Metacurity

Metacurity.com (https://metacurity.com) is the one-stop destination for leading infosec news and cybersecurity developments. Run by infosec writer and columnist Cynthia Brumfield, Metacurity draws from thousands of sources every day to deliver aggregated summaries of the latest infosec developments. If anyone wants to get in touch with me, on or off the record, you can reach me at cynthia [at] digitalcrazytown.com or on Signal via Cynthia.507. Sign up for our free daily emails at https://www.metacurity.com. Searchable

Metacurity: https://metacurity.com
Bluesky: https://bsky.app/profile/msbrumfield.bsky.social
Columns: https://www.csoonline.com/author/Cynthia-Brumfield/
Book: https://www.amazon.com/Cybersecurity-Risk-Management-Mastering-Fundamentals/dp/1119816289
Course: https://www.oreilly.com/live-events/cybersecurity-risk-management-with-the-nist-20-framework/0636920081497/
Cynthia's Personal Ramblings: https://bsky.app/profile/msbrumfield.bsky.social

Public Key

npub102xc6m40gwx94dhvcfk353alkvfsmk28rlnu508mtfjldnxj7k4qp6wzj6

NIP-05 Address

metacurity_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqs84rvdd6h58rz6kmkvymg6g7lmxycdm9r3le728na45e0kenf0t2spz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsser2wd

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub102xc6m40gwx94dhvcfk353alkvfsmk28rlnu508mtfjldnxj7k4qp6wzj6

Show more details

Published at

2026-04-08T09:26:32Z

Kind type

0 Metadata

Event JSON

{ "id": "9d708f643a95522451608fa6df9e85117f16e675c85eb9d1ced4d5b5aebd1421", "pubkey": "7a8d8d6eaf438c5ab6ecc26d1a47bfb3130dd9471fe7ca3cfb5a65f6ccd2f5aa", "created_at": 1775640392, "kind": 0, "tags": [ [ "proxy", "https://infosec.exchange/users/metacurity", "activitypub" ], [ "L", "pink.momostr" ], [ "l", "pink.momostr.activitypub:https://infosec.exchange/users/metacurity", "pink.momostr" ], [ "-" ] ], "content": "{\"name\":\"Metacurity\",\"about\":\"Metacurity.com (https://metacurity.com) is the one-stop destination for leading infosec news and cybersecurity developments. Run by infosec writer and columnist Cynthia Brumfield, Metacurity draws from thousands of sources every day to deliver aggregated summaries of the latest infosec developments. If anyone wants to get in touch with me, on or off the record, you can reach me at cynthia [at] digitalcrazytown.com or on Signal via Cynthia.507. Sign up for our free daily emails at https://www.metacurity.com. Searchable\\n\\nMetacurity: https://metacurity.com\\nBluesky: https://bsky.app/profile/msbrumfield.bsky.social\\nColumns: https://www.csoonline.com/author/Cynthia-Brumfield/\\nBook: https://www.amazon.com/Cybersecurity-Risk-Management-Mastering-Fundamentals/dp/1119816289\\nCourse: https://www.oreilly.com/live-events/cybersecurity-risk-management-with-the-nist-20-framework/0636920081497/\\nCynthia's Personal Ramblings: https://bsky.app/profile/msbrumfield.bsky.social\\n\",\"website\":\"https://infosec.exchange/@metacurity\",\"picture\":\"https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/243/688/522/761/749/original/958dc2958799c9b8.png\",\"banner\":\"https://media.infosec.exchange/infosec.exchange/accounts/headers/109/243/688/522/761/749/original/87ee38dd5d3273ee.png\",\"nip05\":\"metacurity_at_infosec.exchange@momostr.pink\"}", "sig": "159c8262f1a20635676ea9558e213597cef05c1266ed19d09ee1f50a9b4b52c7b0d3b2ea9fd16d76062702bb8b7959edc6b6c710c9408aa16c2f14a41dba1db9" }

Last Notes

2026-03-14 13:09:49 UTC

"The vast majority, about 90%, of the more than 260,000 DHS employees are continuing to work without pay throughout the funding lapse, which began Feb. 14. Employees earlier this month received partial paychecks, compensated only for work hours they completed prior to the start of the shutdown."
https://federalnewsnetwork.com/government-shutdown/2026/03/many-dhs-employees-miss-first-full-paychecks-as-shutdown-continues/?readmore=1

2026-03-13 13:32:16 UTC

A quiet but significant expansion of the US surveillance apparatus is taking shape inside DHS — built from travel databases, biometric systems, location data markets, AI analytics, and tools like Palantir’s ELITE platform.
In this report, I trace how investigative reporting from Mother Jones, Wired, and 404 Media reveals the architecture of a system capable of tracking Americans’ movements, identities, and digital lives.
Available to Metacurity paid subscribers.
https://www.metacurity.com/the-homeland-security-surveillance-machine/

2026-02-20 18:34:08 UTC

This is for Wynn Resorts.
ShinyHunters demands $1.5M not to leak Vegas casino and resort chain data
https://www.theregister.com/2026/02/20/shinyhunters_wynn_resorts/?utm_source=dlvr.it&utm_medium=bluesky

