Archive for FBI

« Older Entries

FBI, Secret Service warn FortiBleed campaign has compromised 86,000+ devices

Posted in Commentary with tags , on October 7, 2026 by itnerd

The FBI and U.S. Secret Service are warning that the ongoing FortiBleed credential-compromise campaign has affected more than 86,644 Fortinet devices across 194 countries, according to a new joint cybersecurity advisory.

The campaign targets internet-facing FortiGate firewalls and SSL VPN gateways, using credentials obtained from previous Fortinet leaks and infostealer logs along with password spraying and credential stuffing. Stolen password hashes are sent to a distributed GPU cluster where attackers attempt to crack them and convert the data into usable credentials.

After gaining access, attackers create new administrative accounts to maintain persistence and can move further into victim networks by enumerating Active Directory accounts and searching for privileged credentials. In some incidents, attackers have changed passwords or deleted legitimate accounts, locking organizations out of their own Fortinet devices and requiring remediation beyond standard patching and password resets.

The FBI and Secret Service said the operation ultimately packages and sells working VPN configurations and access to compromised networks to other threat actors. The FortiBleed attack chain has already been observed providing initial access to ransomware affiliates, including INC/Lynx and Payload ransomware.

Phil Wylie, Senior Consultant & Evangelist, Suzu Labs:

“FortiBleed is a good example of why organizations can’t treat perimeter security appliances as ‘set it and forget it’ infrastructure. Firewalls and VPN gateways are high-value targets because compromising one can give an attacker a trusted entry point into the network.

“What makes this campaign particularly concerning is that organizations may be dealing with more than a vulnerability that needs to be patched. If attackers have valid credentials or have already created new administrative accounts, applying an update and changing a password may not remove them from the environment. Defenders need to assume that previously exposed devices could already be compromised and investigate accordingly.

“Organizations should review administrative accounts, authentication logs and configuration changes, rotate potentially exposed credentials, enforce MFA wherever possible, restrict management interfaces from the public internet and look for evidence of lateral movement. If privileged credentials were accessible from the compromised environment, those credentials should also be considered potentially exposed.

“The ransomware connection also shows how mature the cybercrime ecosystem has become. The people gaining access don’t necessarily have to be the ones deploying ransomware. Initial access itself has value, and compromised VPN access can be packaged and sold to another criminal group that takes the attack from there.”

John Strand, Owner, Black Hills Information Security, Inc.:

“The most interesting thing to me about this particular attack is that some of these attackers are actually selling access to compromised networks to other threat actors. It’s basically malicious hacking as a service. And that concerns me because this isn’t necessarily a ransomware-style attack. You’re getting much closer to what we traditionally think of as an advanced persistent threat, and the persistence is what scares me. I’m not nearly as worried about an attacker who gets into an organization, locks everything down, and announces their presence. I’m terrified of the attacker who wants to quietly live inside that organization for as long as possible. This attack gives them exactly that kind of access.”

If you haven’t addressed FortiBleed, you should have an incentive to do it now. If you have addressed FortiBleed, congratulations. Now do again as it is better to be safe than sorry.

Leave a comment »

FBI removes Accenture contractor after an unpatched third-party PeopleSoft platform exposed employees’ counterintelligence roles and medical records

Posted in Commentary with tags on October 6, 2026 by itnerd

The FBI removed an Accenture contractor on Monday after a data breach exposed sensitive personal details of thousands of bureau employees, Reuters reported. FBI cyber chief Brett Leatherman said the incident “occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform.”

More info here: FBI removes Accenture contractor after ShinyHunters data breach

Jason Brown, Director of Customer Advisory, Counter Fraud Lead, iCOUNTER

“The FBI breach came through a PeopleSoft HR platform that a third party managed. According to the FBI, a contractor failed to apply a patch that Oracle and Google flagged as critical back in June. ShinyHunters claims it got in through that flaw in September. Third-party risk lives in that gap. Organizations hand third parties some of their most sensitive systems and then have very little insight into whether those systems are patched, monitored or exposed. In this case, Reuters reports the result was counterintelligence role descriptions, home addresses of human intelligence operatives, and medical and psychiatric records for bureau employees. Every contract for a managed platform should spell out how quickly critical patches have to be applied, require the third party to prove it was done, and give the customer the right to check. Security teams also need to stop treating third-party managed systems as someone else’s problem. Keep an inventory of every platform a third party runs on your behalf, know what data sits in it, and watch for warning signs, like that platform showing up in exploit activity or criminal forums. Groups like ShinyHunters look for exactly this kind of weak link, because one unpatched platform at a contractor can expose an entire workforce. Intelligence on which of your third parties are being actively targeted gives you a chance to act before the data is gone. Outsourcing the platform leaves the accountability with you. When it’s your employees’ data, the breach is yours.”

