The IT Nerd

This morning, minutes ago, threat intelligence firm Flashpoint released a new report titled “The Flashpoint Method for Threat-Informed Vulnerability Prioritization.”  

The guide provides security teams with the following: 

1. A clear framework for assessing which vulnerabilities demand immediate attention and why.
2. A checklist of key prioritization criteria based on real-world exploitation, business impact, and threat intelligence.
3. Insights into how Flashpoint’s vulnerability intelligence platform and analyst expertise can help put threat-informed vulnerability management into action, at scale.

As organizations expand their digital footprints, the number of vulnerabilities discovered each year climbs, growing faster than the ability of most security teams to respond effectively. With more than 31% of vulnerabilities rated high or critical using CVSSv3, and exploit code publicly available for nearly 42% of all disclosures, teams that rely solely on severity scores realize that it is no longer enough. 

This guide offers a smarter, data-driven approach that helps security teams focus on the vulnerabilities that pose the greatest real-world risk to their specific organizations. Backed by Flashpoint’s proprietary intelligence, this method moves beyond static scoring to incorporate exploit activity, threat actor behavior, business context, and more – so you can cut through the noise and take decisive action faster. 

There will be a two-part blog series as part of the release with the first blog post live at this link.

Today, threat intelligence firm Flashpoint released a new report titled AI and Threat Intelligence: The Defender’s Guide. Between January 1 and May 30, 2025, Flashpoint analysts observed more than two and a half million AI-related posts: jailbreak prompts, deepfake service ads, phishing toolkits, and bespoke language models built for fraud and cybercrime. For security and intelligence teams, the question isn’t just how AI is being used—it’s how that activity changes their own risk assessments, workflows, and priorities.

Developed to help practitioners understand how AI is reshaping threat intelligence for both attackers and defenders, the guide looks to help answer:

• What should cybersecurity leaders be asking themselves right now?
• Where does AI create real opportunity? 
• Where does it introduce risk or operational blind spots? 
• And how can defenders adopt AI without getting swept up in the hype?

Additionally, the report includes the below topics:

• Adversarial Innovation: How Threat Actors Are Evolving with AI
• The Defender’s AI Advantage: How Security Teams Are Responding
• Myth vs. Reality: Cutting Through the Noise on AI in Threat Intelligence
• The Bigger Picture: Strategic Takeaways for Security and Intelligence Leaders
• What Comes Next: Turning Intelligence + AI Into Action
• Glossary: AI and Threat Intelligence Terms to Know

The report also includes findings on the following:

• The top observed 10 malicious LLMs
• AI advertisements on Telegram
• Prompt engineering as a service 

The Flashpoint team posted a blog post about the report here.

I’ve just read a report from Flashpoint that sent a chill down my spine. It’s not available to the public, but let me detail what I read.

The brief that I read provides details on the websites “Luigi was right” and “The CEO Database” sharing the business and personally identifiable information of CEOs and executives from more than 1,000 companies. With this information, threat actors could conduct further searches on open-source platforms or paid data aggregator sites and potentially gain access to additional personally identifiable information (PII). One thing to note is that both websites were created by the same person or persons who have gone as as far as to ask for donations.

The websites are almost certainly referring to Luigi Mangione, the individual accused of fatally shooting UnitedHealthcare CEO Brian Thompson in December 2024. As of May 29, the “Luigi was right” site appeared to be taken down; however, portions of the data were still available via the Wayback Machine archive. “The CEO Database” was still live however.

Analysts assess that this list does not likely pose a significant physical threat to the named executives; however, potential threat actors could use the provided LinkedIn accounts to gather more information or the listed phone numbers to harass executives. Reverse phone number searches on paid data aggregator websites could potentially allow threat actors to gain additional personally identifiable information, such as residential addresses and family members.

Flashpoint obtained the full list of companies and named executives and is sharing that information with those impacted. Which is good. But the fact that these websites were even created is scary. And it highlights the need for better control of personally identifiable information.

I wanted to highlight a blog that Flashpoint published today about the European Vulnerability Database (EUVD).

The blog offers commentary about the following:

• Can the EUVD replace the DVE ecosystem?
• Was the release of EUVD fueled by MITRE funding uncertainty?

The blog is located here.

 Flashpoint just announced that it has hit 400,000 vulnerability disclosures making it the world’s most comprehensive, timely, and actionable source of independently curated vulnerability intelligence.

The blog is here: https://flashpoint.io/blog/flashpoints-vulndb-milestone-intelligence-innovations/.