2026-02-05 11:40:04 UTC

It's downright weird that McDonald's is leading a campaign to advise us to use more secure passwords.
McDonald's is not lovin' your bigmac, happymeal, and mcnuggets passwords
https://www.theregister.com/2026/02/02/mcdonalds_password_advice/

2026-02-04 12:05:29 UTC

If I am reading this correctly, Northern Ireland police, who just received compensation of £7,500 per officer for having their personal details published in error on the internet, were revictimized today when the Northern Ireland court system again published their personal details.
https://www.belfasttelegraph.co.uk/news/northern-ireland/it-defies-belief-names-of-psni-officers-published-on-court-website-in-new-breach/a122899735.html

2026-01-28 13:09:45 UTC

ICE wants all the federal funding , all the government data, all the surveillance technology it can get its hands on. Now it wants to track people using data it can source from technology and advertising companies. It is a malignant black hole.
ICE knocks on ad tech’s data door to see what it knows about you
https://www.theregister.com/2026/01/27/ice_data_advertising_tech_firms/

2026-01-26 15:26:27 UTC

Wow.
“Booz Allen failed to implement adequate safeguards to protect sensitive data, incl. the confidential taxpayer information it had access to through its contracts with the Internal Revenue Service.”
Treasury Cancels Contracts with Booz Allen Hamilton
https://home.treasury.gov/news/press-releases/sb0371

2026-01-20 11:35:44 UTC

This piece makes the interesting case that accountants can be a first line of defense against cyber threats.
Research reveals a surprising line of defence against cyber attacks: accountants
https://theconversation.com/research-reveals-a-surprising-line-of-defence-against-cyber-attacks-accountants-272428

2026-01-13 11:23:30 UTC

Target's dev server offline after hackers claim to steal source code
https://www.bleepingcomputer.com/news/security/targets-dev-server-offline-after-hackers-claim-to-steal-source-code/

2026-01-05 12:33:19 UTC

- reply

Confusing, right? But that video shows total obliteration of one of the substations -- why even bother with cyber if you're going to do that?

2026-01-05 11:26:20 UTC

So Venezuela's energy ministry is saying the attack that brought down the power grid in Caracas was a physical assault on substations and not a cyber attack.
https://mppee.gob.ve/?p=103279
This contradicts Trump's statement about the US having "expertise" and also the NYT's reporting that the attack "began with a cyberoperation that cut power to large swaths of Caracas." 2/2
https://www.nytimes.com/2026/01/03/us/politics/trump-capture-maduro-venezuela.html
Corpoelec's website is not only down for maintenance, it's not accessible at all today. https://corpoelec.gob.ve/

2026-01-04 07:51:25 UTC

https://www.nytimes.com/2026/01/03/us/politics/trump-capture-maduro-venezuela.html
“Inside Venezuela, the effort began with a cyberoperation that cut power to large swaths of Caracas, shrouding the city in darkness to allow the planes, drones and helicopters to approach undetected.”

2025-12-22 09:17:44 UTC

Good god
“At least six career staffers at the Cybersecurity and Infrastructure Security Agency were suspended with pay this summer after organizing a polygraph test that the agency’s acting director, Madhu Gottumukkala, failed.”
https://www.politico.com/news/2025/12/21/cisa-acting-director-madhu-gottumukkala-polygraph-investigation-00701996?utm_source=dlvr.it&utm_medium=bluesky

2025-12-18 12:18:51 UTC

South Korea’s government is mobilizing an all-hands response to a data breach at e-commerce giant Coupang. The CEO was forced to resign and might face charges.
When has any US company or CEO been held to this level of accountability for a breach?
https://www.koreaherald.com/article/10639379

2025-12-11 12:52:45 UTC

A Singaporean man was sentenced to prison and fined for teaching others how to use malware, the first known conviction for teaching malware tutorials.
Man gets jail for filming malware tutorials for syndicate; 129 Singapore victims lost S$3.2m
https://www.channelnewsasia.com/singapore/malaysian-malware-android-phones-129-victims-singapore-32-million-5569846

2025-12-09 06:54:16 UTC

https://www.koreatimes.co.kr/business/companies/20251209/police-raid-coupang-over-massive-data-breach
This is what happens when you do bad cybersecurity.
Police reportedly seek to check for possible lapses in Coupang's security, while tracking down the suspect behind the leak. cybersecurity.

2025-11-25 00:06:55 UTC

https://www.clickondetroit.com/news/local/2025/11/22/campbell-soup-exec-caught-on-secret-recording-slamming-product-people-who-buy-it/
The exec caught on the recording was Campbell’s CISO.

2025-11-24 09:18:50 UTC

https://www.theguardian.com/technology/2025/nov/24/civil-liberties-groups-call-for-inquiry-into-uk-data-protection-watchdog
Dozens of civil liberties campaigners and legal professionals are calling for an inquiry into the UK’s data protection watchdog, after what they describe as “a collapse in enforcement activity” after the scandal of the Afghan data breach.

