The Banshee Queen 👑
@cyberoverdrive.bsky.social
#threatintel @Recorded Future | Formerly @PwC GTI | Malware & infrastructure analysis with a side of cyberpunk. 🌃🌌 She/her, support 🏳️🌈🏳️⚧️✨
"It is estimated that for every $1 invested in integrated climate change and air pollution action about $15 is generated in economic benefits... In contrast, every year of delayed action would forgo more than $1.5tn annually — 0.5 per cent of GDP."
Strong economic case for tackling pollution and climate change together, UN finds
Combined action could lift global growth by 2.8% by 2035, report estimates
ft.com
NEW @citizenlab.ca report, in collaboration with The Share Foundation, finds iPhone of Serbian student protestor hacked with NSO Group's Pegasus spyware This is the first documented Pegasus infection of 2026 citizenlab.ca/research/peg...
Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist - The Citizen Lab
In collaboration with the SHARE Foundation, the Citizen Lab confirmed that the iPhone of a member of Serbia’s student protest movement was infected with Pegasus spyware.
citizenlab.ca
“They are going after the messenger,” EFF's @jillian.bsky.social told @theintercept.com. “I don’t think that the members of the group would necessarily condone the actions of the people that they hosted. What they do condone is the freedom to host, the ability to be anonymous, ... to be private.”
Trump Goes After Anonymous Email Provider in Italy. The Real Target Is Free Speech in the U.S.
Trump designated a collective that provides anonymous email services as a foreign “terrorist” group. It could curtail free speech in the U.S.
theintercept.com
Organizers and activists who oppose the Trump administration's policies should absolutely be paying close attention to this story: theintercept.com/2026/08/28/t...
Trump Goes After Anonymous Email Provider in Italy. The Real Target Is Free Speech in the U.S.
Trump designated a collective that provides anonymous email services as a foreign “terrorist” group. It could curtail free speech in the U.S.
theintercept.com
Looking forward to presenting at LABScon next month. Can’t wait for the event and catching up with everyone again: www.labscon.io/speakers/jul...
Julian Ferdinand Vögele | LABScon
Join us September 16-19th for LABScon, an intimate, invite-only event for the top cybersecurity minds to gather, share cutting-edge research.
labscon.io
Also, ICYMI: Last week I published a 3,200-word deep-dive explainer on a major threat to your home and office: Residential proxy networks allow hackers to use your internet connection for crime and cyberattacks. Find out why resproxies are a threat, how they work, and what *you* can do about them. 🤖
How residential proxy networks are hiding hackers in your home
Security researchers say residential proxy networks present a major threat by allowing hackers to commandeer home and office networks for cybercrime.
this.weekinsecurity.com
Today Insikt Group released new research on BlueDelta’s initial access campaigns targeting government and diplomatic organizations in Romania, Spain, and Türkiye, using diplomatic-themed docs to deliver the backdoor HOOKEDGE. Check out the report here: www.recordedfuture.com/research/blu...
BlueDelta Targets Defense and Diplomacy with HOOKEDGE
Discover how the Russian state-sponsored threat group BlueDelta is using the HOOKEDGE backdoor to target defense and diplomatic organizations across Europe
recordedfuture.com
If we take goose = the worker(s), and egg = output of their labour, we can read Masayoshi Son’s surrealist egg slide as a Marxist parable of the power of the goose 🪿🥚🥚🥚
Insikt Group has identified a series of BlueDelta (APT28/Fancy Bear/Forest Blizzard) initial access campaigns targeting government & diplomatic organizations in Romania, Spain & Turkey. The campaigns deliver the HOOKEDGE backdoor using diplomatic-themed lures. www.recordedfuture.com/research/blu...
"Insights into Suspected DPRK Workers: Red Flags to Look Out For" published by Huntress. #ITWorker, #FamousChollima, #PiKVM, #Guermok https://www.huntress.com/blog/huntress-dprk-remote-worker-investigation
Insights into Suspected DPRK Workers: Red Flags to Look Out For
huntress.com
The temptation to run an alt account to meme / complain / hot take in peace about the absolute s t a t e of the cybersecurity industry is real
That is a lot of Chinese companies. Will be interesting to see how this will play out. home.treasury.gov/news/press-r...
