Allan “Ransomware Sommelier” Liska
@ransomwaresommelier.com
Recorded Future - Ransomware Researcher Owner @greenarcher.io - Yours Truly, Johnny Dollar | The Press Guardian | The Clock | The Green Archer Weird mix of security, comics, photography and wine! www.greenarcher.io
Russian hackers hijack hotel Wi-Fi networks to spy on travelers, Microsoft says via @darynant.bsky.social & @therecordmedia.bsky.social
Russian hackers hijack hotel Wi-Fi networks to spy on travelers, Microsoft says
Russian state-sponsored hackers have been compromising hotel Wi-Fi networks around the world to steal travelers' login credentials and infect devices with espionage malware, Microsoft said.
therecord.media
Oh good 🙄 Anthropic says its AI hacked real-world companies in three incidents via @alexmartin.bsky.social & @therecordmedia.bsky.social
Anthropic says its AI hacked real-world companies in three incidents
Claude maker Anthropic said its AI models escaped test environments and breached networks at three companies on the open internet.
therecord.media
New #ransomware report from the team at Coveware: Adverse cyber extortions are more common than commonly advised coveware.com/2026/07/adve... #CyberSecurity @gate15.bsky.social @ecrime.ch @ransomwaresommelier.com
This from @ciaranm.bsky.social is going to be my airplane read, it looks really good and wlell thought out. From Frenzy to Freakout
From Frenzy to Freakout
AI and the New Wave of Cyber FUD
open.substack.com
Okay, North Carolina frenz, is Raleigh known for its corn dogs?
AI robocall scams rise as small carriers lag on anti-spoofing rules via @suzannesmalley.bsky.social & @therecordmedia.bsky.social
AI robocall scams rise as small carriers lag on anti-spoofing rules
Most small telecommunications providers are not complying with a 2019 law that requires the use of technology that checks the veracity of caller ID in order to block scammers.
therecord.media
India’s Bank of Baroda confirms cyber incident after hackers claim data theft Via @darynant.bsky.social & @therecordmedia.bsky.social
India’s Bank of Baroda confirms cyber incident after hackers claim data theft
An employee's email account had been compromised, allowing unauthorized access to "certain data," Bank of Baroda reported.
therecord.media
Today's interesting newly-registered ransomware themed domain name: ransomware-fbi[.]ph Because the FBI famously uses ccTLDs outside of .gov
I'm Picking Up Really Sketch Vibes
ALT: I'm Picking Up Really Sketch Vibes
static.klipy.com
If you are in Melbourne today, I guess watch out for your sheep…
Clop ransomware targets Windchill, FlexPLM in data theft attacks via @bleepingcomputer.com
Clop ransomware targets Windchill, FlexPLM in data theft attacks
The Clop ransomware gang (also tracked as Cl0p) is targeting Internet-exposed PTC Windchill and FlexPLM instances in a new data theft extortion campaign.
bleepingcomputer.com
Kris and I were driving around today and I was playing Boston. She joked that I was reliving my high school days. So, I switched to Beethoven’s 5th and joked it was so she could relive her high school days. We’re getting divorced now 🤣🤣🤣.
Boston - Amanda (Lyrics)
YouTube video by ALL MIXED
youtu.be
Congratulations to the amazing team at @bsidesnova.bsky.social on 10 incredible years. I didn’t speak at the first one (though I was there, I did speak at 2017’s BSidesNoVA and many since… (Also, people still ignore the security threats of NTP)
BSides Nova 2017 203 Why the NTP Security Problem Is Worse than You Think Allan Liska
YouTube video by Philippe Delteil
youtu.be
BSidesNoVA@bsidesnova.bsky.social · 6mo agoBSides Northern Virginia: Celebrating 10 years of hacking in the best part of the DMV. bsidesnova.org #WeSaidWhatWeSaid
Check Point patches a zero-day in its SmartConsole panel support.checkpoint.com/results/sk/s...
Critical wp2shell WordPress flaws exploited to install webshells via @bleepingcomputer.com
Critical wp2shell WordPress flaws exploited to install webshells
Hackers are exploiting the "wp2shell" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected...
bleepingcomputer.com
'Most #ransomware attacks still rely on familiar problems such as known vulnerabilities, exposed systems & security gaps...the focus should therefore be “exposure management”' via @arstechnica.com arstechnica.com/security/202... @gate15.bsky.social @ecrime.ch @ransomwaresommelier.com #CyberSecurity
Pay up or not? Ransomware surge has victims facing tough choices.