2025-11-19 14:05:39 UTC

The US and the UK are going after bulletproof hosting companies.
United States, Australia, and United Kingdom Sanction Russian Cybercrime Infrastructure Supporting Ransomware
https://home.treasury.gov/news/press-releases/sb0319

2025-11-19 11:08:21 UTC

All those allegations that China is using TP-Link routers to spy or to lay the groundworks for attacks or whatever have cost the California-based but Chinese-owned company $1 billion, according to a lawsuit filed by TP-Link against Netgear.
Fwiw, the allegations began in Washington and were wholly unfounded, but that hasn't slowed the drumbeat to ban TP-Link.
https://www.csoonline.com/article/3504775/no-evidence-that-tp-link-routers-are-a-chinese-security-threat.html
https://www.bloomberg.com/news/articles/2025-11-19/netgear-accused-by-rival-of-china-smear-to-stoke-security-fear

2025-11-19 06:04:39 UTC

https://world.kbs.co.kr/service/news_view.htm?lang=e&Seq_Code=197518
Crazy times in South Korean cyber.

2025-11-17 13:43:24 UTC

There has been an insane amount of high-profile cybersecuriy developments since Friday morning, so check out today's Metacurity for what you might have missed over the weekend, including
--US issues seizure warrants for Starlink terminals in Myanmar cyberscam compounds,
--US citizens plead guilty to aiding DPRK IT worker fraud,
--$28B tied to cybercrime activity over the last two years,
--Princeton got hit by a data-stealing cyberattack,
--Anthropic's report of autonomous AI Chinese hacks hits pushback,
--Cybercom invests in cyberwarfare AI agents,
--German legislature approves ban on selected Chinese kit,
--Taiwan warns of security flaws and misinformation in Chinese LLMs,
--Dutch police seize thousands of bulletproof hosting servers,
--UK prosecutors seize $5.4m from Twitter hacker,
--Russian man busted in Phuket could be Russian intel officer wanted by FBI,
--Breach of Somalia's electronic visa platform has wide implications,
--Hacked CCTV videos from Indian maternity ward sold on Telegram,
--Husband of the founder of Korean sportswear brand Andar sentenced for helping DPRK hackers,
--Critical FortiWeb flaw patched,
--Logitech confirms Clop attack,
--AIPAC breach affects 810 people,
--FBI is trying to unmask Archive[dot]is operator,
--Security pros agree senior management is responsible for security compliance,
--Crypto ATMs outnumber Wells Fargo ATMs,
--Devices for stealing keyless cars fetch $20k
https://www.metacurity.com/us-issues-seizure-warrants-for-starlink-terminals-in-myanmar-cyberscam-compounds/

2025-11-17 12:36:14 UTC

"Twenty’s contracts are a rare case of an AI offensive cyber company with VC backing landing Cyber Command work; typically cyber contracts have gone to either small bespoke companies or to the old guard of defense contracting like Booz Allen Hamilton or L3Harris."
The Pentagon Is Spending Millions On AI Hackers
https://www.forbes.com/sites/thomasbrewster/2025/11/15/pentagon-spends-millions-on-ai-hackers/

2025-11-12 10:24:09 UTC

"Dutch government bodies were unpleasantly surprised by news that an American tech firm has acquired the Dutch cloud company Solvinity, the Financieele Dagblad reported.
Several governments opted for working with Solvinity precisely to reduce dependence on American technology firms"
https://nltimes.nl/2025/11/12/dutch-governments-caught-guard-american-tech-firm-buying-dutch-cloud-company?utm_source=dlvr.it&utm_medium=bluesky

2025-11-10 12:26:14 UTC

Omfg
"NSO’s new executive chairman, David Friedman, a former U.S. ambassador to Israel and onetime bankruptcy lawyer for President Trump, said he wants to use his ties to the Trump administration to help rebuild the company’s spyware business in the U.S."
Israeli Spyware Maker NSO Gets New Owners, Leadership and Seeks to Mend Reputation
https://www.wsj.com/tech/israeli-spyware-maker-nso-gets-new-owners-leadership-and-seeks-to-mend-reputation-166ac50e?gaa_at=eafs&gaa_n=AWEtsqeTjThMB1_h1W1ewQnjnyji8Htzivc14xAyjmLD1jhojtWHS59ZMrQZW_ozWhc%3D&gaa_ts=6911d050&gaa_sig=bi4oz-fCkxtxpjHUj04ELh9BhkSPKU3Napkc4HbMWl5aa923Ah-Y4oBjTZW_Nsdg2DxfRCpo4QqTPBBI_MEqpA%3D%3D

2025-11-03 22:02:53 UTC

"Donald Trump's clampdown on the U.S. Consumer Financial Protection Bureau earlier this year has compounded IT security lapses at the agency through the cancellation of contracts"
US CFPB data security 'not effective' after Trump clampdown, watchdog report says
https://www.reuters.com/sustainability/boards-policy-regulation/us-cfpb-data-security-not-effective-after-trump-clampdown-watchdog-report-says-2025-11-03/

2025-11-03 18:48:25 UTC

- reply

Kevin, I have to reiterate, MIT did not talk to me. You need to correct your piece.