ShinyHunters is busy for sure. Thus proving that this wasn’t going to stop them. Thus if I were you, I would harden things up so that ShinyHunters don’t get in at all.

UPDATE; More commentary has come in.

Justin Beals, CEO & Founder, Strike Graph

“The FBI deserves credit for saying plainly what happened. A contractor failed to apply a patch that was explicitly issued to secure the platform, and the bureau named that as the cause and removed the contractor. Most organizations would bury that finding. The harder truth is that the FBI’s workforce data was only as secure as the patch cadence of a team it didn’t directly manage.

Federal contracting keeps running into this gap. Agencies and primes collect attestations that controls are in place, but an attestation only tells you what a vendor intended to do. It doesn’t tell you whether the patch went in after Google warned that ShinyHunters was going after vulnerable PeopleSoft instances. A DHS prime contractor I work with put it to me directly when we were talking about his obligations as an affirming official: ‘I don’t think a security questionnaire is going to cut it.’ He’s right. A questionnaire is self-attested and unverifiable, and he’s signing for every subcontractor below him.

Expect this to show up in enforcement. DOJ recovered $52 million under its Civil Cyber-Fraud Initiative in FY2025, and those cases turn on the gap between what a contractor said about its controls and what was actually running. Removing the contractor was the right call, but it happened after the damage was done. The agencies and primes that avoid the next headline will be the ones requiring continuous evidence from their suppliers, including time-to-patch on critical systems, rather than a form that gets filed once and never revisited.”

Joe Brinkley, Director of Offensive Security Research & Community, Cobalt

“Outsourcing the management of a platform doesn’t outsource the risk that comes with it. Attackers understand this well, which is why groups like ShinyHunters focus on widely deployed enterprise applications where responsibility for patching sits somewhere between the customer and the service provider. When ownership is split, critical updates tend to fall into the gap, and that gap is where real-world exploitation happens. The approach also scales well for attackers: once they have a working method against one platform, they can sweep the internet for every instance that’s lagging behind, regardless of who manages it. Organizations need to treat third-party-managed systems as part of their own attack surface. That means setting clear contractual ownership of remediation timelines and independently validating that patches were actually applied, because a status report is not evidence that the exposure is gone. The organizations that hold up best test their trusted relationships the same way an attacker would, rather than assuming someone else has it covered.”

UPDATE #2: Kevin Surace, CEO, Token said this:

“What makes this incident so troubling is that this was not some mysterious new zero day attack. It was a well known, critical vulnerability rated 9.8 out of 10, which essentially means patch it urgently, and Oracle had already issued the fix. Accenture reportedly failed to implement that patch, leaving the vulnerable system exposed. ShinyHunters was likely scanning large numbers of systems looking for exactly this situation: an internet facing endpoint that remained unpatched. They found one. The attackers did not need to invent a sophisticated new technique; they simply exploited a known vulnerability that should have already been closed.

“This was an entirely preventable breach and a stark reminder that basic patch management remains one of the most important disciplines in cybersecurity.”

Leave a comment »

Hackers breached propulsion system of U.S.-bound oil supertanker

Posted in Commentary with tags , on October 5, 2026 by itnerd

The FBI and The U.S.Coast Guard investigators found evidence that hackers gained access to the digital propulsion system of the VL Prosperity, a fully loaded oil supertanker bound for Galveston, Texas, according to Bloomberg.

The hackers had temporary access to the propulsion system as the vessel approached the Texas coast this summer. Investigators have not determined how the attackers gained access, how long they remained in the system, who was responsible or what ship functions they may have been capable of controlling.

The FBI and Coast Guard boarded the VL Prosperity in August after the vessel lost communications and authorities received indications that its network had been compromised. The agencies also boarded a second vessel in the Gulf of Mexico because of a suspected cyber threat. By September, U.S. agencies were tracking cyber threats involving nearly 20 vessels around the world and had requested advance notice if any planned to enter a U.S. port. The VL Prosperity remains anchored offshore Galveston as the investigation continues.

