Ransomware-as-a-Service (RaaS) has become a significant threat in the cybersecurity landscape. A recent blog post by Storm-2570 highlights the challenges of tracking and responding to ransomware attacks, emphasizing the need for a more comprehensive approach.
Key points
Ransomware-as-a-Service: RaaS is a business model where attackers offer ransomware tools and services to affiliates, making it easier for them to carry out intrusions and extort victims.
Tracking and Responding: Traditional methods of tracking and responding to ransomware attacks by payload alone can obscure the affiliates carrying out intrusions and the recurring nature of the attacks.
Comprehensive Approach: A more comprehensive approach is needed to address the RaaS threat, including tracking and responding to attacks, as well as disrupting the affiliate networks and supply chains.
Sources
Security - Medical Data Leaks
Medical data leaks have become a significant concern, with another million-record leak reported recently. The incident highlights the need for individuals to take action to protect their data.
Key points
Medical Data Leaks: Medical data leaks have become a common occurrence, with sensitive information being compromised.
Lack of Action: Individuals are often powerless to prevent data leaks, except by filing complaints against the clinics, companies, and institutions involved.
GDPR: The General Data Protection Regulation (GDPR) provides some protection for individuals, but more needs to be done to prevent data leaks.
Sources
Security - PostgreSQL Vulnerability
A recent vulnerability in PostgreSQL has been discovered, which could potentially lead to remote code execution (RCE). The vulnerability highlights the need for prompt patching and security updates.
Key points
PostgreSQL Vulnerability: A vulnerability in PostgreSQL has been discovered, which could potentially lead to RCE.
CVE-2026-15742: The vulnerability is identified as CVE-2026-15742 and affects the fuzzystrmatch integer wraparound.
Patching and Updates: Prompt patching and security updates are necessary to prevent exploitation of the vulnerability.
Sources
Security - Vulnpocalypse
The vulnpocalypse, a situation where a large number of vulnerabilities are discovered and exploited, is turning out to be similar to the Y2K scare. InfoSec already had a 0day/Nday problem, and the pitch was that everything on the internet would face a constant stream of 0days.
Key points
Vulnpocalypse: The vulnpocalypse is a situation where a large number of vulnerabilities are discovered and exploited.
InfoSec Problem: InfoSec already had a 0day/Nday problem, and the pitch was that everything on the internet would face a constant stream of 0days.
Glasswing and CVEs: Glasswing, other projects, and people collecting CVEs like Pokemon have resulted in a bunch of vulnerabilities being discovered and patched.
Sources
Security - LLMs and Agents
The predictions around LLMs/agents on keyboard will probably play out differently. At least that’s already popping up across IR/MDR and other areas. Different groups with varying skill levels are using LLMs and/or agents as part of ransomware and smash and grab operations.
Key points
LLMs and Agents: LLMs and agents are being used in various ways, including as part of ransomware and smash and grab operations.
IR/MDR: LLMs and agents are being used across IR/MDR and other areas.
Different Groups: Different groups with varying skill levels are using LLMs and/or agents.
Sources
Security - Redis Botnet
A recent investigation into an exposed operator directory revealed a 3,562-server Redis botnet. The investigation highlights the need for vigilance in monitoring and responding to botnet activity.
Key points
Redis Botnet: A 3,562-server Redis botnet was discovered through an exposed operator directory.
Investigation: The investigation revealed 147 files, including exploit code, campaign logs, and a portable Python script.
Vigilance: Vigilance is necessary in monitoring and responding to botnet activity.
Sources
Security - Iran War and Cyber Conflict
A recent article by @saffronsec on @bindinghook explores the relationship between cyber and kinetic conflict, using the Iran war as a case study.
Key points
Cyber and Kinetic Conflict: The article explores the relationship between cyber and kinetic conflict, using the Iran war as a case study.
Iran War: The Iran war is used as a case study to examine the intersection of cyber and kinetic conflict.
Cyber Conflict: The article highlights the importance of understanding cyber conflict in the context of kinetic conflict.
Sources
Security - Ransomware and Ethics
A recent conversation with the Security Copilot team highlighted the challenges of training models ethically, particularly in the context of ransomware.
Key points
Ransomware and Ethics: The conversation highlighted the challenges of training models ethically, particularly in the context of ransomware.
Security Copilot: The Security Copilot team was trying to train models ethically, but faced challenges in doing so.
Ransomware: Ransomware is a significant threat, and ethical training of models is crucial in addressing this threat.
Sources
Security - Ransomware and Fines
A recent conversation highlighted the challenges of enforcing fines on companies involved in ransomware attacks.
Key points
Ransomware and Fines: The conversation highlighted the challenges of enforcing fines on companies involved in ransomware attacks.
Enforcement: Enforcement of fines is challenging, particularly in the context of ransomware attacks.
Ransomware: Ransomware is a significant threat, and enforcement of fines is crucial in addressing this threat.
Sources
Security - Monthly Subscriptions
A recent offer provides a $79.99 lifetime PDF editor for Mac, allowing users to drop monthly subscriptions.
Key points
Monthly Subscriptions: The offer allows users to drop monthly subscriptions and use a lifetime PDF editor for Mac.
PDF Editor: The PDF editor is a useful tool for users who need to edit PDFs frequently.
Lifetime Subscription: The lifetime subscription provides a cost-effective solution for users who need to use the PDF editor regularly.