Tessera

New Phishing Campaign: Fake Interviews Offered at Top Brands to harvest Gmail creds, IOCs inside gist.github.com/BushidoUK/57...

GmailPhishingAlert.md

GitHub Gist: instantly share code, notes, and snippets.

gist.github.com

New Blog! 🇬🇧 UK Cybercrime Journal: Argos Account Takeover Fraud - Cybercriminals are using leaked credentials to hijack Argos user accounts - They then order and then collect the goods in-person at a physical store and pay with stolen credit cards 🔗 blog.bushidotoken.net/2026/07/uk-c...

UK Cybercrime Journal: Argos Account Takeover Fraud

CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security

blog.bushidotoken.net

New Blog! 🇬🇧 UK Cybercrime Journal: Hargreaves Landsdown Extortion Attempt by Bashe It appears Bashe weaponised HL’s recent, IT outages & glitches (in Sept 2025 and March 2026) to construct a plausible, but false, narrative of a successful hack. 🔗 blog.bushidotoken.net/2026/06/uk-c...

UK Cybercrime Journal: Hargreaves Landsdown Extortion Attempt by Bashe

CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security

blog.bushidotoken.net

Two of my fav 🇬🇧 🇨🇦 experts when it comes to discussing cyber warfare, Philip Ingram and Ian Thornton-Trump, released an interview reviewing in detail the threat landscape of 🇷🇺 Russian cyber operations in the context of the ongoing war in 🇺🇦 Ukraine. 🔗 youtu.be/p1vl5t4fVWA

How Russia’s cyber propaganda machine is backfiring on the frontline | Ian Thornton-Trump

YouTube video by Frontline

youtu.be

New Blog! 🇬🇧 UK Cybercrime Journal: Sustained DragonForce Campaign Throughout May 2026, the DragonForce RaaS operation claimed seven UK-based companies as its victims by posting them on their Tor data leak site. 🔗 blog.bushidotoken.net/2026/06/uk-c...

UK Cybercrime Journal: Sustained DragonForce Campaign

CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security

blog.bushidotoken.net

New Blog! Ransomware Tool Matrix Project Updates: Three Groups To Track 🔒🛠️ 🔗 blog.bushidotoken.net/2026/06/rans...

Ransomware Tool Matrix Project Updates: Three Groups To Track

CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security

blog.bushidotoken.net

I recently experimented with turning one of my blogs from back in 2020 (the pre-AI era!) into an AI-generated video via @NotebookLM and was surprised with the result. 🎥 Video: The Law of the Jungle 🐍 🦁 🦈 🦀 youtu.be/gb1aOjXly7E Original blog: blog.bushidotoken.net/2020/05/cybe...

The Law of the Jungle: A Cybersecurity Awareness Video made with NotebookLM

YouTube video by BushidoToken

youtu.be

New 🇬🇧 UK Cybercrime Journal Entry: Arup Group Breached by FulcrumSec What do AWS DCs, Disneyland, Wembley Football Stadium, HS2 and HS1 Channel Tunnel Rail Link network, and the Eden Project all have in common? They were engineered by Arup Group 👀 blog.bushidotoken.net/2026/06/uk-c...

UK Cybercrime Journal: Arup Group Breached by FulcrumSec

CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security

blog.bushidotoken.net

New 🇬🇧 UK Cybercrime Journal Entry: British Universities Struck by ShinyHunters Before Exam Season blog.bushidotoken.net/2026/05/uk-c...

blog.bushidotoken.net

New 🇬🇧 UK Cybercrime Journal Entry: £102 million Lost to Scams in 2025 blog.bushidotoken.net/2026/05/uk-c...

UK Cybercrime Journal: £102 million Lost to Scams in 2025

CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security

blog.bushidotoken.net

Will T @bushidotoken.net · 4mo ago

📣 I have been wanting to write more regularly for my site blog.bushidotoken.net and have made a new series: The UK Cybercrime Journal. These are short UK cybercrime incident reports with a BLUF, Analyst Comment, and Defensive Takeaways. Starting here: blog.bushidotoken.net/2026/05/uk-c...

UK Cybercrime Journal: Inside the Cl0p attack on South Staffs Water

CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security

blog.bushidotoken.net

New Blog! Stranger Strings: Yurei Ransomware Operator Toolkit Exposed Through my research with Team Cymru’s data, we have discovered another ransomware operator’s server with Stranger Things-themed tools, check it out👇 www.team-cymru.com/post/yurei-d...

