jon greig
@jgreig.bsky.social
cybersecurity reporter for The Record. formerly: zdnet, techrepublic, blavity, haitian times, cambodia daily — send tips to jonathangreig11@protonmail.com or signal: jgreig.51
$388 million???!!! Texas, Florida top list of states reporting millions of dollars lost through crypto ATMs Via @jgreig.bsky.social & @therecordmedia.bsky.social
Texas, Florida top list of states reporting millions of dollars lost through crypto ATMs
In most complaints, victims said they were given detailed information by fraudsters on how to take money from their bank account, where to find a cryptocurrency kiosk and how to send the funds.
therecord.media
if you’re truly a Knicks fan, you get the KNICKS IN 4 tattoo *tonight*
Nas voice: “Don’t say the tarp’s off / Say the (man) titties is out” www.nytimes.com/athletic/732...
MLB Tarps Off craze has awakened ‘Baseball Heaven’ with the bare truth (Gift Article)
The shirtless MLB movement feels like a miracle drug for boredom, a long time coming for even baseball’s most traditional fan base.
nytimes.com
CISA made a it a bit easier for people outside the government to report exploited bugs to CISA's KEV catalog The agency announced a new portal where experts can report exploited vulnerabilities as long as they provide evidence therecord.media/cisa-to-allo...
CISA to allow researchers to report vulnerabilities to exploited bugs catalog
The Cybersecurity and Infrastructure Security Agency (CISA) announced the creation of a nomination form on Thursday that they said enables “researchers, vendors, and industry partners” to report bugs ...
therecord.media
CISA said all federal agencies have until Sunday to patch CVE-2026-20182, the latest Cisco SD-WAN bug exploited by nation-state actors. It was discovered by @rapid7.com, which said it "behaves like a master key therecord.media/cisa-orders-...
CISA orders all federal agencies to patch exploited bug in Cisco SD-WAN systems by Sunday
Cisco released a patch for the vulnerability on Thursday, writing in an advisory that it could “allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges ...
therecord.media
The good news is we all have increased budget AND staff to keep up with patching all these newly discovered vulnerabilities…oh wait. Microsoft on pace to break annual vulnerability record as AI-driven patch wave takes hold Via @alexmartin.bsky.social & @therecordmedia.bsky.social
Microsoft on pace to break annual vulnerability record as AI-driven patch wave takes hold
Five months into 2026, Microsoft has already patched more than 500 vulnerabilities — although the exact monthly count varies depending on whether analysts include Edge, Chromium and fixes shipped earl...
therecord.media
Massachusetts hospital turning ambulances away after cyberattack via @jgreig.bsky.social & @therecordmedia.bsky.social
Massachusetts hospital turning ambulances away after cyberattack
Signature Healthcare and Signature Healthcare Brockton Hospital said on Monday that the cyber incident is impacting many of their information systems.
therecord.media
Interesting choice with the number of CVEs surging… NIST to limit work on CVE entries as submissions surge via @jgreig.bsky.social & @therecordmedia.bsky.social
NIST to limit work on CVE entries as submissions surge
NIST said it will only add details and information to the records of vulnerabilities that meet a certain threshold — changing a longstanding mission to categorize every CVE, which stands for cybersecu...
therecord.media
North Korean hackers siphon more than $12 million from crypto users in sprawling campaign Via @jgreig.bsky.social & @therecordmedia.bsky.social
North Korean hackers siphon more than $12 million from crypto users in sprawling campaign
Researchers said the group stole up to $12 million in cryptocurrency in the first three months of 2026 through malware attacks on personal devices.
therecord.media
Double it, at least. Cyber incident responders who carried out ransomware attacks given 4-year sentences Via @jgreig.bsky.social & @therecordmedia.bsky.social
Cyber incident responders who carried out ransomware attacks given 4-year sentences
Two cybersecurity incident responders who abused their positions to carry out covert ransomware attacks were sentenced to four years in prison.
therecord.media
Conti, Akira ransomware affiliate given 8-year sentence via @jgreig.bsky.social & @therecordmedia.bsky.social
Conti, Akira ransomware affiliate given 8-year sentence
Deniss Zolotarjovs pleaded guilty in July 2025 to money laundering and wire fraud charges after being arrested in the country of Georgia.
therecord.media
The list of schools impacted has already been published by ShinyHunters...not sure how many students are going to be impacted by this. via @jgreig.bsky.social & @therecordmedia.bsky.social
Educational company Instructure reports cyber incident
By Saturday, Infrastructure’s chief information security officer Steve Proud confirmed that the hackers gained access to information about users at some educational institutions, including names, emai...
therecord.media
CISA said all federal agencies have until Sunday to patch CVE-2026-20182, the latest Cisco SD-WAN bug exploited by nation-state actors. It was discovered by @rapid7.com, which said it "behaves like a master key therecord.media/cisa-orders-...
