Healthcare Sector
- OFFIS DCMTK Toolkit
"Successful exploitation of these vulnerabilities could allow an attacker to write files, access unauthorized information, exhaust memory, or crash affected DCMTK client or server processes."
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01
https://www.bankinfosecurity.com/dicom-toolkit-bugs-raise-medical-imaging-security-risks-a-32114
Industrial Sector
- StoneFly Storage Concentrator
"Successful exploitation of these vulnerabilities could allow attackers to gain broad unauthorized access, execute arbitrary commands with root privileges, steal sensitive data, and perform actions on behalf of legitimate users across interconnected systems."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-06 - Delta Electronics DVP12SE PLC
"Successful exploitation of these vulnerabilities could allow an attacker to remotely issue commands, modify operational values, interfere with control logic, and alter device behavior without authentication or privilege enforcement."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-07 - Mitsubishi Electric MELSOFT Update Manager SW1DND-UDM-M
"Successful exploitation of these vulnerabilities could allow a local attacker to tamper with or destroy information in the affected product, cause a denial-of-service condition in the affected product, or execute arbitrary code when a specially crafted archive file is decompressed by the 7-Zip component included in MELSOFT Update Manager."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-01 - Frangoteam FUXA SCADA/HMI
"Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to enumerate all user accounts and role assignments on a FUXA SCADA/HMI instance."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-02 - Schneider Electric EcoStruxure IT Data Center Expert
"Schneider Electric is aware of a vulnerability in its EcoStruxure
IT Data Center Expert. The EcoStruxure IT Data Center Expert product is a scalable monitoring software that collects, organizes, and distributes critical device information providing a comprehensive view of equipment. Failure to apply the remediation provided below may risk information disclosure."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-03 - Schneider Electric EasyLogic T150 And Saitel DP RTU
"Successful exploitation of these vulnerabilities can allow an attacker to cause unauthorized access and exposure of sensitive information when the unauthenticated attacker accesses credentials stored within firmware or system files."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-04 - XZ Utils Vulnerability Impacting B&R Products
"An update is available that resolves vulnerability in the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability could cause the product to stop or corrupt memory data."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-05
Vulnerabilities
- Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap To Pre-Auth RCE CVE-2026-8037)
"Welcome back to another watchTowr Labs blog post. This time, we're looking at Progress Kemp LoadMaster, a load balancer that sits at the edge of a lot of enterprise networks. Edge appliances have a habit of becoming the way in rather than the thing keeping people out, and CVE-2026-8037 keeps that streak alive: a pre-authentication Remote Code Execution vulnerability accessible to anyone who can access the API. So, in probably a predictable turn of events, we're back doing what we do best."
https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/
https://thehackernews.com/2026/06/progress-kemp-loadmaster-flaw-could-let.html - Adobe Security Bulletin
"Adobe has released security updates for ColdFusion versions 2025 and 2023. These updates resolves critical and important vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass. Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates."
https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html - Citrix Patches a New NetScaler Flaw With Echoes Of CitrixBleed
"Citrix published a security bulletin Tuesday disclosing six vulnerabilities in NetScaler ADC and NetScaler Gateway appliances, including a high-severity memory disclosure flaw that researchers say belongs to a vulnerability class first identified in the 2023 incident known as CitrixBleed. The company rated the overall bulletin severity as high and assigned CVSS scores ranging from 6.9 to 8.8 across the six CVEs. Citrix said customers should install the updated builds and, in one case, manually adjust a configuration parameter even after patching."
https://cyberscoop.com/citrix-netscaler-flaw-cve-2026-8451-citrixbleed/
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604 - CISA: Windows BlueHammer Flaw Now Exploited By Ransomware Gangs
"CISA confirmed on Monday that ransomware gangs have begun exploiting a high-severity Microsoft Defender privilege escalation vulnerability that has previously been abused in zero-day attacks. Dubbed BlueHammer, the security flaw (CVE-2026-33825) was leaked by a security researcher known as "Nightmare Eclipse" in early April, together with proof-of-concept exploit code, in protest at how the Microsoft Security Response Center (MSRC) handles the disclosure process. "Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally," Microsoft explains in a security advisory."
