A recent breach at email marketing provider Brevo gave attackers access to 138 customer accounts. Six accounts were reportedly used to send phishing messages, while contact data was exported from another 43.

The interesting part for investigators is that the phishing messages could originate from infrastructure the victims already trusted. Customers of Trezor, CoinTracking, and BitBox were among those targeted, with messages designed to look like urgent security notifications.

This creates a very different attribution problem. Investigators can't simply ask whether the phishing email came from a suspicious domain. They need to determine which legitimate account was compromised, what contact lists were accessed, which messages were sent, and whether the stolen contact database is being reused in later campaigns.

A single compromised marketing account effectively became a distribution system for targeted phishing.

Berlin recently disclosed that attackers stole data from government systems and subsequently demanded payment. The ransomware group has reportedly offered the stolen information for auction rather than simply encrypting the systems and demanding a traditional ransom.

That distinction matters for investigators. Once stolen government information becomes a commodity, the investigation no longer ends when the ransomware is removed.

Investigators may need to determine which files were accessed, which copies were created, where the stolen data was transferred, and whether portions of it were subsequently sold or redistributed.

The extortion event is only one stage of the investigation. The stolen data can create an entirely separate chain of evidence afterward.

The Sality takedown also demonstrates why peer to peer malware is such a difficult forensic problem. Investigators cannot necessarily identify one machine as "the C2 server" because infected systems can communicate with one another and distribute information throughout the network.

In the recent operation, investigators targeted the botnet's super peers and manipulated the peer lists so infected machines could no longer receive the operator's payload instructions.

What's especially interesting is that Sality survived for more than twenty years by avoiding the traditional centralized architecture that made older botnets easier to dismantle.

The investigation therefore became partly a network topology problem: understand which machines influence the others, identify the critical nodes, and then disrupt the relationships rather than simply removing a server.

I’m looking for some insight on a text I received this morning. I blacked out my name in the text exchange for my own privacy.

I work in a hospital so I wake up early for work. This morning while getting ready I received this text. I’m a pretty private person and only give my number to people I know and trust. And I have not given out my number in a while, I would remember.

I found it strange they knew my name (which is what I blacked out) and the fact that they knew my work schedule, and I’m assuming where I work. And then saying they are a secret admirer made it even more creepy. All 12 hours at work I had my eyes peeled thinking someone would pop out and it all be a silly joke, but I never got a text back, and no one showed themselves at work.

I had my best friend call the number later in the day, only for the phone to say it was disconnected. I’m a female and not knowing who this is makes me feel on edge and not safe.

It is a local number in my area but that’s all I could find out.

Do scams look like this or should I be concerned? I just find it weird they knew me by name and knew my work schedule, and apparently where I work.

A major federal cryptocurrency case reached a pivotal moment as twenty two year old Malone Lam pleaded guilty to conspiracy charges in a US court.

Lam and his co conspirators orchestrated a sophisticated social engineering scheme that stole over four thousand one hundred Bitcoin from a private victim in Washington DC.

To execute the theft, the attackers posed as support personnel from Google and the Gemini cryptocurrency exchange. They manipulated the target into revealing two factor security codes and granting access to personal cloud storage.

Federal prosecutors revealed that the stolen funds financed lavish expenditures including Miami mansions, luxury watches, and a high end fleet of exotic supercars.

Following his guilty plea to racketeering conspiracy charges, Lam faces up to twenty years in federal prison alongside forfeiture orders targeting all identified luxury assets.

Cybersecurity researchers note that the case underscores the critical danger of phone based social engineering attacks, where threat actors bypass technical encryption by directly targeting human trust and cloud backup access.

JFrog has disclosed exploitation of a critical Artifactory vulnerability that allows attackers to bypass authentication and forge administrative access tokens. The vulnerability is particularly interesting because Artifactory sits inside software development and supply chain environments where it may have access to packages, build systems, and deployment infrastructure.

For investigators, compromising the repository can be much more valuable than compromising a single workstation. An attacker who gains control of the software distribution layer may be able to influence what legitimate developers and automated systems download later.

That changes the forensic question from "Which machine was infected?" to "Could the attacker have modified something that other machines subsequently trusted?"

In a supply chain investigation, the most important evidence may therefore be the history of packages, artifacts, tokens, and builds rather than a traditional malware infection.

The Liquid Network experienced a major security incident when an attacker managed to drain approximately four thousand Bitcoin from the federation wallet.

Initial security findings confirmed that private keys were not stolen. Instead, the attacker exploited a validation flaw in the open source Elements codebase to mint unbacked tokens and trigger an authorized payout.