2025-10-29 20:50:59 UTC

Open-source security group pulls out of U.S. grant, citing DEI restrictions
https://cyberscoop.com/python-software-foundation-rejects-federal-grant-funding-citing-dei-restrictions/

2025-10-16 13:13:00 UTC

There is never a let-up in crucial infosec news, so check out today's Metacurity for the developments you should know, including
--CISA warns agencies to update F5 appliances after breach disclosure,
--Sources say China hacked classified UK systems for over a decade,
--Some observers think a secret US cybercrime-fighting group doxxed a Russian ransomware kingpin,
--Microsoft is moving Surface manufacturing out of China,
--Pro-Palestine activists hacked four N. American PA systems,
--Dota 2 YouTube channel was hijacked to promote fraud,
--Criminals behind Bittensor hack laundered funds with anime NFTs,
--Cyberespionage group Mysterious Elephant is growing more sophisticated,
--German spyware victims sue Viktor Orbán,
--Vendor to Spanish retailer Mango experienced unauthorized access,
--Using AI to cover up AI usage,
--Man blames public Wi-Fi for getting totally pwned
https://www.metacurity.com/cisa-warns-agencies-to-update-f5-appliances-after-breach-disclosure/

2025-10-13 12:08:30 UTC

Wow, a lot happened in the cybersecurity world over the weekend, so check out today's Metacurity for the most critical infosec developments you might have missed, including
--The White House fired 176 CISA employees on Friday, with more layoffs feared,
--Scattered Lapsus$ Hunters leaked 5m Qantas, 23m Vietnam Air customers' records,
--Spanish cops dismantle GXC Team,
--Dutch gov't warns of China's Nexperia security risks,
--Breach of crypto betting platform Shuffle exposes user data,
--FCC chair says sites have removed barred Chinese electronics
--N. Korean scammers now posing as architects,
--Korean government launches KT Telecom probe related to breach,
--OTA updates leave Jeeps bricked,
--CEO of UniCredit bank was targeted with Graphite spyware,
--NIH uses sensitive medical equipment from Chinese company with espionage track record,
--Trump withdraws nomination of Gen. William Hartman,
--Criminals are scamming driver's license seekers,
--World's biggest botnet is drawing power from telco-hosted IoT devices,
--Apple ups bug payouts for spyware to $2m,
--Hackers stole data from UK top screen industry union Bectu,
--Hackers stole massive amounts of data from Banco Hipotecario del Uruguay,
--A cyber incident hit Sugar Land, TX,
--Michigan City, IN hit by a ransomware attack,
--Resistant AI raised $25m in Series B,
--1Password sells $75m stake to Utah Jazz owners,
--Google's OSV database fixes undercount,
--AI might kill us with pathogens
https://www.metacurity.com/the-white-house-fired-176-cisa-employees-on-friday-with-more-layoffs-feared/

2025-10-08 10:47:26 UTC

- reply

Yeah, I read that - it had to have been labeled that under a previous government. So, I guess it's that simple.

2025-10-08 10:44:07 UTC

This is hard for me to understand. I mean, why not label China as a security threat?
I understand that China is a powerful economic partner, but I'm missing something here.
China spy case collapse due to Labour government, prosecutors say
https://www.cityam.com/china-spy-case-collapse-due-to-labour-government-prosecutors-say/?mid=1#cid=3153100

2025-10-08 09:16:25 UTC

Employees regularly paste company secrets into ChatGPT
https://www.theregister.com/2025/10/07/gen_ai_shadow_it_secrets/

2025-10-04 10:52:21 UTC

Asahi ships beer using paper and fax after ransomware attack
https://www.japantimes.co.jp/business/2025/10/04/asahi-paper-fax-orders/

2025-09-30 08:47:59 UTC

"If you think you might be burning out, you're already on your way there," says Andrew Tillman, former head of cyber risk and assurance for the UK's Health Security Agency.
Why burnout is a growing problem in cybersecurity
https://www.bbc.com/news/articles/cgqn8e4e700o

2025-09-25 09:13:10 UTC

Wow. The UK government is thinking of bailing out JLR. What a case study on how absolutely critical cybersecurity risk management is.
Government considers financial support for JLR suppliers
https://www.bbc.com/news/articles/c62nv0xx32go

2025-09-23 18:22:21 UTC

https://www.wired.com/story/sim-farm-new-york-threatened-us-infrastructure-feds-say/
“Despite speculation in some reporting about SIM farm operation that suggests it was created by a foreign state such as Russia or China and used for espionage, it’s far more likely that the operation’s central focus was scams and other profit-motivated forms of cybercrime”

2025-09-21 15:50:31 UTC

- reply

Thanks @npub1qax…dr3u
@npub1vc3…axsh, neutrality is not an option anymore. I do my spouting off over at bluesky for the most part.

