60
60
US takes down NightmareStresser DDoS-for-hire platform
FBI seized NightmareStresser, a DDoS-for-hire platform with 566,000 users and servers capable of 200 Gbps attacks, under Operation PowerOFF.
US law enforcement seized the nightmare-stresser[.]com and nightmarestresser[.]org domains used by the DDoS-for-hire service. Searchlight Cyber reported in 2023 that NightmareStresser had over 566,000 registered users and 52 dedicated servers launching attacks of up to 200 Gbps against Layer 4 and Layer 7 targets. The FBI said the service was used for hundreds of thousands of actual or attempted DDoS attacks since 2022. The action continues Operation PowerOFF, which began in December 2018 and previously took down DigitalStress, Dstat.cc and dozens of booter domains.
60
60
Risky Bulletin: Russia tells data centers to deploy drone defenses
Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.
The Russian government instructed data center operators to deploy protections against drone strikes under a presidential decree signed by Putin that allows temporary state administration of critical infrastructure operators failing to defend against Ukrainian hacks and drone strikes. Although data centers are not formally critical infrastructure in Russia, the decree applies to them because other sectors depend heavily on cloud services; Russia has more than 180 data centers, over 80% in the European region within range of Ukrainian strikes. The digest also reports a Dropbox breach affecting nearly 5,000 accounts via the Lenovo ID integration, spyware attacks on at least 14 Serbians using NoviSpy or Pegasus, and a password recovery attack targeting hundreds of thousands of X accounts tied to the new X Money service. Other items include a 14-hour compromise of Coder's Cloudflare infrastructure delivering malicious Terraform modules, donor data breaches at Davayte and You Are Not Alone via the Stripe/WooCommerce integration, a $2.5M Aquifer crypto heist, and a TVING breach exposing data of almost 40 million accounts.
66
CMMC Hit Pause, the FAR Council Hit Play
DoD paused CMMC Phase 2 pending a 60-day review while a proposed FAR Council rule would extend NIST 800-171 Rev 3 to all federal contractors.
The Department of Defense suspended CMMC Phase 2 third-party certification requirements, but Phase 1 self-assessments under DFARS 252.204-7021 remain in force since November 2025, and prime contractors are still directing suppliers to proceed. A CMMC Reform Task Force must report recommendations to the DoD CIO within 60 days, likely by September or October 2026. Separately, the FAR Council's proposed CUI rule from June 23 would apply NIST 800-171 Revision 3, 72-hour incident reporting, and flowdown obligations to all FAR-based federal contracts, not just the defense industrial base. False Claims Act exposure grows as DIBCAC assessment teams now cooperate directly with the DOJ.
62
Risky Bulletin: White House lets private companies carry out offensive cyber ops
A White House memo directs DHS to create a program letting vetted private companies conduct US-government-directed offensive cyber operations against cybercrime.
A presidential memo tasks the DHS National Coordination Center with building a program, under DOJ and DHS oversight, through which private-sector companies can conduct offensive cyber operations against large-scale cybercrime organizations. Requirements include secure facilities, vetted personnel, a $1 million escrow for damages, and written approvals co-signed by DHS and DOJ executive directors. The program must launch within 60 days, around October 11, expanding a March executive order targeting scam compounds, ransomware, and other large-scale cybercrime.
65
60
60
60
60
60
60
60
60
60
60
60
60
60