Kirsten Doyle

Let’s face it: most companies are drowning in vulnerabilities and struggling to patch even a fraction of them. The question has never been how many flaws exist, it’s which ones matter most. Now, NIST thinks it may have an answer, or at least a better guess. In a white paper released on 19 May, researchers Peter Mell and Jonathan Spring introduced a new metric called Likely Exploited Vulnerabilities (LEV). The idea is bold: estimate, not confirm, which vulnerabilities have probably been used in the wild, based on historical trends in exploit prediction data. It’s not perfect. But in a world…

Cybercriminals have been dealt a major blow as global law enforcement agencies, coordinated by Europol and Eurojust, dismantled critical components of the infrastructure behind some of the world’s most disruptive ransomware operations.  Between 19 and 22 May 2025, authorities conducted a sweeping takedown of the digital backbone enabling initial access malware; tools routinely used by bad actors to gain a foothold in victims’ systems. Operation Endgame neutralised over 300 servers across multiple countries, took down 650 malicious domains, and seized more than €3.5 million in cryptocurrency. This brings the total assets confiscated under the Operation Endgame banner to more than…

Streaming credentials are the new gold in the cyber underground, and cybercriminals are cashing in, by using your favorite shows, anime, and blockbuster films as bait. A new report from Kaspersky reveals a troubling spike in phishing and malware campaigns that exploit pop culture to lure users, especially Gen Z, into compromising their devices and handing over credentials.   Attackers are using familiar entertainment brands to drop malware, steal login details, and resell streaming accounts on the dark web at bargain-bin prices. In 2023 alone, Kaspersky blocked nearly 10 million phishing attacks related to streaming services and 4.2 million attempts to…

Operation Endgame has successfully disrupted the infrastructure behind the Latrodectus malware, a sophisticated loader often used by ransomware groups to infiltrate enterprise networks.   According to Expel’s researchers, if history is any guide, this isn’t the end of the story. The developers behind Latrodectus are known for resilience and reinvention. They’ve reemerged before, and odds are, they’ll do it again. So when they return (and they will) here’s what to watch for. Click-Fix: The Deceptive Path to Infection One of the more devious tactics the researchers have seen from the Latrodectus operators is the so-called Click-Fix technique. This method relies on…

Cybersecurity researcher Jeremiah Fowler has uncovered a massive trove of exposed login credentials linked to suspected infostealer malware activity, raising serious global concerns about data privacy and identity theft.  Fowler discovered a non-password-protected and unencrypted database holding more than 184 million unique usernames and passwords, totaling 47.42 GB of raw data. The breach was reported to Website Planet, and access to the database was promptly restricted following responsible disclosure to the hosting provider. The database, linked to two anonymous domains, included credentials from platforms like Facebook, Microsoft, Google, Discord, Roblox, Instagram, and even government and financial portals from around the…

The Federal Trade Commission (FTC) has finalized a settlement order with web hosting provider GoDaddy, resolving allegations that the company misled consumers by failing to implement basic data security measures. The order, approved by a unanimous 3-0 vote, follows a series of data breaches linked to GoDaddy’s inadequate cybersecurity practices.  In a complaint first announced in January 2025, the FTC charged that GoDaddy falsely marketed its services as offering “award-winning security” while neglecting to use standard protections to safeguard customer websites and data. The Commission says GoDaddy did not adopt critical cybersecurity practices such as multi-factor authentication, aggressive threat monitoring,…

Two hacking groups have claimed responsibility for cyberattacks targeting Coca-Cola, with one alleging the theft of over 23 million records. Cyber Security News reported that in posts on dark web forums, the Everest ransomware group claims to have breached Coca-Cola’s internal systems, focusing on data linked to its Middle East operations. Known for previous attacks on NASA and the Brazilian government, Everest reportedly exfiltrated sensitive and confidential company information. However, the credibility of the claim is uncertain, especially after the group’s own leak site was defaced in April. In a separate incident, the Gehenna hacking group alleges it compromised Coca-Cola…

Kettering Health is grappling with the aftermath of a ransomware attack that caused a system-wide technology outage, prompting the cancellation of elective procedures and disrupting normal operations across its 14 medical centers. On Tuesday morning, the Ohio-based health network confirmed it was experiencing a cybersecurity incident resulting from unauthorized access to its network. The attack, which deployed ransomware, has disabled parts of Kettering’s IT infrastructure and affected patient services, including its call center. The outage has led to the cancellation of all elective inpatient and outpatient procedures for Tuesday, May 20, with rescheduling underway. “Elective inpatient and outpatient procedures at…

Microsoft’s Digital Crimes Unit (DCU), working in concert with law enforcement and cybersecurity partners worldwide, has dismantled the infrastructure behind Lumma Stealer, one of the most prolific tools used by cybercriminals to steal sensitive personal and organizational data. The coordinated takedown, which culminated on 13 May, involved legal action filed in the U.S. District Court for the Northern District of Georgia. Microsoft obtained a court order to seize, suspend, and block nearly 2,300 malicious domains powering the Lumma Stealer malware, a tool responsible for hundreds of thousands of infections across the globe. Simultaneously, the U.S. Department of Justice seized Lumma’s…

Ransomware group Interlock has claimed responsibility for a cyberattack on West Lothian Council, adding the Scottish local authority to its data leak site earlier today. The gang alleges it exfiltrated a staggering 2.63 terabytes of data, comprising more than 3.3 million files and over half a million folders. A sample of the stolen data (known as a proof pack) reportedly includes images of passports, driver’s licenses, and a range of other sensitive documents. The council had previously confirmed it fell victim to a ransomware attack on 6 May, with local schools bearing the brunt of the disruption. In a public…