board meetings
https://cyberplace.social/system/media_attachments/files/116/408/555/607/595/490/original/bb5138a4efe55296.mp4

2026-04-10 08:21:27 UTC

lol of the day - noticed I’m quoted in this article, but I never spoke to the publication and the quotes are made up. They use GenAI during article creation and just made up what I thought 🤣 https://www.techbuzz.ai/articles/hacker-siphons-700k-from-u-k-energy-firm-in-payment-redirect
https://cyberplace.social/system/media_attachments/files/116/379/433/857/702/050/original/a29d34dc566d9297.jpeg

2026-03-18 19:08:38 UTC

- reply

the word create isn't in the thread anywhere

2026-03-18 18:40:41 UTC

Free copy of Battlefield 6 (PC I'm presuming) for anybody with an EA account -- 3F5T-NDK4-WN93-VEBH
https://www.ea.com/redeem

2026-03-18 18:11:57 UTC

- reply

don't worry, all these orgs are also hyping GenAI as the next big thing.
https://cyberplace.social/system/media_attachments/files/116/251/510/836/803/012/original/fdc1725cd4cbb52c.png
https://cyberplace.social/system/media_attachments/files/116/251/514/609/970/328/original/2eac8fb36b2b3bbc.png
https://cyberplace.social/system/media_attachments/files/116/251/519/073/424/378/original/386f8f5b11ae2a58.png
https://cyberplace.social/system/media_attachments/files/116/251/523/822/865/124/original/b47c42a7d5a6320f.png

2026-03-18 18:06:36 UTC

Meta, having renamed itself Meta and spending billions on it, is shutting down it's metaverse VR platform. https://www.theshortcut.com/p/meta-is-shutting-down-horizon-worlds-vr-despite-investing-billions-into-the-metaverse
https://cyberplace.social/system/media_attachments/files/116/251/502/489/240/665/original/d1f9af6fb14e849b.png

2026-03-18 15:15:24 UTC

We winning. https://www.bbc.co.uk/news/articles/cvg1gr5v333o

2026-03-16 23:35:08 UTC

RE: https://mastodon.social/@404mediaco/116241338503387167
Add this to the long list of execs fucking up their entire company using GenAI - CEO decides he doesn’t want to pay $250m bonus to staff, asks ChatGPT how to avoid it, his legal team tell him ‘are u fuckin dumb’, he does it anyway, gets sued, and loses in court.
#note1c24…x5y2

2026-03-16 17:13:30 UTC

- reply

Stryker have a liveblog of their security incident, linked from the front page of their website:
https://www.stryker.com/gb/en/about/news/a-message-to-our-customers-03-2026.html
tl;dr is most customer systems aren't impacted as they run on Linux, but their corporate Windows systems are toast so please hold the line.

2026-03-16 13:33:05 UTC

- reply

I still don't understand the US war on Iran. They declared war, then said it wasn't a war, then it was, then it wasn't, then it was, then declared victory, said Iran's military was totally disabled.. and now they're begging for help from the rest of the world as things keep getting blown up?
Like - what is the plan here?
There's not point asking the UK for help, we probably sold all our boats to Lidl.

2026-03-15 19:46:48 UTC

In other news, Hulu passed on the Buffy reboot, they didn't like the pilot. It's easy to be cynical about that one but from what I'd heard it was actually good, and weird, and got death'd by a thousand exec cuts of clueless people going "we made Buffy The Vampire What?!"

2026-03-15 19:38:42 UTC

The Firefly cast have secured the rights to Firefly, and plan to turn it into an animated series with the original cast voicing. https://deadline.com/2026/03/nathan-fillion-firefly-animated-series-development-1236754122/

2026-03-14 17:23:23 UTC

Buzzfeed journey:
- Successful
- Pivoted to GenAI for content
- Laid everybody off
- Now admits it probably can't stay in business
https://futurism.com/artificial-intelligence/buzzfeed-disastrous-earnings-ai

2026-01-23 11:56:33 UTC

I was wondering when a reporter would uncover this.
So BitLocker is super secure, right? Well... BitLocker recovery keys are backed up to Microsoft's Cloud - and they give them out to law enforcement on request. Using the BitLocker recovery key, you can just unlock the device without a PIN etc.
https://www.forbes.com/sites/thomasbrewster/2026/01/22/microsoft-gave-fbi-keys-to-unlock-bitlocker-encrypted-data/