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

“Access and control are separate findings, and the public evidence on VL Prosperity stops before engine control. If investigators can show that an intruder reached a write-capable propulsion controller and issued a valid command, this would be the first publicly documented, independently confirmed cyberattack against a commercial vessel’s propulsion controls. That is a much bigger claim than temporary access to a digital system.

“Bloomberg reports that investigators found temporary access to the tanker’s digital propulsion system. The public joint statement from the Federal Bureau of Investigation and U.S. Coast Guard says the agencies boarded the vessel to examine its information technology (IT) and operational technology (OT) systems after indications that its networks were compromised. It reports no operational disruption, vessel instability, physical danger to the crew, or environmental impact.

“That distinction matters because a propulsion-related bridge console, engineering workstation, machinery automation gateway, and engine controller are materially different findings. The U.S. Coast Guard’s 2019 response to a malware incident aboard a deep-draft vessel is the useful comparison. The malware seriously degraded the ship’s onboard computer network, but investigators found that essential vessel control systems were unaffected. Maersk made a similar distinction during the 2017 NotPetya attack, when its shore and terminal systems were disrupted while its vessels remained maneuverable.

“The closest publicly documented physical-control event was the 2013 University of Texas test that moved a yacht off course by spoofing the Global Positioning System (GPS) and inducing navigation corrections. The researchers did not control the engine. In 2025, French authorities investigated Remote Access Trojan (RAT) malware found on the Fantastic ferry, but the operator said the intrusion was neutralized without operational consequences.

“VL Prosperity could change that record. The decisive evidence is a forensic trail showing a write-capable session sent a valid command to the engine controller and that the controller accepted it. Until authorities produce that, call this a propulsion-access incident. The public record does not yet support a confirmed propulsion takeover.”

ㅤ

Damon Small, Board of Directors, Xcape, Inc.:

“The rapid escalation from a single novel maritime intrusion to federal tracking of nearly 20 compromised vessels globally directly threatens an already precarious global oil market, creating upward pressure on crude prices and downstream refined products. These supertankers operate as self-sufficient floating cities governed by complex operational technology (OT) systems that manage crew life support, navigation, and critical cargo onboarding and offboarding. Although threat actor attribution remains unconfirmed, the scale and sophistication strongly suggest coordinated state-sponsored activity targeting maritime OT.

“A widespread compromise across vessel networks could ground entire fleets or trigger catastrophic physical disruption at sea. To mitigate these systemic risks, asset owners must enforce rigorous physical and digital network segmentation between vessel bridge controls, satellite communications, and IT networks, while implementing unidirectional security gateways and mandatory anomaly monitoring across onboard industrial control systems.”

“Critical Takeaways

  • “Escalating Market Impact: Global tracking of nearly 20 compromised vessels shifts maritime cyber risk from an isolated novelty to a material supply chain threat capable of driving up global oil prices.
  • “Complex OT Vulnerabilities: Supertankers rely on interconnected OT for life support, propulsion, and cargo operations, making unauthorized access to onboard control networks potentially devastating to fleet operations.
  • “Essential Defensive Controls: Security teams must enforce strict network segmentation between bridge IT, satellite communications, and OT systems, backed by unidirectional gateways and continuous industrial network monitoring.

“Air-gapping vessel networks only works if you do not run an ethernet cable straight from the satellite dish to the propulsion engine.”

Ladies and gentlemen, we welcome you to your next high value target. The good thing is that many of the defensive strategies are pretty much the same. Therefore those should be employed ASAP.

Leave a comment »

FBI Tells ShinyHunters To Turn Themselves In

Posted in Commentary with tags , on October 1, 2026 by itnerd

From the “there’s zero chance that this will ever happen” department comes this message from the FBI to the hacker group known as ShinyHunters:

The assistant director of the FBI’s Cyber Division, Brett Leatherman, starred in a video on the FBI’s X feed on Tuesday that warned ShinyHunters members the longer they operate, the more the FBI learns about them.

And:

He also suggested the gang just give up and surrender.

“The longer you stay in this, the more we learn about you,” Leatherman warned. “You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours.”

What he’s referring to is this arrest by the group who apparently have pwned the FBI in a massive way. Now I don’t know any of the inner workings of the ShinyHnters group. But it is a pretty safe best that ShinyHunters is laughing right now. Yes, the arrest in Holland may have hurt them. But there’s not a chance that it will stop them. Chances are that they make way too much money hacking. And even a broad takedown of the group is not likely not stop them. So everyone should expect that this group will continue to hack anything and everything that they can see.

