Weekly Security Sprint EP 114. Protests and a disrupted hostile event

In the latest episode of Nerd Out Alec and Dave welcome back show regulars Joe Levy and Bridget Johnson as they dissect the incidents in the Middle East. Topics included:Reaction to the escalation and then de-esscalation.What this means for organizations.The risk of sleeper cells or inspired / influenced individuals or groups.How to organizations can increase preparedness.Then the group of nerds moved to the weather and talked about the extreme heat and how weather preparedness is no longer optional for organizations.They wrap up the pod with some fun summer activities and what they are looking forward to in regards to pop culture events.

In this week's Security Sprint, Dave and Andy covered the following topics:Warm Open:• WaterISAC to host tabletop exercise to strengthen utility resilience• Maryland Man Charged With Mailing Threatening Communications to Jewish Organizations, Including a Jewish Institution in PhiladelphiaMain Topics:• DHS NTAS Bulletin, 22 June 2025. Summary of the Threat to the United States. o National Terrorism Advisory System Bulletin - Issued June 22, 2025 (PDF)o DHS Issues National Terrorism Advisory System Bulletin Amid Israel-Iran Conflicto US Department of State: Worldwide Caution• Top AI models will lie, cheat and steal to reach goals, Anthropic finds. Large language models across the AI industry are increasingly willing to evade safeguards, resort to deception and even attempt to steal corporate secrets in fictional test scenarios, per new research from Anthropic… Read: Anthropic: Agentic Misalignment: How LLMs could be insider threats• A potent heat dome is building over the US, sending temperatures into the triple digitsQuick Hits:• Scattered Spider Tactics Observed Amid Shift to US Targets• Scattered Spider has moved from retail to insurance• Retail Council Of Canada Member Notice: Cybersecurity Threat Actor Scattered Spider Attacks Retail Sector• Hackers Weaponize Legitimate 'Netbird' Tool in Phishing Campaign Targeting CFOs• Telecom giant Viasat breached by China's Salt Typhoon hackers• Cyber threat bulletin: People's Republic of China cyber threat activity: PRC cyber actors target telecommunications companies as part of a global cyberespionage campaign • Defending the Internet: how Cloudflare blocked a monumental 7.3 Tbps DDoS attack• 13 improvised explosive devices found at home of man arrested near Pennsylvania "No Kings" protest, DA says. “Without that one report from the vigilant person at the "No Kings" rally who noticed something suspicious about Krebs' behavior and reported to police, this threat and the disturbing stockpile of explosives may have gone undetected.”• Minnesota Shootings: After Two-Day Manhunt, Suspect Charged with Shooting Two Minnesota Lawmakers and Their Spouseso Vance Boelter went to other lawmakers' homes the night he killed Rep. Hortman, wounded Sen. Hoffman, FBI sayso Minnesota Shooting Suspect Allegedly Used Data Broker Sites to Find Targets' Addresseso When the Minnesota shooting suspect's life took a strange turno Minnesota shooting suspect Vance Luther Boelter is former pastor, Tim Walz appointeeo Inside the 40 hours of violence and fear as gunman stalks Minnesota politicianso Suspected Dem Killer Sent Cryptic Text to Family After Shootings• Booking photo released of former Coast Guard officer arrested over Trump assassination threats• Miscalculation by Spanish power grid operator REE led to massive blackout, report finds

In this episode of The Gate 15 Interview, Andy Jabbour speaks with Brian Hein and Kristen Dalton, with Silobreaker. Brian presently serves as a Senior Strategic Advisor, and Kristen is the Director, Channel Sales.In the podcast we discuss:​Brian and Kristen’s personal and professional backgrounds (did you know one of them played in two NCAA women’s basketball tournaments? And it wasn’t the guy known as “The Paul Revere of Cybersecurity.“).​Silobreaker, OSINT and making intel useful.​Threats, challenges and mitigating risks.​The power of communities, collaboration, and making connections (and of course, ISACs!).​We play 3 Questions! ​And talk about some of our favorite places, growing up on the internet, and pork chops.​Lots more!

In this week's Security Sprint, Dave went solo to talk about:The LA ProtestsA disrupted hostile event and recognizing concerning behaviors.