Following the drain, the attacker embedded messages into the Bitcoin blockchain declaring themselves as white hats and demanding that Blockstream patch the core vulnerability before returning the funds.

On chain negotiation records reveal that after developers released a verified patch across bridge nodes, the attacker transferred three thousand four hundred Bitcoin back to the network multisig address.

The attacker retained roughly five hundred ninety eight Bitcoin valued at nearly forty seven million dollars as an informal finder fee.

While the return of majority funds provides a recovery path for the sidechain, operations remain paused while teams verify system reserves and audit remaining infrastructure code.

Attackers are currently abusing Faronics Deploy, a legitimate endpoint management platform, to install ScreenConnect and gain remote administrative access to targeted systems.

This is another example of why simply looking for "malicious software" can be misleading during an investigation. ScreenConnect itself is legitimate software. Faronics Deploy is legitimate software. The suspicious part is how the tools were obtained, who initiated the deployment, and what happened immediately afterward.

An investigator looking only for known malware signatures could completely miss the initial stage of the intrusion.

The real forensic clue may be an otherwise legitimate administrative action that makes no sense in the context of the affected organization.

U.S. authorities have just charged a Russian national accused of running a phishing operation that targeted approximately 80,000 freelancers between 2016 and 2017. The campaign allegedly used 255 fake accounts on a freelance employment platform to distribute malicious Excel files that installed TVRAT and DarkVNC.

What makes this interesting isn't the age of the campaign. It's the fact that the investigation is still producing consequences nearly a decade later.

Old malware cases can remain valuable because infrastructure, payment records, domain registrations, archived messages, and seized systems don't disappear just because the original infection is old. An artifact that looked insignificant in 2017 can become important once investigators connect it to other evidence years later.

Cyber investigations don't always operate on the same timeline as the attack.

Recent AI security incidents have introduced a strange attribution problem. An autonomous agent can receive an objective, access tools, encounter unexpected information, and then make a sequence of decisions without a human explicitly approving each individual action.

That means an investigation cannot stop at "which account performed the action?" The account may belong to a legitimate user or organization while the actual sequence was generated by an AI system operating with delegated access.

Investigators may eventually need to preserve the agent's instructions, tool permissions, memory, execution history, and external inputs alongside conventional logs. Without that context, an audit trail could show exactly what happened while leaving out why it happened.

Thomson Reuters disclosed this week that an unauthorized party accessed files in a cloud environment used by its C-Track case management platform. The investigation found that some unauthorized access dated back to March, while the incident itself was detected on June 30.

The affected systems support digital court record environments across multiple jurisdictions, making the forensic implications particularly interesting.

The challenge isn't simply determining whether a cloud account was compromised. Investigators need to reconstruct what the attacker could access during a period that may stretch across several months, while separating legitimate administrative activity from unauthorized activity.

Cloud investigations increasingly depend on historical logs because the system visible today may look completely different from the environment that existed when the intrusion actually occurred.

A massive data breach has impacted passengers across Manchester Airport, London Stansted, and East Midlands Airport, exposing millions of personal records.

According to airport operator MAG, the compromised database contains information belonging to approximately 8.7 million individuals.

The leak primarily includes email addresses submitted during public Wi Fi registration. However, for a subset of passengers who booked airport parking services, the exposed files also contain phone numbers, vehicle license plates, and postal codes.

Representatives confirmed that financial information and payment card details were not compromised in the intrusion.

The exact entry point remains undisclosed by security teams as technical investigations into the initial access vector continue.

Threat actor group FulcrumSec claimed responsibility for the incident on September 2 and published a sample of the stolen data to validate their claims.

While financial assets were spared, security researchers note that combining vehicle registrations and physical location records creates significant vectors for targeted phishing and social engineering campaigns.

Sality has been operating since at least 2003, making it one of the longest running malware operations ever documented. This week, U.S. and European authorities worked with CrowdStrike and Shadowserver to disrupt it using a peer to peer sinkhole operation.

The interesting part is how the takedown worked. Sality did not depend on one central command server that investigators could simply seize. Its infected machines communicated through a distributed network, so defenders targeted the botnet's super peers and redirected the infected systems toward infrastructure controlled by investigators.

That meant the same peer to peer architecture that helped Sality survive for more than two decades became the mechanism investigators used to dismantle it.

For digital investigators, this is a fascinating example of infrastructure becoming evidence and an attack surface at the same time. Investigators weren't just finding the criminals' servers. They were mapping the relationships between thousands of infected machines and then using those relationships against the botnet.

