CYOPS
Cyber Operations
Detection, response and mission delivery in contested networks, and how operations are actually run.
18 articles
Latest
- Four state-aligned actors shared one exploit chain, built from a fix anyone could read The BlueMoon timeline is fully dated: bug reported 4 August, fix visible in the open Chromium tree 7 August, exploitation from 28 August, Chrome Stable patched… 6 min 12 sources
- CLOSEDQUORUM does not remove the C2 chokepoint. It hands it to four vendors. Cisco Talos has published an implant that puts its next action to a vote across four commercial language model providers. The architecture is new; the sample… 6 min 17 sources
- Japan’s record ransomware half-year is a supplier problem, and the two counts of it disagree Police recorded 123 cases; Cisco Talos recorded 90 organisations. Both show the same shift: the victims are small manufacturers, and most of them sit outside every… 5 min 11 sources
- The indicators are disappearing: intrusions are moving onto infrastructure you cannot block Across four separate 2026 investigations, operators used legitimate cloud storage for command and control, one-time infrastructure per victim, and tooling already present on the host. The… 5 min 11 sources
- Six ransomware trackers, six different answers Leak-site counting now feeds board packs, insurance pricing and national policy. The published 2026 figures disagree on victim totals, on how many groups are active, and… 5 min 10 sources
- Berlin’s harder problem started after the data was published Refusing to pay ended the negotiation and began a different operation: reading 1.4 million files of unstructured shared-drive material to work out who has to be… 5 min 12 sources
- AI has compressed attacker tempo, not attacker capability Google's threat intelligence group records agent-driven credential harvesting completed in under six hours. Unit 42 found that roughly 97% of AI-related malware samples never left a… 6 min 12 sources
- Volume up, encryption down: what 2026’s ransomware data changes Victim counts hit records while the share of cases involving encryption fell. Extortion is separating from ransomware, and most response plans are still written for the… 4 min 11 sources