1 Comment »

The CISA, FBI warn critical infrastructure operators of third-party ICS risks

Posted in Commentary with tags , on September 24, 2026 by itnerd

The CISA and the FBI warned critical infrastructure operators about cybersecurity and supply chain risks associated with third-party industrial control system (ICS) integrators, urging organizations to limit access to operational environments and apply the principle of least privilege.

The agencies pointed to a 2025 incident in which foreign cyber actors compromised a U.S. industrial automation solutions company serving power utilities and transportation entities. The attackers searched for customer and SCADA information and created nine ZIP files containing approximately 800 files for presumed exfiltration, including customer SCADA information, ICS device details and schematics.

CISA and the FBI recommend that operators secure and monitor third-party remote access, minimize internet exposure, inventory hardware and software supplied by integrators, include cybersecurity and supply chain requirements in contracts, and maintain offline backups and manual operating capabilities.

Denis Calderone, CTO, Suzu Labs:

“The ugly side of the outsourced ICS model is the amount of trust that goes along with it. Integrators are a vital part of this ecosystem, especially for smaller operators that could never staff all of that engineering expertise themselves. The integrator needs the keys to the castle. They will be responsible for maintaining network diagrams, device configurations and SCADA details while maintaining a privileged path into the operational environment. CISA and the FBI have now documented exactly why this can be a problem and how this extension of trust directly alters the risk profile of the operator.

“The FBI has not said whether this company was selected because of its role as an integrator, but the post-compromise activity strongly suggests the actors knew what they were after. They searched specifically for ‘customers’ and ‘SCADA’ and staged roughly 800 files of device details and schematics. That is targeted intelligence collection against a company that holds a map of multiple critical infrastructure environments in one place. We have been concerned about how third-party integrators implement operational security for decades. As a professional penetration tester for more than 25 years, I have repeatedly seen integrators or all sorts (ICS, building security systems, environmental controls systems, etc) ignore basic security standards while the client fails to notice because, after all, they outsourced that headache. The more than 100 water systems compromised across the US since July illustrate the consequences of the same kinds of implementation failures. Weak or default passwords, architectures designed without meaningful isolation, little or no monitoring across ICS and SCADA networks, and PLCs placed directly on the internet where anyone can find and attack them. The fact that the integrator became the target itself is of no surprise to me.

“The way to manage this relationship is through the contract and then through audit. Put least privilege, named accounts, unique credentials, MFA, data location and retention, patching, incident notification, access termination and a right to audit into the agreement. Then verify those obligations in the environment. Inventory every component and connection the integrator supplied, inspect the remote-access logs, confirm default credentials are gone, make sure no controller is sitting on the public internet, and prove that your team can cut off the vendor, restore from a local offline backup and operate safely without them. If you cannot see, limit and terminate the integrator’s access, you have outsourced more than engineering.”

John Strand, Owner, Black Hills Information Security:

“Whenever I see stories like this, I keep coming back to the fundamentals. One of my mentors used to say, ‘Good security is nothing more than an inspired application of the fundamentals.’ And that still holds true.

“We talk about reviewing third-party access into systems, but that’s basic access control and authorization. These aren’t new security concepts. What stories like this continue to expose is just how often the fundamentals still aren’t implemented.

“For all the money we’ve spent and all the technology we’ve deployed, there are still legacy systems, legacy network connections, and old pathways into critical environments. We keep seeing the same lessons repeated because organizations haven’t fully addressed the lessons we should have learned years ago.

“The fundamentals are still fundamental. And unfortunately, we’re still failing at them.”

Critical infrastructure has been a target for threat actors forever. Now is the time to secure it. Because if not now, when?

Leave a comment »

FBI pwned by ShinyHunters

Posted in Commentary with tags on September 22, 2026 by itnerd

It’s been reported today that threat actor group ShinyHunters have said to 404 Media via the story ‘We Hacked the FBI:’ Hackers Say They Have Data on All FBI Employees:

A high profile hacking group claims it has breached multiple FBI-related services and stolen data “on all FBI employees and applicants.” A representative of the group, called ShinyHunters, told 404 Media the data includes FBI agents’ names, home addresses, phone number, and information on their spouse.

