Will T
@bushidotoken.net
๐ฌ๐ง | Senior Threat Intelligence Advisor at Team Cymru | Co-author SANS FOR589 | Co-founder Curated Intel
New Blog! ๐ฌ๐ง UK Cybercrime Journal: ExfilSquad Emerges - ExfilSquadโs extortion campaign targets UK public sector orgs, education, and law enforcement - ExfilSquad's primary attack vector involves exploiting CRM platforms and Microsoft Power Pages ๐ blog.bushidotoken.net/2026/09/uk-c...
UK Cybercrime Journal: ExfilSquad Emerges
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
blog.bushidotoken.net
New Blog! ๐ฌ๐ง UK Cybercrime Journal: ACRO Breach Report โ Between July 2021 and June 2023, the UK Criminal Records Office had 3 separate breaches โ It had an SQLi attack on its Kentico CMS followed by Mimikatz โ 4x Trend Micro AV alerts were ignored ๐ blog.bushidotoken.net/2026/08/uk-c...
UK Cybercrime Journal: ACRO Breach Report
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
blog.bushidotoken.net
New Blog! ๐ฌ๐ง UK Cybercrime Journal: Carding Tactics & Youth Money Muling - UK law enforcement exposed domestic carding networks and the growing threat of teenage money mules recruited via Snapchat, Instagram, and online gaming services ๐ blog.bushidotoken.net/2026/08/uk-c...
UK Cybercrime Journal: Carding Tactics & Youth Money Muling
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
blog.bushidotoken.net
New Blog! ๐ฌ๐ง UK Cybercrime Journal: Evolution of Courier Fraud Campaigns ๐ blog.bushidotoken.net/2026/08/uk-c...
UK Cybercrime Journal: Evolution of Courier Fraud Campaigns
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
blog.bushidotoken.net
New Blog! ๐ฌ๐ง UK Cybercrime Journal: Qilin Ransomware Rampage in H1 2026 - In H1 2026, Qilin averaged 8 UK victims per month, 37 in total - Most victims are Small/Medium Enterprises (SMEs) - Salford City College appeared on Qilin & DragonForceโs DLSs ๐ blog.bushidotoken.net/2026/07/uk-c...
UK Cybercrime Journal: Qilin Ransomware Rampage in H1 2026
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
blog.bushidotoken.net
New Blog! ๐ฌ๐ง UK Cybercrime Journal: H1 2026 Social Media Fraud Trends - HMRC Warns TikTok Users - Lloyds Bank says 66% of Fraud Cases Started on Metaย - UK Finance Recorded ยฃ221.5m Lost to Investment Scams - Fraudsters arrested in Nigeria by the NCA ๐ blog.bushidotoken.net/2026/07/uk-c...
UK Cybercrime Journal: H1 2026 Social Media Fraud Trends
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
blog.bushidotoken.net
๐ฎ New CTI Resource Announcement! ๐ฎ Project ORBITAL (Operational Relay Box Intelligence, Tracking, & Analysis Lexicon) is the latest open source intelligence (OSINT) collection Iโve created to help educate the industry about ORB Networks. ๐ blog.bushidotoken.net/2026/07/proj...
New Blog! ๐ฌ๐ง UK Cybercrime Journal: H1 2026 Dark Web Seizures & Arrests - Nemesis Dark Web Drug Dealers Arrested - AEGIS Dark Web Drug Market Seizure - Online Killers Marketplace (OKM) Admins Arrested ๐ blog.bushidotoken.net/2026/07/uk-c...
UK Cybercrime Journal: H1 2026 Dark Web Seizures & Arrests
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
blog.bushidotoken.net
New Blog! ๐ฌ๐ง UK Cybercrime Journal: University of Nottingham Breached by ShinyHunters The education sector in the UK has suffered repeated, significant data breaches in recent years, but ShinyHunters campaign has been one of the worst yet. ๐ blog.bushidotoken.net/2026/07/uk-c...
