(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Category: North America
Breaking News, cyber crime, Cybercrime, Global Security News, North America, Security
Taiwanese operator of Incognito Market sentenced to 30 years over $105M darknet drug ring
A Taiwanese man was sentenced to 30 years for running Incognito Market, a major darknet drug site that sold over $105 million in illegal drugs. Rui-Siang Lin (24) was sentenced to 30 years in prison for running Incognito Market, a major darknet drug marketplace that sold over one ton of narcotics. The Taiwanese man pled…
Global Security News, North America
Malicious Script Delivering More Maliciousness, (Wed, Feb 4th)
Today, I received an interesting email with a malicious attachment. When I had a look at the automatic scan results, it seemed to be a malicious script to create a Chrome Injector to steal data. Because InfoStealers are very common these days, it looked “legit” but there was something different. The .bat file looks to…
Global Security News, North America, Press Release
One Identity Appoints Gihan Munasinghe as Chief Technology Officer
Alisa Viejo, United States, 4th February 2026, CyberNewsWire
Global Security News, North America
ISC Stormcast For Wednesday, February 4th, 2026 https://isc.sans.edu/podcastdetail/9794, (Wed, Feb 4th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
Detecting and Monitoring OpenClaw (clawdbot, moltbot), (Tue, Feb 3rd)
Last week, a new AI agent framework was introduced to automate “live”. It targets office work in particular, focusing on messaging and interacting with systems. The tool has gone viral not so much because of its features, which are similar to those of other agent frameworks, but because of a stream of security oversights in…
Global Security News, North America
Think agentic AI is hard to secure today? Just wait a few months
Early experimentation with agentic AI has given CISOs a preview of the possible cybersecurity nightmares ahead. But with autonomous agent adoption expected to soar throughout 2026, CISOs’ lack of visibility into agentic identities, activities, and decision-making is set to get far worse in quick measure. Agentic use will vary by enterprise, but analysts, consultants, and…
Global Security News, North America
ISC Stormcast For Tuesday, February 3rd, 2026 https://isc.sans.edu/podcastdetail/9792, (Tue, Feb 3rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
ISC Stormcast For Tuesday, February 3rd, 2026 https://isc.sans.edu/podcastdetail/9792, (Tue, Feb 3rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
ISC Stormcast For Tuesday, February 3rd, 2026 https://isc.sans.edu/podcastdetail/9792, (Tue, Feb 3rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
ISC Stormcast For Tuesday, February 3rd, 2026 https://isc.sans.edu/podcastdetail/9792, (Tue, Feb 3rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
Scanning for exposed Anthropic Models, (Mon, Feb 2nd)
Yesterday, a single IP address (%%ip:204.76.203.210%%) scanned a number of our sensors for what looks like an anthropic API node. The IP address is known to be a Tor exit node. The requests are pretty simple: GET /anthropic/v1/models Host: 67.171.182.193:8000 X-Api-Key: password Anthropic-Version: 2023-06-01 It looks like this is scanning for locally hosted Anthropic models,…
Global Security News, North America
Scanning for exposed Anthropic Models, (Mon, Feb 2nd)
Yesterday, a single IP address (%%ip:204.76.203.210%%) scanned a number of our sensors for what looks like an anthropic API node. The IP address is known to be a Tor exit node. The requests are pretty simple: GET /anthropic/v1/models Host: 67.171.182.193:8000 X-Api-Key: password Anthropic-Version: 2023-06-01 It looks like this is scanning for locally hosted Anthropic models,…
Global Security News, North America
ISC Stormcast For Monday, February 2nd, 2026 https://isc.sans.edu/podcastdetail/9790, (Mon, Feb 2nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
ISC Stormcast For Monday, February 2nd, 2026 https://isc.sans.edu/podcastdetail/9790, (Mon, Feb 2nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
Google Presentations Abused for Phishing, (Fri, Jan 30th)
Charlie, one of our readers, has fowarded an interesting phishing email. The email was sent to users of the Vivladi Webmail service. While not overly convincing, the email is likely sufficient to trick a non-empty group of users: The e-mail gets more interesting as the user clicks on the link. The linke points to Google…
Channel Analysis, Global Security News, North America
ScalePad Finds MSP Optimism Rising Despite Market Pressure
New research from ScalePad shows MSPs entering 2026 with strong growth optimism, even as budget pressure and competition persist across the channel. We spoke with CEO Chris Day ahead of the release about some of the key findings and why he believes 2026 is a year full of opportunity for channel partners who can build…
Global Security News, North America
ISC Stormcast For Friday, January 30th, 2026 https://isc.sans.edu/podcastdetail/9788, (Fri, Jan 30th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
ISC Stormcast For Friday, January 30th, 2026 https://isc.sans.edu/podcastdetail/9788, (Fri, Jan 30th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Cybercrime, Financial, Global Security News, North America