The data breach could be massively significant and may have all sorts of national security and counterintelligence implications. Criminals from the same ecosystem as ShinyHunters have previously used hacked data like phone records to track, intimidate, and harass the FBI agents investigating them. The highly sensitive data could also be a boon to foreign intelligence agencies who want to better understand how one of the most important law enforcement and intelligence agencies in the U.S. operates. And if the data fell into the hands of more criminals, FBI agents and their spouses could face serious threats to their safety.

“We hacked the FBI. We hold data on all FBI employees and applicants,” the representative of the group told 404 Media.

Denis Calderone, CTO, Suzu Labs Had This To Say:

“ShinyHunters has spent the last week picking fights. On Friday they took over Cl0p’s leak site and put up a ‘seized by ShinyHunters’ banner, and by Tuesday the same banner was on the FBI’s jobs portal. Both were framed as payback, one for threats from a rival gang and one for an FBI advisory that told victims not to pay them. The FBI hasn’t confirmed anything yet, but if this holds up, it doesn’t look like the ShinyHunters we’ve been seeing all year. Their model has always been breach, extort, then settle or leak, and that only works when the victim can pay. The FBI isn’t going to pay, and it isn’t going to pull an advisory because a criminal group demanded it. Not sure what’s going to happen in a week, but I seriously doubt the FBI will act on this threat.

“They also say this isn’t financially motivated, but I’d take that with a grain of salt. I have a hard time believing terabytes of FBI personnel data just sit on a shelf. Foreign intelligence services would love to have it, and having the FBI on their resume makes every future extortion demand more believable, and if the PeopleSoft zero-day is real, the exploit may be worth more than the data. Meanwhile, agents and their spouses could have their home addresses posted publicly within a week if this threat is followed through.

“That zero-day is where everyone else should focus, since ShinyHunters says they plan to use it more broadly. If you run PeopleSoft, don’t wait for a patch. Get it off the public internet wherever you can, put what has to stay public behind a WAF, and make sure admin components like the /PSEMHUB/ path in their screenshot aren’t reachable from outside. Hunt for the June indicators and for SSH attempts against the psoft and oracle accounts. Then ask yourself what your applicant portal can reach. At the FBI, a website built for strangers to upload resumes allegedly led straight into GovCloud.”

“Limiting your blast radius is the best precautionary play here.”

If the FBI did get pwned, then that’s a hell of a black mark on the FBI. You have to wonder what the FBI has to say about that. Let’s see if they dare to comment.

UPDATE: Another comment came in from Doc McConnell, Head of Policy & Compliance, Finite State (https://www.linkedin.com/in/doc-mcconnell)

“If the ShinyHunters hack is confirmed, this is troubling news for FBI employees and the applicants who trusted the FBI jobs portal with their sensitive information. The breach of OPM’s personnel records in 2015 resulted in a decade of credit monitoring for millions of affected individuals, and the full counterintelligence impact will likely never be known. This breach appears to contain similar data, creating potential security concerns for the victims if it is made publicly available.

“As breaches of personal data have become more common in the years since the OPM data was stolen, the public has become inured over time. But even if public response is more muted than it used to be, that does not change the obligation on the FBI throughout the investigation: clear communication to every victim explaining what data was taken, along with what actions–if any–the victims can take to protect themselves. In this case, to restore trust in its sys

Leave a comment »

Coast Guard and FBI board two U.S.-bound tankers after suspected cyberattacks

Posted in Commentary with tags on September 16, 2026 by itnerd

The U.S. Coast Guard and FBI are investigating suspected cyberattacks against at least two foreign tankers bound for the United States, according to Bloomberg.

Specialized teams boarded the vessels in the Gulf of Mexico in August after indications that their networks had been compromised by foreign cyber actors, examining both operational technology and information technology systems and working with crews to remove potential threats.

One of the vessels has been identified as the VL Prosperity, a very large crude carrier capable of transporting roughly 2.3 million barrels of oil. The tanker was reportedly attacked while traveling through the Strait of Gibraltar in early August and lost communications for more than 30 hours. U.S. authorities boarded the vessel on August 21. A second tanker targeted in a separate cyberattack was boarded on August 24 for a similar assessment.

The Coast Guard and FBI said there have been no reported operational disruptions, vessel instability, physical danger to crews or environmental impacts.

John Strand, Owner, Black Hills Information Security, Inc.:

“There’s a lot of conversation right now about attacks against operational technology, especially water and power systems, given the current geopolitical climate. But tankers are absolutely on the menu as well. What makes these environments so attractive is that much of this technology doesn’t have the same endpoint security you would expect on a Windows 11 workstation. You often don’t have EDR running on these systems. That creates a rich target for attackers because many of the defensive technologies we’ve come to rely on in traditional IT simply aren’t there.”

