Sign in Subscribe
InfoSources
InfoSources is a cybersecurity intelligence briefing focused on cybercrime, cyberwarfare, and digital espionage. Trusted by decision-makers worldwide.

Featured articles

Three Russian Clusters, One Playbook: How Moscow's Spies Turned Login Screens Into Listening Posts- 340

Three Russian Clusters, One Playbook: How Moscow's Spies Turned Login Screens Into Listening Posts- 340

Medusa's Affiliate Model Hits Full Stride: 500 Critical-Infrastructure Victims and a Hint of Cracks Beneath- 339

Medusa's Affiliate Model Hits Full Stride: 500 Critical-Infrastructure Victims and a Hint of Cracks Beneath- 339

A Chinese Ransomware Crew Swaps Tools, Not Tactics: Storm-1175's Pivot to StormEncryptor Exposes the Fragility of the MSP Layer- 338

A Chinese Ransomware Crew Swaps Tools, Not Tactics: Storm-1175's Pivot to StormEncryptor Exposes the Fragility of the MSP Layer- 338

The Browser Is the Cover: Inside BlueDelta's HOOKEDGE Campaign Against European Diplomacy- 337

The Browser Is the Cover: Inside BlueDelta's HOOKEDGE Campaign Against European Diplomacy- 337

Dark Caracal Puts a Smart Contract to Work: Blockchain as a Fallback Channel for an Old Lebanese Espionage Toolkit- 336

Dark Caracal Puts a Smart Contract to Work: Blockchain as a Fallback Channel for an Old Lebanese Espionage Toolkit- 336

SilkParasite and the Discipline Problem: What Happens When Chinese Espionage Actors Use AI to Get Better, Not Just Faster- 335

SilkParasite and the Discipline Problem: What Happens When Chinese Espionage Actors Use AI to Get Better, Not Just Faster- 335

SilkParasite and the Discipline Problem: What Happens When Chinese Espionage Actors Use AI to Get Better, Not Just Faster- 335

The Swarm That Wasn't Supposed to Exist: How OpenAI's Own Agents Coordinated a Breach of Hugging Face- 334

The Swarm That Wasn't Supposed to Exist: How OpenAI's Own Agents Coordinated a Breach of Hugging Face- 334

Washington Dismantles a Chinese Hacking-as-a-Service Network — Then Walks Back Its Own Words- 333

Washington Dismantles a Chinese Hacking-as-a-Service Network — Then Walks Back Its Own Words- 333

Berlin's No: A Ransomware Extortion Collides With a State Election- 332

Berlin's No: A Ransomware Extortion Collides With a State Election- 332

A Federal Law Enforcement Agency Learns of Its Own Breach From a Leak Site- 331

A Federal Law Enforcement Agency Learns of Its Own Breach From a Leak Site- 331

When Medical Device Makers Become the Third Domino- 330

When Medical Device Makers Become the Third Domino- 330

The Airport That Underestimated Its Own Breach- 329

The Airport That Underestimated Its Own Breach- 329

Finland Cuts One More Cord to Russia, and Nobody's Quite Sure What's Attached to It- 328

Finland Cuts One More Cord to Russia, and Nobody's Quite Sure What's Attached to It- 328

Britain's Next War Won't Be an Away Game: A Former Spy Chief on Cyber Campaigning- 327

Britain's Next War Won't Be an Away Game: A Former Spy Chief on Cyber Campaigning- 327

Signal Adds a Silent Witness: A New Feature Closes a Key-Swap Loophole- 326

Signal Adds a Silent Witness: A New Feature Closes a Key-Swap Loophole- 326

From Leaked Code to RaaS Empire: Inside the Gunra Ransomware Warning- 325

From Leaked Code to RaaS Empire: Inside the Gunra Ransomware Warning- 325

The Slow Breach: How Long an Attacker Sat Inside South Korea's Diplomatic Training Academy- 324

The Slow Breach: How Long an Attacker Sat Inside South Korea's Diplomatic Training Academy- 324

