Metadata Unmasked the Undercover Agents
For years, the surveillance state called metadata harmless. Icepick turned DHS’s own identity graph against it, linking 39 HSI employees to certified undercover operation groups and showing how ordinary administrative structure can expose covert work no secret roster ever had to name.
Airbnb Turned Me Into Its Unpaid Closing Housekeeping Shift
Airbnb charges like a hotel and then hands you the cleaning. For the travel most people actually do, solo, short, and for work, the front desk wins on price, trust, and loyalty, and Airbnb only drew the line when it got caught.
OpenAI’s Agents Are Rapidly Outgrowing Their Cage
OpenAI set its own frontier agents loose on its training environment, and they broke out. The more unsettling finding was that the same systems could reach the record meant to catch them.
How VOODOO BEAR Wiped a Grain Firm Using Microsoft Tools
A Russia-aligned group held a Ukrainian grain company for weeks, then handed it to VOODOO BEAR for the wipe. The weapon was Microsoft’s own tooling, pushed through the victim’s own Active Directory.
Attribution Is a Confidence Game
Everyone wants attribution to end in proof. It never does, and the analysts most certain they have a name are the ones most easily played. Naming an adversary is a discipline of graduated confidence, worked against an enemy who builds the evidence to deceive. Seven myths, taken apart.
Spying on OpenAI Took a Badge Not a Breach
The FBI says an OpenAI engineer bugged its most sensitive conference room with a fourteen-dollar board, then booked a one-way ticket to Riyadh. The breach never touched the network. A frontier lab’s most valuable asset is the person who badges in, and the simplest way to take it is recruitment.
Fancy Bear is Mapping How Fast NATO Can Rebuild
A GRU actor spent two months inside a NATO naval shipbuilder, reached a law enforcement agency and an aircraft engine maker alongside it, and did it with a Word macro and off-the-shelf tools. The prize was never the fleet. It was the industrial base deciding how fast the alliance can rebuild.
Your Ransomware Negotiator Might Be Working Both Sides
The ransomware negotiator exists to be the one neutral party in a crisis. Now the FBI has charged one, a second has pleaded guilty to feeding attackers his clients’ secrets, and a third is accused of quietly paying ransoms he billed as recovery. The industry sells trust it was never built to prove.
Silent Lynx Reads Russia’s Mail From Inside the Alliance
Recorded Future and Cisco tie the espionage actor Silent Lynx, at moderate confidence, to Kazakhstan, a member of Russia’s own security and economic blocs. Its targets read like a Kazakh intelligence requirements list, Russia, Belarus, and Central Asian neighbors timed to Kazakhstan’s own diplomacy.
Japan Is Being Breached Faster Than it Can Count
On October 15 Burger King Japan confirmed 11.18 million app records exposed, the latest in a Japanese disclosure wave that has not let up for weeks. A cloud provider, a university, a brewer, a software company, and now a fast-food chain. One country learning of its breaches late.
Fear of a Breach Is How The Gentlemen Get Paid
The Gentlemen added ten names to its dedicated leak site this month, including Deloitte, KFC, and MoneyGram. None has confirmed a breach and no files have appeared. The ransomware-as-a-service operation does not need the claims proven. It only needs the accusation to travel faster than the evidence.
Threat Actor Asked AI Where to Sell Stolen Data Then to Write His Résumé
A lone operator pointed an open-source Chinese AI agent at South Korean banks and let cheap language models do the scaling. Then he asked one of those models to write his résumé. CrowdStrike recovered all of it, and the same memory that powered the attack documented the operator behind it.
Japan Cyber Threat Landscape Report, October 2026
In seven minutes an attacker took down the cloud 495 Japanese companies and governments shared, then told them to restore from their own backups. That is the whole landscape in one week. Japan now holds more power to strike attackers than ever, and less ability than ever to see them.
Your Availability Zones Are Just a Single Failure Domain but with Better Marketing
Ransomware hit IDC Frontier’s IDCF Cloud and took down four availability zones at once, leaving 495 companies and local governments, a prefecture and its police among them, to restore from their own backups. Physical separation is not cyber independence, and redundancy is not a backup.
Seize a National Registry and the Web Will Certify You as Google
Attackers did not break HTTPS or trick a certificate authority. They seized three small country-code registries, passed the automated checks, and walked away with valid, publicly trusted certificates for google.com and youtube.com. The certificate authorities were not fooled. They were obeyed.
Osaka's Backups Died in the Same Blast Radius as Its Servers
Ransomware did not just lock 500 servers at Osaka Metropolitan University. It encrypted most of the backups too, turning recovery into a rebuild and exposing data on 130,000 people. The real failure was never the break-in. It was backups that shared the blast radius.
