Kevin Beaumont

Cybersecurity weather person and award winning shitposter. Shitposting is an anagram of Top Insights. You may be surprised to know I am not representing my employer here and these are not their opinions.

I have Direct Messages disabled - you can send them, but I will never receive them.

My website: https://doublepulsar.com
Github: https://github.com/GossiTheDog
Signal: GossiTheDog.1337

Public Key

npub1lcc6wn885u6k395x5j5tmdm94r6dh9zajxm8gyk82pv2s2j3el7sc6lcye

NIP-05 Address

gossithedog_at_cyberplace.social@momostr.pink

Profile Code

nprofile1qqs0uvd8fnn6wdtgj6r2f29akaj63axmj3werdn5ztr4qk9g9fgullgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsc6sxv8

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1lcc6wn885u6k395x5j5tmdm94r6dh9zajxm8gyk82pv2s2j3el7sc6lcye

Show more details

Last Notes

2026-03-18 19:08:38 UTC

- reply

the word create isn't in the thread anywhere

2026-03-18 18:40:41 UTC

Free copy of Battlefield 6 (PC I'm presuming) for anybody with an EA account -- 3F5T-NDK4-WN93-VEBH
https://www.ea.com/redeem

2026-03-18 18:11:57 UTC

- reply

don't worry, all these orgs are also hyping GenAI as the next big thing.
https://cyberplace.social/system/media_attachments/files/116/251/510/836/803/012/original/fdc1725cd4cbb52c.png
https://cyberplace.social/system/media_attachments/files/116/251/514/609/970/328/original/2eac8fb36b2b3bbc.png
https://cyberplace.social/system/media_attachments/files/116/251/519/073/424/378/original/386f8f5b11ae2a58.png
https://cyberplace.social/system/media_attachments/files/116/251/523/822/865/124/original/b47c42a7d5a6320f.png

2026-03-18 18:06:36 UTC

Meta, having renamed itself Meta and spending billions on it, is shutting down it's metaverse VR platform. https://www.theshortcut.com/p/meta-is-shutting-down-horizon-worlds-vr-despite-investing-billions-into-the-metaverse
https://cyberplace.social/system/media_attachments/files/116/251/502/489/240/665/original/d1f9af6fb14e849b.png

2026-03-18 15:15:24 UTC

We winning. https://www.bbc.co.uk/news/articles/cvg1gr5v333o

2026-03-16 23:35:08 UTC

RE: https://mastodon.social/@404mediaco/116241338503387167
Add this to the long list of execs fucking up their entire company using GenAI - CEO decides he doesn’t want to pay $250m bonus to staff, asks ChatGPT how to avoid it, his legal team tell him ‘are u fuckin dumb’, he does it anyway, gets sued, and loses in court.
#note1c24…x5y2

2026-03-16 17:13:30 UTC

- reply

Stryker have a liveblog of their security incident, linked from the front page of their website:
https://www.stryker.com/gb/en/about/news/a-message-to-our-customers-03-2026.html
tl;dr is most customer systems aren't impacted as they run on Linux, but their corporate Windows systems are toast so please hold the line.

2026-03-16 13:33:05 UTC

- reply

I still don't understand the US war on Iran. They declared war, then said it wasn't a war, then it was, then it wasn't, then it was, then declared victory, said Iran's military was totally disabled.. and now they're begging for help from the rest of the world as things keep getting blown up?
Like - what is the plan here?
There's not point asking the UK for help, we probably sold all our boats to Lidl.

2026-03-15 19:46:48 UTC

In other news, Hulu passed on the Buffy reboot, they didn't like the pilot. It's easy to be cynical about that one but from what I'd heard it was actually good, and weird, and got death'd by a thousand exec cuts of clueless people going "we made Buffy The Vampire What?!"

2026-03-15 19:38:42 UTC

The Firefly cast have secured the rights to Firefly, and plan to turn it into an animated series with the original cast voicing. https://deadline.com/2026/03/nathan-fillion-firefly-animated-series-development-1236754122/

2026-03-14 17:23:23 UTC

Buzzfeed journey:
- Successful
- Pivoted to GenAI for content
- Laid everybody off
- Now admits it probably can't stay in business
https://futurism.com/artificial-intelligence/buzzfeed-disastrous-earnings-ai

2025-11-20 18:39:26 UTC

If you use Sourcescrub by Datasite, they're dumping all the things people export into a public Azure Storage Blob - prodscrubstorage.blob.core.windows.net
http://prodscrubstorage.blob.core.windows.net/export?restype=container

