Newsletters

Last week, The Grugq and I travelled to Estonia for CyCon, NATO CCDCOE's conference on Cyber Conflict. Our biggest takeaway from the conversations we had there is that NATO, unsurprisingly, is well prepared for one-off, large-scale military attacks. But it is failing to counter small, unremitting cyberattacks, and this needs to change.

NATO was created to deter the Soviet Union from military aggression. It still defines itself as a defensive alliance that can deliver a "resounding response" in the event of an unlikely but devastating Russian military attack.  

Russian cyber operations, however, are continuous and conducted well below the threshold of armed conflict. Individual operations just aren't damaging enough to attract a robust response. These continuous aggressive incursions are favoured by states like Russia and China as a way to harass their adversaries during peacetime. 

One in every ten new domains registered in 2025 were linked to malicious activity and were eventually added to one or more cybersecurity blocklists.

A total of 84,961,989 domains were created last year and 8,496,811 were later added to a blocklist, according to an Interisle report published on Monday.

Researchers believe the actual number of malicious domains may be double that, at around 16.8 million, with new domains expected to be blacklisted once they are deployed in operations in the wild later on.

The Russian government has greatly expanded the amount of personal and technical data that mobile operators and internet service providers must collect from their customers and share with state authorities.

This data collection is part of a surveillance system used in Russia named SORM, which stands for the System for Operative Investigative Activities. SORM works through special equipment installed at local telcos that collects data on the company's traffic and uploads it to a government database where the police and intelligence services can query it for their investigations.

Over the years as networking equipment has become more powerful, SORM has been slowly updated with new collection rules that telcos must comply with or face a fine.

Dutch authorities have conducted one of the largest-ever malware disruptions and took down a botnet that infected more than 17 million devices across the world.

The botnet was made up of computers, tablets, and smartphones that had been used to send out spam emails, phishing lures, and carry out DDoS attacks.

Dutch Police and the country's national cybersecurity agency seized more than 200 servers at a local provider, servers that had been used to grow and control the botnet.

A major bug has been disclosed in a little known middleware component used in many AI server infrastructure products.

Codenamed BadHost (and tracked as CVE-2026-48710), the vulnerability impacts Starlette, a lightweight Python framework for building asynchronous web services.

In the simplest way to explain it, the bug can allow attackers to trick servers into thinking they want to access a public URL and there's no need to authenticate. In reality, the attackers get connected to private endpoints from where they can download or harvest sensitive data or tell the server to perform malicious actions.

Six weeks after it launched Project Glasswing and its Mythos cybersecurity model, Anthropic says researchers and partners have found more than 23,000 vulnerabilities across more than 1,000 open-source projects.

Analysis is still ongoing, but the company claims that more than a quarter (6,202) of the found bugs (23,019) received or are suspected of having a high or critical severity rating, confirming they are real issues and not just random vulnerability scanning chaff.

More than 1,500 of these critical bugs have been confirmed to be legitimate issues and almost 100 have already received patches. Anthropic expects the 1,500 confirmed figure to go as high as 3,900.

Microsoft is phasing out SMS as a multi-factor authentication and account recovery option for personal Microsoft accounts.

All users will be prompted to add a passkey the next time they log into their accounts.

The company said SMS was a leading source of fraud and the most targeted vector for account takeover.

European governments are trying to move their politicians away from encrypted messaging apps like Signal and WhatsApp and towards sovereign encrypted messaging solutions. This won't be as safe and secure as they think it will, but at least they'll have sovereign control. 

Back in 2020, the European Commission (EC) told its staff that Signal had been "selected as the recommended application for public instant messaging". The idea at the time was it would be used for communications between staff and people outside the Commission. There were already encrypted ways to send sensitive information internally, like encrypted internal email, but they were relatively inconvenient and clunky.

Signal is easy, and adopting it for that relatively narrow use case was a good thing. From a security point of view it was a massive step up from alternatives such as SMS or email, which are more vulnerable to interception and keep plaintext copies lying around on servers. 

Microsoft has sued and seized domains and server infrastructure belonging to SignSpaceCloud (signspace[.]cloud), a Russian cybercrime service that sold code signing certificates to malware and ransomware gangs.

The service, which Microsoft is tracking as Fox Tempest, has been running since May of last year and is what cybersecurity experts call a malware-signing-as-a-service (MSaaS).

The group used hundreds of fake accounts on the Microsoft Artifact Signing service to obtain code signing certificates that it later resold on its website for thousands of US dollars.

Indonesia is emerging as a new hub for cyber scam operations and illegal online gambling in Southeast Asia after massive crackdowns in neighboring countries have sent criminal groups fleeing across borders and seeking to relocate facilities.

Local authorities have detained more than 550 suspects following three raids this month alone.

More than 200 suspects were detained after a raid on an apartment complex in the city of Batam on May 6. Another 321 were arrested in a commercial building near Jakarta's Chinatown neighborhood on May 10. Another 30 were then detained at guest houses on the island of Bali a few days after.