https://www.bleepingcomputer.com/news/security/cisa-windows-bluehammer-flaw-now-exploited-by-ransomware-gangs/
https://www.securityweek.com/bluehammer-vulnerability-exploited-in-ransomware-attacks/ - AirDrop And Quick Share Flaws Let Nearby Attackers Trigger Crashes And Bypass Checks
"Two researchers have found six security flaws in AirDrop and Quick Share, the wireless features that beam files between nearby devices with no cables or shared network. An attacker within wireless range, with just a laptop and no prior connection, can crash the sharing service on a Mac or iPhone set to receive from anyone, with no tap or prompt. The same research found Quick Share flaws that bypass Samsung's session checks and trigger a potentially exploitable crash in Google's Windows app."
https://thehackernews.com/2026/06/airdrop-and-quick-share-flaws-let.html
https://www.helpnetsecurity.com/2026/06/30/apple-airdrop-google-samsung-quick-share-vulnerabilities/ - Apple Patches 30+ iOS, MacOS, Safari Flaws, Including AI-Discovered WebKit Bugs
"Apple on Monday released security updates for iOS, macOS, and the Safari web browser to address over three dozen flaws, including four vulnerabilities in WebKit that were discovered using artificial intelligence (AI) tools like Anthropic Claude and OpenAI Codex Security."
https://thehackernews.com/2026/06/apple-patches-30-ios-macos-safari-flaws.html
https://support.apple.com/en-us/100100
https://securityaffairs.com/194476/security/apple-fixes-webkit-flaws-in-ios-and-macos-with-help-from-ai-tools.html
https://www.malwarebytes.com/blog/news/2026/06/update-time-apple-releases-security-patches-for-ios-macos-tahoe-safari - GuardFall: a Universal Shell Injection Vulnerability In Open-Source AI Agents
"AI coding agents and computer use agents run shell commands with your full account authority: your SSH keys, your cloud credentials, everything in $HOME. Most of them gate that power behind a guard that matches the command string against a list of dangerous patterns. But the string being inspected is different from the command executed. A guard inspects raw text, while system shell (bash) expands, unquotes, and rewrites text before running it. So, when an agent processes untrusted content (for example, an npm package with a poisoned README), the prompt injection can make it run a command that passes all the execution filters. This tactic is not new. It’s a decades-old shell quoting bypass, well known in the security literature. It succeeds against today’s most-used open-source agents. We first met this in the open-source NousResearch/hermes-agent project and surveyed ten others against the same bypass class."
https://adversa.ai/blog/opensource-ai-coding-agents-shell-injection-vulnerability/
https://thehackernews.com/2026/06/guardfall-exposes-open-source-ai-coding.html
https://www.securityweek.com/decades-old-bash-tricks-expose-ai-coding-agents-to-supply-chain-attacks/
Malware
- How Ransomware Syndicates Weaponize Corporate-Style Organization
"Similar to the events that unfolded with the Conti ransomware group’s demise in 2022, leaked internal chat logs of the Black Basta cybercrime group last year gave us a peek behind the curtain of modern ransomware operations. We found that these groups have continued to evolve into highly sophisticated and organized syndicates, taking a corporate-style approach to extortion. According to our analysis, Black Basta members carefully studied victims to launch advanced phishing and malware campaigns, exploit vulnerabilities and intimidate victims into paying via panic-triggering tactics."
https://cyberscoop.com/ransomware-syndicates-corporate-organization-op-ed/
Operation Navy Ghost: How Attackers Planted a Telegram-Powered Backdoor Across Fake * Pyrogram Packages On PyPI
"A threat actor targeted Telegram bot developers adopting the popular ‘pyrogram’ package on PyPI over the course of six months starting November 2025, in Operation Navy Ghost. This malware is a complete backdoor on servers where infected bots are operated, and uses Telegram itself for C2 and data exfiltration. Learn how it works, how it sneaks by most scanners, and how to detect infections."
