Will

ICYMI — I have started a new blog series called 🇬🇧 the UK Cybercrime Journal on my personal site 🥷 I’ll be dropping a new one every Wednesday on what I deem are the latest notable cybercrime issues for the UK. You can read them all here: blog.bushidotoken.net/search/label/U… Stay tuned 🔍

I would love to see it become standard practice for CTI researchers to add “XYZ National CERT was notified prior to the publication of this blog.”

For researchers who uncover a breach, leaks, and other cyber intrusions, and want to do victim notifications, I always recommend and had good experiences with emailing the National Computer Emergency Response Team (CERT) who can often notify them quickly: first.org/members/teams/

New Blog! 🇬🇧 UK Cybercrime Journal: University of Nottingham Breached by ShinyHunters The education sector in the UK has suffered repeated, significant data breaches in recent years, but ShinyHunters campaign has been one of the worst yet. 🔗 blog.bushidotoken.net/2026/07/uk-cyb…

@solostalking Some APTs hunt for other APTs ncsc.gov.uk/news/turla-gro…

I have a doubt 🙋‍!!! What do APTs do when they find other -APTs already in the network? -Do they remove them? -Watch silently? -Watch silently and mind their own business? -Leave the network? -Report it from their public front company to gain it as a client?

I take it they realised a Great Firewall of Britain was not ideal…

When will the cybercriminals ever learn…

New Blog! 🇬🇧 UK Cybercrime Journal: SMS Blaster Gang Convicted - New details emerge about the use of an SMS Blaster device to send fraudulent text messages as part of an organised criminal operation in London 🔗 blog.bushidotoken.net/2026/07/uk-cyb…

Additional coverage from @BleepinComputer x.com/bleepincompute…

New Phishing Campaign: Fake Interviews Offered at Top Brands to harvest Gmail creds, IOCs inside gist.github.com/BushidoUK/57c3…

@fr0gger_ @SecurityBreakAI Congratulations Thomas! Wishing you the best success with your new company 🤘

🤓 After 15 years of threat research, I am building something new! Today, @SecurityBreakAI officially becomes a company focused on AI Threat Intelligence and AI Security! The new website is live! Check it out :) securitybreak.io

Great research & useful resource from Aaron Ringo @bishopfox 👏 Favicon hashes for 3301 products 🔥 1. bishopfox.com/blog/on-favico… 2. github.com/BishopFox/Favi…

New Blog! 🇬🇧 UK Cybercrime Journal: Argos Account Takeover Fraud - Cybercriminals are using leaked credentials to hijack Argos user accounts - They then order and then collect the goods in-person at a physical store and pay with stolen credit cards 🔗 blog.bushidotoken.net/2026/07/uk-cyb…

The Huntress email marketing team really cooked with this subject line 😂

#HagueTIX 2026 🇳🇱 Let’s talk APT 😎

@Kostastsale @malbeacon Interesting, good luck!

@BushidoToken @malbeacon Yes, I’ll be building something better for malware researchers. Better infra and access to telemetry.

One of the hardest problems in malware and threat research is access to realistic infrastructure that can be used safely. I had this crazy idea for awhile now. Some ideas sound unrealistic until enough pieces start coming together. But there more I used this infrastructure for my own research, the more obvious the next question became. Advanced deception infrastructure that trusted researchers could access on demand, not a toy lab. Something closer to real infrastructure, with physical machines, servers, exposed services, telemetry pipelines, and environments modeled around specific industries. The infrastructure has existed for a while, and I have been using it for different research purposes. At some point I thought If this is useful to me, it’ll be useful to others too. Researchers who want a well-built environment to safely detonate malware, observe telemetry, study tradecraft, and understand how threats behave in conditions that feel reain both short term long term. There are hard problems to solve around safety, trust, access control, isolation, abuse prevention, and operations. But this is getting closer to reality. The goal is to make high-quality deception infrastructure-as-a-servicemore accessible to trusted individual researchers, not only large enterprises. We are talking bare metal machines and access to full telemetry, from windowsevent logs to EDR and network. Windows, macOS and Linux. Still early, but it is finally starting to take shape. If this sounds useful to you as a researcher, or you want to help shape it, reach out. I would be open to parnter with folks I know.

@Kostastsale @malbeacon And deception.pro

@Kostastsale Ever heard of @malbeacon ?

Just wanted to give kudos to how the Zscaler @Threatlabz team have been crushing it recently 🤘 Two awesome blogs caught my eye on novel malware families linked to ransomware gangs: 1. MLTBackdoor zscaler.com/blogs/security… 2. Edgecution zscaler.com/blogs/security…

New Blog! 🇬🇧 UK Cybercrime Journal: Hargreaves Landsdown Extortion Attempt by Bashe It appears Bashe weaponised HL’s recent, IT outages & glitches (in Sept 2025 and March 2026) to construct a plausible, but false, narrative of a successful hack. 🔗 blog.bushidotoken.net/2026/06/uk-cyb…

Two of my fav 🇬🇧 🇨🇦 experts when it comes to discussing cyber warfare, Philip Ingram and Ian Thornton-Trump, released an interview reviewing in detail the threat landscape of 🇷🇺 Russian cyber operations in the context of the ongoing war in 🇺🇦 Ukraine. 🔗 youtu.be/p1vl5t4fVWA