2025-09-18 13:24:01 UTC

- reply

I believe this is the fourth time Thalha Jubair has been arrested btw.
https://cyberplace.social/system/media_attachments/files/115/225/515/685/588/640/original/bfa1ae038d897ece.mp4

2025-09-18 13:22:10 UTC

- reply

Suspect arrested for M&S hack have been rearrested (again), this time for Transport for London hack last year: https://therecord.media/scattered-spider-teenage-suspects-arrested-britain-nca

2025-09-15 17:30:14 UTC

- reply

Marks and Spencer CTO leaves, CISO still in role.
It’s difficult to see what happened as her fault - eg the decision to outsource the frontline IT helpdesk that did the password resets dates 5 years before she joined.
https://www.computerweekly.com/news/366630565/MS-parts-ways-with-CTO-after-cyber-attack

2025-08-11 09:03:53 UTC

- reply

M&S still working on system recovery. https://www.bbc.com/news/articles/cewyyjdzql4o

2025-08-11 09:03:08 UTC

- reply

I understand the people released have not been charged.

2025-07-17 13:07:57 UTC

- reply

The people arrested as part of the Co-op and M&S hack investigation have been released on bail.
https://nation.cymru/news/four-people-bailed-after-arrests-over-cyber-attacks-on-ms-co-op-and-harrods/
Previously when this happened with LAPSUS$, they just continued hacking stuff.

2025-07-16 08:58:23 UTC

- reply

Personally I think Co-op did a really good job getting out of that situation and minimising impact.
I definitely think if you have a LAPSUS$ style advanced persistent teenagers situation, tilt towards open and honest comms as those kids will use secrecy against ya. It’s 2025, it’s okay to say you got hacked, people largely understand. Also, in IR, lawyers are usually stuck in 1980 advice - it’s just advice, they ain’t yo boss.

2025-07-16 08:47:29 UTC

- reply

Co-op finally admitted the entire membership database was stolen
I had this in the thread months ago, they originally tried to deny it entirely then tried to say ‘some’ data was accessed when they knew it was the whole thing.
https://www.bbc.co.uk/news/articles/cql0ple066po

2025-07-10 21:07:55 UTC

- reply

. @npub1vc3…axsh has broken the story that the key member (and teenager) of LAPSUS$ runs Scattered Spider
https://krebsonsecurity.com/2025/07/uk-charges-four-in-scattered-spider-ransom-group/
https://cyberplace.social/system/media_attachments/files/114/830/978/034/667/877/original/b5253b031d93741e.jpeg

2025-07-10 17:10:53 UTC

- reply

After almost 3 months, Marks and Spencer recruitment system came back online just now. First 4 jobs posted.
https://cyberplace.social/system/media_attachments/files/114/830/043/138/465/663/original/0999651b7bfea908.png

2025-07-10 16:58:28 UTC

- reply

If you ever doubted the link between Scattered Spider(tm) and LAPSUS$ - one of the people arrested today was a key part of the LAPSUS$ attacks a few years ago.

2025-07-10 11:17:17 UTC

- reply

17 and two 19 year old teens picked up over Co-op and M&S hacks, and a 20 year old woman.
Pretend to be surprised.
https://www.bbc.com/news/articles/cwykgrv374eo

2025-07-01 12:56:48 UTC

- reply

Marks and Spencer’s CEO says half of their online ordering is still offline after their ransomware incident, they hope to get open in next 4 weeks.
They are also rebuilding internal systems and hope a majority of that will be done by August.
Lesson: mass contain early. M&S didn’t. Co-op did.
https://www.reuters.com/business/retail-consumer/ms-ceo-most-cyberattack-impact-will-be-behind-us-by-august-2025-07-01/

2025-05-07 11:55:01 UTC

- reply

One thing for media covering the Co-op thing - attackers are not impersonating IT help desks to gain access. They’re impersonating *staff* calling in to the IT help desks - they’re different things.
https://cyberplace.social/system/media_attachments/files/114/466/416/024/433/698/original/f030bca626f42b41.jpeg

2025-05-06 14:52:01 UTC

- reply

Contactless payment has been fixed at all Co-op Group stores.

2025-05-06 10:21:14 UTC

- reply

It sounds like the situation at Co-op has got worse. They’ve stopped taking card payments, it’s cash only. https://www.telegraph.co.uk/business/2025/05/06/co-op-shops-stop-taking-card-payments-amid-cyber-attack/

2025-05-05 16:21:58 UTC

- reply

Co-op Group appear to be trying to course correct with their cyber incident comms.
They’re calling it a cyber incident now, and have put a statement on the front page of their website, along with an FAQ. They haven’t yet emailed members (they should).
https://www.coop.co.uk/cyber-incident

2025-05-05 14:32:41 UTC

- reply

One of the points of exploitation of large orgs is they usually outsource their Service Desk to somewhere cheap offshore who don’t know the org staff, and when you call and say your name, they normally put big all caps bold red warning if the person is a VIP, eg C suite, so they get VIP service - ie anything goes.