Yurei Double Extortion Ransomware: Operator Toolkit and Analysis

Analyze the Yurei double extortion ransomware campaign, including its toolkit, attack lifecycle, and key tactics used by operators.

team-cymru.com

Will T @bushidotoken.net · 5mo ago

New Blog! The Beast Returns: Analysis of a Beast Ransomware Server 👹 In March 2026, Team Cymru detected a Beast operator’s server that enabled us to understand the flow of their attacks from start, to middle, to the end, including ransomware binaries. www.team-cymru.com/post/beast-r...

Beast Ransomware Toolkit: A Proactive Threat Intelligence Report

Explore our latest threat intelligence report on Beast Ransomware. See the exact incident response tools and TTPs used by operators to bypass EDR and delete backups.

team-cymru.com

Will T @bushidotoken.net · 8mo ago

My latest article for Feedly is about how CTI and Threat Hunting can actually fuse into a single, intelligence-driven workflow instead of operating in silos. If you’re trying to build a more proactive security program, I think you’ll find it useful. 👉 Read it here: feedly.com/ti-essential...

How to Integrate CTI with Threat Hunting: A Practical Guide | TI Essentials | Feedly

feedly.com

Kevin Poireault @leekthehack.bsky.social · 8mo ago

𝗣𝗢𝗗𝗖𝗔𝗦𝗧 🎧 𝗛𝗼𝘄 𝟮𝟬𝟮𝟱 𝗦𝗵𝗮𝗽𝗲𝗱 𝘁𝗵𝗲 𝗙𝘂𝘁𝘂𝗿𝗲 𝗼𝗳 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 We sat down with Rebecca Taylor from Sophos and @bushidotoken.net from @teamcymrus2.bsky.social to discuss 2025’s highs and lows in cyber and make educated guesses on what to look for in 2026. feeds.soundcloud.com/users/soundc...

Will T @bushidotoken.net · 9mo ago

New Blog 👀 This blog discusses the topic of cybercrime counterintelligence to highlight the growing threat toward the cyber threat intelligence (CTI) and law enforcement (LE) communities ⚠️ 🔗 www.sans.org/blog/for589-...

Spotted a rather Team Cymru looking fountain here in the Netherlands 🇳🇱 this week! 📸

New Blog! Lessons from the BlackBasta Ransomware Attack on Capita When a company that manages data for millions of UK citizens falls victim to ransomware, the whole industry should pay attention to it. 📝 blog.bushidotoken.net/2025/10/less...

Lessons from the BlackBasta Ransomware Attack on Capita

CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security

blog.bushidotoken.net

New Blog! 👀 In this research, I take a look at the Qilin RaaS in-depth, which has emerged as one of the leading and most innovative ransomware gangs following the takedown of LockBit, the exit scam by ALPHV/BlackCat, and the shutdown of RansomHub. 🔗 www.sans.org/blog/evoluti...

Will T @bushidotoken.net · 11mo ago

New Blog! 👀 After the last few large breaches, I discuss several cases in which the customers of major SaaS providers, such as Salesloft, Salesforce, and Snowflake have been extorted by adversaries from the English-speaking #cybercrime communities. 🔗 www.sans.org/blog/hunting...

#ThreatHunting

Pleased to share I’ll be speaking at Adversary Village in DEFCON33!

Pleased to share my first official Team Cymru blog that follows on from my webinar last month 🙌 “Uncovering DPRK Remote Workers: Detecting Hidden Threats Through Internet Telemetry” 🇰🇵 🔍 www.team-cymru.com/post/uncover...

Uncovering DPRK Remote Workers: Detecting Hidden Threats Through Internet Telemetry | Team Cymru

This blog explores unpacks key insights and explains how internet telemetry can be used to detect these threats in the real world.

team-cymru.com

⚠️ IntelBroker was arrested in France 🇫🇷 in February 2025, and the US 🇺🇸 is seeking his extradition. How did Law Enforcement Deanonymize IntelBroker? 🔍 TL;DR: He messed up on the Bitcoin opsec after an undercover officer made a controlled buy 💰 www.justice.gov/usao-sdny/me...