Alan Neville

Access Now - Paragon must answer for spyware use against civil society and journalists Access Now calls on Paragon to answer for the use of its spyware in Italy against journalists, and to address oversight failures.

Mercenary spyware vendor Paragon claims it's "responsible", (unlike NSO Group)

But our investigations @citizenlab.ca show Paragon's spyware was abused in Italy 🇮🇹 to target civil society

@accessnow.org sent them a letter with questions, and I signed on 👇

www.accessnow.org/press-releas...

Cyber weapons in the Israel-Iran conflict may hit the US : With Tehran’s military weakened, digital retaliation likely, experts tell The Reg

"Typically the Iranians have deployed wipers against targets in critical infrastructure and other organizations," Google threat intelligence group chief analyst John Hultquist told The Register. "We will probably see more of that in Israel and we could see it in the US as well."

Mysterious leaker GangExposed outs Conti kingpins in massive ransomware data dump 'It's a high-stakes intelligence war' he told El Reg exclusive  A mystery whistleblower calling himself GangExposed has exposed key figures behind the Conti and Trickbot ransomware crews, publishing a trove of internal files and naming names.…

Mysterious leaker GangExposed outs Conti kingpins in massive ransomware data dump

Iranian pleads guilty to launching Baltimore ransomware attack, faces 30 years behind bars Sina Gholinejad admitted to using the Robbinhood ransomware variant to extort ransom payments from dozens of victims.

It’s amazing to me that it can take 6 years from the first attack until the trial starts.

via @jgreig.bsky.social & @therecordmedia.bsky.social

NASA simulation for what you'd see while plunging into a black hole:
youtu.be/chhcwk4-esM
There's actually a lot left to see after passing the event horizon!

#ESETresearch has published its latest APT Activity Report, covering October 2024 to March 2025 (Q4 2024–Q1 2025). China-aligned groups like Mustang Panda and DigitalRecyclers continued their espionage campaigns targeting the EU government and maritime sectors. 1/2

How the Signal Knockoff App TeleMessage Got Hacked in 20 Minutes The company behind the Signal clone used by at least one Trump administration official was breached earlier this month. The hacker says they got in thanks to a basic misconfiguration.

Here's how the TM SGNL server, which had access to plaintext chat logs from people like Mike Waltz, got hacked in about 20 minutes www.wired.com/story/how-th... (my first article in @wired.com!)

Learn about monitoring inauthentic accounts and conducting investigations into Foreign Information Manipulation and Interference (FIMI) in our next Stage Talk on Thursday, 4pm CEST/10am EDT. We're joined by the @doublethinklab.bsky.social team live in our Discord Server
discord.gg/FGq4XfYm?eve...

Layoffs at CrowdStrike. I’m safe, but if you’re looking for IR consultants I know a bunch of fucking amazing ones that will be looking for jobs 🫠

Malicious PyPI Package Targets Discord Developers with Remot... The Socket Research team investigates a malicious Python package disguised as a Discord error logger that executes remote commands and exfiltrates dat...

Socket Security has discovered a malicious Python library that contained a remote access trojan and went undetected for over three years

socket.dev/blog/malicio...

I'm analyzing the TM SGNL source code and will publish findings tomorrow. But the for a sneak peak, here's how it seems TeleMessage's system works:

There's E2EE between TM SGNL and Signal, but NOT between TM SGNL and archive destinations. TM's archive server can read the chat logs.

Stay tuned.

No as a service

Demo naas.isalman.dev/no
Repo github.com/hotheadhacke...

Recorded Future Insikt Group researchers analyse MintsLoader, a malicious loader deployed through multiple infection vectors that commonly deploys second-stage payloads such as GhostWeaver, StealC, and a modified BOINC client. www.recordedfuture.com/research/unc...

ESET researchers provide an analysis of Spellbinder, a lateral movement tool for performing adversary-in-the-middle attacks, used by TheWizards, a China-aligned threat actor. www.welivesecurity.com/en/eset-rese...

Trustwave researchers observed a notable increase in NodeJS-based backdoor deployments across multiple malware campaigns, including KongTuke, Fake CAPTCHA schemes, Mispadu, and Lumma stealers. www.trustwave.com/en-us/resour...

North Korean operatives have infiltrated hundreds of Fortune 500 companies Security leaders at Mandiant and Google Cloud say nearly every major company has hired or received applications from North Korean nationals working on behalf of the country’s regime.

Security leaders at Mandiant and Google Cloud say nearly every major company has hired or received applications from North Korean nationals working on behalf of the country’s regime. via @mattkapko.com cyberscoop.com/north-korea-...