2025-09-19 11:48:59 UTC

"Noah Urban’s role in the notorious Scattered Spider gang was talking people into unwittingly giving criminals access to sensitive computer systems."
‘I Was a Weird Kid’: Jailhouse Confessions of a Teen Hacker
https://www.bloomberg.com/news/features/2025-09-19/multimillion-dollar-hacking-spree-scattered-spider-teen-s-jailhouse-confessions

2025-09-10 09:52:32 UTC

I am begging...does anybody know how to stop Microsoft from automatically shutting down my laptop, ever? There is supposedly a setting to disable this but I can't find it. This is the fourth or fifth time it's happened that has set me back in terms of things I'm working on.

2025-09-08 11:41:24 UTC

The Untold Saga of What Happened When DOGE Stormed Social Security
https://www.propublica.org/article/inside-doge-social-security-takeover-leland-dudek

2025-08-28 12:21:24 UTC

Euro banks block billions in rogue PayPal direct debits after fraud glitch
https://www.theregister.com/2025/08/28/euro_banks_block_paypal_direct_debits/

2025-08-27 18:45:07 UTC

- reply

I asked Sherrod, and she said all they know is that they are a financially motivated threat actor but aren't capable of much attribution beyond that.

2025-08-27 18:05:56 UTC

Microsoft issued a blog post today on a new hellacious ransomware attack by Storm-0501 that hops from on-prem assets to the cloud and then deletes everything it can, including backups, while encrypting everything else.
Thanks to [@sherrod_im](https://twtr.plus/users/sherrod_im ) DiGrippo for sharing her thoughts with me on this brutal new attack chain.
https://www.csoonline.com/article/4046438/storm-0501-debuts-a-brutal-hybrid-ransomware-attack-chain.html

2025-08-06 12:27:52 UTC

This is just sensationally bad: Microsoft struck a deal with the Israeli secret intelligence arm Unit 8200 that allowed it to build a powerful new mass surveillance tool that collects and stores recordings of millions of mobile phone calls made each day by Palestinians in Gaza and the West Bank.
‘A million calls an hour’: Israel relying on Microsoft cloud for expansive surveillance of Palestinians
https://www.theguardian.com/world/2025/aug/06/microsoft-israeli-military-palestinian-phone-calls-cloud

2025-08-03 21:09:17 UTC

27 Behind the Scenes Polaroid Snapshots From the Making of the 1995 Cult Classic “Hackers”
https://www.vintag.es/2025/07/hackers-polaroids.html

2025-08-03 08:21:35 UTC

https://www.tomshardware.com/tech-industry/cyber-security/leading-phone-repair-and-insurance-firm-collapses-after-paying-crippling-ransomware-demand-cutting-100-employees-to-just-eight-wasnt-enough
Leading phone repair and insurance firm collapses after paying crippling ransomware demand — Cutting 100+ employees to just eight wasn’t enough

2025-07-23 13:55:47 UTC

OMFG
"A hacker compromised a version of Amazon’s popular AI coding assistant ‘Q’, added commands that told the software to wipe users’ computers, and then Amazon included the unauthorized update in a public release of the assistant this month"
https://www.404media.co/hacker-plants-computer-wiping-commands-in-amazons-ai-coding-agent/?ref=daily-stories-newsletter

2025-07-22 19:46:44 UTC

- reply

"Cognizant was not duped by any elaborate ploy or sophisticated hacking techniques," according to a copy of the lawsuit reviewed by Reuters. "The cybercriminal just called the Cognizant Service Desk, asked for credentials to access Clorox's network, and Cognizant handed the credentials right over."

2025-07-22 19:44:58 UTC

Lawsuit says Clorox hackers got passwords simply by asking
https://www.reuters.com/legal/government/lawsuit-says-clorox-hackers-got-passwords-simply-by-asking-2025-07-22/

2025-07-15 12:07:25 UTC

- reply

We are on our own now. The mainstream press has abandoned us.

2025-07-01 18:10:24 UTC

Senate strikes AI provision from GOP bill after uproar from the states
https://apnews.com/article/congress-ai-provision-moratorium-states-20beeeb6967057be5fe64678f72f6ab0

2025-06-30 11:54:44 UTC

- reply

Yeah, it's just part of the game, I guess. But when I talk to cyber threat intel analysts about what foreign threat actors do to the US, I frequently ask the question: Do we not do the same thing? Like, haven't we hacked China's telecom infrastructure too?

