Julian-Ferdinand Vögele

The mystery of a globetrotting iPhone-hacking toolkit Tools used in a series of hacking campaigns by hackers in Russia, Ukraine, and China may have originated inside U.S. government contractor L3Harris, TechCrunch has learned.

SCOOP: The iPhone mass hacking toolkit used by Russian spies was developed at U.S. military contractor L3Harris, former employees said.

The Coruna toolkit was used against Ukrainians and by Chinese cybercriminals, according to Google. But the toolkit was initially developed for Western governments.

Finland's intelligence service has released its yearly national security overview report. On the cyber side of things, SUPO warns startups that foreign espionage can rob them of their future.

supo.fi/en/espionage...

📣 #PIVOTcon26 Agenda is here 🤟 We are thrilled to announce the lineup for this year's edition!
2⃣ days and 19 talks from leading #ThreatResearch experts.
The agenda link is in the first comment👇, and the talks and speakers are in the thread.🧵
#CTI #ThreatIntel
1/15

Edition 11 – One mistake ties together more than 100 domains Hey there, Hakan here. This week's edition is going to be a short one about mistakes. Without those, it'd be a whole lot harder to do my job. When trying to...

Short newsletter item about one mistake from disinfo operations #Doppelgänger that makes it possible to tie together >100 domains

buttondown.com/readwrite/ar...

BREAKING: powerful iPhone hacking tools used by Chinese criminals originated from US defense giant L3 Harris.

Their zero-click exploits went to Russian spies too.

Unbelievable harm to our collective security.

Scoop: @lorenzofb.bsky.social, here's why it matters 1/
techcrunch.com/2026/03/09/a...

From a Sophisticated Browser-Extension Supply-Chain Compromise to a VibeCoded Twist: A Chrome Extension as the Initial Access Vector for a Broader Malware Chain Independent technical analysis of a Chrome extension compromise, fake update chain, and Windows-stage malware activity.

"A formerly legitimate Featured Chrome extension (ShotBird) was turned into a remote-controlled malware channel after an apparent ownership transfer"

Curious if this is another case of an extension being sold on ExtensionHub again? A place to watch...

monxresearch-sec.github.io/shotbird-ext...

Bird names in Coruna iOS exploit framework YouTube video by Three Buddy Problem

What's with the bird names in a .gov iOS exploit framework? @craiu.bsky.social @jags.bsky.social www.youtube.com/watch?v=-QNf...

We are aware of recent reports regarding targeted phishing attacks that have resulted in account takeovers of some Signal users, including government officials and journalists. We take this very seriously. 1/7

𝗜𝗿𝗮𝗻 𝗮𝗻𝗱 𝘁𝗵𝗲 𝗰𝘆𝗯𝗲𝗿 𝗱𝗼𝗺𝗮𝗶𝗻: our selected analysis providing useful context on the different ways cyber tools have been used in and around #Iran. (1/5)

(5/5) Ransomware, espionage, & sabotage.
A. Milenkoski, J. Minier, @julianferdinand.bsky.social, M. Smeets, and @tgrossman.bsky.social examine state uses of ransomware, including Iran’s capacity for disruptive & politically motivated cyber operations.
🔗 Read article: bindinghook.com/state-backed...

-Mammoth trojan comes to MAX
-Phishing campaign targets Armenian civil society leaders ahead of elections
-Coruna technical analysis
-LuaJIT malware on GitHub
-Red Alert malware in Israel
-DPRK (ab)uses AI for everything
-New CL-UNK-1068 APT
-APT36 adopts vibeware
-Claude found 22 Firefox bugs

-White House releases new Cyber Strategy
-New Trump EO prioritizes fight against scams and cybercrime
-Chinese hackers breach FBI wiretap network
-Romania's largest meat exporter enters insolvency after ransomware attack

Podcast: risky.biz/RBNEWS535/
Newsletter: news.risky.biz/risky-bullet...

Along with our open call for talks, we have also opened registration for Hague TIX 2026!

The ticket link and everything practical you need to know about #HagueTIX2026 is right here: www.thehagueprogram.nl/the-hague-ti...

@thehagueprogram.bsky.social @fggaleiden.bsky.social @monicakello.bsky.social

New video footage shows a US Tomahawk missile hitting an IRGC facility in Minab, Iran, on Feb 28, showing for the first time that the US struck the area. The footage also shows smoke already rising from the vicinity of the girls’ school, where 175 people were reportedly killed, including children.

Huntress researchers Jamie Levy & Harlan Carvey have identified and detailed the full timeline of an intrusion in a customer environment that aligns with what others have identified as MuddyWater. www.huntress.com/blog/muddywa...

The #DefCon #Singapore March Chill Out will be happening March 27th at Georges in Tai Seng. Everyone is welcome!

Come meet the local InfoSec, Hacker, and Researcher communities working to make the DEF CON Singapore conference a reality at the end April […]

[Original post on defcon.social]

Kremlin hackers attempting to compromise Signal, WhatsApp accounts globally Russian state hackers are carrying out a global campaign to compromise Signal and WhatsApp accounts belonging to government officials and military personnel, Dutch intelligence warned Monday.