Dahvid Schloss, OSCP, Chief Operating Officer, Suzu Labs:

“It appears two separate claims are circulating, and they’re being treated as one. The first one is from the Coast Guard, which has acknowledged indications that the vessel’s network was compromised, with no reported operational disruptions. The other comes from Iranian media, citing a single unnamed crew member, which has alleged a much more extensive compromise involving cooling, fuel systems, and other critical elements of the vessel. Those claims have not been independently verified as of yet, so it’s important to keep your skeptical hat on. Additionally, it’s important to note that Iranian media reporting on the incident also does not establish Iranian responsibility; attribution remains unresolved.

“Regardless, this is a significant situation. A suspected compromise aboard a tanker warrants serious attention even if propulsion and other critical systems continued operating normally. The fact that the Coast Guard and FBI deployed their cyber teams to assess the vessel and remove potential threats shows the importance, even if it does not validate the more dramatic claims.

“The reported communications outage raises a separate technical question. A compromise of the communications suite, or plain RF interference, could explain a 30-hour outage without a threat actor ever touching the ship’s controls. GPS receivers and satellite terminals are chronically soft targets, and I spent enough of my military career working through degraded and jammed satellite comms to know how ordinary that failure mode is. The Strait of Gibraltar in particular is a well-documented GNSS interference corridor, so that’s a possibility I’d want investigators to rule in or out early, but an outage on its own still tells you nothing about how far an intrusion actually reached.

“I think if we take anything away from this ordeal, it is that nothing came of this compromise. No major disruption, environmental impact, or danger to the crew, and if a threat actor genuinely had control of propulsion on a fully loaded crude carrier, the obvious question is why nothing was done with it. When I’ve seen this pattern in the past, it usually points to a proof-of-concept or recon attack, more colloquially put, a rehearsal, not a performance. Now, a rehearsal for what? Can’t say, and neither can anyone else right now, but that’s for the investigators to work out. Either way, with global oil supply already at its tightest it’s been in modern history, this isn’t a low-consequence practice run.”

Damon Small, Board of Directors, Xcape Inc.:

“Physical maritime operations and global energy supply chains face severe operational risks when shipboard networks are compromised. Contrary to official statements downplaying the event, a 30-hour communications blackout on a crude carrier is a significant operational disruption. Vessels underway depend heavily on continuous communications for navigation and collision avoidance, meaning an unannounced blackout can easily precipitate a maritime disaster. Modern commercial watercraft rely on multi-channel connectivity including Very Small Aperture Terminal (VSAT), cellular, and Wi-Fi systems, making a sustained blackout indicative of critical bridge system failure. Defenders must strictly segment bridge communication links from physical operational technology domains, audit firmware across satellite hardware, and monitor for anomalous signal degradation.

“Critical Takeaways

  • Communication loss directly compromises vessel navigation, making a multi-hour blackout a primary operational threat rather than a minor IT glitch.
  • Reliance on VSAT, cellular, and Wi-Fi links requires strict logical separation to prevent lateral movement into shipboard control systems.
  • Maritime operators must treat satellite communications and bridge telemetry as mission-critical assets requiring continuous anomaly monitoring.

“Calling a 30-hour communication blackout on a crude carrier non-disruptive is like ignoring a broken ship’s wheel because the horn still works.”

It seems like threat actors may have found a new hunting ground. That is bad news for all of us.

Leave a comment »

The CISA and FBI advise organizations to drop PR spin during major IT, OT outages 

Posted in Commentary with tags , on September 3, 2026 by itnerd

The CISA and the FBI, alongside cybersecurity agencies from Australia, Canada, New Zealand and the UK, have released new guidance for communicating during major IT and OT outages, warning that poor communication can compound the operational damage caused by an incident.

The agencies specifically advise organizations to avoid PR and marketing language, clearly state what is known and unknown, and provide customers with technical and actionable information rather than vague descriptions such as “service degradation.”

The guidance recommends that organizations establish outage communication plans before an incident, including predefined thresholds for when notifications are required, designated spokespeople, backup communication channels and procedures for reaching customers, regulators and critical infrastructure operators.