https://checkmarx.com/zero-post/operation-navy-ghost-pyrogram-telegram-supplychain-attack/
https://www.bleepingcomputer.com/news/security/malicious-pypi-packages-give-hackers-control-of-telegram-bot-servers/ - The Bear Necessities: A Look At The Drivers, Dynamics, And Applications Of The Pro-Russia Influence Ecosystem
"Four years into Russia’s full-scale invasion of Ukraine, the pro-Russia influence ecosystem has evolved from a tool of war back into a global strategic asset. Since the mobilization of this ecosystem to support frontline objectives, we have witnessed the expedited development of new influence assets linked to multiple, expansive, covert information operations (IO) campaigns and a revitalization of pro-Russia hacktivism at an unprecedented scale. While this threat activity initially adapted to encompass Ukraine-related priorities, it is gradually pivoting back to established Russian influence objectives for which the ecosystem was originally honed."
https://cloud.google.com/blog/topics/threat-intelligence/pro-russia-influence-ecosystem
https://www.bankinfosecurity.com/google-kremlin-expands-ai-backed-campaigns-across-europe-us-a-32120 - Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental App
"Cyble Research and Intelligence Labs identified an emerging Android malware family tracked as Glitch SPY, distributed through a fraudulent Polish apartment and house rental platform designed to lure users into downloading an Android APK. Based on the Polish-language lure and rental-themed distribution website, the activity appears to be Poland-focused, targeting users in Poland or Polish expats."
https://cyble.com/blog/glitch-spy-rat-distributed-via-fake-polish-app/ - Bring Your Own Agent: Hijacking Exposed AI Backends To Power Offensive Operations
"Some abuse of an internet-exposed AI server can be mundane: someone finds free inference and runs a chatbot on your bill. The cases below are different. Between March and May 2026, our honeypot sensors caught three separate operators hijacking our exposed Ollama and LiteLLM endpoints as the model backend for offensive tooling. Two were autonomous penetration-testing frameworks ("Strix" and "HexStrike AI"), and the third was an OpenAI Codex agent carrying a persona built to suppress safety refusals and assisting in web reverse-engineering work."
https://labs.zenity.io/p/bring-your-own-agent-hijacking-exposed-ai-backends-to-power-offensive-operations
https://www.darkreading.com/cloud-security/attackers-hijack-exposed-ai-endpoints-power-offensive-ops - New EvilTokens Attack Exposes Browser Visibility Gap In Enterprise SOCs
"A new EvilTokens attack shows how modern phishing can hide critical evidence from enterprise SOCs until the page runs inside the browser. The case highlights a growing visibility gap in phishing triage: suspicious URLs may appear incomplete at first, while the real account takeover flow is revealed only after execution. For security leaders, that gap can mean slower investigations, delayed response, and higher business risk."
https://hackread.com/eviltokens-attack-browser-visibility-gap-enterprise-socs/ - ToddyCat: Your Hidden Email Assistant. Part 2
"We continue to share details on the malicious techniques and toolsets used by the ToddyCat APT group. In the first part of this report, we examined the group’s attacks aimed at stealing data from browsers, as well as from local and cloud email services. The methods used in that campaign indicated that ToddyCat was attempting to access corporate correspondence while evading monitoring tools. However, all of the group’s methods we described previously are effectively detected by EPP and EDR solutions."
https://securelist.com/toddycat-apt-umbrij-tool-and-oauth/120251/ - RustDuck: An In-Depth Analysis Of a Two-Stage Botnet
"Since February 2026, the XLAB large-scale network threat perception system has detected a new malware family active in cyberspace that adopts a Loader + Core (two-stage loading) architecture. Currently, the family has spawned multiple variants, with the main core functionality being the execution of large-scale Distributed Denial-of-Service (DDoS) attacks. It also possesses strong cross-platform adaptability and continuous evolution capabilities."
https://blog.xlab.qianxin.com/rustduck-en/
https://thehackernews.com/2026/06/rustduck-botnet-rebuilds-in-rust-to.html - Silent Swap: A Crypto Clipper Extension Campaign
"McAfee Advanced Threat Research has identified an active browser-extension campaign designed to steal cryptocurrency by silently substituting wallet addresses the moment a user initiates a transaction. The campaign is delivered through unsigned installers — observed in both .NET and Golang variants — that deploy a malicious Chromium extension masquerading as a benign “Google Notes” utility."
