Risky Business bulletin highlights scams, cybercrime and major incidents
A Risky Business bulletin covers new US cyber priorities alongside reports involving the FBI’s wiretap network and a Romanian exporter.
3 min readOpen brief →
Verified cybersecurity, fraud and digital-banking signals with decision context, affected audiences and practical actions.
TOPIC HUBSBrowse cybersecurity topics →
AI assistants are changing how organizations define security risk
Autonomous AI assistants are gaining adoption while challenging familiar boundaries between software, users, insider threats and the controls organizations use to manage risk.
3 min readOpen brief →
FBI identifies suspicious activity on a network used for wiretaps
The FBI acknowledged suspicious activity on a network used for wiretaps and foreign-intelligence warrants, while details about access, attribution, and impact remain unavailable.
3 min readOpen brief →
Anthropic loses Pentagon role as OpenAI moves in
A reported federal order ended agency use of Anthropic models as OpenAI moved into the Pentagon supplier role, amid disputes over surveillance and autonomous weapons.
3 min readOpen brief →
Risky Business reports Iranian scanning of security cameras for missile-strike support
Risky Business News reports that Iran is attempting to hack security cameras to support missile strikes, while leaving the targets, success, and consequences unspecified.
3 min readOpen brief →
Microsoft and Europol disrupt Tycoon 2FA phishing platform
Microsoft and Europol reportedly disrupted Tycoon 2FA, a phishing service linked in the supplied report to multifactor-authentication bypass, business email compromise, and ransomware.
3 min readOpen brief →
Sean Plankey’s CISA Nomination Reportedly Faces New Uncertainty
A reported departure from DHS put Sean Plankey’s CISA nomination in jeopardy amid concerns about Iran-linked hackers and a weakened agency.
3 min readOpen brief →
International Law Enforcement Dismantles Phishing-as-a-Service Platform
Europol said international agencies dismantled a phishing-as-a-service platform linked to worldwide targeting of hundreds of thousands of accounts, including hospital and school accounts.
3 min readOpen brief →
AirSnitch Targets Wi-Fi Through Cross-Layer Identity Desynchronization
AirSnitch is described as a cross-layer Wi-Fi attack that could enable bidirectional machine-in-the-middle activity across home, office, and enterprise networks.
3 min readOpen brief →
Anthropic Says It Disrupted Use of Claude in Alleged Mexican Government Hack
Researchers said an unknown user tried to use Claude against Mexican government networks; Anthropic said it investigated, disrupted the activity, and banned involved accounts.
3 min readOpen brief →
Hacked Prayer-Timing App Delivered Messages During Explosions in Iran
A widely downloaded prayer app reportedly pushed messages in Iran after explosions, but responsibility for the apparent compromise remains unclaimed and unconfirmed.
3 min readOpen brief →
Authorities from 14 countries shut down LeakBase cybercrime forum
A 14-country operation seized LeakBase, a forum officials said held hundreds of millions of credentials and other stolen corporate and personal data.
3 min readOpen brief →
International operation dismantled LeakBase marketplace for stolen databases
The LeakBase seizure disrupted a market for stolen databases, but copied records can continue supporting identity fraud and account takeover.
3 min readOpen brief →
Researchers link possible U.S.-developed exploits to a mass iOS attack
Google and iVerify research links the Coruna iOS exploit kit to activity across criminal, Russian, and spyware contexts, while its possible origin remains unconfirmed.
3 min readOpen brief →
Ransomware shifts toward stolen passwords and impersonation
Cloudflare says stolen passwords have overtaken infectious code as the most common tactic in major breaches, putting impersonation at the center of ransomware defenses.
3 min readOpen brief →
Business email fraud turns familiar requests into costly payment losses
Dutch NCSC guidance shows how compromised mailboxes turn routine business trust into payment loss unless finance processes verify requests independently.
3 min readOpen brief →
Between Two Nerds examines cyber operations in the war in Ukraine
A Risky Business podcast episode explores how cyber operations in Ukraine have changed, with show notes linking the discussion to espionage and missile-strike reporting.
3 min readOpen brief →
University of Hawaiʻi Cancer Center confirms leak after ransomware attack
The University of Hawaiʻi Cancer Center confirmed a leak after ransomware, with part of the incident traced to records used by a 1993 research cohort.
3 min readOpen brief →
Moltbook’s AI-only image is challenged by evidence of human direction
Moltbook’s reputation as an AI-only social network is complicated by evidence that humans created, prompted, verified, and published through many purported bots.
3 min readOpen brief →
University of Mississippi Medical Center clinics reopen after ransomware attack
After a ransomware attack, University of Mississippi Medical Center clinics regained access to patient records and began resuming normal operations more than a week later.
3 min readOpen brief →
Researchers warn of elevated Iran-linked cyber threat to the US and allies
Researchers warn that hacktivist and state-linked groups associated with Iran are using DDoS, phishing and other tactics against critical infrastructure.
3 min readOpen brief →
Risky Bulletin Highlights LLM Deanonymization Concerns Alongside Several Security Developments
An LLM deanonymization claim leads a bulletin that also covers CISA leadership, a French health ministry data theft, and Google’s ad-fraud-botnet takedown.
3 min readOpen brief →
China-linked hackers reportedly breached telecoms and government agencies using Google Sheets
A Cybersecurity Dive report says China-linked hackers used malware concealed in Google Sheets during attacks affecting telecoms and government agencies.
3 min readOpen brief →
CSO Online outlines ransomware’s shifting strains, tactics and targets
CSO Online’s guide explains how ransomware strains differ, from rapidly locking networks to gradually leaking sensitive data, and why organizations should account for varied tactics.
3 min readOpen brief →