During an outage, providers should explain which systems are affected, the scope and operational impact, and the known cause without speculating when an investigation is still underway. The agencies also call for continuous, time-stamped updates throughout an outage, including recovery milestones and actions being taken.

Joshua Marpet, Senior Product Security Consultant, Finite State:

“Agencies advocating clear communication with timely updates, and avoiding PR style language is great! Useless, but great. Companies will use whatever language their crisis communications firm advocates for, because that is how they avoid liability. Firms with the backbone to be open, honest, and transparent are not exactly the majority out there. Unless you have communication strategies mandated, you have an perfect example of Marpet’s law “Unless it’s mandated, or someone is paying for it, ain’t gonna happen”

“The EU CRA is a great example of mandating that type of communication. 24 hours, 72 hours, and 14 days, after an incident, there are specific types of communications with defined pieces of data you MUST give to the public and stakeholders. This is what we need, not best wishes and prayers.”

Denis Calderone, CTO, Suzu Labs:

“Let’s be honest, at a high level, none of this is new. Cross-functional incident teams, designated spokespeople, escalation paths, time-stamped updates, practice transparency. All of that has been in every incident response framework going back to NIST 800-61. Where this guidance actually adds value is in the operational specifics and the timing. It explicitly tells organizations to assume that their own telecommunications and primary communication channels may be disrupted or unreliable during a crisis. That means establishing and testing backup methods like radios, SMS phone trees, and out-of-band channels before you need them. When I run tabletop exercises for clients, one of the first things I do is take their communications down. Email is gone, Teams is gone, your status page is offline. Now coordinate your response and communicate with your customers. Most organizations completely fall apart at that point, and that is exactly the scenario this guidance is built for.

“The timing also matters. This drops alongside CISA’s CI Fortify initiative, which tells critical infrastructure operators to prepare to deliberately disconnect OT systems from third-party networks during a geopolitical crisis. If you’re a water utility or a power plant making a real-time decision about whether to isolate, you need your service providers telling you exactly what is happening and what is not happening. The guidance specifically calls for articulating “what it is and what it is not” to prevent misattribution. After the year we’ve had with attacks against water utilities, ports, power generation, and PLC suppliers, CISA clearly does not want the next big CI outage to trigger days of “was this a nation-state attack?” speculation while downstream operators are making blind isolation decisions.

“What gives this more weight than a typical government advisory is who helped write it. Microsoft, Sophos, Cloudflare, and American Water all contributed. Cloudflare’s November 2025 outage is explicitly cited as an informing event, and for good reason. Their status page went down during the incident, their own response team initially misidentified the root cause partly because of the communication breakdown, and the whole thing spiraled. The organizations that have been through it are helping write the playbook, and that gives the operational details real credibility.”

John Strand, Owner, Black Hills Information Security, Inc.:

“I think everything in this plan is great. There’s just one area I wish they would address more directly. When the decision is made to shut down network access, there need to be very clear lines defining who is authorized to make that decision and what political protections exist for the people making those calls.

“During a breach of this nature, one of the biggest communication problems is often figuring out who’s on first and who’s on second. Who can actually make the call? Who has the authority to shut down access?

“What often happens is that the decision gets escalated again and again and again until it eventually reaches a director, CEO, commissioner, or some other senior official who has enough authority to make the call. Meanwhile, valuable time is being lost.

“Incident response plans need to go deeper than motherhood and apple pie statements about communicating with customers, coordinating between organizations, and keeping everyone informed. That’s all important, but the plan needs to explicitly identify who has the authority to make the really hard decisions during an incident.

“Just as importantly, there needs to be political cover for the people who make those decisions.

“Hindsight is always 20/20. After an incident, everyone gets to sit around and analyze whether shutting something down was absolutely necessary. The person making that decision in the middle of an active breach doesn’t have that luxury.”

Notifications should never be like Apple release notes of “bug fixes and performance improvements”. They should have clear communication in them 100% of the time. Organizations need to work on that now.

Leave a comment »

Chinese hacking platform takedown exposes an ORB network hiding in your routers 

Posted in Commentary with tags , on August 27, 2026 by itnerd

The DOJ and FBI just disrupted QTFY, a Chinese state-linked hacking platform built around QScan, which scanned the internet for vulnerable IoT and SOHO devices, and QTRouter, which enrolled those devices into an obfuscation mesh to hide attacker traffic. Authorities seized the domains hard-coded into the malware, making the tooling inoperable across every operation that relied on it, not just one campaign. The FBI also flagged business ties between the company behind QTFY and groups like Salt Typhoon and i-Soon.