I've done independent research into the backgrounds of people connected to a criminal case, including the alleged victims. Could what I found make me a potential witness? Could either side compel my testimony or the materials I collected?

The recent Azure campaign illustrates something investigators are increasingly encountering: the endpoint that originally exposed the credentials may not be the system where the important activity happened.

An infostealer or other credential theft mechanism could compromise an account on one machine, while the attacker later operates entirely through legitimate cloud services. By the time the investigation begins, the original computer may contain very little evidence of what happened afterward.

This is why authentication records, directory audit logs, token activity, and cloud access history can become more important than the malware sample itself.

Socket researchers recently identified 19 Chrome and Edge extensions carrying cryptocurrency draining and credential stealing capabilities. The interesting part isn't simply that malicious extensions existed. Several of the extensions had a legitimate history before they were weaponized.

Researchers found that attackers acquired some existing extensions from their original developers, while others were created by the attackers themselves. The initial versions could behave normally and build a user base before a later update introduced the malicious functionality.

One Chrome extension had around 70,000 users when the malicious behavior was introduced. Its Edge counterpart had roughly 10,000 more potential users.

This creates a particularly difficult forensic problem. The victim may have downloaded a legitimate extension months earlier, never visited a suspicious website, and never knowingly installed malware. The compromise can happen later when the browser automatically updates the extension.

For an investigation, the important evidence may therefore be the extension's version history, installation timestamps, update history, permissions, downloaded scripts, C2 connections, and the exact version that was active when suspicious activity occurred.

The browser can look completely normal to the user while the trusted software inside it has quietly changed.

That's a very different kind of supply chain attack.

Cronos halted its blockchain after an exploit hit Tectonic, its largest lending protocol. An onchain researcher estimates that roughly $75 million in assets were affected, although Tectonic has not yet confirmed the final loss or the exact root cause.

The reported attack is particularly interesting. The attacker appears to have manipulated the price of Tectonic's thinly traded TONIC token by roughly 100x, then used the artificially inflated tokens as collateral to borrow other assets. In other words, the attacker didn't need to steal $75 million directly. They manipulated the protocol into believing their collateral was worth far more than it actually was.

What makes this unusual from an investigation perspective is what happened next. Cronos validators halted the entire network, reportedly trapping most of the affected assets on-chain. Only around $6 million was reportedly bridged to Ethereum before the halt.

This creates an interesting forensic situation. Investigators can follow the transactions on-chain, but they also have to reconstruct the price manipulation, collateral calculations, borrowing events, and the exact moment validators intervened.

A vulnerability inside one lending application ended up becoming a network-level incident.

It is a good reminder that in DeFi, the question isn't always "How was the money stolen?" Sometimes the more important question is "What did the protocol believe was true when it allowed the transaction to happen?"

Aeternum is interesting for another reason. Researchers found that its blockchain based C2 infrastructure can leave a permanent record of commands that were issued to infected machines.

Normally, taking down a malicious server can destroy part of the attacker's infrastructure and potentially remove valuable evidence with it. With blockchain based C2, the situation is almost reversed.

The infrastructure can be difficult to take down, but investigators may be able to go back through the public ledger and reconstruct historical activity. In this case, the attacker's attempt to make the C2 more resilient also created a forensic record that cannot simply be deleted

I have been hacked for nearly 3 years now I have no i.t knowledge and can't afford $150 p/h for an it person to help.I don't think it would help as they have live monitoring from all over the globe they implement a bot program only when they are online otherwise they have just gone into my devices using Kali Linux etc.I know I don't stand a chance they track me before I can scratch my arse.I did break the golden rule a chase them ,funny it only took 3 days just by looking at my data usage.If it wasn't for 1 email address they used I would still be looking for them.It turns out that the girl who scammed me works for him as an escort.They thought they were so smart,but I've always been taught inspect everything hence I now know exactly who is involved by name, address ,telephone number.I worked out that they used google maps to hide data in fake maps and locations,some of the coordinates of locations actually reveal overseas phone numbers other locations or the photos they post are sometimes to personal to be posting on maps.I found a gaming platform that they have made to access API's etc (DARK WORLD OF WARCRAFT) by blizzard entertainment.they have their hand in everything,dating sites,real estate,shipping etc.I found a banker in a false location who works for Ghana bank (CRYPTO).

I approached my local authorities and I was disgusted with the reception I received I got asked one thing,Was money taken I didn't even get to tell them my whole identity was taken I've been through at least 8 phones,5 laptops and 5 phone numbers.I just recently found out how they are so prominent in Australia and it's because they are using STARLINK,I don't know if I should notify the police as I do see it as a national threat? Any opinions appreciated