From the headline I assumed that INTERPOL was essentially using Fortinet gear as honeypots because, well, we've all seen the CVEs. So I read the post and I'm still not convinced otherwise. https://www.fortinet.com/blog/industry-trends/fortinet-assists-interpol-in-disrupting-cybercrime-networks-through-operation-serengeti

Holy shit. I know most people here already loathe DOGE ( and if you don't, why the fuck would you be following me? ) but this is a wild, currently ongoing, thread:

Newsie

ProPublica (@ProPublica@newsie.social)

Attached: 2 images On the left: Nate Cavanagh, a 28-year-old #DOGE staffer and college dropout. On the right: Mohammad Halimi, a 53-year-old exil...

Uh oh.

Jorts are now the official uniform of GREEDY GARBANZO.

Infosec Exchange

Cat 🐈🥗 (D.Burch) :blobcatrainbow: (@catsalad@infosec.exchange)

Jorts are now illegal 👖⁠✂️ https://retro.pizza/@chad/115069244747856163

Data I/O Corp had a little fucky wucky.

XBRL Viewer

> On August 16, 2025, Data I/O Corporation (the “Company”) experienced a ransomware incident (the “Incident”) on certain of its internal IT systems. Upon discovery, the Company promptly activated its response protocols, took steps to secure its global IT systems and implemented containment measures, including proactively taking certain platforms offline and implementing other mitigation measures. The Company also engaged leading cybersecurity experts to support the IT system recovery and conduct a comprehensive investigation. Based on the findings, the Company will take additional actions as appropriate, including notifying affected individuals and regulatory authorities in compliance with applicable laws. > The Company is working diligently to restore the affected systems. The Incident has temporarily impacted the Company’s operations, including internal/external communications, shipping, receiving, manufacturing production, and various other support functions. While the Company has implemented measures to allow for the restoration of some operational functions, the timeline for a full restoration is not yet known. As the investigation of the Incident is ongoing, the full scope, nature, and impact are also not yet known. > As of the date of this filing, the Incident does not appear to have had a material impact on the Company’s business operations; however, the full scope and impact of this Incident is not yet known and could result in a future determination that the incident either was not or has been material to the Company's financial statements and results of operations. The expected costs related to the Incident, including fees for our cybersecurity experts and other advisors, and costs to restore any impacted systems, are reasonably likely to have a material impact on the Company’s results of operations and financial condition.

# 🏴 Important #GAYINT Announcement 🏴Due to the failures of the federal government and the corrupt shithole of an industry known as INFOSEC, the US Government is looking to the age of pirates for a solution. GAYINT is now announcing its latest named threat actor: Itself. APT 69420 AKA GREEDY GARBANZO is the privateer arm of GAYINT. Hoist the Colors and let scream the packets of Hell.

Bill would give hackers letters of marque against US enemies

: Bill would let US President commission white hat hackers to go after foreign threats, seize assets on the online seas

Bernie Sanders is once again asking you to block access to Telegram, especially in your corp environments. But also be careful with running random shit from the Internet, especially when it's marketed as an offensive tool.

Socket

Malicious Go Module Disguised as SSH Brute Forcer Exfiltrate...

A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.

#threatIntel

Microsoft suggesting hopes and prayers as mitigation for ClickFix.

Microsoft Security Blog

Think before you Click(Fix): Analyzing the ClickFix social engineering technique | Microsoft Security Blog

The ClickFix social engineering technique has been growing in popularity, with campaigns targeting thousands of enterprise and end-user devices dai...

#threatIntel

Whoopsie in Plesk. Kind of a fun one though. https://support.plesk.com/hc/en-us/articles/33785727869847-Vulnerability-CVE-2025-54336 > In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison. Thus, if the correct password is \"0e\" followed by any digit string, then an attacker can login with any other string that evaluates to 0.0 (such as the 0e0 string). This occurs in admin/plib/LoginManager.php.

I told the whole story here before, but was just reminded of the time I got our phishing training person to try something for me. They sent an email out that basically said "This is a phishing test email. Do not click the link. Report it as phishing. If you do not know how, ask a colleague, search the internal docs, or ask the help desk." The click rate was the same as any other campaign. They interpreted that as "users really are dumb and need more testing and training." But the appropriate take is that phishing testing aimed at users is bullshit and it should focus more on the security controls and procedures.