CISA orders all federal agencies to patch exploited bug in Cisco SD-WAN systems by Sunday
Cisco released a patch for the vulnerability on Thursday, writing in an advisory that it could “allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges ...
therecord.media
OpenAI and Mistral AI were impacted by the supply chain attack on popular open-source library TanStack macOS users will have until June 12 to update their OpenAI applications therecord.media/openai-asks-...
OpenAI asks macOS users to update after TanStack npm supply chain attack
The actions are being taken in light of an expanding supply chain campaign impacting the popular open-source library TanStack and additional npm and PyPI packages tied to several AI companies.
therecord.media
West Pharmaceutical warned the SEC that critical systems used to ship, receive and manufacture products were shut down due to a ransomware attack The company said it has “taken steps intended to mitigate the risk of dissemination of the exfiltrated data.” therecord.media/west-pharmac...
West Pharmaceutical warns of ransomware attack impacting business operations
West Pharmaceutical Services filed a report with the Securities and Exchange Commission (SEC) on Monday evening warning customers that a hacker breached the company network on May 4, stole data and en...
therecord.media
Overnight, Instructure said it paid a ransom to the ShinyHunters cybercriminal group after its data was "returned" and the hackers allegedly sent digital confirmation of data destruction Congress has demanded a briefing from Instructure on the incident therecord.media/instructure-...
Instructure pays ransom after Canvas incident as Congress announces investigation
The company said its agreement with the hackers involved their data being “returned” to them and digital confirmation of data destruction.
therecord.media
More and more companies are reporting cyber theft incidents where criminals insert themselves in the shipping process and steal cargo from trucks, according to the FBI therecord.media/hackers-earn...
Hackers earning millions from hijacked cargo, FBI says
In an advisory this week, FBI officials said cyber actors have spent the last two years breaking into the systems of brokers and carriers — allowing them to pose as victim companies and post fraudulen...
therecord.media
Canadian security firm Bedrock Safeguard has released a decryption utility that can recover files encrypted by The Gentlemen ransomware. The decrypter can be used if companies can recover at least one memory dump taken while the ransomware encryption process was active github.com/Bedrock-Safe...
GitHub - Bedrock-Safeguard/gentlemen-decryptor: First-ever decryptor for The Gentlemen ransomware — recovers encryption keys from process memory dumps using X25519 ephemeral key extraction. 35/35 file...
First-ever decryptor for The Gentlemen ransomware — recovers encryption keys from process memory dumps using X25519 ephemeral key extraction. 35/35 files decrypted. Research by Bedrock Safeguard In...
github.com
Zambia announced it was cancelling the large digital freedoms conference RightsCon days before it was to be held in Lukasa even as thousands were en route. Officials cited concerns about the conference's themes. The Chinese govt reportedly bankrolled the event venue. therecord.media/zabia-cancel...
Zambia cancels global digital freedoms conference days before start
On Tuesday, Zambia’s Minister of Technology and Science offered the first hint that the conference would be cancelled, telling a Zambian news outlet that participants’ security clearances were incompl...
therecord.media
A business's website has been hit by a ransomware attack, demanding 0.1 BTC and a tweet for file recovery. The attack isn't unique to them, as similar messages and values appear on other sites. They are seeking advice on the vulnerability exploited and how to resolve the issue.
Our business is under attack by ransomware (Any help is appreciated)
to recover your files, kindly send 0.1 BTC to bc1q9nh4revv6yqhj2gc5usncrpsfnh7ypwr9h0sp2 and tweet ty15b6TOTuBuzUhfypJeagHl4e2sAs26, then we will help u <3 This is the message that our website got...
reddit.com
NIST announced deep changes to the NVD today, writing that it would no longer enrich every vuln submission. The only bugs that will have info added are in: - CISA's known exploited list - tools used by federal government - software deemed 'critical' therecord.media/nist-to-limi...
