01
29 July 2026 · 14 min read
Flying Eagle Android RAT traced across 170 servers
Researchers found Flying Eagle Android RAT infrastructure fingerprints on 170 servers. We analyse scope, capabilities, detection and response.
Topic · 43 articles
Threats and Incidents
Current campaigns, ransomware, malware, breaches and incidents with impact assessment, detection signals and practical response actions.
FIELD NOTES
TOPIC INDEX
Latest research
02
29 July 2026 · 14 min read
Fake recruitment installed persistent malware on macOS
A real LinkedIn recruitment incident led to a DMG, LaunchAgent and in-memory JXA. We explain the chain, impact, detection and response.
03
28 July 2026 · 12 min read
Cyberattack targets more than 30 Minnesota water systems
A coordinated cyberattack reached technology at more than 30 Minnesota water systems. We separate confirmed impact from speculation and outline OT/SCADA priorities.
04
28 July 2026 · 13 min read
Mirage Kitten deploys NightLedger and WebSocket tunnelers
Kaspersky uncovered new Mirage Kitten tools: the NightLedger backdoor and ArcBridge and BridgeHead tunnelers. We analyse the techniques and detection.
05
27 July 2026 · 17 min read
JadePuffer: the first ransomware run by an AI agent
Sysdig documented JadePuffer — the first ransomware attack carried out end to end by an LLM agent. We analyse the chain and what defenders should do.
06
27 July 2026 · 17 min read
Spirals: from web shell to encryption in under a day
Spirals ransomware encrypted an IT firm's network in under 24 hours. We break down the attack timeline and show where it could have been stopped.
07
26 July 2026 · 16 min read
NAIC and the PeopleSoft 0-day: when the regulator is breached
A 0-day in Oracle PeopleSoft (CVE-2026-35273) hit 100+ organisations including NAIC. Analysis, and a lesson in reading extortion groups' claims.
08
25 July 2026 · 14 min read
Fairlife: the ransomware attack that stopped production
The Anubis attack on Coca-Cola's Fairlife halted US production, and entry came through a third party. An analysis of an OT incident and SEC disclosure.
09
24 July 2026 · 8 min read
Dolphin X: an infostealer that profiles victims with AI
Dolphin X steals data from over 300 applications and advertises AI victim profiling. We separate the confirmed analysis from the criminals' marketing.
10
24 July 2026 · 8 min read
JadeProx and TriBack: an APT campaign on government and health
Group-IB detailed a China-nexus operation, JadeProx, and the TriBack loader, exposed via a misconfigured cloud server. Targets, techniques and defensive lessons.
11
23 July 2026 · 8 min read
msaRAT: Chaos ransomware hides its C2 in the browser
Cisco Talos detailed msaRAT — a Chaos-group trojan that runs C2 through Chrome/Edge and WebRTC to evade network detection. We explain the mechanism and defence.
12
23 July 2026 · 8 min read
Zimbra CVE-2025-66376: a mail espionage campaign
A joint government advisory detailed a campaign abusing an XSS in Zimbra (CVE-2025-66376) to steal mail, passwords and 2FA codes. Who it hits and what to do.
13
22 July 2026 · 15 min read
SOC Analyst Skills: What You Need to Know
Build essential SOC analyst skills in triage, logs, SIEM, networking, detection, incident response, communication, and portfolio evidence.
14
20 July 2026 · 17 min read
HOLLOWGRAPH Hides Malware C2 in Microsoft 365 Calendars
HOLLOWGRAPH uses Microsoft Graph, 2050 calendar events and DNS tunneling for C2 and exfiltration. Review confirmed TTPs, IOCs and detection.
15
19 July 2026 · 16 min read
GigaWiper: Inside the Destructive Windows Backdoor
GigaWiper combines remote access, espionage and three data-destruction paths. Review confirmed IOCs, detection logic and a Windows recovery plan.
16
13 July 2026 · 10 min read
FSB Center 16 targets routers: joint warning from NSA, CISA and Poland's SKW
Authorities warn that Russian actors are exploiting poorly secured routers. Review the observed risk, hardening priorities and an evidence-led edge-device checklist.
17
10 July 2026 · 9 min read
Operation Endgame disrupts three major malware networks
Operation Endgame targeted 326 servers and 142 domains linked to SocGholish, Amadey and StealC. What the action achieved and defenders should do.
18
8 July 2026 · 10 min read
Incident response tabletop exercise: a practical guide
Run a tabletop exercise that exposes response gaps without disrupting production. Design scenarios, injects, decisions and corrective actions.
19
8 July 2026 · 11 min read
SIEM vs XDR vs EDR: differences and the right choice
Compare SIEM, XDR and EDR across telemetry, detection, retention, response and cost, then design an architecture without duplicate alerts and data.
20
6 July 2026 · 10 min read
Cyber threat intelligence: a practical CTI lifecycle
Cyber threat intelligence turns threat data into decisions. Build requirements, sources, analysis, distribution and metrics for an effective CTI loop.
21
5 July 2026 · 10 min read
Hotres Data Breach: Lessons for Hotels and Their Technology Providers
A SQL injection reached guest data held for thousands of Polish hotels. Learn what reportedly leaked, why authenticated access is no defence and how guests, hotels and SaaS providers should respond.
