The Banshee Queen 👑
@cyberoverdrive.bsky.social
#threatintel @Recorded Future | Formerly @PwC GTI | Malware & infrastructure analysis with a side of cyberpunk. 🌃🌌 She/her, support 🏳️🌈🏳️⚧️✨
New incidents have been confirmed in Clayton County, Georgia and the near city of Duchesne, Utah, at an oilfield water treatment facility were the pumps were running dry but looking normal in their dashboards
Techmeme@techmeme.com · 23h agoSources: possible cyberattacks targeting water and wastewater utilities have now been reported in at least 12 US states, and Iran is the prime suspect (ABC News) Main Link | Techmeme Permalink
Most experts are skeptical that cyber operations can be deterred. A wargame with over a thousand players offers new evidence. warontherocks.com/can-cyber-op...
Can Cyber Operations Be Deterred? What Wargames Reveal
The most successful deterrent threats leave no evidence behind. No missiles fly. No networks go down. No troops cross borders. Nothing happens. For
warontherocks.com
Until then, watch out. Spotting Fake Satellite Imagery: 5 Helpful Tips from Soar Atlas about.soaratlas.com/blogs/fake-s...
Spotting Fake Satellite Imagery: 5 Helpful Tips from Soar Atlas
With AI fakes and restricted satellite imagery, truth is harder to find. Platforms like Soar Atlas are offering verified, transparent maps to see what’s really happening.
about.soaratlas.com
Google is creating an epistemological crisis.
Faine Greenwood@faineg.bsky.social · 5d agoI used to do some work on the ethical use of satellite and drone imagery for aid and disaster response, and it is genuinely hard to express in words what a dangerous, stupid thing Google is doing by making it easy to use GenAI to create faked satellite imagery:
I used to do some work on the ethical use of satellite and drone imagery for aid and disaster response, and it is genuinely hard to express in words what a dangerous, stupid thing Google is doing by making it easy to use GenAI to create faked satellite imagery:
How to plant a nuclear plant in Iran
The question is: what on earth is Google doing?
digitaldigging.org
If you all just knew about my group’s 5-year running Dungeons & Dragons campaign you would be SO EFFING JEALOUS
The new “⚠️Seems like AI slop” button on LinkedIn is sending me into orbit lmao
This DPRK subgroup doing watering holes and also ransomware would definitely be a new development.
lazarusholic@lazarusholic.bsky.social · 7d ago"Operation Double Barrel (The Relationship Between a State-Sponsored Threat Actor and the Gunra Ransomware Group)" published by Ahnlab. #Phishing, #Ransomware, #Wateringhole, #Gunra, #Copperhedge, #DoubleBarrel https://asec.ahnlab.com/en/94696
North Korea-linked hackers has been tied to four open-source software compromises dating back to March 2025, Amazon researchers said Wednesday, significantly expanding the known scope of DPRK’s efforts to access trusted code environments www.nextgov.com/cybersecurit...
Amazon uncovers broad North Korean hacking campaign against open-source software
New findings connect the same Pyongyang-backed group to four compromises dating to 2025, revealing a larger operation than previously known.
nextgov.com
So remember last week when we said we hadn’t see TA488/Laundry Bear/Void since Feb? Well... We kinda lied Day before the release, we found em throwing a half click against Outlook to install one of the coolest implants we’ve ever examined: OWAReaper www.proofpoint.com/us/blog/thre...
Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit | Proofpoint US
Threat Research would like to thank the Proofpoint Cloudmark Authority team for their collaboration. Key Findings On 22 July 2026, one day prior to Proofpoint’s recent joint release
proofpoint.com
Yeah the idea that you have to be very careful and measured when talking about bigots lest you be labeled as “hysterical” etc has been a great boon in the push to renew white supremacy.
NEW: After a purported crackdown on scam compounds last year, researchers now say at least 25 new scamming sites have opened or expanded in Myanmar. Satellite images show trees being razed and land cleared, with large compounds appearing months later
Satellite Images Reveal How Suspected Scam Compounds Appear Out of Nowhere
Analysis of satellite images of Myanmar shows dozens of alleged scam compounds have appeared in recent months, despite a purported crackdown on the criminal organizations.
wired.com
1/ We just published new research on TAG-195 (“Golden Chickens” / “Venom Spider”), documenting a major evolution of one of cybercrime’s longest-running Malware-as-a-Service ecosystems. We identified 4 previously undocumented malware families, revealing a shift toward modular, operator-driven tooling
TAG-195 Upgrades MaaS Ecosystem with Modular Tools
Insikt Group identifies four new TAG-195 malware families, revealing an architectural transition toward modular, operator-driven tooling in the MaaS ecosystem
recordedfuture.com
Come read TWO @threatinsight.proofpoint.com blogs on Russia state-aligned threat actors doing some funky exploitation over email 🔥 with accompanying NSA/FBI reporting 👾
Saher@saffronsec.bsky.social · 2w agoMost exciting @threatinsight.proofpoint.com drop yet - in collaboration with NSA - and the product of @greg-l.bsky.social's blood, sweat, and tears. Research into two Russian actors throwing half-click exploits against mailservers. Part 1 on TA488 / Void Blizzard www.proofpoint.com/us/blog/thre...