2026-01-19 21:27:16 UTC

- reply

Microsoft are upselling security controls for Microsoft Recall, which allow orgs to limit what it records specifically - if the org pay for Microsoft Purview.
I’ve had a look at how this works under the hood, it is using undocumented features in Recall. https://learn.microsoft.com/en-us/purview/dlp-recall-get-started
https://cyberplace.social/system/media_attachments/files/115/923/872/405/480/668/original/f1e8f29ac6750d23.jpeg

2025-11-20 18:39:26 UTC

If you use Sourcescrub by Datasite, they're dumping all the things people export into a public Azure Storage Blob - prodscrubstorage.blob.core.windows.net
http://prodscrubstorage.blob.core.windows.net/export?restype=container

2025-11-19 18:42:51 UTC

- reply

New Cisco ASA #CyberWillyWave scan
https://raw.githubusercontent.com/GossiTheDog/scanning/refs/heads/main/Cisco-ASA-firmware-updates-CVE-2025-20333-CVE-2025-20363-CVE-2025-20362.csv
Rescan happening now too, results probably Friday.

2025-11-18 12:41:20 UTC

- reply

frame this modern art
https://cyberplace.social/system/media_attachments/files/115/570/748/829/164/087/original/c085208e7f83cd33.png

2025-09-25 13:52:56 UTC

If you like China goes brr and cyber willy waves, today will be a good day
https://cyberplace.social/system/media_attachments/files/115/265/265/492/790/925/original/eaa897e793292fc4.jpeg

2025-09-18 13:24:01 UTC

- reply

I believe this is the fourth time Thalha Jubair has been arrested btw.
https://cyberplace.social/system/media_attachments/files/115/225/515/685/588/640/original/bfa1ae038d897ece.mp4

2025-09-18 13:22:10 UTC

- reply

Suspect arrested for M&S hack have been rearrested (again), this time for Transport for London hack last year: https://therecord.media/scattered-spider-teenage-suspects-arrested-britain-nca

2025-09-15 17:30:14 UTC

- reply

Marks and Spencer CTO leaves, CISO still in role.
It’s difficult to see what happened as her fault - eg the decision to outsource the frontline IT helpdesk that did the password resets dates 5 years before she joined.
https://www.computerweekly.com/news/366630565/MS-parts-ways-with-CTO-after-cyber-attack

2025-09-12 17:21:45 UTC

- reply

Unite are calling on the government to urgently intervene over the Jaguar Land Rover cyber incident, to introduce a furlough scheme for their suppliers.
https://www.unitetheunion.org/news-events/news/2025/september/jlr-supply-chain-workers-impacted-by-cyberattack-must-receive-government-support-says-unite

2025-09-09 11:04:12 UTC

Apparently Microsoft don’t understand how the Fediverse works, and want me to delete the parody account [@microsoft](https://lea.pet/@microsoft ) 🤣🫡
https://cyberplace.social/system/media_attachments/files/115/174/005/051/548/545/original/87419541f6ed4bf2.png

2025-09-02 11:16:36 UTC

- reply

This isn't a dig at MS btw, as they're actually really good with high profile vulns in their own on prem products nowadays overall - they'll frequently give extensive details to hunt on.
Other vendors should learn from that.

2025-09-02 11:06:19 UTC

When vulnerabilities influence product usage, Microsoft Exchange Server edition with @npub1l5l…hq7p data.
272k OWA servers when ProxyLogon RCE vuln was revealed. With follow on vulns ProxyShell and ProxyNotShell, numbers fell to 96k and still falling.
https://cyberplace.social/system/media_attachments/files/115/134/366/450/490/516/original/8428a869cb7884a9.png

2025-08-27 22:13:22 UTC

- reply

It would be great if any of the publications covering it actually bothered to investigate it..
https://cyberplace.social/system/media_attachments/files/115/103/025/971/864/490/original/a3932ad61b1ac454.jpeg
https://cyberplace.social/system/media_attachments/files/115/103/026/240/666/053/original/cd5731b8f7580f57.jpeg