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/crypto-clipper-wallet-swapping-browser-extension-malware/
https://thehackernews.com/2026/06/silent-swap-crypto-clipper-uses-fake.html - INC Ransomware Targets Mainframes: Exposed Servers Reveal Cross-Platform Payloads And APAC Campaign
"A recent infrastructure exposure provided a rare look into an active INC ransomware affiliate targeting the Asia-Pacific region. In mid-June 2026, a pair of open directories were identified on AEZA Group LLC, a known bulletproof hosting environment, revealing an operational staging server. The exposed directories contained Windows and Linux encryptors, Group Policy Object (GPO) deployment scripts for a Japanese food and beverage company, and 675 MB of operator tooling, and exfiltrated victim data. Together, these findings offered a unique view into an active ransomware campaign in near real-time."
https://cyberandramen.net/2026/06/24/inc-ransomware-targets-mainframes-exposed-servers-reveal-cross-platform-payloads-and-apac-campaign/
Breaches/Hacks/Leaks
- Insurance Giant Aflac Discloses Data Breach After Subsidiary Hack
"American insurance giant Aflac has disclosed a new data breach after attackers breached its Japan subsidiary's systems and stole personal and bank account information. Aflac (short for American Family Life Assurance Company) is a Fortune 500 company and the largest supplemental insurance provider in the United States, serving millions of customers in the U.S. and Japan. In a filing with the U.S. Securities and Exchange Commission (SEC) on Monday, the company revealed that threat actors gained access to Aflac Japan's systems earlier this month."
https://www.bleepingcomputer.com/news/security/insurance-giant-aflac-discloses-data-breach-after-subsidiary-hack/
https://www.securityweek.com/aflac-japan-data-breach-impacts-4-38-million/
https://securityaffairs.com/194488/data-breach/hackers-steal-data-of-4-38-million-aflac-japan-customers.html
General News
- Shadow AI Is Not a Tool Problem. It’s a Timing Problem.
"Most AI policies are written in the future tense. Employees use AI in the present tense. That gap explains a lot about shadow AI. A governance committee may still be defining good AI use. Meanwhile, AI has already become part of how work moves: in the browser, inside SaaS platforms, and across everyday applications. The mismatch is not only organizational. It is temporal."
https://blog.checkpoint.com/ai-security/shadow-ai-is-not-a-tool-problem-its-a-timing-problem/ - Vulnerability Reports Are Arriving Faster Than GitHub Can Review Them
"Across the open source world, people are reporting software flaws in record numbers, and the systems built to verify those reports are straining under the weight. The GitHub Advisory Database, which feeds automated security alerts to millions of projects, has reached a point where some new advisories take weeks to publish. In May 2026, the database published 1,560 reviewed advisories, the most in its history and several times its usual monthly output. The volume still fell short of what arrived."
https://www.helpnetsecurity.com/2026/06/30/github-advisory-database-review/ - Half The Defense Base Still Builds Security Around Compliance
"CMMC requirements are appearing in defense contracts and moving down through supplier networks to thousands of companies new to this kind of compliance work. Many run on limited budgets with lean security teams. The picture comes from nearly 900 defense contractors, C3PAOs, federal suppliers, and cybersecurity professionals who attended the 2026 Secureframe National Cybersecurity Summit."
https://www.helpnetsecurity.com/2026/06/30/federal-cybersecurity-compliance-report/ - Over 300 UK Firms Hit By Ransomware In a Year
"UK organizations suffered more than 26 successful ransomware attacks each month last year, with SMEs hit hardest, according to new data from Report Fraud. The UK’s cybercrime and fraud reporting service was contacted by 323 corporate ransomware victims between April 2025 and March 2026, according to City of London Police. Over 50% of reports were from small and mid-sized companies. Financial losses associated with these incidents increased 50% annually to around £270,000 ($357,000), although the police force admitted this was likely an underestimate given many businesses do not fully disclose the figure."
https://www.infosecurity-magazine.com/news/over-300-uk-firms-hit-ransomware/ - What’s The Difference Between Credential Theft And Session Hijacking?