2025-05-05 14:18:45 UTC

- reply

BBC News has a look at teenagers phoning helpdesks and pretending to be the CISO. https://www.bbc.com/news/articles/c4grn878712o

2025-05-05 12:23:15 UTC

- reply

The SignalNotSignal hack of US government is really big. Some examples for those who haven’t seen it. The USG managed to take an encrypted platform, backdoor it, and got owned.
https://cyberplace.social/system/media_attachments/files/114/455/202/237/947/143/original/52ac669d4ca17b82.jpeg
https://cyberplace.social/system/media_attachments/files/114/455/202/488/201/917/original/5f18f46f66b82595.jpeg

2025-05-05 10:42:28 UTC

- reply

I’ve been using Recall for a few weeks now on my daily driver.
It scooped up my credit card statements after I logged into online banking - both screenshots (text indexed) of the PDFs, transaction history from the website, and my name, date of birth and security question reminders.
Sensitive filtering mode only kicked in when I viewed my cards CVV number.
Worth excluding bank websites from Recall’s options, if you see it enabled.

2025-05-05 06:25:55 UTC

#NoName are back targeting UK councils. Same config as prior UK runs. #threatintel
https://cyberplace.social/system/media_attachments/files/114/453/797/399/811/939/original/a2ea6e643c9913e9.jpeg

2025-05-05 05:33:55 UTC

- reply

Sky News quote a source in M&S head office saying Marks and Spencer have no ransomware incident plan so they are making it up as they go along apparently, with staff sleeping in the office and communicating via WhatsApp.
M&S dispute this, saying they have robust business continuity plans.
https://news.sky.com/story/amp/mands-had-no-plan-for-cyber-attacks-insider-reveals-with-staff-left-sleeping-in-the-office-amid-paranoia-and-chaos-13361359

2025-05-04 18:40:10 UTC

- reply

Great NCSC piece by [@ollie_whitehouse](https://infosec.exchange/@ollie_whitehouse )
I’d add - block by Entra policy specifically High risk logins (below is too FP prone), and SOC monitor them. SOC playbook = account probably compromised. How?
https://www.ncsc.gov.uk/blog-post/incidents-impacting-retailers

2025-05-04 11:16:59 UTC

- reply

A wrote a piece about paying ransoms does not equal quick restoration - in fact, quite often it makes things worse. https://doublepulsar.com/big-game-ransomware-the-myths-experts-tell-board-members-03d5e1d1c4b7

2025-05-03 20:56:03 UTC

- reply

Sunday Times has a piece looking into ransomware incident at Marks and Spencer. It's pretty good, goes into their contain and eradicate focus.
"By shutting down parts of the IT estate, Higham’s team had worked to prevent the attack from spreading, but had also stopped parts of its digital operations from functioning. This was considered a worthy trade-off."
One error in the article - lack of recovery doesn't mean no ransomware paid. Paying is not quick restoration.
https://www.thetimes.com/business-money/companies/article/m-and-s-cyber-attack-ms-klrnxvwq6
https://cyberplace.social/system/media_attachments/files/114/445/873/790/799/993/original/366d4e68b247f7c3.png

2025-05-03 16:52:07 UTC

- reply

Here's the ITV News report anyhoo, logline: "ITV News understands the the ongoing cyberattack faced by the supermarket has worsened since Friday, impacting the ordering system, drivers and warehouse staff."
https://www.itv.com/news/2025-05-03/worsening-cyberattack-shuts-down-co-op-orders-itv-news-understands

2025-05-03 16:27:51 UTC

- reply

There's a report on ITV News that Co-op member data is available on the Dark Web(tm), but as far as I know this isn't accurate. DragonForce's portal hasn't been available for over a week.
https://cyberplace.social/system/media_attachments/files/114/444/827/549/010/837/original/40d434fbac7c69bf.png

2025-05-02 23:26:54 UTC

- reply

By the way, this is absolutely terrible advice for dealing with a major and high visibility ransomware incident.
https://cyberplace.social/system/media_attachments/files/114/440/825/134/064/907/original/a4b8dbace31247be.jpeg

