Featured Article
North Korea Is Sitting on US$3 Billion Nobody Can Freeze
Binance has repaid its customers, but around US$3 billion stolen by North Korea still sits in bitcoin and ether no issuer can freeze. Automated laundering, a Polygon hard fork proposal, terrorism judgment creditors, and stalled sanctions now decide whether Pyongyang ever profits from the theft.
Explore by Topic
Adversaries
Tradecraft
Technology
Geopolitics
Latest Articles
Silent Lynx Reads Russia’s Mail From Inside the Alliance
Recorded Future and Cisco tie the espionage actor Silent Lynx, at moderate confidence, to Kazakhstan, a member of Russia’s own security and economic blocs. Its targets read like a Kazakh intelligence requirements list, Russia, Belarus, and Central Asian neighbors timed to Kazakhstan’s own diplomacy.
Japan Is Being Breached Faster Than it Can Count
On October 15 Burger King Japan confirmed 11.18 million app records exposed, the latest in a Japanese disclosure wave that has not let up for weeks. A cloud provider, a university, a brewer, a software company, and now a fast-food chain. One country learning of its breaches late.
Fear of a Breach Is How The Gentlemen Get Paid
The Gentlemen added ten names to its dedicated leak site this month, including Deloitte, KFC, and MoneyGram. None has confirmed a breach and no files have appeared. The ransomware-as-a-service operation does not need the claims proven. It only needs the accusation to travel faster than the evidence.
Threat Actor Asked AI Where to Sell Stolen Data Then to Write His Résumé
A lone threat actor pointed an open-source Chinese AI agent at South Korean banks and let cheap language models do the scaling. Then he asked one of those models to write his résumé. CrowdStrike recovered all of it, and the same memory that powered the attack documented the operator behind it.
Japan Cyber Threat Landscape Report, October 2026
In seven minutes an attacker took down the cloud 495 Japanese companies and governments shared, then told them to restore from their own backups. That is the whole landscape in one week. Japan now holds more power to strike attackers than ever, and less ability than ever to see them.
Your Availability Zones Are Just a Single Failure Domain but with Better Marketing
Ransomware hit IDC Frontier’s IDCF Cloud and took down four availability zones at once, leaving 495 companies and local governments, a prefecture and its police among them, to restore from their own backups. Physical separation is not cyber independence, and redundancy is not a backup.
Seize a National Registry and the Web Will Certify You as Google
Attackers did not break HTTPS or trick a certificate authority. They seized three small country-code registries, passed the automated checks, and walked away with valid, publicly trusted certificates for google.com and youtube.com. The certificate authorities were not fooled. They were obeyed.
Osaka's Backups Died in the Same Blast Radius as Its Servers
Ransomware did not just lock 500 servers at Osaka Metropolitan University. It encrypted most of the backups too, turning recovery into a rebuild and exposing data on 130,000 people. The real failure was never the break-in. It was backups that shared the blast radius.
Denmark Was Not Hacked, It Was Logged Into
Attackers never breached Denmark's national population register. They abused one trusted company's legitimate access to enumerate and pull 8.8 million identities, then got caught by the bill, not by security. Permission, not malware, emptied the CPR.
China Paid UK Academics to Build Its Spy Tradecraft
MI5 named a Chinese front that funded more than 100 UK academics to build AI and espionage tradecraft for the Ministry of State Security. No breach, no malware, just a grant. China did not hack the research. It bought it, and many academics never knew who was behind it.