22
5 July 2026 · 9 min read
Purple teaming: connect attack, detection and defence
Purple teaming turns adversary techniques into measurable detection tests. Scope exercises safely, improve controls and prove the gaps are closed.
23
2 July 2026 · 9 min read
Ransomware in Europe 2026: manufacturing hit hardest
Black Kite reports disclosed ransomware in Europe rose 55% in 2026, with manufacturing the top target. What it means for companies across the EU.
24
30 June 2026 · 12 min read
Incident Response Plan: What to Prepare Before an Attack
Improvising during an incident costs the most. We show NIST's six phases of response, ready-made playbooks, and what to prepare before the phone rings.
25
21 June 2026 · 12 min read
Security monitoring for SMEs: where to start
You don't need a million-dollar SOC to detect attacks. How a mid-sized company builds monitoring: what to log, what to alert on, when to get help.
26
12 June 2026 · 9 min read
Conduent breach: 62M people and third-party risk
A ransomware attack on Conduent exposed data on 62M+ people. What it says about third-party risk and what to do when a processor holds your data.
27
11 June 2026 · 10 min read
Infostealers: the malware that steals all your passwords
Infostealers are the most common malware stealing passwords, cookies and wallets. How they infect, why they bypass MFA and how to protect yourself.
28
9 June 2026 · 12 min read
Ransomware: how to actually defend, not just pay
Ransomware attacks rarely start with encryption. We break the attack chain into its parts and show where it's cheapest to break it.
29
6 June 2026 · 12 min read
Backups: the 3-2-1 strategy in practice
A backup nobody has tested is just an assumption. The 3-2-1 rule, immutable copies that survive ransomware and restores that actually work.
30
22 May 2026 · 9 min read
Has my data leaked? How to check and what to do
Your passwords and data are almost certainly in some breach. How to check it safely, what a leak really means and what steps to take.
31
6 May 2026 · 11 min read
Data breach: the first 72 hours decide everything
What to do when a data breach happens — from confirming the incident, through limiting the impact, to GDPR obligations.
32
2 May 2026 · 22 min read
Detection engineering with Sigma: SIEM rule lifecycle
Engineer reliable Sigma rules for SIEM: hypotheses, logsource contracts, correlation, filters, backend tests, tuning, metrics and purple-team validation.
33
1 May 2026 · 20 min read
DNS tunneling detection: identify DNS C2 and exfiltration
Detect DNS tunneling and C2 beaconing through label entropy, query length, NXDOMAIN ratios, record types, timing and endpoint-to-resolver correlation.
34
10 April 2026 · 7 min read
The ransomware wave hitting Polish hospitals in 2026
In spring 2026 several Polish hospitals were hit by ransomware in quick succession. Why healthcare is a target and how to limit the impact.
35
10 March 2026 · 10 min read
Teenagers sold DDoS attacks: Poland's booter-as-a-service case
Polish cybercrime police identified seven minors who allegedly sold DDoS tools. We explain booter infrastructure, evidence and resilient service design.
36
3 March 2026 · 18 min read
Coruna: five iOS chains and 23 exploits targeting iPhones
Technical Coruna exploit-kit analysis: WebKit RCE, PAC/PPL bypasses, ChaCha20 blobs, PlasmaLoader, seed-phrase theft, Lockdown Mode and hunting.
37
17 February 2026 · 11 min read
Phobos ransomware arrest in Poland: how the RaaS supply chain works
Polish cybercrime police detained a 47-year-old suspected of handling tools and access data and communicating with Phobos. A technical RaaS ecosystem analysis.
38
10 February 2026 · 10 min read
Polish water utility attack: technical account risk
Polish cybercrime police detained a water utility breach suspect. We analyse the technical account, darknet publication and critical-infrastructure controls.
39
5 February 2026 · 7 min read
Attack on the energy sector and NoName057 DDoS
A destructive attack on Poland's energy sector and pro-Russian DDoS show critical infrastructure is a target — what it means for companies.
40
14 January 2026 · 12 min read
RedVDS disrupted: cloned Windows fueled global phishing
Microsoft and law enforcement disrupted RedVDS. We analyse 7,300 IPs, homoglyph domains, a shared Windows image and behaviour-based cybercrime detection.
41
18 December 2025 · 10 min read
Cyberattacks on Poland in 2025: what the year showed
2025 was a record year for Poland: attacks on hospitals, DDoS on infrastructure and disinformation. We summarise the threats and lessons for businesses.
42
13 May 2025 · 10 min read
Scattered Spider: the call that took down retail
In 2025 Scattered Spider paralysed UK retail. The weapon wasn't a 0-day but a helpdesk call. We break down the technique and the defence.
43
24 February 2025 · 10 min read
The Bybit heist: $1.5bn and a cold-wallet lesson
In February 2025, $1.5bn in crypto vanished from Bybit. We break down the Lazarus attack and what failed despite a cold wallet.
BR / NEXT STEP
Want to prepare your team for these threats?
We turn current threats into role-based training, safe exercises and a clear reporting path. The free Academy remains available for self-directed learning.
NDA · clear scope · direct communication