"Credential theft targets login details: Attackers steal usernames and passwords to access accounts, often through phishing or social engineering. Session hijacking targets active access: Attackers steal or manipulate session tokens to impersonate users who have already logged in. Multifactor authentication (MFA) helps, but it isn’t foolproof: Session hijacking can bypass MFA because the attacker is exploiting an already-authenticated session. Stopping these attacks requires layered defenses: Strong authentication, encryption, session monitoring, device checks, and user training all play a role."
https://blog.barracuda.com/2026/06/29/credential-theft-vs-session-hijacking - UK Healthcare Sector Records Tenfold Increase In Cyber-Attacks
"The UK’s healthcare sector is being “stress-tested to breaking point," with a tenfold increase in attacks during January-May 2026 compared to the whole of 2025, according to SonicWall. The security vendor’s data comes from its intrusion prevention system (IPS) sensors dispersed across UK healthcare clients. They recorded 264,000 individual events in the first five months of the year compared to just 27,000 for 2025."
https://www.infosecurity-magazine.com/news/uk-healthcare-tenfold-increase/ - Accelerating The Quantum-Safe Timeline
"For years, planning for post-quantum cryptography (PQC) was framed as a future problem: important, inevitable, but distant. That perspective is evolving as technology advances and organizations prepare for the scale and complexity of the transition ahead. At Microsoft, we are acting on this shift by bringing our quantum-safe timeline forward so organizations can begin the transition earlier and with greater confidence."
https://www.microsoft.com/en-us/security/blog/2026/06/30/microsoft-advances-quantum-safe-security-as-the-risk-timeline-shifts/
https://www.bleepingcomputer.com/news/microsoft/microsoft-accelerates-quantum-safe-roadmap-as-risks-grow/ - Communications Security Establishment Canada Annual Report 2025-2026
"For 80 years, the Communications Security Establishment Canada (CSE) has used its expertise in signals intelligence to keep Canada and Canadians safe. As technology has evolved, so has CSE’s role. Through our Canadian Centre for Cyber Security (Cyber Centre), we now provide authoritative, practical advice and technical guidance to help Canadian individuals, businesses, various levels of government and critical infrastructure stay safe from cyber threats. Together, we are Canada’s digital frontline of defence."
https://www.cse-cst.gc.ca/en/accountability/transparency/reports/communications-security-establishment-canada-annual-report-2025-2026
https://www.bankinfosecurity.com/russian-water-system-hack-attempted-to-turn-canada-dry-a-32122 - AI-Generated Workflows Are a Silent Security Disaster
"A security analyst at a large enterprise recently found sensitive HR documents being copied into a Microsoft Teams channel that hundreds of employees could access. It was not caused by a malicious insider, a compromised admin account, or a sophisticated attacker. It was caused by a Power Automate workflow. The workflow had been created by a developer who wanted to automate document approvals between SharePoint and Teams. To move faster, the developer used an AI assistant to generate the automation logic. Functionally, the workflow worked. Documents moved from one location to another. Notifications were sent. The approval process became faster."
https://www.darkreading.com/cyber-risk/ai-generated-workflows-silent-security-disaster - Two Months In: Assessing The Impact Of NIST's Enrichment Cutbacks
"On April 15, NIST announced that it would no longer attempt enrichment for every CVE. Vulnerabilities are still ingested by the National Vulnerability Database, but enrichment is now reserved for a selected subset. Everything else will be marked as Not Scheduled. That may sound strategic, but is actually problematic. For years, NIST established itself as an authoritative source of vulnerability data. Teams have come to rely on their assessment of CVSS, CWE, and CPE for vulnerability management and automation."
https://blog.volerion.com/posts/two-months-in-nist-cuts-back-on-enrichment-efforts/
https://www.darkreading.com/vulnerabilities-threats/nist-enrichment-reductions-cve-coverage-accuracy - Singapore Cyber Landscape 2025/2026
"The cybersecurity landscape over the past year was defined by several prominent trends, underpinned by a threat environment of growing complexity, speed, scale, and sophistication. Key among the drivers of these trends were the proliferation and accessibility of artificial intelligence, as well as the interdependencies inherent in modern supply chains. In line with global trends, Singapore’s cyber landscape saw an increase in ransomware attacks. Locally, there was also a notable rise in the number of infected systems, driven primarily by an expanded attack surface stemming from the increasing adoption of Malware-as-a-Service (MaaS) operations, and the proliferation of consumer-grade Internet-of-Things (IoT) devices with unpatched firmware or default passwords."
