X-Industry

Bridewell, a UK-based cybersecurity services company, has released its latest CTI Annual Report, a comprehensive deep dive into ransomware trends.  It highlighted a significant shift in attack strategies, payment dynamics, and threat actor behaviors, revealing that data theft and extortion have overtaken traditional encryption-only ransomware as the most successful approach for attackers.  While encryption-based attacks tend to result in larger individual ransom payments, often due to the urgenc

Over the past decade, many state governments have set aggressive renewable energy mandates regarding the adoption of grid-scale wind and solar power generation systems and the shuttering of fossil fuel generators.  Whether these policy mandates were well-intentioned or the result of foreign influence operations designed to undermine US energy security, most states are meeting their targets.[1]

The closing of baseload power generators, like coal plants, and the simultaneous deep penetration of wi

Since 9 June 2025, Internet users located in Russia and connecting to web services protected by Cloudflare have been throttled by Russian Internet Service Providers (ISPs).  As the throttling is being applied by local ISPs, the action is outside of Cloudflare’s control and we are unable, at this time, to restore reliable, high-performance access to Cloudflare products and protected websites for Russian users in a lawful manner.  Internal data analysis suggests that the throttling allows Internet

Threat actors are abusing the ConnectWise ScreenConnect installer to build signed remote access malware by modifying hidden settings within the client’s Authenticode signature.  ConnectWise ScreenConnect is a remote monitoring and management (RMM) software that enables IT administrators and managed service providers (MSPs) to troubleshoot devices remotely.  When a ScreenConnect installer is built, it can be customized to include the remote server the client should connect to, the text displayed

Cybersecurity experts at Forcepoint’s X-Labs are warning about the continued activity of Remcos malware. This sophisticated threat consistently adapts to bypass security measures and maintain a hidden presence on infected computers.  This malware, often delivered through convincing phishing attacks, allows attackers to establish long-term access.

According to reports, campaigns observed between 2024 and 2025 show that Remcos malware remains highly active, continually adapting to stay hidden, as

The current ceasefire between Iran and Israel may prevent the two countries from firing missiles at each other, but it won't carry any weight in cyberspace, according to former NATO hacker Candan Bolukbas.  "In the cyber world, there's no such thing as a ceasefire," he recently said.  “If we see something in cyberspace that can disrupt us, we're going to attack it first, and we have that under US Cyber Command's mission

Bolukbas is chief technology officer and founder of Black Kite, a cyber-risk

A massive data leak stemming from a cyber-attack on a third-party subcontractor has affected Swiss banks UBS and Pictet, as well as over a dozen other multinational companies, potentially including auditing firm KPMG.  Unhinged cybercriminals attributed to the attack on Swiss-based Chain IQ have leaked over 130,000 UBS employee records on the dark web, including the company CEO Sergio Ermotti’s personal information.  Baar-based ChainIQ operates in New York, USA; London, U.K.; Singapore, Singapor

A proof-of-concept attack detailed by Neural Trust demonstrates how bad actors can manipulate LLMs into producing prohibited content without issuing an explicitly harmful request.  Named "Echo Chamber," the exploit uses a chain of subtle prompts to bypass existing safety guardrails by manipulating the model's emotional tone and contextual assumptions.  Developed by Neural Trust researcher Ahmad Alobaid, the attack hinges on context poisoning.  Rather than directly asking the model to generate in

In what may be a portent of things to come, researchers have discovered the first known malware sample in the wild that attempts to evade AI-powered security tools by essentially prompting them to halt their analysis.  In its present form, the malware, which its author appears to have named "Skynet" in a nod to the sentient AI overlords in the Terminator franchise, does not work. Researchers at Check Point, who analyzed the sample after recently spotting it on VirusTotal, found the code to be ru

Most email users are now well aware of the scams and attacks that flood inboxes daily.  Google has become so adept at identifying rogue messages that most are instantly filtered out before they reach customer accounts.  However, it seems now is not the time to let our guard down.  Hackers have recently executed a cyber-attack that bypasses Google's multi-factor authentication.  This means that cyber criminals could gain full access to accounts without the owner ever realizing something is amiss.