"And with that puerile quarrel between stubborn warlords over the right to own and to rape a girl, Western literature begins." ... "Classical culture is a lot of things including, literally, rape culture." A must-read essay by Solnit
Rebecca Solnit@rebeccasolnit.bsky.social · 2w agoBeard's essay opens, "I want to start very near the beginning of the tradition of Western literature, and its first recorded example of a man telling a woman to ‘shut up’; telling her that her voice was not to be heard in public." My essay on the Odyssey, Andrew & Tristan Tate, misogyny then & now:
Great writeup from @lorenzofb.bsky.social on the recent OpenAI vs. Hugging Face incident. Turns out it started with a human mistake at OpenAI: someone forgot to set up an isolated environment prior to testing a model; the model went rogue; and attacked Hugging Face. techcrunch.com/2026/07/22/h...
dtex.ai/blog/dprk-it... dtex.ai/org_hierarch... dtex.ai/payment_brea... dtex.ai/geography_ma... Used this as a jumping off point because ZachXBT drop on it didn't get as much attention as it should've. In between the crypto info, were the operators/managers self identifying and filling in...
From Payroll to Pyongyang: The DPRK IT Worker Money Trail
Follow the DPRK IT worker money trail. Our research reveals how payments are processed and funds flow through the regime.
dtex.ai
Cisco has released Antares, a family of small language models (SLMs) for finding vulnerabilities within codebases -2 variants available -a third coming soon -designed for local deployments that require data security compliance blogs.cisco.com/ai/introduci...
Introducing Antares: Highly Efficient Open Weight AI Models for Vulnerability Localization
Today, Cisco is introducing Antares, a family of security small language models (SLMs) purpose-built for one of the hardest, most time-consuming and expensive problems in security: pinpointing where k...
blogs.cisco.com
7-Zip version 26.02 was released to fix a remote code execution vulnerability that could allow attackers to execute malicious code by convincing users to open specially crafted compressed files.
Update now: 7-Zip fixes RCE flaw exploitable with malicious archives
7-Zip version 26.02 was released to fix a remote code execution vulnerability that could allow attackers to execute malicious code by convincing users to open specially crafted compressed files.
bleepingcomputer.com
North Korea’s Reconnaissance General Bureau (RGB) has been renamed the General Reconnaissance and Intelligence Bureau (GRIB) en.yna.co.kr/view/AEN2026...
N. Korea to expand intelligence agency's role against 'potential enemies' | Yonhap News Agency
SEOUL, July 10 (Yonhap) -- North Korea has called for expanding the functions and missions...
en.yna.co.kr
The billionaires have a vision of the future, and in it, many of us are dead. Not because they all want to kill us (some of them want to kill some of us), but because we are simply surplus and expendable in their eyes.
Ohhh, this is a fascinating find. The lesson here is that if your AI SOC depends on models you don't explicitly control, you cannot depend on it during incident response.
David J. Bianco@davidjbianco.bsky.social · 3w agoHuggingFace got hacked by an AI. What stuck out to me was the guardrail asymmetry. The attacker had no constraints, but HF's response ran afoul of the abuse guardrails, forcing them into an unplanned switch to local models. Another aspect for your IR plans. huggingface.co/blog/securit...
Volexity has published details on a recent incident response investigation involving exploitation of multiple #0day vulnerabilities in SonicWall SMA 1000 series appliances. This full technical breakdown includes vulnerability workflow, malware analysis & IOCs. #dfir #memoryforensics #threatintel
Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation
In early July 2026, Volexity was engaged to perform an incident response investigation where it discovered a threat actor had successfully compromised multiple of the customer's SonicWall Secure Mobil...
volexity.com
"Pegasus training material describes situations where it may not be possible to attack a target directly [...] NSO Group suggests expanding to 'close-circle infection,' targeting [...] colleagues, friends or family members of the primary target in order to gather information about them indirectly."
Inside Pegasus: The evolution of the world's most notorious spyware system - Amnesty International Security Lab
We are presenting here our most complete analysis to date of the Pegasus spyware. This blog post builds on previous technical reports and forensic investigations by Amnesty International’s Security La...
securitylab.amnesty.org
If you use Signal to work with sensitive contacts, it’s not a “set it and forget it” app. You do need to maintain the safety of your account. Our digital security team walks through foundational account security settings to help.
What journalists need to know about Signal account safety
There are a few straightforward steps you can take to make your account and identity much more secure
freedom.press
As we argued in our recent report (linked in the thread), security remains key to China's economic interest in Balochistan, with the latest case highlighting how poor security affects Chinese investment: www.ft.com/content/0579...
China-backed copper mine threatens Pakistan shutdown over security risk
Worsening violence in Balochistan imperils Islamabad’s resource ambitions
ft.com
Julian-Ferdinand Vögele@julianferdinand.bsky.social · 4w ago3/ The convergence is what makes this case interesting: despite very different collection priorities, both China- and India-linked actors targeted Balochistan Police, reflecting the organization's role at the intersection of internal security, counterinsurgency, and regional geopolitics.
German firm files for insolvency, blames cybercrims who shut down production for 6 weeks. ZEGO's filing adds another name to the short but growing list of companies that say a digital break-in was commercially fatal to their business. From The Register: www.theregister.com/cyber-crime/...
German firm files for insolvency, blames cybercrims who shut down production for 6 weeks
ZEGO-TVZ says the financial fallout from a March cyberattack left shutting its doors as the only option
theregister.com
Somehow the man responsible for ruthlessly killing 700,000 people is the world’s first trillionaire. Our society is fundamentally broken.
The New Yorker@newyorker.com · 3w agoElon Musk’s cuts to U.S.A.I.D. led to some 700,000 deaths, Atul Gawande says. www.newyorker.com/news/the-new...
“The shift has been driven largely by cost, as companies try to curb ballooning AI bills. But in Europe it has taken on a sharper geopolitical edge after the Trump administration last month imposed export controls on Anthropic’s Mythos and Fable models”
Companies turn to Chinese AI models to cut costs
DoorDash, Siemens and Airbnb are among those seeking to curb ballooning bills and reduce reliance on US technology
giftarticle.ft.com