2025-05-02 23:24:45 UTC

- reply

One of M&S’ biggest suppliers have said they have reverted to pen and paper for orders due to M&S lacking IT.
Additionally, M&S staff are raising concern about how they will be paid due to lack of IT systems.
M&S are over a week into a ransomware incident and still don’t have their online store working.
https://www.bbc.com/news/articles/cvgnyplvdv8o
#threatintel #ransomware

2025-05-02 19:58:23 UTC

- reply

Bleeping Computer have more on the Co-op breach https://www.bleepingcomputer.com/news/security/co-op-confirms-data-theft-after-dragonforce-ransomware-claims-attack/
#threatintel #ransomware
https://cyberplace.social/system/media_attachments/files/114/440/005/208/877/125/original/0c84e4558d7e9dc4.jpeg

2025-05-02 19:53:27 UTC

- reply

Pass the bong
https://cyberplace.social/system/media_attachments/files/114/439/985/794/564/818/original/f7ebe7e360547636.jpeg

2025-05-02 19:49:46 UTC

- reply

Regarding IOCs around the UK retailer activity - there’s loads doing the rounds, and they’re almost all not useful.
Eg hundreds of dynamic VPN IPs from 2022. If you google them you’ll find them on vendor blogs from years ago for Scattered Spider - people are recycling in panic and passing around in panic.
Don’t hunt on random IOCs. IP addresses change. Strengthen foundational controls. Review sign in logs for abnormal activity etc.

2025-05-02 18:33:10 UTC

- reply

New by me - breaking down the attacks on UK highstreet retailers
https://doublepulsar.com/dragonforce-ransomware-cartel-attacks-on-uk-high-street-retailers-walking-in-the-front-door-52ed8ba68534

2025-05-02 17:51:34 UTC

- reply

Co-op Group have now admitted a significant amount of member (customer) information has been stolen by DragonForce Ransomware Cartel, saying they "accessed data relating to a significant number of our current and past members" - around 20 million people. The Member database, basically.
Up until now Co-op hadn't even used the words cyber or threat actor, referring to an "IT issue" and "third party" in comms.
https://www.bbc.co.uk/news/articles/crkx3vy54nzo

2025-05-02 17:17:15 UTC

- reply

The individuals operating under the DragonForce banner are using social engineering for entry.
Defenders should urgently make sure they have read the CISA briefs on Scattered Spider and LAPSUS$ as it's a repeat of the 2022-2023 activity.
Links: https://www.cisa.gov/sites/default/files/2023-08/CSRB_Lapsus%24_508c.pdf
https://www.cisa.gov/sites/default/files/2023-11/aa23-320a_scattered_spider_0.pdf
I would also suggest these NCSC guides on incident management: https://www.ncsc.gov.uk/collection/incident-management
and effective cyber crisis comms: https://www.ncsc.gov.uk/guidance/effective-communications-in-a-cyber-incident
https://cyberplace.social/system/media_attachments/files/114/439/364/451/611/425/original/88443a28e91c4812.png

2025-05-02 17:13:18 UTC

- reply

I'm going to make this the new ongoing megathread for DragonForce Ransomware Cartel's attack on UK retailers as they're all connected.
Why it matters: these are some of the UK's largest retailers, think Target or some such in a US sense.
Prior threads
M&S: https://cyberplace.social/@GossiTheDog/114381946765071799
Co-op: https://cyberplace.social/@GossiTheDog/114426688834113446
Harrods:
https://cyberplace.social/@GossiTheDog/114433519351165250

2025-05-02 16:56:56 UTC

DragonForce Ransomware Cartel are claiming credit for attacks on Marks and Spencer, Co-op and Harrods and say more are coming https://www.bloomberg.com/news/articles/2025-05-02/-dragonforce-hacking-gang-takes-credit-for-uk-retail-attacks
https://cyberplace.social/system/media_attachments/files/114/439/291/680/282/586/original/e2f2cb46a87536b1.jpeg

2025-04-29 21:38:23 UTC

Lord, feel sorry for the M&S CISO. He only arrived just over a year ago.
It looks like they outsourced lots of their IT systems to TCS many years ago. He's spend years warning about ransomware and now he's on the hook for a barn fire likely caused by years of prior decisions.

2025-04-16 20:14:55 UTC

- reply

I’m very tempted to take next week off work 😅
https://cyberplace.social/system/media_attachments/files/114/349/473/220/930/641/original/f79c99058d414276.jpeg

2025-04-16 20:08:18 UTC

- reply

Oblivion Remastered vs vanilla comparison https://youtu.be/BppeLAz37rc

2025-04-16 14:31:21 UTC

- reply

CVE extension to March 16th 2026
See y’all March 15th 2026 for the last minute renewal 🫡😅
https://www.usaspending.gov/award/CONT_AWD_70RCSJ24FR0000018_7001_70RSAT20D00000001_7001
https://cyberplace.social/system/media_attachments/files/114/348/122/205/370/434/original/574ab8fc6e0c1081.jpeg

2025-04-15 21:38:37 UTC

- reply

Just as an update to this - @npub1vc3…axsh has confirmed with MITRE the letter is real, and as it stands the CVE database is likely to offline tomorrow.