No Single Actor Controls Enough to Be Deterred: Why Law Enforcement Keeps Losing the Cybercrime Race- 323

No Single Actor Controls Enough to Be Deterred: Why Law Enforcement Keeps Losing the Cybercrime Race- 323

Angola's Biggest Carrier Picked the Worst Possible Day to Get Hacked- 322

Angola's Biggest Carrier Picked the Worst Possible Day to Get Hacked- 322

One Click From a Forged Signature: The Flaws in Belgium's Digital Identity System- 321

One Click From a Forged Signature: The Flaws in Belgium's Digital Identity System- 321

The Warehouse Nobody Watches: How One Logistics Breach Reached Steam Customers Across Europe- 319

The Warehouse Nobody Watches: How One Logistics Breach Reached Steam Customers Across Europe- 319

One Click, One Mailbox, One Defense Contractor: The IEH Breach-318

One Click, One Mailbox, One Defense Contractor: The IEH Breach-318

The Silence Is the Signal: China's Opaque Review of Palo Alto Networks- 317

The Silence Is the Signal: China's Opaque Review of Palo Alto Networks- 317

Borrowed Trust: How Moscow Turns Everyday Software Into an Access Network- 316

Borrowed Trust: How Moscow Turns Everyday Software Into an Access Network- 316

You Don't Have to Hack In, You Just Have to Log In: Phishing's New Engineering Problem- 315

You Don't Have to Hack In, You Just Have to Log In: Phishing's New Engineering Problem- 315

The Trust Multiplier: When One Vendor's Compromise Becomes Everyone's- 314

The Trust Multiplier: When One Vendor's Compromise Becomes Everyone's- 314

Scaling the Scam: Inside One AI-Powered Compound While Washington Argues With Beijing- 313

Scaling the Scam: Inside One AI-Powered Compound While Washington Argues With Beijing- 313

Nothing Broken, Everything Exploited: Crypto Theft Spreads Across the Entire Stack- 312

Nothing Broken, Everything Exploited: Crypto Theft Spreads Across the Entire Stack- 312

Eight Months Later: The Attack Inside Poland's Attack, and What Came Next- 311

Eight Months Later: The Attack Inside Poland's Attack, and What Came Next- 311

Fear or False Comfort: Ransomware Gangs Are Now Managing the Whole Story- 310

Fear or False Comfort: Ransomware Gangs Are Now Managing the Whole Story- 310

Fifteen Years in the Making: The Sentencing of Ransomwareas- a-Service's Original Architect- 309

Fifteen Years in the Making: The Sentencing of Ransomwareas- a-Service's Original Architect- 309

A Familiar Hand, A New Weapon: Storm-1175 Steps Out From Medusa's Shadow- 308

A Familiar Hand, A New Weapon: Storm-1175 Steps Out From Medusa's Shadow- 308

New Name, Same Playbook: How a Vishing Crew Climbed From Retail to Wall Street in 18 Months- 307

New Name, Same Playbook: How a Vishing Crew Climbed From Retail to Wall Street in 18 Months- 307

The Whole Pipeline: How Breached Data Becomes Cash, Leverage, and Sextortion Material- 306

The Whole Pipeline: How Breached Data Becomes Cash, Leverage, and Sextortion Material- 306

The Authentic Trap: How H1 2026's Scam Campaigns Learned to Borrow Trust Instead of Faking It- 305

The Authentic Trap: How H1 2026's Scam Campaigns Learned to Borrow Trust Instead of Faking It- 305

Up, Down, and Sideways: What Three Ransomware Trend Claims in One Week Actually Measure- 304

Up, Down, and Sideways: What Three Ransomware Trend Claims in One Week Actually Measure- 304

The Long Gap: What Five Healthcare Breaches Reveal About Who's Actually Watching- 303

The Long Gap: What Five Healthcare Breaches Reveal About Who's Actually Watching- 303

