x.com/RnaudBertran... Interesting pivot; this tells me... Open-weight sovereign deployment stack is a real product category. Nvidia (compute), edge inference vendors, open model labs, and integration middleware players all benefit, regardless of who wins the model-quality race.

Arnaud Bertrand (@RnaudBertrand) on X

After reflection, this new narrative by Palantir is probably much more consequential than people may assume. Palantir is basically being the canary in the coal mine announcing the death of two major ...

x.com

Colleagues of mine at Insikt Group just released new research on the Iran-nexus cluster #TAG-182, deploying #MarkiRAT, a malware family previously observed in use by #FerociousKitten, for internal and external surveillance: www.recordedfuture.com/research/nex...

Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool

Discover how Iranian-nexus threat cluster TAG-182 uses MarkiRAT malware and fake VPN/media apps to conduct cyber surveillance operations against domestic targets.

recordedfuture.com

#IYKYK

#CopyFail #CVE-2026-31431... The world's answer to all of the people who forgot to save the su password on that one old VPS. Your patience has been rewarded, my friend 🫡

a man with a beard and long hair is looking at the camera

ALT: a man with a beard and long hair is looking at the camera

media.tenor.com

www.dbreunig.com/2026/04/14/c... one of the strongest post mythos articles in the game right now

Cybersecurity Looks Like Proof of Work Now

Is security spending more tokens than your attacker?

dbreunig.com

After reading about Mythos and remembering the Sora shutdown pressures. I have a strange feeling these pure-play frontier providers (OpenAI, Anthropic) will be like Amazon in the near future.

a monopoly man is wearing a top hat and a suit .

ALT: a monopoly man is wearing a top hat and a suit .

media.tenor.com

Working on #malware analysis #AI #agents reminds me of playing with a #Tamagotchi 😆. Repetitive, sometimes frustrating, but you love to see it evolve! 🤩. Pro Tip: If you are just pointing Claude/Codex/OpenCode at a bunch of analysis tool MCPs... you are doing it wrong and expensively.

Wow! SMCI dropped 33% on this news. That reaction is telling. The market understood immediately that export controls on AI compute are serious business, not theater. The AI race has a resource constraint, and everyone's been watching how aggressively it gets enforced. lowendbox.com/blog/supermi...

SuperMicro Founder Indicted on Charges of Smuggling Nvidia GPUs to China

Yih-Shyan “Wally” Liaw, one of the founders of server manufacturer SuperMicro, has been indicted on charges of smuggling billions of dollars' worth of high-end Nvidia GPUs to China.

lowendbox.com

I'm super excited for this to finally be out!! A TON OF CONTENT for CTI Pros!

Julian-Ferdinand Vögele@julianferdinand.bsky.social · 5mo ago

1/ Today we’re publishing our annual malicious infrastructure report, providing a broad view of global threat infrastructure. This year, we significantly expanded coverage across malware families, threat categories, and deeper infrastructure insights: www.recordedfuture.com/research/202...

October infostealer 🗝️. March extortion emails 📧. 5 months of dwell time. This is what undetected credential compromise looks like in practice. And with AI tools lowering the automation barrier, expect that timeline to speed up fast 🏃. www.bleepingcomputer.com/news/securit...

Hacker mass-mails HungerRush extortion emails to restaurant patrons

Customers of restaurants using the HungerRush point-of-sale (POS) platform say they received emails from a threat actor attempting to extort the company, warning that restaurant and customer data coul...

bleepingcomputer.com

Recorded Future’s Insikt Group uncovered four GrayBravo activity clusters. TAG-160 impersonates logistics firms, while TAG-161 impersonates Booking.com, employing ClickFix to deliver CastleLoader and Matanbuchus. www.recordedfuture.com/research/gra...

"There is a lack of consensus regarding the current state of AI malware maturity." So we put together #AIM3 to help #malware researchers describe the maturity level of an #AI_Malware Threat. www.recordedfuture.com/blog/ai-malw...

We all spent the last year vibe coding the shit out of web apps in React without knowing a single thing about JavaScript. Then enters #CVE-2025-55182 #React2Shell... poetry. “The spirits that I summoned I now cannot rid myself of again.”

Excited to join a discussion on the second edition of The Mythical Beast by Jen Roberts (@atlanticcouncil.bsky.social), exploring the complex networks behind the spyware ecosystem. This kicks off the new Colloquium series by @virtualroutes.bsky.social: virtual-routes.org/event/mythic...

Mythical Beasts and Where to Find Them: Diving into the Depths of the Global Spyware Market - Virtual Routes Colloquium

The first session of the Virtual Routes Colloquium Fall/Winter series hosts Jen Roberts from Cyber Statecraft Initiative. Jen will present her research on "Mythical Beasts and Where to Find Them: Divi...

virtual-routes.org

Great blog post from @briankrebs.infosec.exchange.ap.brid.gy on #StarkIndustries. Makes a great point by highlighting it's links to MIRHosting. Where there are Dutch prefixes under these providers, there is usually always MIRHosting upstream.

Not a lot of public reporting on this, but we are seeing a mountain of activity 👀

Julian-Ferdinand Vögele@julianferdinand.bsky.social · 11mo ago

1/ Today @whoisnt.bsky.social, Marius, and I release a report on a new threat actor, #TAG-150, active since at least March 2025, which stands out for its rapid development, sophistication, responsiveness to reporting, and a large, evolving infrastructure: www.recordedfuture.com/research/fro...