2025-06-25 11:25:07 UTC

A website developed for the UK Home Office's 2022 "flop" anti-encryption campaign has seemingly been hijacked to push a payday loan scheme.
https://www.theregister.com/2025/06/25/home_office_antiencryption_campaign_website/?mid=1#cid=2936061

2025-06-20 13:40:27 UTC

Don't head out for the weekend until you've checked out today's Metacurity for the most critical infosec developments you should know, including
--Report of 16 billion credential breach debunked,
--Hegseth is under pressure to find Haugh's replacement,
--Israeli hackers released Nobitex source code,
--Czech president says China and Russia are hacking equals,
--China has repeatedly hacked Russia,
--Ryuk suspect extradited to US,
--Korean megachurch hacked to display DPRK flag,
--Oz kiddie social media ban nears reality,
--Krispy Kreme confirms 160K customers' data stolen,
--Oxford City Council hit by cyber incident,
--Taiwan's Feng Chia University hit by ransomware,
--X account of Andreessen Horowitz hijacked,
--New AI agent protocol can create malicious tickets,
--Banana Squad exploits GitHub to spread malware,
--Reputation-related cyber incidents cost shareholders 27%,
--Tadaweb raises $20m,
--France’s Gendarmerie has 100K Linux machines,
--Cloudflare blocked 7.3 Tbps attack,
--Poverty-stricken workers fired for susceptibility to hacker bribes
https://www.metacurity.com/report-of-16-billion-credentials-breach-debunked/

2025-06-18 08:50:33 UTC

https://www.bbc.com/news/articles/cvg85r4yr5jo
Your most sensitive data is apparently worth £10 but only if you spend £40.

2025-06-07 15:05:07 UTC

Um, yeah...
White House security staff warned Musk’s Starlink is a security risk
https://wapo.st/459sFuR

2025-05-28 08:59:49 UTC

Exclusive: Legal Practice Board of Western Australia confirms Dire Wolf ransomware attack
https://www.cyberdaily.au/security/12158-exclusive-legal-practice-board-of-western-australia-confirms-dire-wolf-ransomware-attack

2025-05-20 21:44:38 UTC

- reply

Good lord. "The brief attack appears to have been a test run for a massive new Internet of Things (IoT) botnet capable of launching crippling digital assaults that few web destinations can withstand."

2025-05-16 12:34:34 UTC

This should be much bigger news.
CrowdStrike discovered that state officials in Rhode Island had been unaware for more than five months that its VPN system, managed by Deloitte, had been hacked. Deloitte didn't know until the hackers asked for a ransom.
Now, it looks like RI will sue Deloitte.
https://www.bostonglobe.com/2025/05/15/metro/ribridges-vpn-hack-ri-breach-personal-data-investigation-findings/
Here is the CrowdStrike report.
https://admin.ri.gov/sites/g/files/xkgbur536/files/2025-05/RIBridges%20Investigation%20Summary%20FINAL%20-%20External%20Release.pdf

2025-05-15 11:40:16 UTC

The Coinbase hack is expected to cost the company up to $400 million, and the company has launched a $20 million reward fund for information leading to the attackers’ arrest and conviction.
https://www.investing.com/news/stock-market-news/coinbase-discloses-security-breach-expects-impact-of-up-to-400m-4047654

2025-05-11 21:39:31 UTC

"Looking back now on the flag-planting internet movies of 1995, it’s incredible how well they predicted the possibilities and horrors on the horizon."
https://www.fastcompany.com/91330930/30-years-hackers-the-net-predicted-possibilities-horrors-internet-culture-90s

2025-05-07 13:07:54 UTC

Oh goodie...
Generative AI will surpass cybersecurity in many corporate tech budgets this year
https://www.geekwire.com/2025/generative-ai-tops-cybersecurity-in-2025-tech-budget-priorities-new-aws-study-finds/

2025-05-01 14:48:07 UTC

What the actual f?
"On Wednesday afternoon, Krebs received an email saying that his Trusted Traveler Program status had changed. He logged into the program and learned his Global Entry program membership had been revoked."
https://www.cnn.com/2025/04/30/politics/chris-krebs-cbp-global-entry-revoked

2025-04-29 11:06:23 UTC

Oracle engineers caused days-long software outage at U.S. hospitals
https://www.cnbc.com/2025/04/28/oracle-engineers-caused-days-long-software-outage-at-us-hospitals.html

2025-04-18 12:24:53 UTC

Dozens of mobile providers across 35 countries are routing mobile traffic through major Chinese interconnect providers such as China Mobile International, China Telecom Global and China Unicom Global, allowing the Chinese telcos to conduct MITM attacks, track device locations in real time, intercept SMS and voice communications and "silently push spyware or malware onto target devices using signaling-level attacks."
https://dd80b675424c132b90b3-e48385e382d2e5d17821a5e1d8e4c86b.ssl.cf1.rackcdn.com/external/iverify-abusing-data-in-the-middle.pdf
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/358/946/428/172/187/original/872ff2327983b6fd.png

2025-04-17 13:48:57 UTC

Check out today's Metacurity for the most crucial infosec developments you should know, including
--Krebs quits SentinelOne to fight Trump's punitive order
--Third parties step forward to insulate vulnerability reporting from US government whims,
--State Department shutters foreign disinformation monitoring office,
--Fraudulent bot students steal aid funding,
--DOGE returns to NLRB,
--UK minister's X account hacked,
--Apple issues emergency patches,
--much more
https://www.metacurity.com/krebs-quits-sentinelone-to-fight-trumps-punitive-order/

2025-04-16 11:44:47 UTC

Oh wow. This just in from a CISA spokesperson:
“The CVE Program is invaluable to cyber community and a priority of CISA. Last night, CISA executed the option period on the contract to ensure there will be no lapse in critical CVE services. We appreciate our partners’ and stakeholders’ patience.”

