Liam

Cato CTRL™ Threat Actor Profile: IntelBroker In June 2025, IntelBroker was charged by the U.S. for stealing and selling stolen data. Cato CTRL summarizes the digital forensics techniques used to track and arrest IntelBroker.

www.catonetworks.com/blog/cato-ct...

A fascinating read, some of the opsec errors are particularly eye opening.

I’ll never tire of watching the hope fade from people’s eyes when they start trying to use Eurostar Wi-Fi.

Your friend is sharing Vivaldi with you! Explore a powerful browser designed to give you control of the Internet. Personalize Vivaldi to fit your browsing style and needs.

Check out Vivaldi, the browser I'm using: vivaldi.com/invite

Amsterdam, I’m a big fan.

Yeah, I never thought about it that way before. That article genuinely shocked me!

This is a terrifying read.

What are people using for SIEM/EDR/XDR/etc on home lab devices installed on separate networks?

Bucharest is exquisite in the sun.

Zendesk now has a dark mode and I am a bit too excited about it!

Watching an argument between a customer service worker and two travellers. Raised voices etc. The employee has said she won’t assist if the travellers continue to raise their voice and walked away. A stark contrast to policing!

DragonForce Ransomware Cartel attacks on UK high street retailers: walking in the front door The individuals operating under the DragonForce banner and attacking UK high street retailers are using social engineering for entry.

doublepulsar.com/dragonforce-...

Co-op data exfiltrated, including member database.

Shocking to read, feel for the IR team. Disappointed at the lack of communications. Customers are becoming more tech aware, they deserve to be kept updated. And treated like adults.

We need to be more open.

I agree, and this is where the NCSC should be using their contacts to run briefs for trusted contacts within retail operational security teams. That is not happening, so we're all sharing the same IOCs we've found on Twitter, or have been passed with no context.

As someone in the retail space, this week has been chaotic.

Although I'm in CTI, I can't share any intelligence as nobody is sharing any intelligence. It's all rumour (RUMINT).

The NCSC really need to take control here, and lead the sharing of intelligence with operational security teams.

Co-op fends off hackers as police probe M&S cyber attack The firm said the steps it had taken had had a 'small impact' on its call centre.

www.bbc.co.uk/news/article...

Good luck Co-op!

Marks & Spencer breach linked to Scattered Spider ransomware attack Ongoing outages at British retail giant Marks & Spencer are caused by a ransomware attack believed to be conducted by a hacking collective known as "Scattered Spider" BleepingComputer has learned from...

www.bleepingcomputer.com/news/securit...

Looks like I may have been (kind of) right.

Scattered Spider are a very competent threat group, best wishes to anyone doing IR for M&S.

M&S stops online orders and issues refunds after cyber attack The firm has stopped taking orders on its website and apps, including for food and clothes.

www.bbc.co.uk/news/article...

No ransomware group have uploaded data to leak sites, that in itself is telling. What threat actors don't routinely ransomware / post to leak sites?

Compare and contrast with the Ahold Delhaize breach which occurred last week.

It *feels* like it has due to the amount of posters I see across the network. You’re correct with Met and busses however if a revenue op happens at a larger station then that’ll be BTP and Met, so much more likely to get involved in ticket irregularities.

Yeah, that’s the Croydon bus incident. Pax refused to cooperate with an RPI which led to a Met PC arrest. PC charged with assault and convicted, I believe then overturned. The Met no longer do fare evasion ops, just TfL who have no powers. I think that’s why evasion is endemic.

Was this the Croydon bus incident? I used to be a Special Constable with the British Transport Police so I regularly dealt with ticket irregularities (fare evasion). It’s a tricky one to deal with.

This is fascinating - thank you for sharing.

Thanks @proton.me, loving your offerings! And your support has been excellent when I've had stupid questions.

You’ve been wonderful, Bristol

Confirmed - legacy system popped. No lateral movement. Potentially encrypted passwords.

Well, Oracle, after your hastily issued statement, I’d be surprised if any of your customers trust you again.

Shows the importance of communications in dealing with any breach.

The Biggest Supply Chain Hack Of 2025: 6M Records Exfiltrated from Oracle Cloud affecting over 140k Tenants | CloudSEK CloudSEK uncovers a major breach targeting Oracle Cloud, with 6 million records exfiltrated via a suspected undisclosed vulnerability. Over 140,000 tenants are impacted, as the attacker demands ransom...

My gut says that a TA did breach a *part* of Oracle, now we wait and see if they do indeed have millions of credentials.

www.cloudsek.com/blog/the-big....

It's only an "ORB" if it is from the Cheltenham region of UK, otherwise it is just a sparkling botnet

Asda data breach warning after job cuts from tech team insider 'Asda will get a massive data breach and we all know it'

www.thegrocer.co.uk/news/asda-da...

Offttt