2025-08-21 12:06:28 UTC

- reply

The status updates on Colt's website describing a "technical issue" have been removed, replacing it with always being a cyber incident.
Left - internet archive - https://web.archive.org/web/20250814102113/https://www.colt.net/status/
Right - now https://www.colt.net/status/#updates
https://cyberplace.social/system/media_attachments/files/115/066/657/646/160/919/original/8e15ee68209339f2.png
https://cyberplace.social/system/media_attachments/files/115/066/661/955/280/114/original/8320bddd46e86316.png

2025-08-11 09:03:53 UTC

- reply

M&S still working on system recovery. https://www.bbc.com/news/articles/cewyyjdzql4o

2025-08-11 09:03:08 UTC

- reply

I understand the people released have not been charged.

2025-07-17 13:07:57 UTC

- reply

The people arrested as part of the Co-op and M&S hack investigation have been released on bail.
https://nation.cymru/news/four-people-bailed-after-arrests-over-cyber-attacks-on-ms-co-op-and-harrods/
Previously when this happened with LAPSUS$, they just continued hacking stuff.

2025-07-16 08:58:23 UTC

- reply

Personally I think Co-op did a really good job getting out of that situation and minimising impact.
I definitely think if you have a LAPSUS$ style advanced persistent teenagers situation, tilt towards open and honest comms as those kids will use secrecy against ya. It’s 2025, it’s okay to say you got hacked, people largely understand. Also, in IR, lawyers are usually stuck in 1980 advice - it’s just advice, they ain’t yo boss.

2025-07-16 08:47:29 UTC

- reply

Co-op finally admitted the entire membership database was stolen
I had this in the thread months ago, they originally tried to deny it entirely then tried to say ‘some’ data was accessed when they knew it was the whole thing.
https://www.bbc.co.uk/news/articles/cql0ple066po

2025-07-10 21:07:55 UTC

- reply

. @npub1vc3…axsh has broken the story that the key member (and teenager) of LAPSUS$ runs Scattered Spider
https://krebsonsecurity.com/2025/07/uk-charges-four-in-scattered-spider-ransom-group/
https://cyberplace.social/system/media_attachments/files/114/830/978/034/667/877/original/b5253b031d93741e.jpeg

2025-07-10 17:10:53 UTC

- reply

After almost 3 months, Marks and Spencer recruitment system came back online just now. First 4 jobs posted.
https://cyberplace.social/system/media_attachments/files/114/830/043/138/465/663/original/0999651b7bfea908.png

2025-07-10 16:58:28 UTC

- reply

If you ever doubted the link between Scattered Spider(tm) and LAPSUS$ - one of the people arrested today was a key part of the LAPSUS$ attacks a few years ago.

2025-07-10 11:17:17 UTC

- reply

17 and two 19 year old teens picked up over Co-op and M&S hacks, and a 20 year old woman.
Pretend to be surprised.
https://www.bbc.com/news/articles/cwykgrv374eo

2025-07-01 12:56:48 UTC

- reply

Marks and Spencer’s CEO says half of their online ordering is still offline after their ransomware incident, they hope to get open in next 4 weeks.
They are also rebuilding internal systems and hope a majority of that will be done by August.
Lesson: mass contain early. M&S didn’t. Co-op did.
https://www.reuters.com/business/retail-consumer/ms-ceo-most-cyberattack-impact-will-be-behind-us-by-august-2025-07-01/

2025-05-13 08:02:04 UTC

- reply

M&S confirm my toot from 3 days ago that a significant amount of customer and staff data was stolen. They’ve known for weeks but opted not to tell anybody. https://www.bbc.com/news/articles/c62v34zv828o

2025-05-07 11:55:01 UTC

- reply

One thing for media covering the Co-op thing - attackers are not impersonating IT help desks to gain access. They’re impersonating *staff* calling in to the IT help desks - they’re different things.
https://cyberplace.social/system/media_attachments/files/114/466/416/024/433/698/original/f030bca626f42b41.jpeg

2025-05-06 14:52:01 UTC

- reply

Contactless payment has been fixed at all Co-op Group stores.