One Regime, Four Fronts: Inside North Korea's Parallel Cyber Enterprise- 302

One Regime, Four Fronts: Inside North Korea's Parallel Cyber Enterprise- 302

Seeing Is No Longer Believing: How Synthetic Media Weaponizes Trust in Two Unrelated Worlds- 301

Seeing Is No Longer Believing: How Synthetic Media Weaponizes Trust in Two Unrelated Worlds- 301

Ship First, Secure Later: AI Productivity Tools Are Outrunning Their Own Guardrails- 300

Ship First, Secure Later: AI Productivity Tools Are Outrunning Their Own Guardrails- 300

The Student Becomes the Weapon: Inside China's Program to Distill Western AI Into Military Tools- 299

The Student Becomes the Weapon: Inside China's Program to Distill Western AI Into Military Tools- 299

Hands Off the Wheel: China's Shift to Autonomous AI-Run Cyberattacks- 298

Hands Off the Wheel: China's Shift to Autonomous AI-Run Cyberattacks- 298

The Long Wire: How Beijing Builds Access That Outlasts Its Cover Stories- 297

The Long Wire: How Beijing Builds Access That Outlasts Its Cover Stories- 297

Borrowed Trust: How Moscow Turns Everyday Software Into an Access Network- 296

Borrowed Trust: How Moscow Turns Everyday Software Into an Access Network- 296

The Maintenance Excuse: Zbtlink, the National Intelligence Law, and the Case Against Trusting Chinese Router Firmware- 295

The Maintenance Excuse: Zbtlink, the National Intelligence Law, and the Case Against Trusting Chinese Router Firmware- 295

Beneath the Waterline: Iran's Deniable Campaign Against America's Weakest Infrastructure- 294

Beneath the Waterline: Iran's Deniable Campaign Against America's Weakest Infrastructure- 294

The weak link in modern warfare: Russia's FSB quietly walking through the world's routers- 293

The weak link in modern warfare: Russia's FSB quietly walking through the world's routers- 293

A blank marketing email as a spy's front door: how suspected Chinese operators are quietly reading university mailboxes- 285

A blank marketing email as a spy's front door: how suspected Chinese operators are quietly reading university mailboxes- 285

When cybercrime borrows a spy's toolkit: the UAT-11795 campaign hiding inside everyday software- 292

When cybercrime borrows a spy's toolkit: the UAT-11795 campaign hiding inside everyday software- 292

A parking-lot camera as a weapon of war: how Russia turned Europe's own infrastructure into a targeting network- 291

A parking-lot camera as a weapon of war: how Russia turned Europe's own infrastructure into a targeting network- 291

One police force, two foreign intelligence services: how China and India ended up spying on the same Pakistani database- 290

One police force, two foreign intelligence services: how China and India ended up spying on the same Pakistani database- 290

A breach at the edge, reassurance at the center: what actually leaked from India's largest nuclear plant- 289

A breach at the edge, reassurance at the center: what actually leaked from India's largest nuclear plant- 289

Washington widens its warning as Iran's cyber-physical reach grows — and its own threats escalate-288

Washington widens its warning as Iran's cyber-physical reach grows — and its own threats escalate-288

Four years in, Russia's propaganda machine turns back toward its old targets- 287

Four years in, Russia's propaganda machine turns back toward its old targets- 287

The hacktivist who helped a hacker flee: inside Spain's arrest of a pro-Russia network operative- 286

The hacktivist who helped a hacker flee: inside Spain's arrest of a pro-Russia network operative- 286

Russia's silent reach into the world's mailboxes- 284

Russia's silent reach into the world's mailboxes- 284

Tax season as an attack surface: how a suspected Chinese hacking cluster is running parallel RAT campaigns across India, Japan, and China- 283

Tax season as an attack surface: how a suspected Chinese hacking cluster is running parallel RAT campaigns across India, Japan, and China- 283

When the watchdog gets watched: Pegasus inside the European Parliament's own spyware inquiry- 282

When the watchdog gets watched: Pegasus inside the European Parliament's own spyware inquiry- 282

