[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentEmerging Threats
Researchers Identify New LockBit Ransomware Victims
LockBit is back—and meaner: its new cross‑platform payloads can hit Windows, Linux and VMware ESXi, turning a single break‑in into a crisis for hospitals, utilities and virtualized environments. Defenders must speed up containment and broaden detection beyond traditional endpoints or risk irreversible damage.
ToolShell Gains Traction as Public App Exploits Surge
When did a routine update become a battleground? ToolShell has quietly moved from niche reconnaissance to a go‑to exploit chain that turns public apps into launchpads for credential theft, lateral movement and ransomware — a wake‑up call that exposed services and slow patching can let attackers topple whole networks.
Iran-linked MuddyWater Breach Hits 100+ Government Networks
How did one compromised mailbox become a battering ram against more than 100 government networks? Researchers say Iran-linked MuddyWater used a hijacked account and its own VPN to send convincing phishing across the Middle East and North Africa, quietly stealing credentials and siphoning sensitive intelligence — a reminder that simple, trusted tools can inflict huge damage.
Cyber Executive Charged with Selling Secrets to Russia
How does the steward of Americas cyber defenses become the seller of its secrets? A former Trenchant executive is accused of trading zero‑day exploits and offensive tools to a Russian buyer for $1.3 million — an alleged betrayal prosecutors say endangers U.S. operations and national security.
Mysterious Russian Drone Spotted in Combat Zone
Imagine spotting a flying doughnut over the front lines — Ukrainian electronic‑warfare specialists say Russian units are testing an unusual annular ring‑wing drone that looks nothing like the usual quadcopters. Its circular design could trade wingspan for endurance, potentially changing how drones loiter, scout and strike.
60% of Security Leaders Warn of Rapid Threat Evolution
Sixty percent of security leaders say attackers are evolving faster than defenses — a wake‑up call as crime gets industrialized into automated, turnkey attacks that prey on cloud, supply‑chain and IoT gaps. The upshot: rising costs, eroding trust and a simple choice for organizations — act now to close the gap or accept escalating risk.
85,000 Pet Owner Records Exposed in Major Data Breach
Turns out your pet’s medical chart can be a treasure map for crooks — over 85,000 pet and owner records were left publicly accessible, exposing names, contact details, microchip and medical data. What starts as spam can quickly turn into targeted fraud, identity theft or even false ownership claims, putting families and animals at real risk.
ShinyHunters Orchestrate Widespread Corporate Extortion
ShinyHunters have kicked off a sweeping campaign of corporate extortion—leaking stolen data and demanding ransoms—so read on to see how companies are fighting back and what it means for you.
WestJet Notifies U.S. Consumers of Data Breach
WestJet has notified U.S. customers of a recent data breach—find out what happened and the simple steps you can take now to protect your information. Stay informed and act quickly to safeguard your accounts.
Feds Tie Scattered Spider Duo to $115M in Ransoms
U.S. prosecutors say 19‑year‑old Thalha Jubair helped power Scattered Spiders telecom‑focused extortion ring, allegedly netting at least $115 million through SIM‑swap scams, social engineering and account takeovers. The cross‑border indictment is a stark wake‑up call that human trust, lax recovery policies and reused credentials—not exotic malware—still fuel major ransoms.
Stark Industries Evades EU Sanctions via Bulletproof Host
When the EU sanctioned Stark Industries in May 2025 — a bulletproof host tied to Kremlin-linked cyberattacks — the operation simply rebranded and shifted assets, proving how shell companies and rapid infrastructure swaps let illicit networks shrug off penalties. It’s a wake-up call: sanctions alone can’t stop a well‑engineered cyber hydra.