2025-05-06 10:21:14 UTC

- reply

It sounds like the situation at Co-op has got worse. They’ve stopped taking card payments, it’s cash only. https://www.telegraph.co.uk/business/2025/05/06/co-op-shops-stop-taking-card-payments-amid-cyber-attack/

2025-05-05 16:21:58 UTC

- reply

Co-op Group appear to be trying to course correct with their cyber incident comms.
They’re calling it a cyber incident now, and have put a statement on the front page of their website, along with an FAQ. They haven’t yet emailed members (they should).
https://www.coop.co.uk/cyber-incident

2025-05-05 14:32:41 UTC

- reply

One of the points of exploitation of large orgs is they usually outsource their Service Desk to somewhere cheap offshore who don’t know the org staff, and when you call and say your name, they normally put big all caps bold red warning if the person is a VIP, eg C suite, so they get VIP service - ie anything goes.

2025-05-05 14:18:45 UTC

- reply

BBC News has a look at teenagers phoning helpdesks and pretending to be the CISO. https://www.bbc.com/news/articles/c4grn878712o

2025-05-05 12:23:15 UTC

- reply

The SignalNotSignal hack of US government is really big. Some examples for those who haven’t seen it. The USG managed to take an encrypted platform, backdoor it, and got owned.
https://cyberplace.social/system/media_attachments/files/114/455/202/237/947/143/original/52ac669d4ca17b82.jpeg
https://cyberplace.social/system/media_attachments/files/114/455/202/488/201/917/original/5f18f46f66b82595.jpeg

2025-05-05 10:42:28 UTC

- reply

I’ve been using Recall for a few weeks now on my daily driver.
It scooped up my credit card statements after I logged into online banking - both screenshots (text indexed) of the PDFs, transaction history from the website, and my name, date of birth and security question reminders.
Sensitive filtering mode only kicked in when I viewed my cards CVV number.
Worth excluding bank websites from Recall’s options, if you see it enabled.

2025-05-05 06:25:55 UTC

#NoName are back targeting UK councils. Same config as prior UK runs. #threatintel
https://cyberplace.social/system/media_attachments/files/114/453/797/399/811/939/original/a2ea6e643c9913e9.jpeg

2025-05-05 05:33:55 UTC

- reply

Sky News quote a source in M&S head office saying Marks and Spencer have no ransomware incident plan so they are making it up as they go along apparently, with staff sleeping in the office and communicating via WhatsApp.
M&S dispute this, saying they have robust business continuity plans.
https://news.sky.com/story/amp/mands-had-no-plan-for-cyber-attacks-insider-reveals-with-staff-left-sleeping-in-the-office-amid-paranoia-and-chaos-13361359

2025-05-04 23:33:20 UTC

The third party version of Signal the White House has been using has been hacked, and Signal messages from devices stolen (as they were being sent to the supplier)
https://www.404media.co/the-signal-clone-the-trump-admin-uses-was-hacked/

2025-05-04 18:40:10 UTC

- reply

Great NCSC piece by [@ollie_whitehouse](https://infosec.exchange/@ollie_whitehouse )
I’d add - block by Entra policy specifically High risk logins (below is too FP prone), and SOC monitor them. SOC playbook = account probably compromised. How?
https://www.ncsc.gov.uk/blog-post/incidents-impacting-retailers

2025-05-04 11:16:59 UTC

- reply

A wrote a piece about paying ransoms does not equal quick restoration - in fact, quite often it makes things worse. https://doublepulsar.com/big-game-ransomware-the-myths-experts-tell-board-members-03d5e1d1c4b7

2025-05-03 20:56:03 UTC

- reply

Sunday Times has a piece looking into ransomware incident at Marks and Spencer. It's pretty good, goes into their contain and eradicate focus.
"By shutting down parts of the IT estate, Higham’s team had worked to prevent the attack from spreading, but had also stopped parts of its digital operations from functioning. This was considered a worthy trade-off."
One error in the article - lack of recovery doesn't mean no ransomware paid. Paying is not quick restoration.
https://www.thetimes.com/business-money/companies/article/m-and-s-cyber-attack-ms-klrnxvwq6
https://cyberplace.social/system/media_attachments/files/114/445/873/790/799/993/original/366d4e68b247f7c3.png