Iran's quiet war inside Israel's networks- 281

Iran's quiet war inside Israel's networks- 281

FortiBleed and the anatomy of an unforced error: how 86,000 stolen passwords, not a software flaw, opened Foreign Office networks, NHS suppliers, and global shipping to the same campaign- 280

FortiBleed and the anatomy of an unforced error: how 86,000 stolen passwords, not a software flaw, opened Foreign Office networks, NHS suppliers, and global shipping to the same campaign- 280

Ten months in the dark: how a breach of South Korea's diplomatic training platform became a five-month secret before it became a public one- 279

Ten months in the dark: how a breach of South Korea's diplomatic training platform became a five-month secret before it became a public one- 279

Nichirei and the price of ambiguity: what the RansomHouse extortion of Japan's cold-chain giant reveals about a widening pattern of unattributed pressure on Japanese industry- 278

Nichirei and the price of ambiguity: what the RansomHouse extortion of Japan's cold-chain giant reveals about a widening pattern of unattributed pressure on Japanese industry- 278

Canada's Signals Intelligence Agency Turns Its Offensive Toolkit on Criminal Networks, Not Just State Adversaries- 277

Canada's Signals Intelligence Agency Turns Its Offensive Toolkit on Criminal Networks, Not Just State Adversaries- 277

What Medtronic's Own Notice Leaves Unsaid: A Breach, an Extortion Claim, and a Company That Won't Connect the Two- 276

What Medtronic's Own Notice Leaves Unsaid: A Breach, an Extortion Claim, and a Company That Won't Connect the Two- 276

Fifteen Years, Nine Countries: The EU and UK Name the FSB Behind Europe's Infrastructure Sabotage Campaign- 275

Fifteen Years, Nine Countries: The EU and UK Name the FSB Behind Europe's Infrastructure Sabotage Campaign- 275

When the Operator Became the Model: JadePuffer and the Collapse of Ransomware's Skill Floor- 274

When the Operator Became the Model: JadePuffer and the Collapse of Ransomware's Skill Floor- 274

When the Attacker Stops Being Human: Two July 2026 Cases Mark the Shift to AI-Operated Offensive Cyber Campaigns- 273

When the Attacker Stops Being Human: Two July 2026 Cases Mark the Shift to AI-Operated Offensive Cyber Campaigns- 273

Israel's bid to own the agentic security frontier- 272

Israel's bid to own the agentic security frontier- 272

Washington Recasts Pig-Butchering as a National-Security Problem: Inside the $43 Million Network That Fed China-Bound Laundering Pipelines- 271

Washington Recasts Pig-Butchering as a National-Security Problem: Inside the $43 Million Network That Fed China-Bound Laundering Pipelines- 271

Bulletproof No Longer: The Unsealing of the Media Land Indictment- 270

Bulletproof No Longer: The Unsealing of the Media Land Indictment- 270

When the Basics Fail: FSB Center 16's Router Campaign and the West's First Joint Cyber Sanctions Response- 269

When the Basics Fail: FSB Center 16's Router Campaign and the West's First Joint Cyber Sanctions Response- 269

When the Bottling Line Goes Dark: Coca-Cola's Fairlife Ransomware Incident and the Limits of Early Disclosure- 268

When the Bottling Line Goes Dark: Coca-Cola's Fairlife Ransomware Incident and the Limits of Early Disclosure- 268

Old Protocol, New War: How Iran Tracked US Military Phones Through a 1970s Telecom Flaw- 267

Old Protocol, New War: How Iran Tracked US Military Phones Through a 1970s Telecom Flaw- 267

Hardening the Metal Beneath the Model: Why AI Data Centers Are Outrunning Their Own Security- 266

Hardening the Metal Beneath the Model: Why AI Data Centers Are Outrunning Their Own Security- 266

Hacking Like It's 1999: Why Operational Technology Security Plays by Different Rules- 265

Hacking Like It's 1999: Why Operational Technology Security Plays by Different Rules- 265

Trusting the Untrusted: How 6 GHz Wi-Fi's Traffic Cop Could Be Turned Against Critical Infrastructure- 264