Russian state hackers are carrying out a global campaign to compromise Signal and WhatsApp accounts belonging to government officials and military personnel, Dutch intelligence warned Monday.

A beginner's guide to analyzing the network traffic of apps and websites In 2025, journalist Zack Whittaker found three popular apps were leaking sensitive user data. This is how he uses network analysis tools like Burp Suite to understand how apps and websites work and sh...

In this how-to for beginners, I explain how to get started with Burp and similar browser tools, we'll explore API basics, how to understand network requests, and getting started. I'll also walk you through some examples of how I found security bugs and data leaks, which I wrote up for TechCrunch.

🧨 🚨 NEW POD UP! (presented by @thinkstcanary.canary.tools) - The Coruna iOS exploit kit, the connection to the Peter Williams/Trenchant exploit sale to Russians, how it slipped from government hands into criminal use @craiu.bsky.social @jags.bsky.social

LISTEN everwhere 👇
pod.link/1414525622

The Iran war has entered a new phase Both sides have changed their tactics, our data analysis finds

Terrific data deep dive with animated maps, showing how US/Israeli targeting shows a shift over the course of the war’s first week: from targeting army and drone/missile sites to targeting police and regime security, to enable an uprising.
economist.com/interactive/...

Iran war shows data centers emerging as critical targets From Amazon sites in the Gulf to reported strikes on Tehran data centers, digital infrastructure is increasingly becoming a casualty of war - Anadolu Ajansı

My comment for Anadolu Agency (turkish press agency) on data centres as targets in the Iran war. The strikes on Amazon facilities in the UAE and Bahrain are the first time commercial cloud infrastructure has taken physical damage from a drone or missile attack. www.aa.com.tr/en/middle-ea...

Kaspersky recently produced a podcast on Operation Triangulation, basically a story of the investigation

Things that I haven't seen mentioned elsewhere:
— Triangulation malware existed for >10 years
— Some technical details similar to the Equation Group

www.youtube.com/watch?v=j4pC...

United States • Florida-based spyware company tied to ex-NSA head closes its doors Defense Prime Inc, also known as Palm Beach Networks, has been staffed by veterans of Israeli spyware firm NSO Group, as well as a former NSA boss. The low profile firm recently dissolved its Florida

“The Florida-based cyber firm Defense Prime—which has also done business as Palm Beach Networks—& been staffed mostly by former employees of NSO Group, has dissolved its Florida operations. Its executives have moved their business operations to 🇪🇸Barcelona.”
www.intelligenceonline.com/americas/202...

From Ukraine to Iran, Hacking Security Cameras Is Now Part of War’s ‘Playbook’ New research shows hundreds of attempts by apparent Iranian state hackers to hijack consumer-grade cameras, timed to missile and drone strikes. Israel, Russia, and Ukraine have also adopted this trick...

Hacking internet-connected civilian security cameras for recon has become a standard operating procedure of modern warfare. First for Russia and Ukraine, now for Israel and Iran.

Your insecure internet-of-things surveillance system is now their targeting system.

www.wired.com/story/from-u...

Russia is providing Iran intelligence to target U.S. forces, officials say The targeting information has included the locations of American warships and aircraft in the Middle East, the officials said.

Exclusive: Russia is providing Iran with targeting information to attack American forces in the Middle East, the first indication that another major U.S. adversary is participating — even indirectly — in the war.

-Iranian hackers are scanning for security cameras to aid missile strikes
-Israel bombs Iran's cyber headquarters
-CISA's CIO leaves
-Authorities take down LeakBase and Tycoon 2FA
-Mexico mandates SIM registration to real IDs

Newsletter: news.risky.biz/risky-bullet...
Podcast: risky.biz/RBNEWS534/

Google says half of all zero-days it tracked in 2025 targeted buggy enterprise tech | TechCrunch Enterprise software was a major focus of zero-day activity during 2025, with security and networking devices, like firewalls, VPNs, and virtualization platforms among the most targeted by malicious ha...

NEW: Google said that last year, and for the first time, it found more zero-days used by spyware makers (15) rather than government-backed espionage groups (12) in the wild.

The shift demonstrated “a slow but sure movement in the landscape” of how governments hack targets, the company said.

Assessing the impact of counter-ransomware interventions Counter-ransomware interventions are becoming increasingly common, but judging whether those interventions ‘work’ remains difficult. Understanding impact means considering more than a single outcome a...

Counter-ransomware interventions are increasing, but assessing the impact remains difficult. Our latest article by @maxwsmeets.bsky.social, @jamiemaccoll.bsky.social, S. Williams-Dunning, & @bobherc.bsky.social introduces a practical framework to evaluate them.

Read: bindinghook.com/assessing-th...

My oh my... I hope they didn't store all their cyberz and computers in the same building /s

www.politico.com/news/2026/03...

Microsoft describes how a global coalition disrupted Tycoon 2FA, a phishing-as-a-service platform behind tens of millions of fraudulent emails reaching more than 500,000 organizations each month. blogs.microsoft.com/on-the-issue...