Kirsten Doyle

The United Kingdom is sharpening its defence posture. Five technologies stand at the heart of this effort. While the industry’s heavyweights continue to supply capability, fresh value lies with early to mid-stage firms. These smaller players, often led by veterans and security professionals, move fast. They innovate, adapt, and bring new answers to complex military challenges. A new report from Heligan Group maps out the technologies driving UK, European, and NATO power projection. Matt Croker, Director of Corporate Finance at Heligan Group, frames the moment plainly: “The UK is well-positioned in a range of defence technologies with both investment as…

The web began quietly. A few servers, a handful of users, a few ideas. It promised knowledge at the speed of light. But as the connections multiplied, so did the shadows. Each innovation brings progress, but also vulnerability. Today, the internet is no longer a tool; it is a living, sprawling ecosystem. And its evolution has been anything but gentle. The Shifting Threat Landscape Ross Moore, Information Security Researcher, remembers the early simplicity of cyber threats: “It would be great if the most complex threat today were the Melissa or ILOVEYOU viruses spread through email attachments!” Those viruses were nuisances,…

Between June and August this year, CrowdStrike’s Falcon platform stopped a coordinated malware campaign aimed at more than 300 customer environments. The operation involved SHAMOS, a variant of the Atomic macOS Stealer (AMOS), built and rented out by the cybercriminal group COOKIE SPIDER. The scheme was simple. Malvertising lured users searching for macOS fixes to spoofed help sites.  There, victims were told to copy and paste a one-line command into Terminal. That single command bypassed Apple’s Gatekeeper checks and installed a Mach-O executable. It is a technique increasingly favored by eCrime groups. SHAMOS and its predecessor, Cuckoo Stealer, have both…

The dark web has its own job boards. Its own recruiters. Its own economy of skills.  There, posts read like the listings on LinkedIn or Indeed, only the roles are not for project managers or analysts. They are for AI specialists, cloud exploiters, and social engineers fluent in English. The recruits are not employees. They are accomplices.  ReliaQuest research showed how the market is booming. Job-related posts on cybercriminal forums such as Exploit and RAMP more than doubled between 2023 and 2024. By mid-2025, they had already equaled the previous year’s total. The growth signals a shift. Cybercrime is no…

Darktrace has uncovered a coordinated campaign of SaaS account takeovers. Attackers hid behind Virtual Private Servers, slipping into accounts, moving unseen, and wiping away the traces of phishing. The pattern was consistent: suspicious logins from VPS-linked infrastructure, swift creation of inbox rules, and deleted emails, particularly those tied to phishing. What researchers found was a portrait of a campaign built on stealth, persistence, and the calculated use of virtual infrastructure. What is a VPS, and Why Does it Matter? A VPS provides dedicated computing resources on a shared physical server. For businesses and developers, it is a useful, legitimate tool.…

AI Browsers promise a future where an Agentic AI can handle your online life. From shopping to emails, they are designed to act autonomously, to save time, to make life easier. Yet convenience has a price. Recent researach by Guardio reveals a worrying truth: security guardrails are inconsistent, sometimes absent entirely. The AI clicks, pays, and fails, often without human oversight. Welcome to what Guardio call “Scamlexity,” a new era of scam complexity, supercharged by Agentic AI. Familiar tricks hit harder than ever, while new AI-born attack vectors break into reality. “The scam no longer needs to trick you. It…

The FBI and Cisco Talos have issued fresh warnings about a Russian cyber espionage campaign that has quietly compromised network devices around the world. The threat actor, tracked as Static Tundra, is linked to the Federal Security Service’s (FSB) Center 16 unit and has been active for more than a decade. At the heart of its operations is an old weakness. Static Tundra continues to exploit CVE-2018-0171, a seven-year-old vulnerability in Cisco’s Smart Install feature. Cisco patched the flaw in 2018. Yet unpatched and end-of-life devices remain exposed. They are still being targeted. Cisco Talos describes Static Tundra as “a…

It sounds counterintuitive. An adversary exploits a system, gains access, and then patches the very hole they used to break in. Yet that is exactly what Red Canary researchers observed in a recent campaign targeting cloud-based Linux servers. The logic is simple. By fixing the exploited vulnerability, a malefactor can lock out rivals and mask their method of entry. What looks like remediation is, in reality, persistence. The Red Canary Threat Intelligence team tracked a cluster of activity exploiting CVE-2023-46604 in Apache ActiveMQ, a widely deployed open-source message broker. Once inside, the adversary moved quickly. “It’s a great way to…

Britain has abandoned its demand that Apple build a “backdoor” into its encryption systems. The change follows months of quiet talks between London and Washington, Reuters reports. In a statement posted on X, U.S. Director of National Intelligence Tulsi Gabbard, said: “As a result, the UK has agreed to drop its mandate for Apple to provide a ‘backdoor’ that would have enabled access to the protected encrypted data of American citizens and encroached on our civil liberties.” She added that the U.S. government had been working with Britain “to ensure that Americans’ civil liberties are protected.” The discussions involved President…

Colt Technology Services has been dealing with a cyberattack that has disrupted parts of its business for more than a week. The UK-based telecommunications firm, which operates in 30 countries and runs nearly 50,000 miles of fiber connecting 900 data centers, confirmed that several internal support systems remain offline.   The incident began on 12 August, when Colt detected unusual activity and took systems down as a protective measure. The move cut access to Colt Online, its Voice API platform, and hosting and porting services.  Customers who normally use web portals have been told to rely on phone or email instead,…