Trusting the Untrusted: How 6 GHz Wi-Fi's Traffic Cop Could Be Turned Against Critical Infrastructure- 264

Digital Growth, Deepening Exposure: Nigeria's Race to Regulate a Rising Cybercrime Economy- 263

Digital Growth, Deepening Exposure: Nigeria's Race to Regulate a Rising Cybercrime Economy- 263

Following the Money: Inside the Takedown of a €140 Million Iberian Fraud Network- 262

Following the Money: Inside the Takedown of a €140 Million Iberian Fraud Network- 262

Past the Perimeter: Why Identity, Not Exploits, Now Drives Ransomware- 261

Past the Perimeter: Why Identity, Not Exploits, Now Drives Ransomware- 261

Free Hosting, Weaponized: How 148 npm Packages Turned Students' Browsers Into a Botnet- 260

Free Hosting, Weaponized: How 148 npm Packages Turned Students' Browsers Into a Botnet- 260

A Quiet Patch with a Familiar Shape: 7-Zip's Latest Reminder About Archive Trust- 259

A Quiet Patch with a Familiar Shape: 7-Zip's Latest Reminder About Archive Trust- 259

Trust as the Attack Surface: Inside the ClickFix Campaigns Powering ACR Stealer- 258

Trust as the Attack Surface: Inside the ClickFix Campaigns Powering ACR Stealer- 258

Listening to the Seabed: Denmark's Bet on Acoustic Sensing as a First Line of Maritime Defense- 257

Listening to the Seabed: Denmark's Bet on Acoustic Sensing as a First Line of Maritime Defense- 257

Beneath the Radar: A Reawakened Espionage Toolkit Targets Southeast Asian Governments- 256

Beneath the Radar: A Reawakened Espionage Toolkit Targets Southeast Asian Governments- 256

The Certificate Authority's Blind Spot: How a Trusted Signing Chain Became a Weapon- 255

The Certificate Authority's Blind Spot: How a Trusted Signing Chain Became a Weapon- 255

The ransomware gang that used a training-data BTC address by mistake was actually the AI's mistake- 254

The ransomware gang that used a training-data BTC address by mistake was actually the AI's mistake- 254

A breach nobody's attributed yet, hitting the platform that's coordinating World Cup security- 253

A breach nobody's attributed yet, hitting the platform that's coordinating World Cup security- 253

North Korea just made its malware payload host itself on the blockchain- 252

North Korea just made its malware payload host itself on the blockchain- 252

The lawyers MSG banned with facial recognition are now the plaintiffs suing over it - 251

The lawyers MSG banned with facial recognition are now the plaintiffs suing over it - 251

Anubis's real innovation isn't the ransomware — it's making destruction irreversible- 250

Anubis's real innovation isn't the ransomware — it's making destruction irreversible- 250

China-Linked CL-STA-1062 Shifts From Taiwan to Critical Infrastructure Across Southeast Asia- 249

China-Linked CL-STA-1062 Shifts From Taiwan to Critical Infrastructure Across Southeast Asia- 249

The Microsoft bug leaker treating vulnerability disclosure as a countdown- 248

The Microsoft bug leaker treating vulnerability disclosure as a countdown- 248

When "unauthorized AI app" becomes an SEC disclosure category of its own- 247

When "unauthorized AI app" becomes an SEC disclosure category of its own- 247

The worm that infects the tools developers trust to catch it- 246

The worm that infects the tools developers trust to catch it- 246

A malware sample built for single-core Windows XP may be the first cyberweapon ever found- 245

A malware sample built for single-core Windows XP may be the first cyberweapon ever found- 245

ClawSwarm proves you can hijack an AI agent without writing a single line of malware- 244

ClawSwarm proves you can hijack an AI agent without writing a single line of malware- 244

Ten months later, nobody knows why Huawei routers took down Luxembourg's phone network- 243

Ten months later, nobody knows why Huawei routers took down Luxembourg's phone network- 243