The ‘staggering’ cybersecurity weakness that isn’t getting enough focus, according to a top Secret Service official
The internet domain registration system is a major weakness that malicious hackers can exploit, but is often being overlooked, a senior Secret Service official said Thursday. “It is staggering to me that we live in a world where domain registrars and registrars will do bulk registration of various spellings of a major institution’s brand name…
disinformation, Election Security, Global Security News, Government, National Association of Secretaries of State, North America
Lawmakers, election officials blast Trump administration after Fulton County raid
Following a federal raid on Fulton County, Georgia’s Elections Office, lawmakers and state election officials sharply criticized the Trump administration, accusing the White House of chasing baseless internet conspiracy theories about fraud in the 2020 election. Officials also warned the raid could set a precedent for similar federal actions targeting the 2026 midterm elections. According…
Global Security News, North America
ISC Stormcast For Thursday, January 29th, 2026 https://isc.sans.edu/podcastdetail/9786, (Thu, Jan 29th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
AI, Cybersecurity, Geopolitics, Global Security News, Government, North America, privacy
Undressed victims file class action lawsuit against xAI for Grok deepfakes
A class of individuals who say they were victimized by nude or undressed deepfakes generated by Grok have filed a lawsuit against parent company xAI, calling the tool “a generative artificial intelligence chatbot that humiliates and sexually exploits women and girls by undressing them and posing them in sexual positions in deepfake images publicly posted…
Global Security News, Identity and Access Management, Risk Management, Security, North America
Always-on privileged access is pervasive — and fraught with risks
Privileged access management (PAM) has always been about ensuring least privilege. But the nature of enterprise cybersecurity — on top of the complexity of system operations — has prompted far too many users to log in at the highest possible privilege and stay there, even when most of their tasks do not require it. One…
Global Security News, North America
ISC Stormcast For Wednesday, January 28th, 2026 https://isc.sans.edu/podcastdetail/9784, (Wed, Jan 28th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America, Technology
Apple Workers Are Livid That Tim Cook Saw “Melania” Movie Hours After CBP Killed Pretti
Just hours after a U.S. Border Patrol officer gunned down Minneapolis resident Alex Pretti, Apple CEO Tim Cook, donned his tuxedo to attend an exclusive screening of a new documentary about First Lady Melania Trump. A growing number of Apple workers are now internally criticizing Cook and the company’s silence in the face of an…
Artificial Intelligence, Global Security News, North America, Technology
OpenAI’s ChatGPT ad costs are on par with live NFL broadcasts
OpenAI plans to begin rolling out ads on ChatGPT in the United States if you have a free or $8 Go subscription, but the catch is that the ads could be very expensive for advertisers. […]
Global Security News, North America
Initial Stages of Romance Scams [Guest Diary], (Tue, Jan 27th)
[This is a Guest Diary by Fares Azhari, an ISC intern as part of the SANS.edu BACS program] Romance scams are a form of social-engineering fraud that causes both financial and emotional harm. They vary in technique and platform, but most follow the same high-level roadmap: initial contact, relationship building, financial exploitation. In this blog post I focus…
Global Security News, North America
ISC Stormcast For Tuesday, January 27th, 2026 https://isc.sans.edu/podcastdetail/9782, (Tue, Jan 27th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
ISC Stormcast For Monday, January 26th, 2026 https://isc.sans.edu/podcastdetail/9780, (Mon, Jan 26th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
Scanning Webserver with /$(pwd)/ as a Starting Path, (Sun, Jan 25th)
Based on the sensors reporting to ISC, this activity started on the 13 Jan 2026. My own sensor started seeing the first scan on the 21 Jan 2026 with limited probes. So far, this activity has been limited to a few scans based on the reports available in ISC [5] (select Match Partial URL and Draw):…
Global Security News, North America
AI needs a course correction, say World Economic Forum speakers
Discussions around artificial intelligence dominated the 2026 World Economic Forum meeting in Davos, Switzerland. Prognosticators said the situation may get worse before it improves. Top executives talked about improved productivity and economic impact with advances in finance, healthcare, and other sectors. But others noted concerns about the unchecked race to superintelligence, warning that AI’s illusions…
cyber attack, cyber crime, Cybersecurity, Global Security News, malware, North America
Venezuelan Nationals Face Deportation After Multi State ATM Jackpotting Scheme
According to authorities, both suspects were in the United States unlawfully.