https://www.csa.gov.sg/resources/publications/singapore-cyber-landscape-2025-2026/ - What's Trending: Top Cyber Attacker Techniques, March - May 2026
"Between March 1 and May 31, 2026 (“the reporting period”), attackers achieved their objectives by exploiting trusted identities, devices, and tools rather than malicious code. Because their activity resembled normal behavior, traditional perimeter and file-scanning defenses often failed to catch it. Adversaries leaned on two strategies: social engineering at scale and attacks on unpatched, internet-facing infrastructure. The leading technique “ClickFix” drove the first, shifting delivery from compromised websites to emailed links, while “Qilin,” the period’s most active ransomware operator, continued exploiting unpatched edge devices for mass extortion. What’s more, AI is making social engineering faster, cheaper, and more convincing, accelerating familiar techniques rather than creating new ones."
https://reliaquest.com/blog/threat-spotlight-whats-trending-top-cyber-attacker-techniques-march-may-2026
https://www.infosecurity-magazine.com/news/clickfix-cybercriminals-favorite/ - Securing AI Agents: When AI Tools Move From Reading To Acting
"As enterprise deployments mature, some enterprise AI agents are shifting from reading content to taking action. In this post, Microsoft Incident Response walks through an attack pattern that targets the fastest growing part of the agentic AI supply chain: Model Context Protocol (MCP) tools. The post provides a practical playbook for detecting, containing, and preventing this class of attack using Microsoft security controls."
https://www.microsoft.com/en-us/security/blog/2026/06/30/securing-ai-agents-ai-tools-move-from-reading-acting/
https://thehackernews.com/2026/06/microsoft-warns-poisoned-mcp-tool.html - What The Numbers Say About FIFA 2026 Cyber Risk
"The FIFA World Cup 2026 opened on June 11. By that date, according to Check Point Research, the fraud infrastructure targeting it had already been built, staged, and partially deployed. Threat actor activity was pre-planned, months out, across three sectors and at least ten languages. Check Point Exposure Management published the FIFA World Cup 2026 Cyber Threat Report this month, covering financial services, transportation, hospitality, and gambling. Here are three findings worth reading carefully."
https://thehackernews.com/2026/06/what-numbers-say-about-fifa-2026-cyber.html
https://checkpoint.cyberint.com/fifa-report-2026 - Hacker Conversations: Chris Thompson, Former Head Of IBM X-Force Red, Co-Founder Of RemoteThreat
"From bad game hacker to an elite good red team hacker. Chris Thompson is a hacker. His journey took him from hacking game controls as a teenager to become the founder of IBM’s first dedicated red team and then global head of X-Force Red. In 2024 he founded and remains the organizer of Offensive AI Con, and in 2025 moved from IBM to be co-founder and CEO at RemoteThreat."
https://www.securityweek.com/hacker-conversations-chris-thompson-former-head-of-ibm-x-force-red-co-founder-of-remotethreat/ - The AI Token Costs That Can Break Cybersecurity
"Imagine this scenario. It’s Tuesday night at 11:47 PM. Your senior SOC analyst is pulled into a critical, high-severity alert. A primary Domain Controller has flagged a deeply anomalous administrative command sequence originating from a mid-level employee’s standard workstation. The analyst triggers “agents” on the organization’s cybersecurity platform to assist with her investigation: mapping the account’s full authentication timeline, cross-referencing internal network logs, scanning active threat intelligence feeds, constructing secondary lookup queries to hunt for lateral movement. The investigation is moving at machine speed."
https://www.securityweek.com/the-ai-token-costs-that-can-break-cybersecurity/ - XSS Forum: From DaMaGeLaB To The 2025 Takedown
"XSS[.]is, the most influential Russian-language cybercrime forum of the past decade and the direct heir to the legacy board DaMaGeLaB, lost its administrator on 22 July 2025 when French and Ukrainian police arrested a 38-year-old man in Kyiv. Europol, which coordinated Operation Ratatouille, said the forum had more than 50,000 members and that the suspect earned over EUR 7 million arbitrating deals between criminals. The Ransomnews Research Team analysed a leaked copy of the forum database, 123,241 messages across 51 trading sections, to show exactly how the marketplace worked and where it sat in the ransomware kill chain."
https://ransomnews.com/xss-forum-damagelab-takedown-2025/
https://securityaffairs.com/194524/security/xss-is-the-forum-that-ran-the-ransomware-supply-chain-is-down-the-market-isnt.html
อ้างอิง
Electronic Transactions Development Agency (ETDA) 
