Cedric Pernet
@cedricpernet.bsky.social
Senior Threat Researcher @ Proofpoint. Cybercrime / Cyberespionage aficionado. Has worked in several CSIRTs/CERTs. Metal & Rock dude, never enough guitars. Motorcycles fan. Wrote a book in French language on cyberespionage. Ex-Law Enforcement Officer
NEW: A politician investigating Pegasus spyware… had their phone hacked with Pegasus multiple times. The compromises came days ahead of key meetings of the spyware inquiry Story with @lhn.bsky.social
EU Politicians Investigated Pegasus Spyware. Then It Ended Up on One of Their Phones
“It is a direct attack on the rule of law,” says one European Parliament member of the new findings from Citizen Lab.
wired.com
Jordan doing good work deep diving into Turla related malware we’ve been tracking for a while now. If you’re into Turla this is a good read. cloud.google.com/blog/topics/...
The Latest Addition to Turla’s Intelligence Gathering Apparatus | Google Cloud Blog
Analysis of a backdoor, STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla.
cloud.google.com
Strengthening Public-Private Collaboration in the Fight Against #Cybercrime : #Proofpoint Joins #Europol EC3’s Advisory Group on #InternetSecurity www.proofpoint.com/us/blog/corp...
Definitely worth a read : Don't Fear the Repo: UNK_DeadDrop #Phishing Campaign Targets #Developers to Steal #Cryptocurrency www.proofpoint.com/us/blog/thre... #proofpoint #cybercrime #datatheft #northkorea
Mon caissier est un esclave : 43 travailleurs nigérians sans-papiers ont été exploités sans rémunération dans des Franprix, Super U, G20 de Paris et de la région parisienne. Une enquête préliminaire pour traite d’êtres humains a été ouverte. Une info @liberation.fr www.liberation.fr/societe/des-...
Des dizaines de Nigérians sans papiers exploités dans des supérettes parisiennes : «Il m’a dit qu’il allait me sortir de la rue et que j’aurais un CDI»
Contre la promesse d’un titre de séjour, des exilés vulnérables ont été recrutés par un prêcheur pentecôtiste pour effectuer des stages dans des magasins. En réalité, ils ont dû travailler autant voir...
liberation.fr
Web history disappears when it can’t be preserved. Today, many publishers are blocking the Wayback Machine from archiving parts of the public web, putting decades of digital history at risk. Tell publishers: don’t block the #WaybackMachine Sign the petition ➡️ www.savethearchive.com/newsleaders/
Tell New York Times, The Atlantic, and USA Today to keep the crucial work of journalists in the Wayback Machine!
The news isn’t getting preserved in the Wayback Machine anymore because major media outlets are blocking it.
savethearchive.com
Derrière les fuites de données, une cyberdélinquance française, jeune et en quête d’« affirmation de soi »
Derrière les fuites de données, une cyberdélinquance française, jeune et en quête d’« affirmation de soi »
« Données personnelles, la grande fuite » (8/9). Loin des dossiers cybercriminels aux ramifications internationales, les vols de données sont bien souvent le fait d’adolescents isolés cherchant une forme de reconnaissance. Des profils particuliers auxquels la justice tente aujourd’hui d’adapter sa réponse.
lemonde.fr
New, by me: Scammers are abusing a legitimate internal Microsoft account, used for sending critical account alerts and MFA codes to users logging in, to send spam and scam emails. We first saw a flood of these emails last week, but anti-spam project Spamhaus says this has been going on for months.
Scammers are abusing an internal Microsoft account to send spam links | TechCrunch
The loophole allows spammers and scammers to send emails from a legitimate Microsoft email address typically used for sending genuine account alerts.
techcrunch.com
Since the beginning of 2026, at least four landslides are reported to have killed hundreds of people at the Rubaya mines in the Democratic Republic of Congo (DRC), a major global source of coltan. Coltan is widely used in smartphones, laptops and e-vehicles. www.youtube.com/shorts/RZ_PH...
How We Verified Deadly Landslides in DRC Mines
YouTube video by Bellingcat
youtube.com
Poland’s domestic intelligence service said attackers breached water treatment facilities in five towns in 2025, in some cases gaining access to industrial control systems that could have disrupted water supplies.
Polish intelligence warns hackers attacked water treatment control systems
The agency did not publicly attribute the incidents to a specific group or country but said Poland faced intensified hostile cyber activity in 2024 and 2025, “with particular emphasis on the special s...
therecord.media
Just heard @cloudflare.social kicked 1100 people out. A 20% layoff. Fxxxk !
All German .de domains went down on Tuesday due to a DNSSEC failure at the country's domain registrar status.denic.de/pages/incide...
