In this week’s edition of Risky Business Dmitri Alperovitch and Adam Boileau join Patrick Gray to talk through the week’s news, including:

• EXCLUSIVE: A Scattered Spider-style crew is hijacking DNS MX entries and compromising enterprises within minutes
• The SVG format brings the all horrors of HTML+JS to image files, and attackers have noticed
• Brian Krebs eats a 6.3Tbps DDoS … ‘cause that’s how you demo your packet cannon
• Law enforcement takes out Lumma Stealer, Qakbot, Danabot and some dark web drug traffickers
• Iranian behind 2019 Baltimore ransomware mysteriously appears in North Carolina and pleads guilty
• CISA’s leadership is fleeing in droves, even though the US needs them more than ever.

This week’s episode is sponsored by Thinkst Canary. Long time friend of the show Haroon Meer joins and talks through where he feels the industry is at, having just returned home from the AI-fueled hype at this year’s RSA conference.

Show notes:

China-linked ‘Silk Typhoon’ hackers accessed Commvault cloud environments, person familiar says - Nextgov/FCW https://www.nextgov.com/cybersecurity/2025/05/china-linked-silk-typhoon-hackers-accessed-commvault-cloud-environments-person-familiar-says/405579/

Risky Bulletin: SVG use for phishing explodes in 2025 - Risky Business Media https://risky.biz/risky-bulletin-svg-use-for-phishing-explodes-in-2025/

KrebsOnSecurity Hit With Near-Record 6.3 Tbps DDoS – Krebs on Security https://krebsonsecurity.com/2025/05/krebsonsecurity-hit-with-near-record-6-3-tbps-ddos/

Midwestern telco Cellcom confirms cyber incident after days of service outages | The Record from Recorded Future News https://therecord.media/midwestern-cellcom-telcom-cyberattack

Microsoft leads international takedown of Lumma Stealer | Cybersecurity Dive https://www.cybersecuritydive.com/news/microsoft-takedown-lumma-stealer/748727/

Who said what? on X: “Message from the administrator of Lumma Stealer on the forums about the recent events🕊️👀 https://t.co/MOjCSMMErK” / X https://x.com/g0njxa/status/1925905296137838626?s=46&t=VLIuBKdOq3MvRk4IpV-_-A

Ransomware hackers charged, infrastructure dismantled in international law enforcement operation | The Record from Recorded Future News https://therecord.media/hackers-charged-infrastructure-dismantled-operation-endgame

Oops: DanaBot Malware Devs Infected Their Own PCs – Krebs on Security https://krebsonsecurity.com/2025/05/oops-danabot-malware-devs-infected-their-own-pcs/

DOJ charges man allegedly behind Qakbot malware | The Record from Recorded Future News https://therecord.media/doj-charges-man-allegedly-behind-qakbot-malware

US, Europol arrest 270 dark web drug traffickers in Operation RapTor | The Record from Recorded Future News https://therecord.media/global-law-enforcement-arrest-270-tied-to-dark-web-drug-sales

Iranian pleads guilty to launching Baltimore ransomware attack, faces 30 years behind bars | The Record from Recorded Future News https://therecord.media/iranian-years-decades-guilty-ransomware

Decentralized crypto platform Cetus hit with $223 million hack | The Record from Recorded Future News https://therecord.media/decentralized-crypto-platform-cetus-theft

Nearly 70,000 impacted by Coinbase breach involving $20 million ransom demand | The Record from Recorded Future News https://therecord.media/nearly-70000-impacted-coinbase-breach

USA: Crypto investor charged with kidnapping, torturing man in an NYC apartment https://www.9news.com.au/world/usa-new-york-crypto-investor-is-charged-with-kidnapping-and-torturing-a-man/9756fcd9-1e8f-4895-9407-bac5ef0048bd

Vietnam orders ban on Telegram messaging app over security concerns | The Record from Recorded Future News https://therecord.media/vietnam-orders-telegram-messaging-ban

Exclusive: Hacker who breached communications app used by Trump aide stole data from across US government | Reuters https://www.reuters.com/world/us/hacker-who-breached-communications-app-used-by-trump-aide-stole-data-across-us-2025-05-21/

CISA loses nearly all top officials as purge continues | Cybersecurity Dive https://www.cybersecuritydive.com/news/cisa-senior-official-departures/748992/

White House dismisses scores of National Security Council staff - The Washington Post https://www.washingtonpost.com/national-security/2025/05/23/national-security-council-trump-rubio/