2025-04-15 18:58:37 UTC

- reply

My take on the CVE contract issue for businesses: don’t overreact, wait and see what impacts are.
The NVD backlog was already pretty crazy.. the US gov has gotta put real funding into this area if it wants to retain control of cyber standards.

2025-04-03 13:05:12 UTC

- reply

Also in both cases Oracle hasn’t filed an 8-K or told regulators or provided an IR report to customers or a written technical statement of what happened or put anything on their website or commented to press.

2025-04-03 12:55:16 UTC

- reply

To answer my own question up thread - from talking to people, the Oracle Health breach appears to be unrelated to the Oracle SaaS incident this thread describes.
In both cases they’re being extorted, and in both cases they’re working with the FBI and external incident response.

2025-04-03 12:09:26 UTC

- reply

Oracle were still trying to get SaaS solutions *they* manage off Oracle Classic aka Gen1 as of 2023. They made a mess of it.
https://cyberplace.social/system/media_attachments/files/114/273/954/152/805/333/original/9462e09daeffbb8b.jpeg

2025-04-03 12:05:46 UTC

- reply

Yeah, by legacy system Oracle mean ‘a system we manage housing active customer data’. They’ve also been telling people it isn’t Oracle Cloud.. but it is, and they know it is, they’re just doing customer talking points to wordsmith around it.
https://infosec.exchange/@Fringedcrow/114273919390396133

2025-04-03 08:54:12 UTC

- reply

The Bloomberg article is paywall so here’s screenshots.
https://cyberplace.social/system/media_attachments/files/114/273/186/220/506/506/original/f8f2490848206049.jpeg
https://cyberplace.social/system/media_attachments/files/114/273/186/529/949/197/original/42a2ca8df53b03fb.jpeg

2025-04-03 08:25:37 UTC

- reply

“The company informed customers that the system has not been in use for eight years and that the stolen client credentials therefore pose little risk, the report added. The stolen data included Oracle customer log-in credentials from as recently as 2024, the report said.”
This would be Oracle Classic, aka Gen1. I’ve been told the systems were left online after migration.. unpatched.
Oracle are trying to play legacy angle - but what else was stolen? What else did the attacker do? Why cover up?

2025-04-03 08:22:25 UTC

- reply

We have an update. Reuters and Bloomberg confirm my blog, that’s there’s a security incident going on at Oracle cloud. Oracle declined to comment, after lying to @npub1pkr…6763 and other outlets on the record.
CrowdStrike is the IR company.
“Oracle staff acknowledged to some clients this week that an attacker had gotten into a legacy environment, Bloomberg News report said.”
https://www.reuters.com/technology/cybersecurity/oracle-tells-clients-second-recent-hack-log-in-data-stolen-bloomberg-news-2025-04-02/

2025-04-02 17:21:23 UTC

- reply

100% on this one, seen all the time on real world incidents.
Problem: somebody got a password for an account and nobody knows how.
How: the business user signed into their personal Google account in Chrome at work, which synced all their bookmarks and saved passwords to Google. Then they switched on their home PC, Chrime synced, and infostealer took all the details
Solution: Google Chrome ADMX, and set Group Policy to turn off personal account sign in with Chrome.
https://infosec.exchange/@Walker/114268652560517693

2025-04-02 16:20:00 UTC

- reply

I should also point out there's a lot of infosec people at trillion dollar tech companies sat thinking quantum and AI is going to be the next big problem...
...when in reality SMBs make up a vast majority of the global economy - and are getting owned by people running this as they can't work out nmap parameters, while playing Call of Duty on their second monitor (this isn't even a joke, this was a ransomware deployment):
https://cyberplace.social/system/media_attachments/files/114/269/268/098/136/656/original/1f351dc552d9a58a.png

2025-04-02 15:16:55 UTC

- reply

Finally, if you want the raw incident data to analyse, Sophos has it, anonymized: https://github.com/sophoslabs/Active_Adversary_Report/blob/main/sophos-aar2501-github-share.csv

2025-04-02 15:15:06 UTC

- reply

Notably, for the second year running (and same with all prior reports) (and the same across other IR and MDR providers), the report doesn't mention AI or Generative AI once.
Absolutely not popular to say that and always get next to zero engagement on LinkedIn, but let me be super clear on this one:
The threat to your business is foundational IT and security. The big incident that screws you over will be somebody pointing and clicking. Focus on what actually matters, not AI.

