Lindsey O&#39;Donnell-Welch

FBI: Silent Ransom Group Turns to IT Support Ploy

The Silent Ransom Group, a data exfiltration and extortion actor, started posing as IT teams via phone calls and phishing emails sent to legal sector firms.

MAY 22

Authorities Disrupt First VPN Cybercriminal Service

Law enforcement is increasingly targeting the “infrastructure layer” of cybercrime, rather than ransomware operators themselves.

MAY 17

Supply Chain

Grafana Investigating Token Compromise and Extortion Attempt

An “unauthorized party” obtained a token with access to the Grafana Labs GitHub environment and downloaded Grafana’s codebase.

MAY 7

Vulnerabilities

Ivanti Warns of Exploited EPMM Flaw CVE-2026-6973

The vulnerability (CVE-2026-6973) exists in Ivanti Endpoint Manager Mobile (EPMM) is being exploited by threat actors.

MAY 6

Karakurt Ransomware Negotiator Sentenced to 8 Years Prison

Deniss Zolotarjovs, 35, of Moscow, Russia, was a member of a ransomware group called Karakurt, which was led by the former operators of Conti.

APR 27

Alleged Silk Typhoon Hacker Extradited to US

The hacker was allegedly involved in Hafnium campaigns that targeted Exchange server flaws and in attacks against COVID-19 research institutions.

APR 26

Lindsey O'Donnell-Welch · 4 min

Firestarter Malware Sparks Updated CISA Emergency Directive

CISA is warning of a persistent backdoor called Firestarter that’s being used in attacks against Cisco Firepower and Secure Firewall products.

APR 22

Supply Chain

Attackers Target Checkmarx KICS Ecosystem

Yet another supply chain attack has hit the open source ecosystem, this time impacting the Checkmarx KICS Docker Hub repository.

APR 10

Anthropic’s Claude Mythos is Just the Beginning

Anthropic’s Project Glasswing initiative, announced this week, sent shockwaves across the cybersecurity world.

APR 7

US Gov: Iran-Linked Actors Targeting Critical Infrastructure PLCs

The advisory comes amid the ongoing conflict between the U.S. and Iran. CISA said Iran-linked APT campaigns targeting U.S. orgs have recently escalated.

Lindsey O'Donnell-Welch · 5 min

APR 5

Intrusions

The $285M Drift Protocol Heist Was ‘6 Months in the Making’

During the largest DeFi hack of 2026, it only took attackers 12 minutes to drain millions in user assets – but the build up to the attack took six months of meticulously planned social engineering.

MAR 27

Supply Chain

TeamPCP’s Supply Chain Attack Spree Continues

TeamPCP’s latest victim is the Telnyx Python SDK on PyPl, coming after a wave of supply chain hits on Aqua Trivy, Checkmarx KICS/OpenVSX, and LiteLLM.

MAR 24

DoJ Sentences Russian Initial Access Broker to 6 Years in Prison

Aleksei Volkov, 26, has been sentenced to almost seven years in prison for his role in facilitated Yanluowang ransomware group attacks.

DEC 17

Threat Actors Target Unpatched Cisco AsyncOS Zero-Day

Threat actors are exploiting an unpatched zero-day vulnerability in Cisco AsyncOS software.

DEC 16

Intrusions

Russian Hackers Target Misconfigured Edge Devices in ‘Concerning Evolution’ For Critical Infrastructure Attacks

Amazon researchers highlighted a “tactical pivot” by Russian GRU hackers who have been moving away from zero-day and N-day exploitation.

DEC 4

Lindsey O'Donnell-Welch · 4 min

Government, Private Sector Officials Mull Telecom Security Woes

A year after Salt Typhoon’s telecom hack, private and public sector officials discussed next steps.

NOV 19

DoJ Sanctions Bulletproof Hosting Provider Used By Ransomware Groups

The provider, Media Land LLC, has been used by ransomware actors like Lockbit, BlackSuit, and Play, and its infrastructure has been leveraged across several distributed denial-of-service (DDoS) attacks against US companies and critical infrastructure.