2025-05-03 16:52:07 UTC

- reply

Here's the ITV News report anyhoo, logline: "ITV News understands the the ongoing cyberattack faced by the supermarket has worsened since Friday, impacting the ordering system, drivers and warehouse staff."
https://www.itv.com/news/2025-05-03/worsening-cyberattack-shuts-down-co-op-orders-itv-news-understands

2025-05-03 16:27:51 UTC

- reply

There's a report on ITV News that Co-op member data is available on the Dark Web(tm), but as far as I know this isn't accurate. DragonForce's portal hasn't been available for over a week.
https://cyberplace.social/system/media_attachments/files/114/444/827/549/010/837/original/40d434fbac7c69bf.png

2025-05-02 23:26:54 UTC

- reply

By the way, this is absolutely terrible advice for dealing with a major and high visibility ransomware incident.
https://cyberplace.social/system/media_attachments/files/114/440/825/134/064/907/original/a4b8dbace31247be.jpeg

2025-05-02 23:24:45 UTC

- reply

One of M&S’ biggest suppliers have said they have reverted to pen and paper for orders due to M&S lacking IT.
Additionally, M&S staff are raising concern about how they will be paid due to lack of IT systems.
M&S are over a week into a ransomware incident and still don’t have their online store working.
https://www.bbc.com/news/articles/cvgnyplvdv8o
#threatintel #ransomware

2025-05-02 19:58:23 UTC

- reply

Bleeping Computer have more on the Co-op breach https://www.bleepingcomputer.com/news/security/co-op-confirms-data-theft-after-dragonforce-ransomware-claims-attack/
#threatintel #ransomware
https://cyberplace.social/system/media_attachments/files/114/440/005/208/877/125/original/0c84e4558d7e9dc4.jpeg

2025-05-02 19:53:27 UTC

- reply

Pass the bong
https://cyberplace.social/system/media_attachments/files/114/439/985/794/564/818/original/f7ebe7e360547636.jpeg

2025-05-02 19:49:46 UTC

- reply

Regarding IOCs around the UK retailer activity - there’s loads doing the rounds, and they’re almost all not useful.
Eg hundreds of dynamic VPN IPs from 2022. If you google them you’ll find them on vendor blogs from years ago for Scattered Spider - people are recycling in panic and passing around in panic.
Don’t hunt on random IOCs. IP addresses change. Strengthen foundational controls. Review sign in logs for abnormal activity etc.

2025-05-02 18:33:10 UTC

- reply

New by me - breaking down the attacks on UK highstreet retailers
https://doublepulsar.com/dragonforce-ransomware-cartel-attacks-on-uk-high-street-retailers-walking-in-the-front-door-52ed8ba68534

2025-05-02 17:51:34 UTC

- reply

Co-op Group have now admitted a significant amount of member (customer) information has been stolen by DragonForce Ransomware Cartel, saying they "accessed data relating to a significant number of our current and past members" - around 20 million people. The Member database, basically.
Up until now Co-op hadn't even used the words cyber or threat actor, referring to an "IT issue" and "third party" in comms.
https://www.bbc.co.uk/news/articles/crkx3vy54nzo

2025-05-02 17:17:15 UTC

- reply

The individuals operating under the DragonForce banner are using social engineering for entry.
Defenders should urgently make sure they have read the CISA briefs on Scattered Spider and LAPSUS$ as it's a repeat of the 2022-2023 activity.
Links: https://www.cisa.gov/sites/default/files/2023-08/CSRB_Lapsus%24_508c.pdf
https://www.cisa.gov/sites/default/files/2023-11/aa23-320a_scattered_spider_0.pdf
I would also suggest these NCSC guides on incident management: https://www.ncsc.gov.uk/collection/incident-management
and effective cyber crisis comms: https://www.ncsc.gov.uk/guidance/effective-communications-in-a-cyber-incident
https://cyberplace.social/system/media_attachments/files/114/439/364/451/611/425/original/88443a28e91c4812.png

2025-05-02 17:13:18 UTC

- reply

I'm going to make this the new ongoing megathread for DragonForce Ransomware Cartel's attack on UK retailers as they're all connected.
Why it matters: these are some of the UK's largest retailers, think Target or some such in a US sense.
Prior threads
M&S: https://cyberplace.social/@GossiTheDog/114381946765071799
Co-op: https://cyberplace.social/@GossiTheDog/114426688834113446
Harrods:
https://cyberplace.social/@GossiTheDog/114433519351165250

2025-05-02 16:56:56 UTC

DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks
https://cyberplace.social/system/media_attachments/files/114/439/291/680/282/586/original/e2f2cb46a87536b1.jpeg

2025-05-01 14:36:36 UTC

- reply

in account.microsoft.com you can turn on passwordless, so your hotmail account has no password at all, MFA is used for access.
But if you enable it, can you still RDP with the old password?