2025-04-02 15:12:07 UTC

- reply

In 84% of cases - you know, almost all - attackers use RDP, aka Remote Desktop.
Yes, you think attackers are hacking the matrix and using Generative AI to generate 31337 code... but in fact, almost all of them are using Remote Desktop to *point and click* hack you.
There's some really good recommendations in that for monitoring internal RDP usage. It's by far one of the biggest ways to catch people internally being naughty. Why is somebody RDPing to a domain controller at 3am?
https://cyberplace.social/system/media_attachments/files/114/269/004/298/623/743/original/261720b193529c4f.png

2025-04-02 15:09:31 UTC

- reply

If you have a way of being able to block or at least alert on software, yeet these:
- SoftPerfect Network Scanner
- AnyDesk
- mimikatz (lol 2025)
- Rclone
- WinRAR
- Advanced IP Scanner
- Advanced Port Scanner
https://cyberplace.social/system/media_attachments/files/114/268/995/801/228/130/original/3e670dbc98e71494.png

2025-04-02 15:07:31 UTC

- reply

Bruteforce and external remote access drives a significant portion of incidents, which also ties to compromised credentials (78% of cases is remote access with valid creds, infostealers go brrrr).
CitrixBleed was 5% of all security incidents - may explain why I made an MSPaint.exe logo for it
The long story short is you need really robust authentication - if you get it wrong, you are toast in 2025 - and really, really robust external services patching. Don't ever present RDP to the internet.
https://cyberplace.social/system/media_attachments/files/114/268/985/251/405/106/original/b56a028a2912c150.png

2025-04-02 13:00:21 UTC

- reply

Compromised credentials continue to drive a majority of incidents. Why? home PCs and infostealers.
MS Recall got the shite kicked out of it because it would have been a disaster for exactly this reason, we don't need to pour petrol on that already raging and unsolved fire.
Bruteforcing of VPNs and exploitation of network border vulnerabilities continues to be a major (and growing) problem.
Bang for buck: Concentrate on MFA everything, patch everything internet facing, monitor bruteforce.
https://cyberplace.social/system/media_attachments/files/114/268/477/001/972/365/original/4f9e7c5d782aeef0.png

2025-04-02 12:55:31 UTC

The 2025 Sophos Active Adversary Report is out.
I thread these every year as, personally, I think yearly IR and MDR reports are the best source of data for defenders on _real world_ threats.
https://news.sophos.com/en-us/2025/04/02/2025-sophos-active-adversary-report/
Key take aways for me:
- Despite what you read from scare vendors, ransomware dwell time (initial access to deployment) is still measured days.
It is not hopeless and by active monitoring you *can* stop attackers.
https://cyberplace.social/system/media_attachments/files/114/268/471/173/532/870/original/2e2261a255c41905.png

2025-04-02 12:00:13 UTC

- reply

Meanwhile, on the Oracle cloud front, Oracle’s silence is deafening.
https://cyberplace.social/system/media_attachments/files/114/268/255/102/142/354/original/21819ef23b2b1800.jpeg
https://cyberplace.social/system/media_attachments/files/114/268/255/364/172/111/original/966f7d243c226f18.jpeg
https://cyberplace.social/system/media_attachments/files/114/268/255/650/012/976/original/a109334601c72870.jpeg

2025-04-02 11:54:23 UTC

- reply

A class action lawsuit has been filed in the US around Oracle failing to publicly disclose a breach of Oracle Health. https://storage.courtlistener.com/recap/gov.uscourts.txwd.1172831612/gov.uscourts.txwd.1172831612.1.0.pdf

2025-03-31 11:53:59 UTC

- reply

I can confirm there has definitely been a serious security incident at Oracle's managed cloud service, and they're attempting to wordsmith their way out of it. https://doublepulsar.com/oracle-attempt-to-hide-serious-cybersecurity-incident-from-customers-in-oracle-saas-service-9231c8daff4a

2025-03-28 15:31:43 UTC

- reply

Going back to the Oracle Cloud security incident, the 2019 video posted by the threat actor: https://youtu.be/375_G9wAffo
Now has an audio transcription https://github.com/j-klawson/oracle_breach_2025/blob/main/youtube_video_transcript.txt
https://cyberplace.social/system/media_attachments/files/114/240/775/632/585/626/original/608845a01b8aee49.png