Governments look at banning ransom payments in face of increasingly sophisticated threats.
arstechnica.com
Hackers were inside South Korea's diplomat training system for 9 months via @alexmartin.bsky.social & @therecordmedia.bsky.social
Hackers were inside South Korea's diplomat training system for 9 months
Unidentified hackers compromised an online education system used by South Korea's diplomatic academy, stealing personal information belonging to former and current employees of the country's Ministry ...
therecord.media
Romania races to restore land registry after cyberattack disrupts property market via @darynant.bsky.social & @therecordmedia.bsky.social
Romania races to restore land registry after cyberattack disrupts property market
Romania's land registry agency is still recovering from a cyberattack it called "the most serious technical incident in the institution's history."
therecord.media
Software provider to more than 2,000 US hospitals says hackers stole employee and customer data via @alexmartin.bsky.social & @therecordmedia.bsky.social
Software provider to more than 2,000 US hospitals says hackers stole employee and customer data
Craneware, which is headquartered in Edinburgh and listed on London's AIM market, told investors it detected unauthorized access to a “subset” of its data environment and has since brought in outside ...
therecord.media
Today’s interesting newly registered ransomware-themed domain name is. hospitalransomware[.]com Which someone is trying to sell for $50k. That’s right, for about the 1/2 the cost of the average ransom paid by a healthcare provider you can own this domain!
Another reminder that you don’t own your domain name. I love that Texas thinks it’s a good thing that they can get a Dutch company’s website taken down. Because there is no way this could come back to bite Texas in the ass.
Attorney General Ken Paxton Secures Landmark Legal Victory to Lock Pornographic Website Domain and Protect Minors From Harmful Content
Attorney General Ken Paxton secured a landmark court order to cut off a pornographic website’s ability to operate under its domain name after the company failed to take measures to protect children fr...
texasattorneygeneral.gov
Allan “Ransomware Sommelier” Liska@ransomwaresommelier.com · 3w agoGood reminder that you never actually own your domain.
Every week, Metacurity offers our readers a selection of the top infosec-related long reads we couldn't do justice to amid the torrent of daily news. This week's choices cover --How an audacious server heist exposed the fragility of digital infrastructure, 1/2 www.metacurity.com/hidden-syste...
Hidden systems, hidden risks: Best infosec long reads 7/18/26
How an audacious server heist exposed the fragility of digital infrastructure, WhatsApp has quietly become an essential service, The NHS fought to keep sensitive health data out of Palantir's hands, T...
metacurity.com
New: A Canadian cybersecurity firm accused a former contractor of sharing trade secrets about a previously unknown flaw used to hack iPhones with a rival firm Gift link: www.bloomberg.com/news/article...
IPhone Hacking Firm Sues Ex-Worker Over Alleged Theft of Secrets
Magnet Forensics Inc., a Canadian cybersecurity firm, accused a former contractor of sharing trade secrets about a previously unknown flaw used to hack iPhones with a rival firm.
bloomberg.com
Love this episode of @smashingsecurity.com with Geoff White. As we’ve done more Kickstarter campaigns for our comics we get hit with these “author scams” so often it’s almost background noise and thrilled to see Geoff talking about it.
podcasts.apple.com
New from @dannypalmer.bsky.social, 'Compromised Logins Surge as the Most Common Entry Point for #Ransomware Attacks' (re: @sophossecurity.bsky.social www.sophos.com/en-us/blog/s...) www.infosecurity-magazine.com/news/comprom... #CyberSecurity @gate15.bsky.social @ecrime.ch @ransomwaresommelier.com
Compromised Logins Surge as the Most Common Entry Point for Ransomware
Research of incidents by Sophos finds that phishing, brute force attacks and other identity-based threats have surpassed software vulnerabilities as means of delivering ransomware
infosecurity-magazine.com
Good reminder that you never actually own your domain.
Zack Whittaker@zackwhittaker.com · 3w agoNew: Telegram's short URL t.me domain returned online Tuesday after a day-long suspension knocked the domain off the web. The domain registrar behind .me said the incident was due to "OFAC compliance," likely sparked by fresh US Treasury sanctions against a VPN firm that contained a "t.me" link. 🤦
This is good reporting from Microsoft on ShinyHunters and their abuse of OAuth in SaaS applications to carry out extortion/ransomsware attacks.
Defending SaaS-based applications against ShinyHunters OAuth abuse | Microsoft Security Blog
Microsoft Threat Intelligence identified threat actor activity with overlapping tradecraft commonly associated with ShinyHunters, including voice phishing (vishing), supply-chain compromise, and misco...
microsoft.com
This is a big deal 👀! Russia's FSB blamed for Poland grid attack as UK and EU impose first joint cyber sanctions Via @darynant.bsky.social, @alexmartin.bsky.social & @therecordmedia.bsky.social
Russia's FSB blamed for Poland grid attack as UK and EU impose first joint cyber sanctions
The allies blamed Center 16, the FSB’s signals intelligence arm, for acts of attempted cyber sabotage targeting Poland’s energy sector and water treatment facilities, alongside “a wide range of malici...
therecord.media