Treasury Launches Unprecedented Campaign Against Iranian Regime on Economic D-Day
Initiates Operation Economic Outcast **WASHINGTON**—Today, at President Trump’s direction, the U.S. Department of the Treasury has begun Operation Economic Outcast: an unprecedented, whole-of-government, economic campaign against the Islamic Republic of Iran and its enablers. “In the Second World …
home.treasury.gov
CISA's red teams tried to break into two unnamed volunteer targets (a government agency and a water utility), with very different results based on how the organizations operated. CISA's new report explains the takeaways: www.cisa.gov/news-events/...
say what you will about the myriad valid concerns with current LLMs but I personally will never get over the fact that Aaron Swartz was prosecuted to his literal death for downloading JSTOR and then a decade later, they downloaded & ingested the entire world and our IP laws just went ¯\_(ツ)_/¯
This stuff is the same as UNC5976 (and yes, i had to go look that up because we dont use the UNC designation internally on my team) discussed in our post yesterday: cloud.google.com/blog/topics/...
Distinct Clusters Target Individuals of Interest to Russia | Google Cloud Blog
Distinct Russian clusters have been conducting phishing activity focused on Application Specific Passwords (ASP), OAuth flows, and malware delivery. All of these operations seem focused on account com...
cloud.google.com
Wesley Shields@wxs.bsky.social · last mo.This came out while I was traveling last week and it's a good read on a single campaign from this group we've been tracking: dslua.org/publications... - They are fairly active doing this kind of phishing and also other nefarious activities.
Sometimes, and especially right now, the field of cyber security feels like a bandwagon of doom that never reaches its destination.
Residential proxies are probably in the top 3 active threats to global cybersecurity, so Zack's work here is important:
Zack Whittaker@zackwhittaker.com · 3w agoTech giants and telcos are at war with residential proxy networks, which let hackers use your home/office internet connections for cyberattacks. For this.weekinsecurity.com, I explore why resproxies are a risk to you and your devices, how they enable crime, & what you can do to find and remove them.
More. Many of them believe that the lives in the future count more than yours.
David Burbach 🇺🇸@dburbach.bsky.social · 3w agoImportant to understand that many of the AI techbros and their X fans think that the welfare of software agents spawned in a gajillion future instances of SimCity2100 count just as much as the lives of you and neighbors today
This is very interesting. Military insiders are making big longshot polymarket bets that are then copied by trading bots, "raising concerns that the market could broadcast signals exploitable by foreign adversaries." www.reuters.com/business/fin...
EXCLUSIVE: More than 150 Polymarket wallets may have traded on military secrets, research finds
More than 150 wallets on Polymarket International may have traded on inside U.S. military information, attracting copycat bets and raising concerns that the market could broadcast signals exploitable...
reuters.com
Lots of people crashing out over the plagiarism machine making its output harder to hide and lie about. If you're honest and transparent about your LLM use, why would you ever care about the watermark?
John Gruber@gruber.foo · 4w agoIt’s unacceptable for a tool to sacrifice an iota of clarity, coherence, meaning, quality, etc. for the purpose of embedding hidden clues within the text to suggest its provenance. daringfireball.net/2026/08/anthro…
Re-upping my April 2026 @lawfaremedia.org essay on "The Perils of Privatized Cyberwarfare" www.lawfaremedia.org/article/the-... In light of 🇺🇸 Trump's new Executive Order authorizing US private firms to conduct offensive cyber ops www.whitehouse.gov/presidential...
The Perils of Privatized Cyberwarfare
Privatized cyberwar will complicate oversight, create counterintelligence risks, fuel arms races and insecurity, and put civilians at risk.
lawfaremedia.org
Hey this dude put in a PTO request for April 15th and it just says “The Day of the Sun”?
Adam@adam35.bsky.social · 4w agoWhich federal agency hired the North Korean lmao
1/ In Feb 2026, OpenAI reported on a doxxing website, which since 2023 had been exposing Chinese activists and dissidents. Unsurprisingly, the company attributed that activity to Chinese law enforcement. We @citizenlab.ca had been looking at it for a while and have some extra details. 🧵
Disrupting malicious uses of AI
Our latest threat report examines how malicious actors combine AI models with websites and social platforms—and what it means for detection and defense.
openai.com
Russia's Sandworm follows North Korea and Iran and adopts the fake IT job interview as a malware delivery vector cert.gov.ua/article/6318...
CERT-UA
Урядова команда реагування на комп’ютерні надзвичайні події України, яка функціонує в складі Державної служби спеціального зв’язку та захисту інформації України.
cert.gov.ua
This is the ransomware used in recent operations by North Korean hackers
Gate 15@gate15.bsky.social · last mo.CISA released a cybersecurity advisory, #StopRansomware: Gunra Ransomware, sharing information about the ransomware-as-a-service Gunra. Read more below: www.cisa.gov/news-events/... #cybersecurity @andyjabbour.bsky.social