CVE-2024-10442 (CVSS 10): Zero-Click RCE in Synology DiskStation, PoC Publishes

Windows RDP lets you log in using revoked passwords. Microsoft is OK with that. Researchers say the behavior amounts to a persistent backdoor.

So regarding this behavior: I've confirmed it, and there's more detail than is in the story. Let's go.

arstechnica.com/security/202...

Ako ransomware affiliate gets five years in prison

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks ESET researchers publish an analysis of Spellbinder, a lateral movement tool used to perform adversary-in-the-middle attacks.

#ESETResearch analyzed the toolset of the China-aligned APT group that we have named #TheWizards. It can move laterally on compromised networks by performing adversary-in-the-middle (AitM) attacks to hijack software updates. www.welivesecurity.com/en/eset-rese... 1/6

Russia attempting cyber sabotage attacks against Dutch critical infrastructure Kremlin-backed hackers have tried sabotage attacks against critical infrastructure in the Netherlands, the country's Military Intelligence and Security Service said in its annual report.

Russia attempting cyber sabotage attacks against Dutch critical infrastructure therecord.media/dutch-mivd-r...

Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows Since early March 2025, Volexity has observed multiple suspected Russian threat actors conducting highly targeted social engineering operations aimed at gaining access to the Microsoft 365 (M365) acco...

@volexity.com #threatintel: Multiple Russian threat actors are using Signal, WhatsApp & a compromised Ukrainian gov email address to impersonate EU officials. These phishing attacks abuse 1st-party Microsoft Entra apps + OAuth to compromise targets.

www.volexity.com/blog/2025/04...

#dfir

Rocky ❤️

CVE-2025-24054, NTLM Exploit in the Wild - Check Point Research Key Points Introduction NTLM (New Technology LAN Manager) is a suite of authentication protocols developed by Microsoft to verify user identities and protect the integrity and confidentiality of netwo...

Check Point published a write-up of CVE-2025-24054, an NTLM leak that Microsoft patched last month.

The company says the vulnerability is now being exploited in the wild, with one campaign targeting government and private institutions in Poland and Romania.

research.checkpoint.com/2025/cve-202...

China swipes at NSA for alleged Asian Winter Games hack : Beijing claims NSA went for gold in offensive cyber, got caught in the act

After years of the West naming and shaming nation-state hackers I have wondered (and written about) the lack of similar finger pointing back at the US etc. This new shift from China to out western hackers for cyber spying is overall a good thing for transparency. www.theregister.com/2025/04/15/c...

Around the World in 90 Days: State-Sponsored Actors Try ClickFix | Proofpoint US Key Findings While primarily a technique affiliated with cybercriminal actors, Proofpoint researchers discovered state-sponsored actors in multiple campaigns using the ClickFix social

My first blog with Proofpoint is live! And we love a good crossover. State-sponsored actors try their hand at ClickFix - the hottest thing in cybercrime. Meet the North Koreans, Iranians, and Russians who are upping their social engineering game www.proofpoint.com/us/blog/thre...

NSO lawyer names Mexico, Saudi Arabia, and Uzbekistan as spyware customers behind 2019 WhatsApp hacks | TechCrunch This is the first time representatives for the spyware maker have publicly named its government customers.

NEW: In a hearing last week, an NSO Group lawyer said that Mexico, Saudi Arabia, and Uzbekistan were among the governments responsible for a 2019 hacking campaign against WhatsApp users.

This is the first time representatives of the spyware maker admit who its customers are.

CVE program averts swift end after CISA executes 11-month contract extension After DHS did not renew its funding contract for reasons unspecified, MITRE’s 25-year-old Common Vulnerabilities and Exposures (CVE) program was slated for an abrupt shutdown on April 16, which would ...

MITRE’s CVE database was hours from disappearing. CISA saved it at the last minute with a contract extension. Here’s what you need to know.

Read Cynthia Brumfield's @metacurity.com news article:

www.csoonline.com/article/3963...

#InfoSec #ThreatIntel #CVE

CISA extends funding to ensure 'no lapse in critical CVE services' CISA says the U.S. government has extended MITRE's funding to ensure no continuity issues with the critical Common Vulnerabilities and Exposures (CVE) program.

CISA to the rescue www.bleepingcomputer.com/news/securit...

CVE Foundation FOR IMMEDIATE RELEASE April 16, 2025 CVE Foundation Launched to Secure the Future of the CVE Program [Bremerton, Washington] – The CVE Foundation has been formally established to ensure the long-term ...

👏 "Active CVE Board members have spent the past year developing a strategy to transition CVE to a dedicated, non-profit foundation." www.thecvefoundation.org/home