Threat actors, campaigns, tactics and indicators: who is attacking, how, and what defenders should watch for.
Below the Surface episode 82 was recorded on September 10, 2026, with host Paul Asadoorian joined by Vlad Babkin and Chase Snyder. The conversation moves across several current security stories, but its center of gravity is clear: modern infrastructure…
1 min Open reportForking an existing C2 agent sounds faster than building from scratch. Bishop Fox learned otherwise. This post documents what…
1 min Open reportTLDR: CiliumHound is a BloodHound OpenGraph extension for auditing Cilium network policies. It ingests a folder of JSON or YAML…
1 min Open reportTL;DR: The upcoming Ghostwriter v7.3.0 release brings a major UI refresh to nearly every part of the application. The new design…
1 min Open reportCloudflare operates at a scale so big that even after working here for years, it doesn’t seem real. We have thousands of servers…
1 min Open reportA modern storefront can look perfectly healthy while malicious JavaScript works underneath: siphoning affiliate revenue…
1 min Open reportWithout proper controls, website owners have long faced a difficult tradeoff: allow your content to be used for AI training, or…
1 min Open reportAs more teams — and now agents — build applications on Cloudflare's Developer Platform, having the right access controls is…
1 min Open reportIn this post, we examine two vibe-coded credential harvesting platforms, Loot and UltraVault, and the Amazon Bedrock abuse used…
1 min Open reportIn this post, we walk through different threats to GitHub and how to detect them.
1 min Open reportBe alert: targeted attacks on prominent Rustaceans Important warning from Adam Harvey and the crates security team: We believe…
1 min Open reportHBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation In September 2026, the cybersecurity…
1 min Open reportA hacking group has claimed responsibility for an August 2026 cyberattack on Cedar County Memorial Hospital in Missouri…
1 min Open reportIn September 2026, a Chase-themed campaign delivered more than 80,000 messages in a few hours. The email presented a secure…
1 min Open reportThe coordinated action conducted on 18 September 2026 led to two arrests. Allegedly, the traffickers forced their victims to work…
1 min Open reportThe Victim Identification Task Force brings together experts from across the globe to combat child sexual exploitation. During…
1 min Open reportEuropol has supported law enforcement agencies from Italy and Brazil in dismantling a major drug trafficking and money laundering…
1 min Open reportThe 7th SIRIUS Single Point of Contact (SPoC) Network Meeting, organised by Europol’s EU Internet Referral Unit (EU IRU) together…
1 min Open reportThrough this connection, the Andorran Police will be able to securely share law enforcement information with Europol and a wide…
1 min Open reportEuropol has supported an international operation targeting a criminal network linked to the Italian mafia-type organisation…
1 min Open report