Josh Picolet, VP of Detection & Analysis, Team Cymru had this to say:

“QTFY is a useful case study in how state-linked contracting networks actually operate. The detail worth noting is what QScan was built to do. It scanned the internet, likely in a very targeted manner, for vulnerable IoT/SOHO devices and enrolled them into QTRouter, the layer that hid the actual operations behind a mesh of compromised hardware. That is the operating model of an ORB network, an operational relay box mesh assembled from hijacked edge devices, and it is exactly the type infrastructure ecosystem we have been tracking at Team Cymru for years. QTFY is one network in a much larger pattern. Turning routers, IoT gear, and SOHO devices into an obfuscation layer for attacker traffic is not a one-off tactic bolted onto a single contractor. It is how China’s freelance hacking and contracting market has learned to work, and the business ties noted here to Salt Typhoon and i-Soon are the visible edge of a quartermaster model that resells capability and access across many customers.

That model is also why the takedown landed the way it did. The domains were hard-coded into the malware for communication and authentication, so seizing that infrastructure made the tooling inoperable across every operation depending on it, not just one intrusion. Detection built around a single campaign’s indicators would never have surfaced a platform built to be shared across operators. What exposes infrastructure like this is the ability to detect the shared obfuscation layer underneath the operations, recognizing the mesh as a repeatable tradecraft pattern rather than a scatter of unrelated victims.

Defenders should not expect this one to fade. The quartermaster model and the compromise of edge devices for obfuscation will be fought for years to come. We track a large number of these ORB mesh networks, and the modus operandi across them is remarkably consistent. That is why we tag and track every model of router, IoT, and SOHO device we can observe, so these networks can be detected early and customers get a real risk level on the IPs involved. Organizations in defense, telecom, and critical infrastructure should be asking whether their own detection reaches that layer, well past the perimeter.”

Disruptions like this are good. But what will really solve the issue is going after the people behind these schemes and bringing them to justice. That way the profitability gets taken out of activities like these.

Leave a comment »

The FBI created its own crypto token to catch a $7.5 billion pump-and-dump fraud ring

Posted in Commentary with tags on August 26, 2026 by itnerd

A UK judge rejected Manpreet Kohli’s fight against extradition to the US on wire fraud and market manipulation charges tied to Saitama, an Ethereum-based token he led that peaked at a $7.5 billion market value, with prosecutors alleging he and more than a dozen co-conspirators publicly claimed to be holding and buying the token while privately selling their own holdings for millions in profit. The case marks the first known instance of the FBI creating its own digital token specifically to investigate this kind of fraud, and Kohli’s case now goes to UK ministers to decide on extradition, with Kohli free on £200,000 bail and able to appeal.

More details here: Cryptocurrency chief facing extradition from UK to US on fraud charges – Yahoo News Canada

Jason Brown, Director of Counter Fraud Operations, iCOUNTER:

“A token does not reach a $7.5 billion valuation in isolation. The activity moved through market makers, exchanges, wallets, and counterparties. That is the third-party problem in one sentence, and it is why detection has to start outside your perimeter.

What’s notable in this case is how the FBI worked the whole ecosystem, not just the issuer. Prosecutors say Kohli and his co-conspirators publicly claimed to be holding and buying Saitama tokens while privately selling their own holdings for millions in profit. Kohli alone is alleged to have made around $20 million. That’s a classic pump-and-dump dressed up in crypto terminology. But the same investigation went after the market makers hired to manufacture the volume, and to reach them the FBI stood up its own token, NexFundAI, and watched firms like ZM Quant and CLS Global manipulate it in real time. Trading was disabled before retail investors were exposed. The issuer and the vendors were two halves of one campaign, and neither half was visible from inside a single platform.

That’s the lesson for anyone running fraud detection today, in crypto or otherwise. The Saitama token itself was never the crime scene. The crime happened in the gap between what was said publicly and what was done privately across wallets and counterparties, and you only see that gap if you’re watching the full network, not just the asset. A $7.5 billion valuation built on that kind of coordinated deception should be a wake-up call for anyone who thinks perimeter-level monitoring of a single platform or exchange is sufficient. It isn’t. The fraud is distributed by design, and the detection has to be too.”

Fact: Every one of these people need to be extradited to face the legal system (such as it is in the US). That is the only way that bad guys will stop doing bad things.

Leave a comment »

« Older Entries