Global Security News, North America
ISC Stormcast For Friday, January 23rd, 2026 https://isc.sans.edu/podcastdetail/9778, (Fri, Jan 23rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
CryptoCurrency, Cybercrime, Cybersecurity, Global Security News, North America, Ransomware
Leader of ransomware crew pleads guilty to four-year crime spree
A Russian national pleaded guilty to leading a ransomware conspiracy that targeted at least 50 victims during a four-year period ending in August 2022. Ianis Aleksandrovich Antropenko began participating in ransomware attacks before moving to the United States, but conducted many of his crimes while living in Florida and California, where he’s been out on…
Android, Cellebrite, Citizen Lab, Geopolitics, Global Security News, North America, privacy
Researchers find Jordan government used Cellebrite phone-cracking tech against activists
Jordanian authorities used Cellebrite phone-cracking technology to access the devices of domestic activists and human rights defenders and then extract information from them, according to an investigation published Thursday. The nonconsensual access stood in conflict with international human rights treaties that Jordan ratified, the University of Toronto’s Citizen Lab investigation determined, prompting the research organization…
Global Security News, North America
Is AI-Generated Code Secure?, (Thu, Jan 22nd)
The title of this diary is perhaps a bit catchy but the question is important. I don’t consider myself as a good developer. That’s not my day job and I’m writing code to improve my daily tasks. I like to say “I’m writing sh*ty code! It works for me, no warranty that it will for…
Global Security News, North America
ISC Stormcast For Thursday, January 22nd, 2026 https://isc.sans.edu/podcastdetail/9776, (Thu, Jan 22nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Breaking News, cyber crime, Cybercrime, Global Security News, hacking, hacking news, North America
Crooks impersonate LastPass in campaign to harvest master passwords
Password manager LastPass warns of an active phishing campaign impersonating the service to steal users’ master passwords. LastPass warned users about an active phishing campaign that began around January 19, 2026. Attackers impersonate the service with emails claiming urgent maintenance and urge users to back up their password vaults within 24 hours. The messages use…
Global Security News, North America
Automatic Script Execution In Visual Studio Code, (Wed, Jan 21st)
Visual Studio Code is a popular open-source code editor[1]. But it’s much more than a simple editor, it’s a complete development platform that supports many languages and it is available on multiple platforms. Used by developers worldwide, it’s a juicy target for threat actors because it can be extended with extensions. Of course, it became a…
Global Security News, North America
ISC Stormcast For Wednesday, January 21st, 2026 https://isc.sans.edu/podcastdetail/9774, (Wed, Jan 21st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Artificial Intelligence, Global Security News, North America, Technology
Google says Gemini won’t have ads, as ChatGPT prepares to add them
OpenAI recently rolled out ads to ChatGPT in the United States if you use $8 Go subscription or a free account, but Google says it does not plan to put ads in Gemini. […]
CISO, Global Security News, MSP, North America, Press Release, Research
Airlock Digital Announces Independent TEI Study Quantifying Measurable ROI & Security Impact
Atlanta, GA, United States, 20th January 2026, CyberNewsWire
CISO, Global Security News, North America, Press Release
Sprocket Security Appoints Eric Sheridan as Chief Technology Officer
Madison, United States, 20th January 2026, CyberNewsWire
Global Security News, North America
Add Punycode to your Threat Hunting Routine, (Tue, Jan 20th)