THORChain's breach is a rounding error in 2026's record year for crypto theft- 242

THORChain's breach is a rounding error in 2026's record year for crypto theft- 242

Operation Ramz shows where Southeast Asia's scam compounds go when they get shut down- 241

Operation Ramz shows where Southeast Asia's scam compounds go when they get shut down- 241

Latest

15
Sep
Three Russian Clusters, One Playbook: How Moscow's Spies Turned Login Screens Into Listening Posts- 340

Three Russian Clusters, One Playbook: How Moscow's Spies Turned Login Screens Into Listening Posts- 340

August 22, 2026 Google's Threat Intelligence Group has spent the past year quietly tracking three separate Russia-linked
5 min read
15
Sep
Medusa's Affiliate Model Hits Full Stride: 500 Critical-Infrastructure Victims and a Hint of Cracks Beneath- 339

Medusa's Affiliate Model Hits Full Stride: 500 Critical-Infrastructure Victims and a Hint of Cracks Beneath- 339

August 20, 2026 An updated federal advisory on the Medusa ransomware-as-a-service operation reads less like a warning
3 min read
15
Sep
A Chinese Ransomware Crew Swaps Tools, Not Tactics: Storm-1175's Pivot to StormEncryptor Exposes the Fragility of the MSP Layer- 338

A Chinese Ransomware Crew Swaps Tools, Not Tactics: Storm-1175's Pivot to StormEncryptor Exposes the Fragility of the MSP Layer- 338

August 16, 2026 For a financially motivated hacking crew that had gone quiet since April, the reappearance of Storm-1175
4 min read
15
Sep
The Browser Is the Cover: Inside BlueDelta's HOOKEDGE Campaign Against European Diplomacy- 337

The Browser Is the Cover: Inside BlueDelta's HOOKEDGE Campaign Against European Diplomacy- 337

September 2, 2026 A phishing document that looks exactly like a real government meeting agenda is a familiar enough trick.
4 min read
15
Sep
Dark Caracal Puts a Smart Contract to Work: Blockchain as a Fallback Channel for an Old Lebanese Espionage Toolkit- 336

Dark Caracal Puts a Smart Contract to Work: Blockchain as a Fallback Channel for an Old Lebanese Espionage Toolkit- 336

September 1, 2026 Dark Caracal has been running intelligence-gathering operations out of Lebanon's General Directorate of General
4 min read
15
Sep
SilkParasite and the Discipline Problem: What Happens When Chinese Espionage Actors Use AI to Get Better, Not Just Faster- 335

SilkParasite and the Discipline Problem: What Happens When Chinese Espionage Actors Use AI to Get Better, Not Just Faster- 335

September 1, 2026 There are two very different ways a state-linked hacking operation can put artificial intelligence to work,
3 min read
10
Sep

SilkParasite and the Discipline Problem: What Happens When Chinese Espionage Actors Use AI to Get Better, Not Just Faster- 335

September 1, 2026 There are two very different ways a state-linked hacking operation can put artificial intelligence to work,
2 min read
10
Sep
The Swarm That Wasn't Supposed to Exist: How OpenAI's Own Agents Coordinated a Breach of Hugging Face- 334

The Swarm That Wasn't Supposed to Exist: How OpenAI's Own Agents Coordinated a Breach of Hugging Face- 334

September 1, 2026 Sometime in mid-July, more than seventeen thousand distinct attacker actions moved through Hugging Face's
7 min read
10
Sep
Washington Dismantles a Chinese Hacking-as-a-Service Network — Then Walks Back Its Own Words- 333

Washington Dismantles a Chinese Hacking-as-a-Service Network — Then Walks Back Its Own Words- 333

September 1, 2026 When the Justice Department announced last week that it had seized the infrastructure behind a Chinese state-
4 min read
10
Sep
Berlin's No: A Ransomware Extortion Collides With a State Election- 332

Berlin's No: A Ransomware Extortion Collides With a State Election- 332

September 2, 2026 A city-state government's refusal to pay a ransom is rarely news in itself; what
4 min read