Threats
The Gentlemen reportedly listed Deloitte, but the breach remains unverified. EY's documented support-platform incident shows why client records deserve attention without proving a shared campaign.
Threats
ShinyHunters claims it breached the FBI, stole employee and applicant data, and demanded changes to an official warning. The bureau is investigating, reporters have corroborated parts of a sample, and the group denies ties to “the Com”. Here is what is known and what remains unproven.
Threats
CLOSEDQUORUM asks up to four AI models to choose its next malware action. Talos explains the design, but has not confirmed deployment in the wild or observed a complete end-to-end run.
Threats
Microsoft links EvilTokens campaigns to more than 12,000 compromised inboxes. The trick is not always a fake login page: victims can approve the attacker's session through a genuine Microsoft sign-in.
Threats
ShinyHunters has turned its feud with Cl0p into a public extortion demand. The site takeover is documented; claims about stolen payment records remain unverified. Previous victims have reason to keep watching.
Threats
A condition of lawful CSAM scanning has gone unevidenced for five years, and the deadline for providers to start meeting it falls today. Ireland's Data Protection Commission is the body that would know how many ever did, and it now has a Freedom of Information request asking.
Alerts
A detection that has quietly failed and a detection with nothing to report look identical from the outside. A field write-up of building rules for the ShieldBreak privilege-escalation zero-day, and of the assurance layer that tells quiet apart from broken.
Threats
Eclipse is a newly advertised ransomware-as-a-service operation offering affiliates a 90/10 split, refusing cases under $70,000, and claiming ChaCha20 and Kyber encryption across Windows, ESXi and Nutanix. Everything known comes from its own recruitment advertising.
Threats
The security tier lists going round social media rank Telegram above WhatsApp, ClamAV above Bitdefender and a jailbroken model as high safety. We rebuilt all eight rankings against the evidence, kept the logos, and showed our criterion for every tier.
Breaches
Connor Moucka pleaded guilty on 5 August over the campaign that hit 165 Snowflake customers. Snowflake was never breached. Stolen infostealer credentials, no MFA, no rotation, no allow lists. One working password was four years old.
Threats
High-severity ransomware alert, one TLS connection, and ninety-eight minutes to prove nothing happened. The hunt produced a technique that reconstructs browsing from endpoint file events, and an injection campaign no reputation verdict has flagged.
Breaches
Jubair and Flowers got five years six months each for the 2024 TfL attack: 148 systems down, ~28,000 staff resetting passwords in person, £29m lost. The court heard the way in was partial credentials bought on a forum and a social-engineered help desk call. The playbook has not changed.