The milestone is a testament to Flashpoint’s long-term commitment for providing independently curated vulnerability intelligence without the limitations, delays, and coverage gaps of public programs such as the Common Vulnerabilities and Exposures (CVE) and the National Vulnerability Database (NVD) programs.

Threat data and intelligence firm Flashpoint just released a report and blog on the Top Ransomware Groups Targeting the Healthcare Sector.

By industry in 2024, healthcare (11.5%) sustained the fourth most ransomware attacks behind Technology (24.6%), Manufacturing (18.3%), and Retail (12.3%). Almost every organization in the healthcare industry contains highly sensitive information such as patient data, treatment documentation, and financial records linked to patient insurance.

The blog hits on Ransomware-as-a-service and top ransomware groups from Jan-April 2025. If you’re in healthcare, you need to read this ASAP.

This morning Flashpoint announced the release of new robust capabilities to its flagship platform, Flashpoint Ignite, at the RSA Conference 2025.  These newest AI-powered Ignite innovations will address a growing need: making threat intelligence more usable, intuitive, and aligned to how teams actually work enabling them to reduce friction and extract more value from their threat intelligence.

Specifically, the new Ignite features include artificial intelligence (AI)-powered risk discovery, curated threat feeds, asset-centric intelligence, and on-demand expansion of highly relevant data sources. These innovations are uniquely designed to deliver the most actionable insights that are precisely aligned with customers’ threat and intelligence needs, enabling organizations to make informed decisions and protect their most critical assets.

You can get more details here.

Flashpoint just published a blog about AgeoStealer. Which is an Infostealer.

Infostealers have proven to be a gold mine for threat actors, responsible for stealing 75%—or 2.1 billion—of 2024’s 3.2 billion total credentials, fueling a constant cycle of account takeover attacks, ransomware, and high-profile data breaches. In our 2025 Global Threat Intelligence Report, we detailed their meteoric rise as a primary threat vector, with our analysts tracking over 24 unique stealer strains—such as RedLine, RisePro, and Lumma Stealer—being listed for sale on illicit marketplaces. Now, organizations will need to add AgeoStealer to their watch list as cybercriminals exploit the immense popularity of gaming.

You can read about this infostealer here: : https://flashpoint.io/blog/ageostealer-how-social-engineering-targets-gamers/.

Flashpoint just made available a Tax Fraud Threat Landscape report that covers the sharp increase in cybercriminal tax refund fraud schemes just as millions of Americans navigate tax season.

Flashpoint analysts have observed widespread discussions among fraud communities—especially on Telegram and Dark Web forums—about tactics to steal personally identifiable information (PII), file fraudulent returns, and cash out IRS refunds before the real taxpayer ever files.

Some of the most concerning trends include:

• Exploitation of identity verification systems like ID.me, with fraudsters leveraging stolen selfies, forged documents, and social engineering tactics.
• A marketplace for “fullz”—complete PII packages—used to impersonate victims and file fake returns via popular tax prep services like TurboTax and H&R Block.
• Targeted abuse of government programs, such as the Employee Retention Credit and the California Middle Class Tax Refund.
• Disaster-related fraud, with actors already exploiting aid programs linked to the 2025 LA wildfires.

Telegram remains a major hub for fraud coordination, with thousands of posts sharing step-by-step “sauce” and tutorials. Screenshots of six-figure IRS refunds are common, many accompanied by sales pitches for methods to bypass verification letters and fraud detection systems.

Flashpoint analysts also highlight in the report emerging schemes involving romance scams, job ads, and phishing campaigns—many designed to coax ID.me credentials and IP PINs directly from victims.

You can read the report here: https://flashpoint.io/blog/four-steps-of-tax-refund-fraud/

Protecting today’s corporate executive has become more complex and unpredictable than ever.  In today’s evolving security landscape, executives are facing an unprecedented convergence of digital and physical threats. Doxxing, swatting, misinformation, and geopolitical targeting are no longer isolated risks.

To help security teams stay ahead, Flashpoint just released The Complete Guide to OSINT for Executive Protection—a 20-page comprehensive resource for security professionals, executive protection teams, and corporate risk leaders. This guide was purpose-built to help these teams and leaders harness OSINT to strengthen protection strategies. It offers practical strategies and real-world insights on leveraging Open-Source Intelligence (OSINT) to:

• Identify and assess the full range of modern executive threats
• Implement proactive security measures based on best practices and real world examples to mitigate risks
• Leverage AI-driven OSINT tools for real-time threat analysis

A blog post on this is here.