Threat Intelligence

Isometric clay diorama on deep navy: a Bitcoin hardware wallet beside a single red loaded die — the Coldcard firmware PRNG flaw behind a $70M crypto theft.

Vulnerabilities

Coldcard Hardware Wallet Firmware Flaw Linked to $70M Bitcoin Theft in 41 Minutes

One flaw, 41 minutes, seventy million dollars. Galaxy Research tied a July 30 sweep of 1,196 Coldcard-generated Bitcoin addresses to a 2021 firmware error that routed seed generation to a predictable software PRNG. What hardware-wallet owners should verify now.

Navy duotone documentary: a water-treatment plant with one red location marker — cyberattacks on water systems across seven US states, likely tied to Iran.

Critical Infrastructure

Seven States' Water Systems Hit by Cyberattacks Likely Tied to Iran — Scope Expands Beyond Minnesota

The water-sector campaign just got bigger. WIRED reports systems in seven US states hit by attacks likely tied to Iran — beyond the 30-plus Minnesota systems first disclosed. What every water utility should verify now, and what's still unnamed.

Navy duotone documentary: a hotel-lobby laptop showing a fake update with one red progress bar — Microsoft's CaptiveCrunch hotel Wi-Fi CornFlake RAT.

Nation-State Cyber Threats

CaptiveCrunch: Fake Browser Updates on Hotel Wi-Fi Deliver Russia's CornFlake RAT

A browser-update prompt on hotel captive-portal Wi-Fi is the whole attack. Microsoft's CaptiveCrunch campaign, attributed to a Russian sub-cluster of Midnight Blizzard, delivers the CornFlake RAT to travelers. The defense is a short, enforceable checklist, not awareness in the abstract.

Flat white line-art of an Android TV box disguised as a phone clicking an ad, the payout looping to a company, on a saturated background with one red dot.

IoT Security

Fuyao: The Android TV Ad-Fraud Botnet Now Has a Name and an Operator

The cheap Android TV boxes that pose as phones to click ads now have a name — Fuyao — and an attributed operator, Zhejiang Fengwo IoT. Bitsight's forensic trail, the machine-vision fraud engine, and why the headline device counts are softer than they look.

Flat white line-art of a TV streaming box splitting into two paths — one to a house, one to a phone clicking an ad — on a saturated background with one red dot.

IoT Security

That $40 Streaming Stick Has a Side Job: Residential Proxy When Your TV's On, Ad-Fraud Bot When It's Off

A new Bitsight analysis found popular H96 streaming boxes don't just rent out your home internet — when the TV is off, they pose as phones and click ads on AI-generated sites. What owners and ad networks should do.

Flat white line-art of a Mac display showing a fake full-screen update above a crypto wallet on a dark background — DPRK macOS malvertising campaign.

North Korean Threat Actors

DPRK's "Contagious Interview" Campaign Moves Into macOS Malvertising to Drain Crypto Wallets

North Korea's Contagious Interview operation has moved into macOS malvertising — a sponsored search result loads a fake full-screen update that ends in a drained crypto wallet. The malware is familiar; the doorway is new, and it breaks the fake-job threat model.

Flat white line-art of three key-shaped drivers feeding one control panel, on a deep teal background — SilverFox's three-driver BYOVD chain and ValleyRAT.

Nation-State Cyber Threats

SilverFox Deploys 3-Driver BYOVD Chain and ValleyRAT Against Japanese Manufacturer

Three vulnerable drivers, one payload — SilverFox on the wire this week.

Flat white line-art of an open back door linked by one line to a distant relay node, on a teal background — the NightLedger backdoor.

Nation-State Cyber Threats

Iran-Linked Nimbus Manticore Deploys NightLedger Backdoor Across Middle East, Africa, South Asia

New backdoor, familiar actor — the Iran-linked group tracked as Nimbus Manticore has a fresh toolset, and Kaspersky's write-up of NightLedger lands this week.

Flat white line-art of a browser window building a jigsaw file from separate pieces, on a teal background — the SourTrade browser-assembly malvertising research.

Threat Intelligence

Confiant Documents "SourTrade" Malvertising Campaign Assembling Executables in the Victim's Browser

A novel malvertising delivery technique lands from Confiant — defender review for ad-tech and retail-trader-adjacent environments this weekend.

Flat white line-art of one control panel routing several tiles into a central hub, on a deep teal background — a centralized RaaS operator portal.

Ransomware

PRODAFT Documents "DevMan" Ransomware-as-a-Service Portal Operated by "Funky Mantis"

Another named RaaS operator profile from PRODAFT — defender-team pattern-tracking this weekend.

Editorial illustration of a gavel over a policy scroll beside a transit farecard — UK police chiefs cite the TfL case to push for Cybercrime Risk Orders.

Policy & Government

UK Police Chiefs Cite TfL Prosecution to Push for New Cybercrime Risk Orders

UK police chiefs are citing the Transport for London prosecution and the Scattered Spider sentencing to press for Cybercrime Risk Orders — a proposed civil tool to restrain suspected cyber offenders. Post-TfL policy analysis this week.

Editorial illustration of a defaced presidential webpage showing a wallet address, marking Kenya's probe into the hack of President Ruto's website with a Bitcoin ransom.

Policy & Government

Kenya Probes Hack of President William Ruto's Website Following Bitcoin Ransom Demand

A Kenyan presidential-website hack draws a Bitcoin-ransom demand — government-website defender awareness this week.

See all