30
30
30
30
30
60
Authorities seize popular, long-running DDoS-for-hire service domainsnew
FBI and RCMP seized NightmareStresser DDoS-for-hire domains under Operation PowerOFF; the service enabled hundreds of thousands of attacks since at least 2022.
The Justice Department announced the court-ordered seizure of NightmareStresser's primary domain and related sites, executed by the FBI Anchorage field office and the Royal Canadian Mounted Police under Operation PowerOFF. The DDoS-for-hire service enabled hundreds of thousands of attacks or attempted attacks since at least 2022, targeting educational institutions, government agencies, gaming platforms, and millions of people. Authorities have seized more than 100 booter domains since 2018; operators remain unidentified and the service claimed to operate under Russian law.
45
30
30
CISA head says agency must change quickly to prevent the 'worst that could happen'
Acting CISA Director Nick Andersen warned of US cyber vulnerabilities and said the agency is refilling staff cut to about half strength.
Speaking at the Billington CyberSecurity Summit, acting CISA Director Nick Andersen warned that decades of bad decisions, overwhelming technical debt, outdated technology and AI-driven threats could lead to devastating cyber incidents without rapid, significant changes. He said the agency has about 250 screened hires awaiting security clearances after losing roughly a third of its staff to DOGE-related cuts and attrition, and referenced a June pledge by DHS Secretary Markwayne Mullin to refill about 600 CISA jobs. Andersen called AI a gamechanger, citing daily headlines about rogue AI agents and an Anthropic researcher leaving over model safety concerns.
32
55
30
30
30
Risky Bulletin: Two TeamPCP members arrested in Australia
Australian Federal Police arrested two alleged TeamPCP members behind supply-chain worm attacks that stole over 500,000 credentials from compromised open-source libraries.
The AFP arrested alleged TeamPCP leader Ruben Thomson, 21, and Louis Gaebler, 23, near Perth; both were charged and remain in custody. The group inserted a self-spreading credential-stealing worm into open-source projects including Trivy, KICS, LiteLLM, and Telnyx, harvesting more than 500,000 credentials used for network access, ransomware, extortion, and sales. About 78,000 tokens and secrets from nearly 2,200 organizations leaked online last month, and the FBI supported the investigation that began in April.
74
Risky Bulletin: Russia tells data centers to deploy drone defenses
Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.
The Russian government instructed data center operators to deploy protections against drone strikes under a presidential decree signed by Putin that allows temporary state administration of critical infrastructure operators failing to defend against Ukrainian hacks and drone strikes. Although data centers are not formally critical infrastructure in Russia, the decree applies to them because other sectors depend heavily on cloud services; Russia has more than 180 data centers, over 80% in the European region within range of Ukrainian strikes. The digest also reports a Dropbox breach affecting nearly 5,000 accounts via the Lenovo ID integration, spyware attacks on at least 14 Serbians using NoviSpy or Pegasus, and a password recovery attack targeting hundreds of thousands of X accounts tied to the new X Money service. Other items include a 14-hour compromise of Coder's Cloudflare infrastructure delivering malicious Terraform modules, donor data breaches at Davayte and You Are Not Alone via the Stripe/WooCommerce integration, a $2.5M Aquifer crypto heist, and a TVING breach exposing data of almost 40 million accounts.
66
30
30
30
55
Risky Bulletin: Dutch intel services to get extensive new powers
Netherlands proposed a bill granting AIVD and MIVD expanded warrantless tapping, faster hacking powers, and forced data disclosure, citing Russia, China, and Iran threats.
The Dutch government introduced a bill greatly expanding surveillance powers of intelligence agencies AIVD and MIVD, allowing up to one year of tapping without pre-approval and simplified hacking operations against 'foreign adversaries'. Agencies could compel Dutch companies or citizens to provide data under threat of charges, share data with the private sector, and oversight bodies would merge into a new CTT board. The bill follows similar overhauls in Ireland, Germany, and France after Russia's invasion of Ukraine. The newsletter also reports Moonwell hacked for $8.7M, a Cosmos EVM bug exploited for ~$3M, ShinyHunters listing McKesson with claimed hundreds of millions of records, and a pro-Kremlin DDoS claim against Norway's government network.
42
60
30
55
30
55
55
55
30
30
30
55
30
55
30
60
30
Risky Bulletin: Russia starts blocking DoH and DoT
Russian users report blocks on DoH and DoT servers, including Cloudflare 1.1.1.1 and Google 8.8.8.8, in an apparent censorship crackdown.
Russian internet users began reporting failures connecting to DNS-over-HTTPS and DNS-over-TLS servers, suggesting a government crackdown on the two privacy protocols. The blocks reportedly cover Cloudflare's 1.1.1.1 and Google's 8.8.8.8 resolvers; Roskomnadzor has not officially confirmed the action. The agency tested a similar block in March on Beeline's network and had named DoH for blocking as early as 2021. The bulletin also briefly notes state-sponsored phishing of EU officials, a DDoS against Norway's Digdir, the ReliaQuest/ShinyHunters dispute, and older ransomware and breach disclosures.
40
30
42