Beat
Policy
Government, law enforcement, regulation and the people shaping security policy.
- 32
- stories
- SEP 16
- latest
US, UK Agencies Detail Iranian Malware Campaign Targeting Dissidents
A new joint advisory from multiple law enforcement agencies this week warned of an Iranian cyber campaign targeting dissidents and journalists in the U.S., UK, and elsewhere.
LINDSEY O'DONNELL-WELCH · SEP 16 · 2 min
All Policy
US Sanctions First VPN Cybercriminal Service
First VPN has been active for more than a decade and is specifically designed for ransomware operators, fraud groups, and other cybercriminals trying to hide malicious activity from law enforcement.
Lindsey O'Donnell-Welch · 2 min
DoJ: Alleged Scattered Spider Member Extradited to US
19-year-old Peter Stokes is one of several to be arrested for their alleged participation in Scattered Spider.
Lindsey O'Donnell-Welch · 2 min
Targeting Cybercrime ‘Assembly Lines:’ Europol Announces Malware Crackdown
As part of the takedown, SocGholish infrastructure tied to fake browser-update scams was heavily impacted, including remediation of nearly 15,000 compromised WordPress sites.
Lindsey O'Donnell-Welch · 2 min
FBI: Silent Ransom Group Turns to IT Support Ploy
The Silent Ransom Group, a data exfiltration and extortion actor, started posing as IT teams via phone calls and phishing emails sent to legal sector firms.
Lindsey O'Donnell-Welch · 2 min
Authorities Disrupt First VPN Cybercriminal Service
Law enforcement is increasingly targeting the “infrastructure layer” of cybercrime, rather than ransomware operators themselves.
Lindsey O'Donnell-Welch · 2 min
Karakurt Ransomware Negotiator Sentenced to 8 Years Prison
Deniss Zolotarjovs, 35, of Moscow, Russia, was a member of a ransomware group called Karakurt, which was led by the former operators of Conti.
Lindsey O'Donnell-Welch · 3 minAlleged Silk Typhoon Hacker Extradited to US
The hacker was allegedly involved in Hafnium campaigns that targeted Exchange server flaws and in attacks against COVID-19 research institutions.
Lindsey O'Donnell-Welch · 2 min
Firestarter Malware Sparks Updated CISA Emergency Directive
CISA is warning of a persistent backdoor called Firestarter that’s being used in attacks against Cisco Firepower and Secure Firewall products.
Lindsey O'Donnell-Welch · 4 min
US Gov: Iran-Linked Actors Targeting Critical Infrastructure PLCs
The advisory comes amid the ongoing conflict between the U.S. and Iran. CISA said Iran-linked APT campaigns targeting U.S. orgs have recently escalated.
Lindsey O'Donnell-Welch · 2 min
DoJ Sentences Russian Initial Access Broker to 6 Years in Prison
Aleksei Volkov, 26, has been sentenced to almost seven years in prison for his role in facilitated Yanluowang ransomware group attacks.
Lindsey O'Donnell-Welch · 2 minEU Sanctions Iranian and Chinese Companies for Targeting Member Nations
The new sanctions list includes two China-based technology companies, two of their co-founders, and an Iranian firm, all implicated in a range of attacks from corporate espionage and critical infrastructure disruption to disinformation campaigns.
Dennis Fisher · 2 min
US, Europol Crack Down on SocksEscort Residential Proxy Network
The US and other international partners seized 34 SocksEscort domains and 23 servers in seven countries. The U.S. also froze $3.5 million in cryptocurrency.
Decipher · 2 min
APT28 Reemerges with Modern Espionage Arsenal, Code Tied to 2010s Operations
The modern Sednit arsenal is centered on two highly-developed implants, deployed systematically in tandem to ensure persistent access.
Dennis Fisher · 3 min
Google: Commercial Surveillance Vendors Dominated Zero-Day Exploitation in 2025
Out of 42 unique zero days tracked by Google in 2025, 18 were attributed to CSVs, while 15 were linked to state-sponsored espionage groups.
Decipher · 3 min
Microsoft, Europol Disrupt Tycoon 2FA Phishing Service
The comprehensive effort, which involved seizing 330 active domains, cuts off a critical pipeline for account takeovers that targeted over 500,000 organizations and sent tens of millions of fraudulent emails monthly.
Dennis Fisher · 3 min
Q&A: Tod Beardsley on How to Use CISA’s KEV Catalog
Without context, the KEV catalog is just a very large collection of data. Tod Beardsley is the former CISA KEV section chief, and he recently released a paper called KEVology that provides key context and evaluates the value of certain enrichment signals.
Dennis Fisher · 4 min
Cisco, NSA Warn of Attacks Targeting Catalyst SD-WAN Zero Day
Cisco released software updates on Feb. 25 to fix the vulnerability, which affects both on-premises and cloud deployments of the Catalyst SD-WAN Controller.
Dennis Fisher · 2 min