Bulletproof Host Stark Industries Evades EU Sanctions
Think sanctions shut down bad actors? When Stark Industries was sanctioned, it vanished and reemerged under new names within days — a stark reminder that bulletproof hosting’s rapid rebrands and shell-game tactics let Kremlin-linked cyber and disinformation networks keep running despite EU measures.
investment scam: Shocking, Risky Deepfake Google Ads
Scammers are buying top search spots and using AI deepfakes to impersonate Singapore officials, creating convincingly official sites that trick investors into wiring funds. Learn simple checks—verify .gov.sg domains and contact agencies directly—to avoid falling for these high-tech cons.
National Time Service Center: Exclusive Risky Attack
China’s MSS claims the NSA used 42 cyber tools to tamper with the National Time Service Center—a charge that, if true, would turn the country’s clocks into a powerful tool for disrupting finance, telecoms and critical infrastructure. Dramatic as the allegation is, the lack of a public forensic dossier leaves the claim hanging between serious threat and strategic rhetoric.
insider risk: Essential Defenses Against Costly Breaches
Insider risk is now a frontline threat—77% of organizations have suffered data loss—so prioritize least-privilege access, zero-trust IAM, and integrated DLP/UEBA/SIEM while building a people-first culture that balances privacy with protection. These must-have defenses stop costly breaches before trusted channels become exit ramps.
BeaverTail and OtterCookie: Stunning Critical Threat
Cisco Talos warns a North Korean group is fusing BeaverTail’s credential-theft with OtterCookie’s browser persistence into single, stealthier JavaScript malware that’s harder to spot — defenders should start hunting for blended behaviors and tighten basics like MFA, patching, and anomaly detection now.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
payment data breach: Stunning Alarming Risk Exposed
About 180,000 people had names and payment details left exposed — putting them at heightened risk of fraud and identity theft; here’s what to do now to protect yourself and why companies must tighten their defenses.
rewire democracy: Exclusive Best Reforms
Join Nathan E. Sanders and me in Cambridge on October 22 for talks at Harvard Kennedy School’s Ash Center and a book signing at Cambridge Public Library, then tune in online on October 23 for a virtual discussion with Data & Society as we unpack how algorithms, platforms, and data are reshaping democracy—and what practical steps can make civic systems more resilient.
Rewiring Democracy: Stunning Risks Ahead
What if the platforms that expanded our public square began shaping what we think? In Rewiring Democracy, Bruce Schneier shows how AI-driven persuasion, automated governance, and synthetic media could rewrite politics — and urges us to decide who will redraw our democratic wiring.
AI and governance: Stunning Risks and Best Fixes
Think politics is messy now? Bruce Schneier warns AI will rewrite the rules — promising smarter governance and wider participation while risking manipulation, bias, and concentrated power, and his new book kickstarts a crucial debate about whether these tools will strengthen or unravel democracy.
ShinyHunters extortion: Stunning Risky Corporate Threat
Imagine waking up to find your company’s secrets posted online unless you pay up — that’s the stark reality dozens of firms now face after ShinyHunters launched a brazen public extortion site. This escalation — tied to prior Salesforce, Discord, and Red Hat breaches — raises the stakes for stronger security, faster incident response, and clearer vendor transparency.
ShinyHunters Exclusive: Dangerous Corporate Extortion
ShinyHunters has escalated from voice‑phishing to a public extortion site threatening to dump data from dozens of Fortune 500 companies. That shift puts customers and companies at risk and makes strengthening human‑centric defenses and zero‑trust controls urgently necessary.
WestJet data breach: Urgent Exclusive Warning
WestJet says a recent cybersecurity incident may have exposed U.S. customers’ travel and payment info — if you’ve flown with them recently, check your accounts, be on the lookout for phishing, and watch for the airline’s updates as the investigation continues.
Scattered Spider Shocking $115M Ransom Scandal
How did a 19‑year‑old become the alleged face of a criminal group accused of extracting $115 million in ransoms? U.S. prosecutors say Thalha Jubair and a co‑conspirator tied to Scattered Spider used social engineering and stolen credentials to hit hospitals, transit and retailers—proof that stronger defenses and international cooperation are now essential.