@crowdstrike.bsky.social extends Falcon OverWatch to @microsoft.com #Endpoint Customers - ittech-pulse.com/news/crowdst... #crowdstrike #microsoft #detection #DFIR
If you're going to extort millions from major retailers, maybe don't pose for Snapchat in a diamond-encrusted "HACK THE PLANET" necklace. A 19-year-old accused of being part of the Scattered Spider cybercrime gang has been arrested at Helsinki Airport. He now faces extradition to the USA.
Teenager alleged to be Scattered Spider hacker arrested in Finland, faces US extradition
Here's a tip for you all.
bitdefender.com
'What to do if your child is being sextorted: A therapist’s guide for parents' new on Bitdefender www.bitdefender.com/en-us/blog/h... #sextortion #cybersecurity #parenting @gate15.bsky.social
What to do if your child is being sextorted
Learn how sextortion affects children and how parents can respond calmly, support recovery, and protect their child from online abuse.
bitdefender.com
QAnthropic restreint le lancement de son dernier modèle d’IA pour prévenir les risques de cyberattaques www.lemonde.fr/pixels/artic...
Anthropic restreint le lancement de son dernier modèle d’IA pour prévenir les risques de cyberattaques
Une cinquantaine d’entreprises auront accès à Mythos, modèle avancé de l’entreprise d’intelligence artificielle, particulièrement performant pour identifier les failles logicielles. Les progrès fulgur...
lemonde.fr
Notepad ++ hijacked by state sponsored group, updates mechanism hijacked to spread fake update to a very specific set of selected targets notepad-plus-plus.org/news/hijacke...
Notepad++ Hijacked by State-Sponsored Hackers | Notepad++
notepad-plus-plus.org
For those who read our piece about crypto scam compound whistleblower Red Bull, I've verified that this is his real Bluesky account below. Thank for your incredible courage and all your work to achieve justice, @mohammadmuzahir02.bsky.social.
Mohammad Muzahir@mohammadmuzahir02.bsky.social · 6mo agoThis wasn’t easy to share, but it mattered. Thanks to WIRED for documenting what I witnessed. It shows what’s happening behind online scam operations.
Can’t stop, won’t stop: TA584 innovates initial access www.proofpoint.com/us/blog/thre... #ClickFix #cybercrime #TA584 #ThreatActor #SocialEngineering #EMail #Tsundere #IAB
Fell on this nice #malware analysis and noticed I did not know about "anti-termination signal handling", so super interesting for me - evilcel3ri.github.io/2026/01/16/s... #threatintel #CTI #cybercrime
Cet article est un must-read qui nous éclaire sur les problématiques liées à l' #AdInt
Martin Untersinger@untersin.gr · 7mo agoDe plus en plus d'entreprises vendent aux forces de l’ordre la possibilité de pister des utilisateurs de smartphones grâce à leurs données publicitaires. « Le Monde » a assisté à des présentations confidentielles de certains de ces outils. Enquête sur l'Adint, nouvelle frontière de la surveillance :
github.com/VirusTotal/y... - 1.11.0 is out! Lots of new features, modules and bug fixes. Read the release notes and congrats to Victor and the contributors!
Release v1.11.0 · VirusTotal/yara-x
Make the parser stricter (#502). Implement dex module (#458). Implement C api console log (#515). Implement permhash for the crx module (#510). Implement the imports() method for the Rules object i...
github.com
FBI FLASH: North Korean Kimsuky Actors Leverage Malicious QR Codes in Spearphishing Campaigns Targeting U.S. Entities www.ic3.gov/CSA/2026/260... #cybersecurity @gate15.bsky.social
404 Media has obtained material that explains how two surveillance systems ICE recently purchased, work. One can track phones without a warrant and follow their owners home or to their employer. @evystadium.bsky.social has more. Scoop by @josephcox.bsky.social: www.404media.co/inside-ices-...
"Among the government bodies listed on documents seen by Intelligence Online are 🇵🇰Pakistan and its defence ministry, 🇮🇩Indonesia's State Intelligence Agency, the 🇲🇲Myanmar Police Force, 🇲🇽Mexico's army and navy and 🇻🇪Venezuela's defence ministry." www.intelligenceonline.com/americas/202...
Common mistake for some CTI people: flagging a web provider's parking IP addresses as malicious. Please check carefully. This can lead to total nonsense attribution/pivots when unverified. #fail #ThreatIntelligence
Brian Krebs identified the real-world identity of Rey, a key administrator of Scattered Lapsus$ Hunters, a hacking group blamed for dozens of high profile hacks. The hacker, identified as a Jordanian teenager, agreed to be interviewed after Krebs tracked him down and contacted his father.
Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’
A prolific cybercriminal group that calls itself "Scattered LAPSUS$ Hunters" made headlines regularly this year by stealing data from and publicly mass extorting dozens of major corporations. But the ...
krebsonsecurity.com