IDNs or “International Domain Names” have been with us for a while now (see RFC3490[1]). They are (ab)used in many attack scenarios because.. it works! Who can immediately spot the difference between: https://youtube.com/ And: https://youtube.com/ The magic is to replace classic characters by others that look almost the same. In the example above, the letter “o”…
Global Security News, North America, Press Release, Product Launch
One Identity Unveils Major Upgrade to Identity Manager, Strengthening Enterprise Identity Security
Alisa Viejo, United States, 20th January 2026, CyberNewsWire
Global Security News, North America
ISC Stormcast For Tuesday, January 20th, 2026 https://isc.sans.edu/podcastdetail/9772, (Tue, Jan 20th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Artificial Intelligence, Global Security News, North America, Technology
You can get ChatGPT’s $20 Plus subscription for free for a limited time
OpenAI is offering ChatGPT Plus, which costs $20 in the United States, for free, but the offer is valid for some accounts only, and it’s a limited-time deal. […]
Global Security News, North America
“How many states are there in the United States?”, (Sun, Jan 18th)
I’ve seen many API requests for different LLMs in the honeypot logs. Like this one: The prompt is always the same: “How many states are there in the United States?”. This is recon to find open LLMs. Not necessarily to exploit them, but to use them. Coincidentally, something similar has been reported in the news: “Hackers…
Global Security News, North America
Wireshark 4.6.3 Released, (Sat, Jan 17th)
Wireshark release 4.6.3 fixes 4 vulnerabilities and 9 bugs. Didier Stevens Senior handler blog.DidierStevens.com (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Artificial Intelligence, Global Security News, North America, Technology
ChatGPT Go subscription rolls out worldwide at $8, but it’ll show you ads
OpenAI’s $8 ChatGPT Go subscription, which gives you 10x more messages, is now available in the United States and other regions. […]
Cybercrime, Cybersecurity, Department of Justice (DOJ), Global Security News, North America
Jordanian national pleads guilty after unknowingly selling FBI agent access to 50 company networks
A 40-year-old Jordanian national pleaded guilty Thursday to operating as an access broker, selling access to at least 50 victim company networks he broke into by exploiting two commercial firewall products in 2023, according to the Justice Department. Feras Khalil Ahmad Albashiti, who lived in the Republic of Georgia at the time, sold an undercover…
AI, Global Security News, North America
Report: Why AI Productivity Gains Disappear into Rework
Workday, an enterprise AI platform, recently released new research that found AI is delivering productivity gains, but organizations aren’t fully capturing its value. Report shows workers find themselves fixing mistakes in AI work too often The Beyond Productivity: Measuring the Real Value of AI report found that employees surveyed are saving meaningful time with AI…
Global Security News, North America, Security
China-linked hackers exploited Sitecore zero-day for initial access
An advanced threat actor tracked as UAT-8837 and believed to be linked to China has been focusing on critical infrastructure systems in North America, gaining access by exploiting both known and zero-day vulnerabilities. […]
Global Security News, North America
ISC Stormcast For Friday, January 16th, 2026 https://isc.sans.edu/podcastdetail/9770, (Fri, Jan 16th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
ISC Stormcast For Friday, January 16th, 2026 https://isc.sans.edu/podcastdetail/9770, (Fri, Jan 16th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America, Press Release, Product Launch
BreachLock Expands Adversarial Exposure Validation (AEV) to Web Applications
New York, United States, 15th January 2026, CyberNewsWire
Global Security News, North America, Press Release