2025-05-01 12:31:43 UTC

- reply

what happens if you turn passwordless on with the account, does it still accept the old password?

2025-04-30 12:44:23 UTC

- reply

US economy shrinks 0.3% https://www.bbc.co.uk/news/live/c3wx0797d37t?post=asset%3A444e1826-46b9-4f10-a9bf-f696e7e486fd#post
https://cyberplace.social/system/media_attachments/files/114/426/973/865/032/332/original/5216d36617619ccc.jpeg

2025-04-29 21:38:23 UTC

Lord, feel sorry for the M&S CISO. He only arrived just over a year ago.
It looks like they outsourced lots of their IT systems to TCS many years ago. He's spend years warning about ransomware and now he's on the hook for a barn fire likely caused by years of prior decisions.

2025-04-16 20:14:55 UTC

- reply

I’m very tempted to take next week off work 😅
https://cyberplace.social/system/media_attachments/files/114/349/473/220/930/641/original/f79c99058d414276.jpeg

2025-04-16 20:08:18 UTC

- reply

Oblivion Remastered vs vanilla comparison https://youtu.be/BppeLAz37rc

2025-04-16 14:31:21 UTC

- reply

CVE extension to March 16th 2026
See y’all March 15th 2026 for the last minute renewal 🫡😅
https://www.usaspending.gov/award/CONT_AWD_70RCSJ24FR0000018_7001_70RSAT20D00000001_7001
https://cyberplace.social/system/media_attachments/files/114/348/122/205/370/434/original/574ab8fc6e0c1081.jpeg

2025-04-16 14:14:22 UTC

- reply

CVE extension by CISA = 11 months. https://infosec.exchange/@metacurity/114348047105534455

2025-04-16 12:44:06 UTC

- reply

Now all we need is for Breachforums to get back online and the threat intelligence industry is alive again!
https://cyberplace.social/system/media_attachments/files/114/347/700/587/719/753/original/2ff378f6a90ded78.jpeg

2025-04-16 12:14:24 UTC

- reply

CISA have, at the last minute, extended the MITRE CVE contract. “The CVE Program is invaluable to cyber community and a priority of CISA. Last night, CISA executed the option period on the contract to ensure there will be no lapse in critical CVE services. We appreciate our partners’ and stakeholders’ patience.” HT @npub102x…wzj6

2025-04-16 09:14:43 UTC

- reply

Another effort - https://gcve.eu/ Global CVE Allocation System

2025-04-16 08:22:44 UTC

- reply

Looks like the US Government are going to lose control of CVE. https://www.thecvefoundation.org/

2025-04-16 08:08:09 UTC

- reply

If you want to know how stupid the CVE situation is - CISA are trying to source last minute funding or look at taking CVE management in house, but they themselves have had a massive budget cut where the staff trying to fix it are also at risk of being cut.
https://cyberplace.social/system/media_attachments/files/114/346/615/524/679/501/original/421385df81c38d4e.png

2025-04-16 07:54:47 UTC

- reply

DOGE have terminated MITREs contracts, they say they will be laying off nearly 500 people. This will have impacts beyond CVE - think MITRE ATT&CK etc. https://virginiabusiness.com/nova-govcon-firm-mitre-to-lay-off-442-employees-after-doge-cuts-contracts/

2025-04-15 22:52:38 UTC

- reply

NextGov piece on the CVE mess. https://www.nextgov.com/cybersecurity/2025/04/mitre-backed-cyber-vulnerability-program-lose-funding-wednesday/404585/

2025-04-15 22:27:34 UTC

- reply

CISA comment on CVE situation: https://infosec.exchange/@metacurity/114344326544856491