2025-03-28 15:27:15 UTC

- reply

There’s now been a data breach at Oracle Health, which is separate to the ongoing security issue at Oracle Cloud.
Oracle have not commented publicly on the breach, instead telling people to only talk to their CISO by phone, not in writing. They’ve sent out letters without Oracle letterheads, using external lawyers instead.
The behaviour going on at Oracle with cybersecurity is extremely alarming.
https://www.bleepingcomputer.com/news/security/oracle-health-breach-compromises-patient-data-at-us-hospitals/

2025-03-26 21:42:15 UTC

- reply

Also, that YouTube video I linked above has two hours of audio of Oracle employees talking. I haven’t transcribed it yet.
Separately, the threat actor has shared what they claim to be current config files from Oracle Cloud servers with a different reporter.
I’m deliberately staying out of this one for now as I’m trying to finish Assassin’s Creed Shadows first.. but I think Oracle may have a pending PR disaster when the TikTok deal is due to complete.

2025-03-26 21:26:28 UTC

- reply

Bleeping Computer say multiple Oracle customers confirm their customer data has been stolen from Oracle Cloud. Oracle continue to deny there is a problem.
https://www.bleepingcomputer.com/news/security/oracle-customers-confirm-data-stolen-in-alleged-cloud-breach-is-valid/

2025-03-26 12:40:31 UTC

- reply

I think it’s entirely possible the US gov will try arresting the reporters and staff at that outlet to try to shut the story down, we’ll see.

2025-03-26 12:37:47 UTC

- reply

More Signal messages have been posted online, sent to a reporter, which clearly show a breach in US national security. https://www.theatlantic.com/politics/archive/2025/03/signal-group-chat-attack-plans-hegseth-goldberg/682176/?utm_source=bluesky&utm_medium=social&utm_campaign=the-atlantic&utm_content=edit-promo
https://cyberplace.social/system/media_attachments/files/114/228/767/200/484/510/original/0d6c1cc2b1ea9f7f.jpeg

2025-03-25 20:39:51 UTC

- reply

lol
https://cyberplace.social/system/media_attachments/files/114/225/000/521/387/503/original/682dc6a53cb32460.jpeg

2025-03-25 17:35:51 UTC

- reply

The Trump administration claims the Signal chats don’t contain classified material, but they refused to release them publicly.
The journalist in the conversations is saying he won’t release them, as they do contain classified information.
https://www.bbc.co.uk/news/live/cg70xgxl3vmt?post=asset%3Ac0c0c6ea-9066-4cd0-88d9-f5b1e59cb801#post
https://cyberplace.social/system/media_attachments/files/114/224/276/946/081/264/original/e3716b7c70329e34.jpeg

2025-03-25 13:11:08 UTC

- reply

Well done to Trump administration officials for starting a major diplomatic crisis via a secure messaging platform that children should be able to operate. https://www.bbc.co.uk/news/live/cg70xgxl3vmt
https://cyberplace.social/system/media_attachments/files/114/223/236/084/839/803/original/9afb858ca922e523.jpeg

2025-03-25 11:01:32 UTC

- reply

CloudSEK are doubling down on their Oracle Cloud breach reporting, despite a denial from Oracle: https://cloudsek.com/blog/part-2-validating-the-breach-oracle-cloud-denied-cloudseks-follow-up-analysis
I am still looking into this and will probably do a blog post this week. The threat actor is still dropping files everywhere and they do tend to point to a security incident at Oracle Cloud.

2025-03-25 09:18:57 UTC

- reply

Well done to the US Gov for becoming headline laughing stock, again.
https://cyberplace.social/system/media_attachments/files/114/222/322/957/006/618/original/530d4755da418684.jpeg

2025-03-24 22:50:59 UTC

How to quit Vi
https://cyberplace.social/system/media_attachments/files/114/219/853/815/520/697/original/91618074edab45a2.jpeg

2025-03-24 21:41:51 UTC

- reply

Nothing to see here move along
https://www.bbc.co.uk/news/live/cg70xgxl3vmt?post=asset%3Ac915585e-03e2-4f45-8da3-b2b162f7186f#post
https://cyberplace.social/system/media_attachments/files/114/219/581/937/428/056/original/b2901d04a7575506.jpeg

2025-03-24 19:43:15 UTC

- reply

Hudson Rock are reporting the Oracle Cloud breach claim threat actor has provided 10k records, and they appear genuine according to one of their customers.
https://www.linkedin.com/posts/alon-gal-utb_big-i-just-received-10000-records-from-activity-7310017463516127232-XWbI
It’s unclear to me exactly what is happening with this one as the threat actor doesn’t appear to understand basic English grammar.. but there are signs something has happened at Oracle.
Big problem for Oracle as I’m not sure how plausible denials will be when threat actor, who sounds 12, is dumping data online.
https://cyberplace.social/system/media_attachments/files/114/219/115/581/579/873/original/d470ab9984e4af67.jpeg