UK Cybercrime Journal: University of Nottingham Breached by ShinyHunters
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
blog.bushidotoken.net
New Blog! ๐ฌ๐ง UK Cybercrime Journal: SMS Blaster Gang Convicted - New details emerge about the use of an SMS Blaster device to send fraudulent text messages as part of an organised criminal operation in London ๐ blog.bushidotoken.net/2026/07/uk-c...
UK Cybercrime Journal: SMS Blaster Gang Convicted
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
blog.bushidotoken.net
New Phishing Campaign: Fake Interviews Offered at Top Brands to harvest Gmail creds, IOCs inside gist.github.com/BushidoUK/57...
GmailPhishingAlert.md
GitHub Gist: instantly share code, notes, and snippets.
gist.github.com
New Blog! ๐ฌ๐ง UK Cybercrime Journal: Argos Account Takeover Fraud - Cybercriminals are using leaked credentials to hijack Argos user accounts - They then order and then collect the goods in-person at a physical store and pay with stolen credit cards ๐ blog.bushidotoken.net/2026/07/uk-c...
UK Cybercrime Journal: Argos Account Takeover Fraud
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
blog.bushidotoken.net
New Blog! ๐ฌ๐ง UK Cybercrime Journal: Hargreaves Landsdown Extortion Attempt by Bashe It appears Bashe weaponised HLโs recent, IT outages & glitches (in Sept 2025 and March 2026) to construct a plausible, but false, narrative of a successful hack. ๐ blog.bushidotoken.net/2026/06/uk-c...
UK Cybercrime Journal: Hargreaves Landsdown Extortion Attempt by Bashe
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
blog.bushidotoken.net
Two of my fav ๐ฌ๐ง ๐จ๐ฆ experts when it comes to discussing cyber warfare, Philip Ingram and Ian Thornton-Trump, released an interview reviewing in detail the threat landscape of ๐ท๐บ Russian cyber operations in the context of the ongoing war in ๐บ๐ฆ Ukraine. ๐ youtu.be/p1vl5t4fVWA
How Russiaโs cyber propaganda machine is backfiring on the frontline | Ian Thornton-Trump
YouTube video by Frontline
youtu.be
New Blog! ๐ฌ๐ง UK Cybercrime Journal: Sustained DragonForce Campaign Throughout May 2026, the DragonForce RaaS operation claimed seven UK-based companies as its victims by posting them on their Tor data leak site. ๐ blog.bushidotoken.net/2026/06/uk-c...
UK Cybercrime Journal: Sustained DragonForce Campaign
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
blog.bushidotoken.net
New Blog! Ransomware Tool Matrix Project Updates: Three Groups To Track ๐๐ ๏ธ ๐ blog.bushidotoken.net/2026/06/rans...
Ransomware Tool Matrix Project Updates: Three Groups To Track
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
blog.bushidotoken.net
I recently experimented with turning one of my blogs from back in 2020 (the pre-AI era!) into an AI-generated video via @NotebookLM and was surprised with the result. ๐ฅ Video: The Law of the Jungle ๐ ๐ฆ ๐ฆ ๐ฆ youtu.be/gb1aOjXly7E Original blog: blog.bushidotoken.net/2020/05/cybe...
The Law of the Jungle: A Cybersecurity Awareness Video made with NotebookLM
YouTube video by BushidoToken
youtu.be
New ๐ฌ๐ง UK Cybercrime Journal Entry: Arup Group Breached by FulcrumSec What do AWS DCs, Disneyland, Wembley Football Stadium, HS2 and HS1 Channel Tunnel Rail Link network, and the Eden Project all have in common? They were engineered by Arup Group ๐ blog.bushidotoken.net/2026/06/uk-c...
UK Cybercrime Journal: Arup Group Breached by FulcrumSec
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
blog.bushidotoken.net
New ๐ฌ๐ง UK Cybercrime Journal Entry: British Universities Struck by ShinyHunters Before Exam Season blog.bushidotoken.net/2026/05/uk-c...
blog.bushidotoken.net
New ๐ฌ๐ง UK Cybercrime Journal Entry: ยฃ102 million Lost to Scams in 2025 blog.bushidotoken.net/2026/05/uk-c...