AppGuard Critiques AI Hyped Defenses; Expands its Insider Release for its Next-Generation Platform
McLean, Virginia, United States, 15th January 2026, CyberNewsWire
Global Security News, Microsoft, North America, Security
Microsoft disrupts massive RedVDS cybercrime virtual desktop service
Microsoft announced on Wednesday that it disrupted RedVDS, a massive cybercrime platform linked to at least $40 million in reported losses in the United States alone since March 2025. […]
Global Security News, North America
ISC Stormcast For Thursday, January 15th, 2026 https://isc.sans.edu/podcastdetail/9768, (Thu, Jan 15th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
ISC Stormcast For Thursday, January 15th, 2026 https://isc.sans.edu/podcastdetail/9768, (Thu, Jan 15th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain, (Wed, Jan 14th)
Introduction In recent weeks, Lumma Stealer infections have followed a specific pattern in follow-up activity. This pattern adds scheduled tasks for the same action, which increases traffic to the same C2 domain. This diary documents an example from one of these infections on January 14, 2026. Details After Lumma Stealer performs its data exfiltration, the…
Global Security News, North America
Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain, (Wed, Jan 14th)
Introduction In recent weeks, Lumma Stealer infections have followed a specific pattern in follow-up activity. This pattern adds scheduled tasks for the same action, which increases traffic to the same C2 domain. This diary documents an example from one of these infections on January 14, 2026. Details After Lumma Stealer performs its data exfiltration, the…
Australia, Cybercrime, Cybersecurity, Global Security News, North America, Research
Microsoft seizes RedVDS infrastructure, disrupts fast-growing cybercrime marketplace
Microsoft announced Wednesday that it worked with international law enforcement to seize infrastructure used to run cybercrime subscription service RedVDS and organized civil actions in the United States and United Kingdom to disrupt its further use. RedVDS has enabled at least $40 million in fraud losses in the U.S. since March 2025, according to Microsoft.…
Global Security News, North America
ISC Stormcast For Wednesday, January 14th, 2026 https://isc.sans.edu/podcastdetail/9766, (Wed, Jan 14th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
ISC Stormcast For Wednesday, January 14th, 2026 https://isc.sans.edu/podcastdetail/9766, (Wed, Jan 14th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Bennie Thompson, Geopolitics, Global Security News, Government, North America, Policy
Hill warning: Don’t put cyber offense before defense
Amid budding sentiment in the Trump administration and Congress to expand offensive cyber operations, some lawmakers and experts are warning that the United States needs to get its defenses in order before going too far down that road. A House Homeland Security subcommittee on Tuesday examined how to deter foreign cyberattacks, with an emphasis on…
Global Security News, Have I Been Pwned, North America
Who Decides Who Doesn’t Deserve Privacy?
Remember the Ashley Madison data breach? That was now more than a decade ago, yet it arguably remains the single most noteworthy data breach of all time. There are many reasons for this accolade, but chief among them is that by virtue of the site being expressly designed to facilitate extramarital affairs, there was massive…
Global Security News, North America
ISC Stormcast For Tuesday, January 13th, 2026 https://isc.sans.edu/podcastdetail/9764, (Tue, Jan 13th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
ISC Stormcast For Tuesday, January 13th, 2026 https://isc.sans.edu/podcastdetail/9764, (Tue, Jan 13th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America, Technology
Why Is Everyone Suddenly Talking About Putting Data Centers in Space?