2025-03-24 18:11:07 UTC

- reply

If anybody from Oracle follows me, I definitely think the OCI team needs to spin up security incident response on that YouTube video to try to find out what was happening. It looks like it may be a Citrix session recording of a staff member's access in OCI.
https://cyberplace.social/system/media_attachments/files/114/218/745/158/497/859/original/b5b36c0daca27d37.png

2025-03-24 18:03:12 UTC

- reply

The Oracle thing keeps getting more strange. The threat actor has supplied an hour long YouTube video, which appears to be taken from an endpoint inside Oracle... in 2019. They've also supplied a dump of data from 2025, to Hudson Rock. https://www.youtube.com/watch?v=375_G9wAffo
https://cyberplace.social/system/media_attachments/files/114/218/711/742/869/667/original/8382310060762807.png
https://cyberplace.social/system/media_attachments/files/114/218/715/149/037/272/original/e9928ab55ae16003.png
https://cyberplace.social/system/media_attachments/files/114/218/717/325/542/819/original/cb8c83c51c73398b.png
https://cyberplace.social/system/media_attachments/files/114/218/721/581/577/187/original/7f22d3be1eae3bae.png

2025-03-24 17:21:05 UTC

- reply

In other news, zero click Signal zero days just went up in price... I bet you cashy money if somebody did a forensic inspection of the Trump admin's Apple devices, they'd open pandora's box.

2025-03-24 17:15:23 UTC

- reply

How any of that passes security clearance and compliance etc I do not know, btw.

2025-03-24 17:13:34 UTC

The Trump admin uses Signal to coordinate military operations... and somebody in the Signal group added a member of the press into the group about which targets to bomb in error, and didn't notice. https://www.theatlantic.com/politics/archive/2025/03/trump-administration-accidentally-texted-me-its-war-plans/682151/

2025-03-21 20:50:57 UTC

- reply

Oracle are denying a breach to @npub1pkr…6763, but the threat actor has provided an archived URL which suggests they somehow uploaded a file to the Oracle Access Manager (SaaS solution) frontend.
https://web.archive.org/web/20250301161517/http:/login.us2.oraclecloud.com/oamfed/x.txt?x
https://cyberplace.social/system/media_attachments/files/114/202/394/913/416/345/original/b1a12b9c76ad2a57.jpeg

2025-03-21 18:32:28 UTC

- reply

Has anybody else got Oracle to comment on this? No reply to my queries.

2025-03-21 13:02:50 UTC

- reply

If anybody is interested, the servers they claim they targeted all run Oracle WebLogic and are managed by Oracle as a SaaS service.

2025-03-21 13:00:23 UTC

Somebody is claiming to have exfiltrated 6 million lines of data with Oracle Cloud’s SSO and LDAP data that includes JKS files, encrypted SSO passwords, key files and enterprise manager JPS keys from servers on login.*.oraclecloud.com
The poster has no prior reputation, it is unclear if they're LARPing. Some of the sample data does align with prior infostealer logs, I'm told. https://breachforums.st/Thread-SELLING-Oracle-cloud-traditional-hacked-login-X-oraclecloud-com
#threatintel
https://cyberplace.social/system/media_attachments/files/114/200/517/844/862/858/original/1563ce5dafbde69c.png

2025-03-14 19:26:52 UTC

- reply

Btw - this thread isn't to downplay the two Apache Camel vulns. They're valid vulns.
If you use Apache Camel for something like a Jetty based webapp which executes code, you risk a bad time and should calmly patch.
I just don't see the evidence that a lot of orgs have, it's a narrow situation. I can't find any COTS vendor solutions that do, either. It isn't a log4j log4shell situation.

2025-03-14 18:35:34 UTC

- reply

Critical... 9.8 CVSS score we made up... RED ALERT!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!1!
https://cyberplace.social/system/media_attachments/files/114/162/210/595/439/209/original/984daa7f008db8c7.png
https://cyberplace.social/system/media_attachments/files/114/162/213/578/349/656/original/e0bee300c205fc0d.png
https://cyberplace.social/system/media_attachments/files/114/162/218/866/152/447/original/ecea1767d1e4d7f9.png
https://cyberplace.social/system/media_attachments/files/114/162/223/398/571/213/original/32c6db4d39757cd6.png