UK Cybercrime Journal: ยฃ102 million Lost to Scams in 2025
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
blog.bushidotoken.net
๐ฃ I have been wanting to write more regularly for my site blog.bushidotoken.net and have made a new series: The UK Cybercrime Journal. These are short UK cybercrime incident reports with a BLUF, Analyst Comment, and Defensive Takeaways. Starting here: blog.bushidotoken.net/2026/05/uk-c...
UK Cybercrime Journal: Inside the Cl0p attack on South Staffs Water
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
blog.bushidotoken.net
New Blog! Stranger Strings: Yurei Ransomware Operator Toolkit Exposed Through my research with Team Cymruโs data, we have discovered another ransomware operatorโs server with Stranger Things-themed tools, check it out๐ www.team-cymru.com/post/yurei-d...
Yurei Double Extortion Ransomware: Operator Toolkit and Analysis
Analyze the Yurei double extortion ransomware campaign, including its toolkit, attack lifecycle, and key tactics used by operators.
team-cymru.com
New Blog! The Beast Returns: Analysis of a Beast Ransomware Server ๐น In March 2026, Team Cymru detected a Beast operatorโs server that enabled us to understand the flow of their attacks from start, to middle, to the end, including ransomware binaries. www.team-cymru.com/post/beast-r...
Beast Ransomware Toolkit: A Proactive Threat Intelligence Report
Explore our latest threat intelligence report on Beast Ransomware. See the exact incident response tools and TTPs used by operators to bypass EDR and delete backups.
team-cymru.com
My latest article for Feedly is about how CTI and Threat Hunting can actually fuse into a single, intelligence-driven workflow instead of operating in silos. If youโre trying to build a more proactive security program, I think youโll find it useful. ๐ Read it here: feedly.com/ti-essential...
How to Integrate CTI with Threat Hunting: A Practical Guide | TI Essentials | Feedly
feedly.com
๐ฃ๐ข๐๐๐๐ฆ๐ง ๐ง ๐๐ผ๐ ๐ฎ๐ฌ๐ฎ๐ฑ ๐ฆ๐ต๐ฎ๐ฝ๐ฒ๐ฑ ๐๐ต๐ฒ ๐๐๐๐๐ฟ๐ฒ ๐ผ๐ณ ๐๐๐ฏ๐ฒ๐ฟ๐๐ฒ๐ฐ๐๐ฟ๐ถ๐๐ We sat down with Rebecca Taylor from Sophos and @bushidotoken.net from @teamcymrus2.bsky.social to discuss 2025โs highs and lows in cyber and make educated guesses on what to look for in 2026. feeds.soundcloud.com/users/soundc...
New Blog ๐ This blog discusses the topic of cybercrime counterintelligence to highlight the growing threat toward the cyber threat intelligence (CTI) and law enforcement (LE) communities โ ๏ธ ๐ www.sans.org/blog/for589-...
Spotted a rather Team Cymru looking fountain here in the Netherlands ๐ณ๐ฑ this week! ๐ธ
New Blog! Lessons from the BlackBasta Ransomware Attack on Capita When a company that manages data for millions of UK citizens falls victim to ransomware, the whole industry should pay attention to it. ๐ blog.bushidotoken.net/2025/10/less...
Lessons from the BlackBasta Ransomware Attack on Capita
CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security
blog.bushidotoken.net
New Blog! ๐ In this research, I take a look at the Qilin RaaS in-depth, which has emerged as one of the leading and most innovative ransomware gangs following the takedown of LockBit, the exit scam by ALPHV/BlackCat, and the shutdown of RansomHub. ๐ www.sans.org/blog/evoluti...
New Blog! ๐ After the last few large breaches, I discuss several cases in which the customers of major SaaS providers, such as Salesloft, Salesforce, and Snowflake have been extorted by adversaries from the English-speaking #cybercrime communities. ๐ www.sans.org/blog/hunting...