2025-04-14 11:57:54 UTC

I haven't listened yet, but folks I admire say that this TED talk is a killer.
https://www.youtube.com/watch?v=TZOoT8AbkNE&ab_channel=TED

2025-04-14 11:06:33 UTC

Mandatory short duration TLS certificates are probably coming soon
https://utcc.utoronto.ca/~cks/space/blog/web/ShortTLSCertificatesComing

2025-04-10 15:22:50 UTC

- reply

Traders have climbed off their temporary euphoria of yesterday and realized that Trump's tariffs have pushed other nations to flee the US as a reliable trading partners, and significantly raised the cost of Chinese imports, including components that all tech service providers, including cybersecurity companies, need.

2025-04-10 15:18:32 UTC

Just g-damn.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/314/331/542/837/956/original/fdfe970f11d4be29.png

2025-04-10 13:00:53 UTC

Chris Krebs and SentinelOne face a long slog to redress Trump's EO stripping them of their security clearances.
This is the latest in a string of similar punitive actions against a host of Trump "enemies." As one legal expert told me, “We might as well live in Stalin’s Soviet Union.”
Check out my latest piece in CSO.
Trump revokes security clearances for Chris Krebs, SentinelOne in problematic precedent for security vendors
https://www.csoonline.com/article/3958808/trump-revokes-security-clearances-for-chris-krebs-sentinelone-in-problematic-precedent-for-security-vendors.html

2025-03-26 12:11:44 UTC

Exclusive: DOGE staffer, 'Big Balls', provided tech support to cybercrime ring, records show
https://www.reuters.com/world/us/doge-staffer-big-balls-provided-tech-support-cybercrime-ring-records-show-2025-03-26/

2025-03-23 15:41:10 UTC

CEO of AI ad-tech firm pledging “world free of fraud” sentenced for fraud
https://arstechnica.com/gadgets/2025/03/ceo-of-ai-ad-tech-firm-pledging-world-free-of-fraud-sentenced-for-fraud/

2025-03-17 11:13:45 UTC

The greatest thing of the day - when Microsoft needlessly demanded a PoC video for a vulnerability that analyst Will Dormann discovered and was well-documented, he submitted a 15-minute video that contained a clip from Zoolander, in which the protagonist unveils the "Center for Kids Who Can't Read Good," as well as a punchy techno backing track while wasting the reviewer's time with approximately 14 minutes of inactivity.
https://www.theregister.com/2025/03/17/microsoft_bug_report_troll/

2025-03-04 17:19:30 UTC

Exclusive: Fired US government workers with top security clearances were not given exit briefings, sources say
https://www.reuters.com/world/us/fired-us-government-workers-with-top-security-clearances-were-not-given-exit-2025-03-04/

2025-03-02 11:28:50 UTC

https://www.cnn.com/2025/02/28/politics/us-intel-russia-china-attempt-recruit-disgruntled-federal-employees/index.html
Exclusive: US intel shows Russia and China are attempting to recruit disgruntled federal employees, sources say

2025-02-10 12:24:09 UTC

Penetration Testers Arrested During Approved Physical Penetration Testing
https://gbhackers.com/penetration-testers-arrested-during-approved-physical-penetration-testing/

2025-02-06 08:22:40 UTC

https://www.wired.com/story/edward-coristine-tesla-sexy-path-networks-doge/
DOGE’s Mr. Big Balls owns dozens of Russian domains, one active Russian website, tried to buy powerful DDoS capability and so much more.
And yes, he’s still a teenager.
“If I was doing the background investigation on him, I would probably have recommended against hiring him for the work he’s doing,” says EJ Hilbert, a former FBI agent who also briefly served as the CEO of Path Network prior to Coristine’s employment there.

2025-02-02 17:46:53 UTC

"The DOGE personnel demanded to be let in and threatened to call US Marshals to be allowed access, two of the sources said.
Three of the sources said the DOGE personnel wanted to gain access to security systems and personnel files. Two of those sources said also they wanted access to classified information."
Senior USAID security officials put on leave after refusing Musk’s DOGE access to agency systems
https://www.cnn.com/2025/02/02/politics/usaid-officials-leave-musk-doge/index.html?cid=ios_app

2025-01-31 21:09:54 UTC

Musk has locked OPM workers out of their computer systems.
Exclusive: Musk aides lock government workers out of computer systems at US agency, sources say
https://www.reuters.com/world/us/musk-aides-lock-government-workers-out-computer-systems-us-agency-sources-say-2025-01-31/

