Tootfinder

"Ryan Clifford Goldberg, a former incident response supervisor at Sygnia Consulting Ltd., and Kevin Tyler Martin, who was a ransomware negotiator for DigitalMint, pleaded guilty to one count each of conspiracy to interfere with commerce by extortion."
ht…

US federal prosecutors allege that three cybersecurity professionals carried out ransomware attacks on at least five US companies in 2023 using ALPHV ransomware (Matt Kapko/CyberScoop)
https://cyberscoop.com/incident-response-ransomware-professionals-charge…

Prosecutors allege incident response pros used ALPHV/BlackCat to commit string of ransomware attacks
The alleged cybersecurity turncoats attacked at least five U.S. companies while working for their respective employers, officials said.

Understanding the Efficacy of Phishing Training in Practice
"Combined with the bulk of empirical evidence from other studies involving
real-world, controlled experiments, our results suggests that organizations should not expect large anti-phishing benefits from either annual security awareness training or embedded phishing as commonly deployed today."
In addition, the overall cost on third-party organisations doing incident response should not exclude the impact of false-posi…

Kash Patel fires head of #FBI’s critical incident response group, the 3rd head of this key transportation focused unit to be dismissed since Patel was confirmed in February.
Patel's anger apparently stems from embarassing press reports that the nation's top law enforcement agency head had flown in an FBI jet to attend a #VinceMcMahon

CISA, NSA warn of China’s BRICKSTORM malware after incident response efforts https://therecord.media/cisa-nsa-warn-brickstorm-china

DOJ accuses US ransomware negotiators of launching their own ransomware attacks
The Department of Justice indicted Kevin Tyler Martin and another unnamed employee,
who both worked as ransomware negotiators at DigitalMint,
with three counts of computer hacking and extortion related to a series of attempted ransomware attacks against at least five U.S.-based companies.
Prosecutors also charged a third individual, Ryan Clifford Goldberg, a former incident response manage…

DOJ accuses US ransomware negotiators of launching their own ransomware attacks | TechCrunch
Three people, including two U.S. ransomware negotiators, are accused of working on behalf of the ALPHV/BlackCat ransomware gang.

POLAR: Automating Cyber Threat Prioritization through LLM-Powered Assessment
Luoxi Tang, Yuqiao Meng, Ankita Patra, Weicheng Ma, Muchao Ye, Zhaohan Xi
https://arxiv.org/abs/2510.01552

POLAR: Automating Cyber Threat Prioritization through LLM-Powered Assessment
Large Language Models (LLMs) are intensively used to assist security analysts in counteracting the rapid exploitation of cyber threats, wherein LLMs offer cyber threat intelligence (CTI) to support vulnerability assessment and incident response. While recent work has shown that LLMs can support a wide range of CTI tasks such as threat analysis, vulnerability detection, and intrusion defense, significant performance gaps persist in practical deployments. In this paper, we investigate the intrins…

I wonder how much of this is going on unreported - it's like taking candy from a baby.
The small town of Gloversville, NY, was hit by a ransomware attack and paid a ransom of $150,000, negotiated down from $300,000.
https://wnyt.com/top-stories/gloversville-hit-b…

Gloversville hit by ransomware attack
The city of Gloversville’s computer system was hit by a ransomware attack, which compromised the personal information of employees past and present. The attack was discovered by the finance commissioner back in March, the city announced on Saturday. There was a ransomware note on the server. Gloversville reported the attack to the FBI. State Police and the Department of Homeland Security’s Incident Response Team.

Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence
Yuqiao Meng, Luoxi Tang, Feiyang Yu, Jinyuan Jia, Guanhua Yan, Ping Yang, Zhaohan Xi
https://arxiv.org/abs/2509.23573

Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence
Large Language Models (LLMs) are intensively used to assist security analysts in counteracting the rapid exploitation of cyber threats, wherein LLMs offer cyber threat intelligence (CTI) to support vulnerability assessment and incident response. While recent work has shown that LLMs can support a wide range of CTI tasks such as threat analysis, vulnerability detection, and intrusion defense, significant performance gaps persist in practical deployments. In this paper, we investigate the intrins…