Ransomware payments jumped 44% to an average $3.6M in 2025 as attackers shift to fewer, higher-value strikes—forcing organizations to weigh grim pragmatism against costly downtime, data leaks, and regulatory fallout.
When Muji paused online orders after logistics partner Askul was hit by ransomware, it exposed a stark truth: a single third-party breach can freeze entire retail operations. This outage is a wake-up call for brands to map dependencies, tighten vendor security, and treat supply-chain risk as an ongoing priority.
When LostKeys was exposed this spring, Coldriver didn’t fold — they reinvented, rolling out a lean, modular strain called NoRobot that sneaks past signatures, steals credentials, and blends into normal traffic. Defenders now need behavior-based detection, stronger identity controls like MFA, and faster threat-sharing to keep up with this smarter, stealthier pivot.
A rival cybercrime group has publicly doxxed the operators behind Lumma Stealer, ripping away their secrecy and wreaking reputational havoc while creating both intelligence opportunities—and dangerous misinformation—for defenders, victims, and investigators.
Heads-up: Google TAG says Russia-linked COLDRIVER has churned out three new malware families and is retooling them within days—an accelerated development pace that makes signature-based defenses brittle and raises the urgency for MFA, behavior-based EDR, and proactive threat hunting.
A major European telecom was breached after attackers exploited a Citrix NetScaler flaw to deploy Snappybee — a modular espionage toolkit tied to the China-linked Salt Typhoon group — showing how trusted remote-access appliances can become gateways for stealthy data theft. The incident is a wake-up call to prioritize patching, segmentation, and behavioral detection before the next exploit hits.
Have I Been Pwned flags 17.6 million records tied to a suspected September hack of Prosper, leaving customers and regulators in the dark while the lender says it can’t yet verify the claims. Check whether your email appears in the database and take basic precautions like changing passwords and monitoring your credit.
When does teenage curiosity cross into state espionage? A small Dutch town is grappling with that question after prosecutors say three teens — one allegedly linked to a Russian-affiliated hacker group — may have helped a foreign intelligence service, raising tricky legal and ethical questions about intent, culpability and how to guide tech-savvy youth.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Cybercriminals are hijacking compromised WordPress sites and hiding malware distribution inside blockchain smart contracts — a tactic called EtherHiding that makes takedowns harder and spreads info-stealers like AMOS, Lumma, RADTHIEF and Vidar to Windows and macOS. Protect your site and devices now: patch WordPress, lock down plugins and admin access, and keep endpoints and authentication strong.
Sotheby’s recent data breach exposed buyers’ sensitive financial and identity records — and some of those files are already being offered for sale online — forcing clients to scramble for protection and pushing the auction world to rethink security. If you entrusted the house with your details, now’s the time to monitor accounts, consider fraud alerts, and demand stronger safeguards.
UK tech graduate hiring has collapsed 46% in a year, with another 53% drop forecast. GenAI is replacing routine junior roles, squeezing Gen Z out of entry-level jobs and threatening the talent pipeline unless employers and universities adapt.
Over 23 million people had personal data exposed in Q3, according to the ITRC — a wake-up call that privacy can’t be an afterthought as breaches across sectors put identities, finances and long-term security at risk.
This week’s ThreatsDay unpacks a staggering $15B crypto fraud, chilling satellite-enabled surveillance, and a rise in smishing — showing how everyday tech is being turned against us and what simple steps you can take to protect your money, data, and trust.
The UK and US have hit a sprawling Southeast Asian scam network with coordinated sanctions to freeze assets and choke off the financial lifelines behind investment and romance frauds. The move targets call centres in Cambodia and Myanmar that allegedly use script-driven deception, coerced workers and complex laundering to prey on victims worldwide.
Researchers uncovered TA585’s sophisticated campaign delivering a new MonsterV2 variant, using modular malware, resilient infrastructure and advanced obfuscation that can bypass signature-based defenses. Organizations should adopt layered detection, tighten email gateways and share intelligence now to stay ahead of these increasingly professionalized criminal operators.
UK firms are feeling the sting of unmanaged AI — EY finds an average hit of £2.9m per organisation from faulty models, data breaches and regulatory slip-ups. It’s a wake-up call: invest in governance, oversight and clear accountability now or watch innovation turn into costly disruption.
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it along
The UK’s NCSC recorded a record 204 nationally significant cyber incidents — a staggering 130% jump — forcing a wake-up call about who gets hurt, what counts as “nationally significant,” and whether our defenses can hold against the next wave.
Imagine a trusted package quietly sending your API keys to a Discord channel — researchers found npm, PyPI, and RubyGems libraries doing exactly that by abusing Discord webhooks as a simple command-and-control. Protect your projects now: audit and pin dependencies, lock down secrets, and add egress controls before convenience becomes the next supply-chain disaster.
Spanish police arrested a 25‑year‑old accused of leading the GXC Team, a group investigators say sold malware and AI‑enabled attack tools like commercial products. The takedown highlights how cybercrime is becoming a turnkey business—and why businesses, policymakers and everyday users need to harden defenses and push for better international cooperation.
AI is already reshaping how campaigns persuade, personalize, and mislead voters—if we don’t act, the next election could be redesigned by synthetic media and automated messaging. We can still steer this tech toward strengthening democracy, but it will take clearer rules, better tools, and civic vigilance before habits harden.
The FBI and French police just knocked BreachForums offline, disrupting a major marketplace for stolen data. It’s a bold win — but domain seizures are only a pause unless paired with sustained investigations, stronger security practices, and international cooperation.
U.S. and French authorities have shut down the latest BreachForums marketplace, a welcome blow to a forum that trafficked stolen data and coordinated extortion. But while the takedown disrupts criminals and helps victims, the real test is whether arrests and sustained action can stop cybercriminals from just reappearing elsewhere.
A cyber gaffe at Prospect exposed sensitive details — including sexual orientation and disability status — for up to 160,000 members. Now the union must act fast with clear fixes and transparent support to rebuild trust and protect vulnerable members.
A zero-day in Oracle E-Business Suite, actively exploited by CL0P since Aug. 9, 2025, likely hit dozens of organizations and put payroll, financial and HR data at risk. Security teams and leaders are racing to contain the damage, patch systems and lock down access before attackers strike again.