2025-01-24 11:09:18 UTC

Folks, I haven't been posting on Facebook or Instagram for at least a week and don't intend ever to post there again.
But with X and Threads out of the question, the only social media outlets I have to help boost the circulation of Metacurity are this one and one over at BlueSky.
So, if you can, please help me keep Metacurity growing by boosting my posts here or passing on the site to your colleagues. Thank you.
Instagram and Facebook Blocked and Hid Abortion Pill Providers’ Posts
https://www.nytimes.com/2025/01/23/technology/instagram-facebook-abortion-pill-providers.html?smid=nytcore-ios-share&referringSource=articleShare

2025-01-18 14:48:51 UTC

"Norway is sounding the alarm after discovering that Russia is no longer only disrupting the Global Navigation Satellite Systems (GNSS) across the border, but also spoofing GPS signals, an attack that can cause significant disruption to commercial aviation."
"We were spoofed on approaching Kirkenes today”
https://www.thebarentsobserver.com/news/we-were-spoofed-on-approaching-kirkenes-today/423323

2024-12-28 12:29:05 UTC

- reply

that’s weird. When I click on it I don’t have the same issue.

2024-12-28 11:50:49 UTC

https://www.nicholsonstudentmedia.com/news/hackers-steal-more-than-100k-from-ucf/article_1c9ae4a4-bd07-11ef-b191-135f176344d2.html
This is interesting. A BEC scammer flooded the University of Central Florida’s inbox with spam to prevent the school from reading an email from a vendor who denied the veracity of a fake invoice.
“However, due to what the audit described as an email bomb, or an intentional influx of emails sent in an attempt to cover up a scam, responses were delayed because of the amount of spam in the university's inboxes.”

2024-12-14 11:03:16 UTC

https://www.golocalprov.com/news/ri-massive-hack-hundreds-of-thousands-ss-banking-information-names-dob
Right before Christmas, RI is forced to close its SNAP food and Medicaid systems due to what sounds like a ransomware attack.
“At an unprecedented Friday night press conference held by Governor Dan McKee, he claimed that the State of Rhode Island was first notified on December 5 of a potential major massive cyberattack.
McKee disclosed late on Friday that the state’s system to support everything from SNAP benefits to Medicaid to HealthsourceRI are all now closed.”

2024-12-08 10:37:27 UTC

https://www.timesofisrael.com/liveblog_entry/syrian-sources-say-assad-may-have-been-killed-in-plane-crash-during-escape/
Reuters hasn’t confirmed it but reports are that Assad was killed in a plane crash.

2024-12-04 22:59:29 UTC

Not a good month for telecoms!
Scattered Spider Teen Hacked Telecoms to Spam Victims, US Says
https://www.bloomberg.com/news/articles/2024-12-04/scattered-spider-teen-hacked-telecoms-to-spam-victims-us-says

2024-12-04 13:20:05 UTC

- reply

Interesting. Why would they be filtering some networks?

2024-12-04 13:09:39 UTC

The German Federal Police (BKA) website has been offline for quite a while this morning.
I'm not saying there is a connection, but yesterday, news broke that the BKA helped take down the cybercrime marketplace Crimenetwork and I've been trying to read the BKA's statement for about an hour.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/594/705/754/760/586/original/7dbe75e2c8e32a8d.png

2024-11-29 19:56:21 UTC

https://www.nytimes.com/2024/11/29/world/canada/canada-openai-lawsuit-copyright.html
Major Canadian News Outlets Sue OpenAI in New Copyright Case

2024-11-27 19:01:23 UTC

- reply

I can see how the writer interpreted the small MSP space "really doesn't matter" as "won't be missed."
But I will delete my toot that quoted the article directly to not create any confusion.

2024-11-18 20:26:58 UTC

- reply

Same and I’ve been this way for nearly two weeks for some reason.

2024-11-18 13:53:24 UTC

Check out today's Metacurity for the most critical infosec developments you might have missed over the weekend, including
--T-Mobile hacked yet again, this time by China's Salt Typhoon
--Rand Paul guns for CISA,
--Trump wants relaxed cyber rules,
--Easterly to leave CISA on 1/20,
--Library of Congress emails hacked,
--Turkey fines Twitch for breach,
--Pro-Russian hackers breached German stats agency,
--Hacker returns $25M to Thala Labs,
--Hacker steals $12M from Polter Finance,
--much more
https://www.metacurity.com/t-mobile-hacked-yet-again-this-time-by-chinas-salt-typhoon/

2024-11-14 20:07:57 UTC

- reply

"sex trafficking drug addicted piece of shit" 😂

2024-11-11 22:12:07 UTC

It's funny, but the tiniest blip of news results in a cascade of emails from PR folks pushing their experts for commentary.
After last week's election earthquake, I have received precisely zero emails from folks offering up their experts for comment.

2024-11-10 16:02:25 UTC

State Department Division That Battles Foreign Disinformation Faces Closure
https://www.wsj.com/politics/national-security/state-department-division-that-battles-foreign-disinformation-faces-closure-315e58b7

2024-11-07 15:12:06 UTC

- reply

I deleted mine yesterday after not posting there for over two years.

2024-11-06 08:09:03 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/434/982/766/629/381/original/618a03c2a45f5853.png