Data centers present sprawling engineering and political problems, with ravenous appetites for land and resources. Building them on Earth has proven problematic enough — so why is everyone suddenly talking about launching them into space? Data centers are giant warehouses for computer chips that run continuously, with up to hundreds of thousands of processors packed…
Global Security News, North America
ISC Stormcast For Monday, January 12th, 2026 https://isc.sans.edu/podcastdetail/9762, (Mon, Jan 12th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
ISC Stormcast For Monday, January 12th, 2026 https://isc.sans.edu/podcastdetail/9762, (Mon, Jan 12th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
YARA-X 1.11.0 Release: Hash Function Warnings, (Sun, Jan 11th)
YARA-X’s 1.11.0 release brings a new feature: hash function warnings. When you write a YARA rule to match a cryptographic hash (either the full file content or a part of it), what’s actually going on are string comparisons: Function hash.sha256 returns a string (the hexadecimal SHA256 hash it calculated) and that is compared to a…
Global Security News, North America
YARA-X 1.11.0 Release: Hash Function Warnings, (Sun, Jan 11th)
YARA-X’s 1.11.0 release brings a new feature: hash function warnings. When you write a YARA rule to match a cryptographic hash (either the full file content or a part of it), what’s actually going on are string comparisons: Function hash.sha256 returns a string (the hexadecimal SHA256 hash it calculated) and that is compared to a…
Global Security News, North America
Malicious Process Environment Block Manipulation, (Fri, Jan 9th)
Reverse engineers must have a good understanding of the environment where malware are executed (read: the operating system). In a previous diary, I talked about malicious code that could be executed when loading a DLL[1]. Today, I’ll show you how a malware can hide suspicious information related to created processes. The API call CreateProcess() is…
Global Security News, North America
Malicious Process Environment Block Manipulation, (Fri, Jan 9th)
Reverse engineers must have a good understanding of the environment where malware are executed (read: the operating system). In a previous diary, I talked about malicious code that could be executed when loading a DLL[1]. Today, I’ll show you how a malware can hide suspicious information related to created processes. The API call CreateProcess() is…
Global Security News, North America
ISC Stormcast For Friday, January 9th, 2026 https://isc.sans.edu/podcastdetail/9760, (Fri, Jan 9th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
ISC Stormcast For Thursday, January 8th, 2026 https://isc.sans.edu/podcastdetail/9758, (Thu, Jan 8th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
Analysis using Gephi with DShield Sensor Data, (Wed, Jan 7th)
I’m always looking for new ways of manipulating the data captured by my DShield sensor [1]. This time I used Gephi [2] and Graphiz [3] a popular and powerful tool for visualizing and exploring relationships between nodes, to examine the relationship between the source IP, filename and which sensor got a copy of the file.…
Artificial Intelligence, Generative AI, Global Security News, North America
Common health questions to ask Chat GPT
Open AI has presented a new report entitled AI as a Healthcare Ally. In the report, we learn that it is very common for users to ask questions about their health to Chat GPT. One in four users (over 200 million) asks health-related questions every week, while one in twenty users (over 40 million) asks…
Global Security News, North America
A phishing campaign with QR codes rendered using an HTML table, (Wed, Jan 7th)
Malicious use of QR codes has long been ubiquitous, both in the real world as well as in electronic communication. This is hardly surprising given that a scan of a QR code can lead one to a phishing page as easily as clicking a link in an e-mail. No more surprising is that vendors of…
Global Security News, North America
In the US, the death of expertise
Back in 1980, science fiction and science author Isaac Asimov wrote, “There is a cult of ignorance in the United States, and there has always been. The strain of anti‑intellectualism has been a constant thread winding its way through our political and cultural life, nurtured by the false notion that democracy means that my ignorance…
Global Security News, North America
ISC Stormcast For Wednesday, January 7th, 2026 https://isc.sans.edu/podcastdetail/9756, (Wed, Jan 7th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Global Security News, North America
Tool Review: Tailsnitch, (Tue, Jan 6th)
In yesterday’s podcast, I mentioned “tailsnitch”, a new tool to audit Tailscale configurations. Tailscale is an easy-to-use overlay to Wireshark. It is probably best compared to STUN servers in VoIP in that it allows devices behind NAT to connect directly to each other. Tailscale just helps negotiate the setup, and once the connection is established,…
Global Security News, North America
ISC Stormcast For Tuesday, January 6th, 2026 https://isc.sans.edu/podcastdetail/9754, (Tue, Jan 6th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
AI, disinformation, Election Security, Geopolitics, Global Security News, Government, North America
AI, voting machine conspiracies fill information vacuum around Venezuela operation