1/ Today @whoisnt.bsky.social, Marius, and I release a report on a new threat actor, #TAG-150, active since at least March 2025, which stands out for its rapid development, sophistication, responsiveness to reporting, and a large, evolving infrastructure: www.recordedfuture.com/research/fro...

From CastleLoader to CastleRAT: TAG-150 Advances Operations with Multi-Tiered Infrastructure

Insikt Group reveals TAG-150’s multi-tiered infrastructure and CastleRAT malware—an advanced threat actor evolving rapidly with stealth and scale.

recordedfuture.com

Big report from our team at Recorded Future around #ThreatActivityEnablers (all of the hostings and services that power malicious infrastructure). Great Research on #StarkIndustries!

Lawrence S.@lawrencesec.bsky.social · 11mo ago

1/ Today, we published “One Step Ahead: Stark Industries Solutions Preempts EU Sanctions,” revealing how hosting provider #StarkIndustries executed a multi-phase restructuring of its operations, beginning up to a month before #EU sanctions.

Please give me the strength not to buy this hotswap GPU framework laptop with maxed-out specs. 😬

1/ We just released a new report on TAG-144 (also known as Blind Eagle), where we identified five distinct activity clusters that have been active throughout 2024 and 2025, primarily targeting the Colombian government at multiple levels. Link to the report: www.recordedfuture.com/research/tag...

TAG-144’s Persistent Grip on South American Organizations

Persistent cyber operations by TAG-144 (Blind Eagle) continue to target South American, primarily Colombian, government entities through advanced spearphishing and RAT-based malware campaigns. Explore...

recordedfuture.com

🔎 A day in the life of a #Lumma malware operator... this is a must-read! 💪

Julian-Ferdinand Vögele@julianferdinand.bsky.social · 12mo ago

1/ Today, we release a first-of-its-kind analysis of a set of Lumma affiliates within a vast info-stealing ecosystem, showing their interconnectedness and resilience even after a major law enforcement takedown attempts earlier this year: www.recordedfuture.com/research/beh...

1/ We've just released a new report uncovering new infrastructure tied to multiple activity clusters linked to the Israeli spyware vendor #Candiru across several countries. Full report: www.recordedfuture.com/research/tra...

Tracking Candiru’s DevilsTongue Spyware in Multiple Countries

Recorded Future's Insikt Group uncovers active infrastructure linked to Candiru’s DevilsTongue spyware across multiple countries. Discover how this stealthy spyware targets high-value individuals and ...

recordedfuture.com

"By 2025, 96% of companies are expected to use public cloud services, and 84% will adopt private cloud services. Additionally, 92% of organizations are projected to implement a multicloud strategy, reflecting the growing trend of cloud adoption across various industries." - Nextwork

Amazing DDoSia Project Research by @calwarez.bsky.social, great work!!! www.recordedfuture.com/research/ana... NoName057(16) had thousands of targets in their crosshairs 🎯, and they utilized their DDoSia Project and a crowdsourced army 🪖 to take them down... This is a must-read Report!

Inside DDoSia: NoName057(16)’s Pro-Russian DDoS Campaign Infrastructure

Discover how NoName057(16) targeted 3,700+ hosts across Europe using its DDoSia platform. This in-depth report reveals multi-tiered C2 infrastructure, attack patterns, and strategic geopolitical motiv...

recordedfuture.com

simonwillison.net/2025/Jul/6/s... This is likely the beginning of the new "open S3 bucket" wave of attacks. MCP is awesome and a greatly needed standard, but we know how this will go for the next year or two. 🫤

#Remcos #malware is now at v7.0. No significant changes to the payload side, but improvements to enhance reliability and address bugs based on operator experience added. Samples: tria.ge/250709-3vxwa... tria.ge/250710-vba87... Looks to be distributed via email campaigns from reboundue[.]com emails

Today we are releasing a report on new infrastructure and tooling linked to GrayAlpha, a financially motivated threat actor overlapping with FIN7 🧵 www.recordedfuture.com/research/gra...

GrayAlpha Unmasked: New FIN7-Linked Infrastructure, PowerNet Loader, and Fake Update Attacks

Insikt Group exposes GrayAlpha’s evolving infrastructure and infection methods—including PowerNet and MaskBat loaders, fake 7-Zip sites, and the undocumented TAG-124 network—linking the group to FIN7’...

recordedfuture.com

Today we’re publishing new findings on Predator spyware, still active despite global sanctions, now with a new client and ties to a Czech entity. Here’s what we found 🧵 www.recordedfuture.com/research/pre...

Predator Spyware Resurgence: Insikt Group Exposes New Global Infrastructure

Despite sanctions and global scrutiny, Predator spyware operations persist. Insikt Group reveals new infrastructure links in Mozambique, Africa, and Europe, highlighting ongoing threats to civil socie...

recordedfuture.com

Another report by Insikt Group on newly identified malware families #TerraStealerV2 as well as #TerraLogger, both attributed to the threat actor Golden Chickens: www.recordedfuture.com/research/ter...

Golden Chickens Unveils TerraStealerV2 and TerraLogger: New Credential Theft Tools Identified by Insikt Group

Insikt Group reveals two emerging malware strains—TerraStealerV2 and TerraLogger—linked to Golden Chickens, a threat actor behind credential theft and keylogging MaaS platforms. Learn how these tools ...

recordedfuture.com

Oh my god, they just unintentionally wrecked a ton of red team playbooks at the NSA popular.info/p/the-nsas-b...