FTC warns of record $3.5 billion losses to imposter scams in 2025
The U.S. Federal Trade Commission (FTC) warned that Americans lost $3.5 billion to imposter scams in 2025, with reported losses nearly tripling since 2020.
Advait Patel on How SRE and Security Engineering Are Converging
Advait Patel explains how SRE and security engineering in cloud systems, covering DevSecOps, IAM, AI, and large-scale observability challenges.
Come funziona un Command and Control (C2)
IntroduzioneFunzionamento di baseStageless vs. StagedCanale di comunicazioneLab si esempioDetectionConclusione Chi segue il blog o il canale YouTube da un po’ è a conoscenza dei miei obiettiv…
Estonia to quarantine emails sent from Russian .ru domain before they reach government officials
Estonia to quarantine emails sent from Russian .ru domain before they reach government officials
China Spent Over a Year Inside U.S. Medical Research Networks — And Used Google’s Own Email Rules to Steal Data
The attackers, tracked as "UNC6508," did not write new malware to steal emails. They created an administrator rule inside Google Workspace, named it "Patroit"
CISA warns of another cPanel plugin flaw exploited in attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has given U.S. government agencies three days to secure their servers against an actively exploited vulnerability (CVE-2026-54420) in the LiteSpeed cPanel user-end plugin.
Ransomware gang abuses Microsoft Teams relays to hide malicious traffic
DragonForce ransomware used a custom malware named 'Backdoor.Turn' to hide command-and-control traffic inside Microsoft Teams relay infrastructure.
The New Standard for URL Analysis: Closing Phishing Blind Spots with In-Browser Data Inspection
See how full browser visibility transforms URL analysis, helping analysts investigate phishing threats with confidence.
Cyber Shield: la resilienza dell’Italia nella protezione dei mega-eventi
Analisi della cybersecurity per i mega-eventi italiani: le strategie di difesa per le Olimpiadi e il Giubileo a Roma.
Critical Fortinet FortiSandbox flaws now exploited in attacks
Attackers are now exploiting several critical vulnerabilities in Fortinet's FortiSandbox cyber threat detection platform, according to threat intelligence company Defused.
Windows version of SprySOCKS Linux malware used to attack govt orgs
Windows variants for the SprySOCKS Linux malware have been used in attacks targeting government organizations in at least four countries.
La resilienza non si scrive, ma si costruisce: si parte dall’elenco dei fornitori critici
La domanda da porsi non è se esistono alternative, ma se possiamo davvero sostituire un fornitore senza compromettere la continuità. Questo è l'interrogativo che rivela la vulnerabilità nascosta. Ecco perché occorre partire dall’elenco dei fornitori critici, per costruire la resilienza
Saily, eSIM Stati Uniti in sconto del 35%: come funziona l’offerta per navigare senza roaming
Arriva un imperdibile 35% di sconto per attivare una eSIM Saily per gli Stati Uniti: come attivare questa offerta e dove è valida.
AI Demo Day 2026: l’AI per produzione, supply chain e procurement e le implicazioni cyber
Il 18 giugno a Milano torna l’AI Demo Day con demo live su produzione, supply chain e procurement. Un’occasione per vedere l’AI in azione nei processi industriali e per capire cosa cambia sul fronte della sicurezza informatica e della gestione del rischio, perché le implicazioni cyber non si possono più ignorare
Dozens of malicious wallpapers found on Steam Workshop: gamers’ accounts at risk
Since late 2025, malware has been spreading rapidly through the Steam Workshop. In most cases, we caught old, familiar threats such as DarkKomet, the Lumma and Vidar infostealers.
Belarus-Linked UNC1151 Launches Gmail Phishing Campaign to Steal 2FA Codes
A new UNC1151 Gmail phishing campaign is targeting Polish users, stealing passwords and 2FA codes through fake Gmail login pages.
Critical SearchLeak Flaw in Microsoft 365 Copilot Exposed Sensitive Enterprise Data
SearchLeak vulnerability in Microsoft 365 Copilot Enterprise enabled data theft via a crafted URL before Microsoft patched CVE-2026-42824.
iRhythm discloses data breach, says hackers stole patient info
Digital healthcare company iRhythm Holdings has disclosed a data breach after hackers stole patients' personal and health information stored on third-party-hosted business applications.
| dfir.ch
Technical blog by Stephan Berger (@malmoeb)
FIRST Technical Colloquium Paris: Inside Mythic: Dissecting a Modern Attack Framework
Technical blog by Stephan Berger (@malmoeb)
Botconf: Tomb Raider - In Search of the Lost Signatures
Technical blog by Stephan Berger (@malmoeb)
Brucon: Anti-Forensics (and Anti-Anti-Forensics) Techniques
Technical blog by Stephan Berger (@malmoeb)
Anatomy of a Deno-Based Proxy & RAT
Technical blog by Stephan Berger (@malmoeb)
iRhythm Discloses Data Breach After Threat Actor Claims PHI Theft
The iRhythm data breach exposed sensitive data, including PHI, after a threat actor accessed third-party business applications.
UK Social Media Ban for Under-16s Could Take Effect by Spring 2027
The UK social media ban for under-16s, targeting major platforms and harmful online features expected by 2027.
Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework
This report details the ErrTraffic threat and its associated ecosystem, highlighting three specific campaigns and their operators' arsenal.
Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework
This report details the ErrTraffic threat and its associated ecosystem, highlighting three specific campaigns and their operators' arsenal.
UK to ban social media access for children under 16
DOJ seizes CFAKE, SOCFAKE deepfake nude sites under TAKE IT DOWN Act
The U.S. Department of Justice announced Friday that it has seized the CFAKE.com and SOCFAKE.com websites, which allegedly hosted nonconsensual AI-generated nude images and videos of women, in what appears to be the first publicly announced domain seizure under the TAKE IT DOWN Act.
The Shift to Threat-Informed Prioritization: Operationalizing CISA BOD 26-04
We examine how CISA BOD 26-04 shifts away from flat CVSS scoring and how Flashpoint bridges the critical vulnerability data gaps.