The surprise raid by U.S. armed forces and law enforcement agencies in Caracas, Venezuela had observers around the world scouring social media and news for updates on an operation that saw Venezuelan president Nicholas Maduro and his wife captured and flown to the United States to face criminal charges. The Trump administration initially offered few…
Global Security News, North America, Security
US broadband provider Brightspeed investigates breach claims
Brightspeed, one of the largest fiber broadband companies in the United States, is investigating security breach and data theft claims made by the Crimson Collective extortion gang. […]
Global Security News, North America
Risks of OOB Access via IP KVM Devices, (Mon, Jan 5th)
Recently, a new “breed” of IP-based KVM devices has been released. In the past, IP-based KVM devices required dedicated “server-grade” hardware using IPMI. They often cost several $100 per server, and are only available for specific systems that support the respective add-on cards. These cards are usually used to provide “Lights Out” access to servers,…
Global Security News, North America
ISC Stormcast For Monday, January 5th, 2026 https://isc.sans.edu/podcastdetail/9752, (Mon, Jan 5th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Breaking News, Emcore, Global Security News, intelligence, Laws and regulations, North America, Security
President Trump blocks $2.9M Emcore chip sale over security concerns
Trump ordered the divestment of a $2.9M chip deal, citing U.S. national security risks if HieFo retained control of Emcore ’s technology. President Trump ordered the divestment of a $2.9 million chips deal, citing national security risks tied to HieFo Corp.’s control of Emcore ’s chip technology. HieFo (short for High Efficiency Photonics) is a…
Global Security News, North America
Cryptocurrency Scam Emails and Web Pages As We Enter 2026, (Sun, Jan 4th)
Introduction In October 2025, a work colleague documented a cryptocurrency scam using a fake chatbot. After investigating this, I was able to receive messages from the campaign, and these emails have continued to land in my honeypot account since then. This diary documents the cryptocurrency scam campaign as it continues in 2026. Shown above: My honeypot…
Global Security News, North America
Debugging DNS response times with tshark, (Fri, Jan 2nd)
One of my holiday projects was to redo and optimize part of my home network. One of my homelab servers failed in November. I had only thrown the replacement in the rack to get going, but some cleanup was needed. In addition, a lot of other “layer 1” issues had to be fixed by re-crimping some…
Breaking News, cyber crime, Cybercrime, Global Security News, Google Cloud Application, hacking, North America
Phishing campaign abuses Google Cloud Application to impersonate legitimate Google emails
Researchers uncovered a phishing campaign abusing Google Cloud Application Integration to send emails posing as legitimate Google messages. Check Point researchers have revealed a phishing campaign that abuses Google Cloud Application Integration to send emails impersonating legitimate Google messages. The attack uses layered redirection with trusted cloud services, user validation checks, and brand impersonation to…
Global Security News, North America
ISC Stormcast For Sunday, December 28th, 2025 https://isc.sans.edu/podcastdetail/9750, (Sun, Dec 28th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Breaking News, FCC, Federal Communications Commission, Global Security News, Laws and regulations, North America, Security
U.S. Federal Communications Commission (FCC) bans foreign-made drones over national security concerns
The FCC announced a ban on drones and critical components made in foreign countries, citing national security concerns. The U.S. Federal Communications Commission (FCC) said it has banned drones and key components manufactured abroad over national security concerns. The U.S. government said drones can improve safety and innovation but also pose security risks if used…
Global Security News, North America
Google says no to training AI on its search results
Google is suing SerpApi, a web-scraping company that provides its customers with an API that mimics human searching, the latest salvo in the battle over access to data for training and operating AI large language models. Many of the large language models powering AI services today were trained on data scraped from websites, often without…
Global Security News, North America, Security
Amazon has stopped 1,800 job applications from North Korean agents
Amazon’s chief security officer Stephen Schmidt writes that since April 2024, the company has stopped over 1800 job applications suspected of coming from North Korean agents. The number of applications linked to North Korea has also increased by about 27% per quarter in 2025. The purpose of the infiltration is said to be to obtain…
Breaking News, cyber crime, Cybercrime, Global Security News, malware, North America
Ukrainian hacker pleads guilty to Nefilim Ransomware attacks in U.S.
Ukrainian Artem Stryzhak (35) pleaded guilty in the U.S. for Nefilim ransomware attacks; he was arrested in Spain in 2024, extradited in April 2025. A 35-year-old Ukrainian, Artem Aleksandrovych Stryzhak (35), pleaded guilty in the U.S. for Nefilim ransomware attacks. The Ukrainian citizen was arrested in Spain in 2024 and extradited to the US in…
Global Security News, North America, Security
Ukrainian hacker admits affiliate role in Nefilim ransomware gang
A Ukrainian national pleaded guilty on Friday to conducting Nefilim ransomware attacks that targeted high-revenue businesses across the United States and other countries. […]