NIST to limit work on CVE entries as submissions surge
NIST said it will only add details and information to the records of vulnerabilities that meet a certain threshold — changing a longstanding mission to categorize every CVE, which stands for cybersecu...
therecord.media
A North Korea expert compared last week's $280 million theft from Drift to the assassination of Kim Jong Un's brother in 2017 Pyongyang created a fake company and hired people to meet up with Drift officials in person at conferences before launching the 4/1 attack therecord.media/drift-crypto...
‘It reads like a spy novel’: $280 million theft from Drift involved North Korean fake companies, cutouts
Drift officials said the operation began six months ago, when they were approached at a cryptocurrency conference by members of a company claiming to focus on quantitative trading.
therecord.media
After the $280 million theft from Drift, the Treasury Dept said it will start sharing cyber threat intel with the crypto industry Crypto firms will receive the same actionable cyber information Treasury regularly shares with traditional U.S. financial institutions therecord.media/treasury-dep...
Treasury Department announces crypto industry cyber threat sharing initiative
Eligible U.S. digital asset firms and industry organizations “that meet Treasury’s criteria” will be able to receive, at no cost, the same actionable cybersecurity information Treasury regularly shares with traditional U.S. financial institutions.
therecord.media
Bitcoin ATM said someone stole more than $3 million after breaking into their corporate systems last month therecord.media/crypto-atm-b...
Cryptocurrency ATM giant Bitcoin Depot reports $3.6 million stolen in cyberattack
Bitcoin Depot filed a notice with the Securities Exchange Commission (SEC) explaining that a threat actor “gained access to certain systems and obtained control of credentials associated with the company’s digital asset settlement accounts.”
therecord.media
Winona County Administrator Maureen Holte told @therecordmedia.bsky.social that Monday's ransomware attack did not involve the same cybercriminal responsible January's ransomware attack Minnesota governor Tim Walz sent the National Guard to help the county recover therecord.media/minnesota-se...
Minnesota governor sends national guard to county after cyberattack
Minnesota governor Tim Walz issued an executive order on Tuesday, writing that Winona county experienced a cyberattack on critical systems that began on Monday.
therecord.media
Buried in the FBI, DOD and NSA advisory on Iran cyberattacks on critical infrastructure operational technology was acknowledgement that 75 devices were compromised during the CyberAv3ngers campaign in 2023/2024 therecord.media/fbi-pentagon...
FBI, Pentagon warn of Iran hacking groups targeting operational technology
The advisory said Iranian actors are targeting local municipal governments, water and wastewater systems and the energy sector.
therecord.media
Medusa has been on a tear lately, going after more impactful targets... Medusa ransomware gang claims attacks on prominent Mississippi hospital, New Jersey county Let's hope they come to regret this very soon. via @jgreig.bsky.social & @therecordmedia.bsky.social
Medusa ransomware gang claims attacks on prominent Mississippi hospital, New Jersey county
The Medusa ransomware operation has claimed a devastating cyberattack that knocked out systems at the biggest hospital in Mississippi for nine days.
therecord.media
Interlock ransomware gang exploited Cisco firewall zero-day weeks before disclosure: Amazon via @jgreig.bsky.social & @therecordmedia.bsky.social
Interlock ransomware gang exploited Cisco firewall zero-day weeks before disclosure: Amazon
The Interlock ransomware gang recently exploited a zero-day vulnerability in a popular line of Cisco firewalls before the bug was disclosed publicly, according to an Amazon report.
therecord.media
Interesting from @jgreig.bsky.social, w/ confirmation of "historical" data from FBI. Imagine attempting to conduct hostile operations in the U.S. and **you have access to the personal email account** of the counterintelligence agency's director. What would you burn that access for? A cheap info op?
FBI confirms theft of director’s personal emails by Iran-linked hacking group
An FBI spokesperson told Recorded Future News that the information is “historical in nature and involves no government information,” adding that the agency has “taken all necessary steps to mitigate p...
therecord.media
Electronic health record company CareCloud told the SEC that a recent cyberattack "is material in light of the sensitivity of the potentially affected information and the potential consequences of the incident.” therecord.media/carecloud-ha...
Healthcare software firm CareCloud informs SEC of potential patient data leak
The healthcare software firm CareCloud warned the Securities and Exchange Commission that a cyberattack may have resulted in the leak of patient data.
therecord.media