US hospitals and essential infrastructure are reportedly on alert, anticipating Iran-backed cyberattacks in response to the US strikes on Iran's nuclear facilities.  In the days since the 21 June strikes, the US power grid’s cyberthreat-sharing monitor has reportedly begun monitoring the dark web for signs of Iranian activity, and hospital executives have been briefed by the US Federal Bureau of Investigation (FBI).

While Iran and Israel are abiding by a shaky ceasefire agreement, experts have w

Major artificial intelligence platforms like ChatGPT, Gemini, Grok, and Claude could be willing to engage in extreme behaviors including blackmail, corporate espionage, and even letting people die to avoid being shut down.  Those were the findings of a recent study from San Francisco AI firm Anthropic.

In the study, Anthropic stress-tested 16 leading AI models from multiple developers in hypothetical corporate environments to identify potentially risky behaviors from AI gents.  In the study, AI

A phishing malware campaign, known as Shadow Vector, has been reported, targeting users in Colombia through malicious SVG files disguised as urgent court notifications. The campaign uses the MITRE ATT&CK technique known as SVG smuggling, where scalable vector graphics are used to embed or link malicious content.  It begins with spear-phishing emails containing SVG attachments, which, when rendered in a browser, redirect victims to download payloads from public platforms like Bitbucket, Dropbox,

Israeli officials are urging citizens to disconnect internet-connected security cameras, warning that Iran may be exploiting them to gather real-time intelligence and adjust missile targeting.

Former Israeli cybersecurity official Refael Franco said in a public radio interview last week that Iranian actors have been attempting to access private surveillance systems in recent days to evaluate the impact of their strikes.  “We know that in the past two or three days, the Iranians have been trying

"If you can't see the threat coming, you can't defend against it."  The third-party risk management (TPRM) industry has a significant blind spot, and it's becoming increasingly problematic.  While we concentrate on SOC reports, ISO certifications, and vendor questionnaires, cybercriminals are actively trading your vendors' stolen credentials, exploiting their vulnerabilities, and planning their next attacks, all in plain sight on the dark web.

The Underground Economy Your TPRM Program Overlooks

A pro-Israel group of hackers on 18 June drained more than $90 million from Iran’s largest cryptocurrency exchange but may have lost all of the proceeds from the heist in the process, according to several crypto tracking firms.

Coins like Bitcoin, Ethereum and Doge were sniped from digital wallets on Iranian exchange Nobitex, which has been linked to the Islamic Revolutionary Guard Corps.  The IRGC is a branch of Iran’s military that has been labeled a terrorist organization by the US, United Ki

Almost half (44%) of mobile users report being exposed to scams and threats daily, with a majority concerned about losing important files and productivity loss as a result, according to Malwarebytes.  The security vendor polled 1,300 adults in the US, UK, Austria, Germany, and Switzerland for its "Tap, Swipe, Scam" report.  Although it focused on the personal impact of such threats, they’re having a growing impact on enterprise risk, given the large number of organizations that allow Bring Your

In the modern theatre of conflict, cyber warfare has emerged as a pivotal front, where states flex their technological prowess to assert dominance and counteract adversarial threats.  Iran, a nation deeply entrenched in geopolitical struggles, finds itself as both a perpetrator and a target in this digital battleground.  Recent cyber campaigns targeting Iran have sought to undermine its critical infrastructure, destabilize its economic systems, and disrupt its strategic ambitions.  These operati

Cyberattacks are escalating in speed, volume, and sophistication.  As organizations work to strengthen their defenses, adversaries target their weaknesses: employees susceptible to social engineering and systems lacking modern security controls. Once inside, they act within seconds, stealthily moving across networks to execute attacks.

Crowd Strike has recently provided its 2025 Global Threat Report to cyber professionals.  Red Sky Alliance would like to share this excellent report, as it provid

Researchers at Sentinel Labs have shared another significant discovery and expert analysis.  Red Sky Alliance has been following Sentinel Labs for a few years, and we think highly of their research and analysis.  This report is eye-opening.  The study below outlines threats that SentinelLABS observed and defended against in late 2024 and the first quarter of 2025.  This report expands upon previous SentinelLABS research, which provides an overview of threats against cybersecurity vendors, includ