In this week's Security Sprint, Dave and Andy covered the following topics:Warm Start:·      The Gate 15 Interview EP 58 – Cathy Lanier: Leading NFL Security with Attitude, Effort, Crabs and Beer·      Gate 15: Test, Don’t Guess: Exercising Your Response Plan·      WaterISAC’s H2OEx: Click Below to Register for a Location Near You! o  Daytona, FL- July 28 o  Los Angeles, CA- Sept 11 o  Arlington, TX- Nov 6·      26th Annual TribalNet Conference & Tradeshow Main Topics: Boulder:·      DOJ: Justice Department Files Federal Charges Against Alleged Perpetrator of Anti-Semitic Terror Attack in Colorado. The Justice Department has filed federal charges against illegal alien Mohammed Sabry Soliman, the alleged perpetrator of yesterday’s anti-Semitic terrorist attack in Colorado… Soliman is being charged with a federal hate crime in addition to facing state charges for attempted murder in Colorado. Read the federal complaint HERE·      Updates: Colorado Attack That Injured 12 Was Planned for a Year, Officials Say. The F.B.I. said in a court filing that thesuspect, an Egyptian citizen who had sought asylum in the U.S., brought more than a dozen incendiary devices to a march in support of hostages in Gaza.·      Colorado suspect, now charged with federal hate crime, planned antisemitic attack for a year, FBI says·      12 burned in Boulder attack; suspect charged with federal hate crime:·      Boulder terror attack suspect planned mass shooting but was stopped from buying gun due to immigration status, as he faces 624 years in prison·      What We Know About the Boulder, Colorado Attack·      After Several Attacks, Heightened Anxiety Among American Jews Pride Month: Trans community most targeted in anti-LGBTQ+ incidents, GLAAD data shows. Transgender and gender-nonconforming people were the target of over half of allanti-LGBTQ+ incidents tracked by GLAAD over the last year in a new report… GLAAD counted more than 930 anti-LGBTQ+ incidents from May 2024 through April 2025, 52% of which targeted transgender and gender nonconforming people, across 49 states and Washington, D.C. Insider Threat:o  U.S. Government Employee Arrested for Attempting to Provide ClassifiedInformation to Foreign Government. ·      Intelligence agency employee accused of attempting to leak classified documents out of frustration with Trump.  Ransomware! ·      Gate 15: Test, Don’t Guess: Exercising Your Response Plan·      Q1 '25 Travelers' Cyber Threat Report: Record Attack Activity·      Delinea - 2025 State of Ransomware Report - Adapting with agility to a fast-changing threat landscape·      FBI PIN - Silent Ransom Group Targeting Law Firms·      Firm in Baltimore Archdiocese bankruptcy case says stolen data wasdeleted after cyber breach·      Akira Ransomware: When Paying Isn’t Enough to Stay Anonymous·      The State of State-Sponsored Hacktivist Attacks Quick Hits·      Ukraine launches massive drone strike on air bases deep inside Russia ·      Crypto Hacks in May 2025 Hit $244M, But $157M Frozen in Swift Recovery Efforts·      FBI FLASH: Infrastructure Used to Manage Domains Related to Cryptocurrency Investment Fraud Scams between October 2023 and April 2025 ·      US DIA 2025 Threat Assessment warns of growing complexity in global threats, national security·      DIA Releases 2025 Worldwide Threat Assessment: Cyber, Cartels, and Global Military Buildup Dominate Outlook·      Get ready for several years of killer heat,top weather forecasters warn·      America's summers keep getting warmer·      North Korea Infiltrates U.S. Remote Jobs—With the Help of Everyday Americans·      Tornado season 2025: active through April, andMay is keeping pace·      Treasury Takes Action Against Major Cyber Scam Facilitator

In the latest episode of Nerd Out, Dave and Alec ran through some of the incidents over the past week to talk about what happened, what impact it has on organizations, and what strategies organizations can take. The events included discussions on:Severe weather to include NOAA's latest hurricane forecast.Sabatoge in France.Geopolitical events hitting the homeland.The second season of Andor.Extreme Weather PreparednessNOAA predicts above-normal 2025 Atlantic hurricane season - https://www.noaa.gov/news-release/noaa-predicts-above-normal-2025-atlantic-hurricane-seasonWeather-related Power Outages Rising - https://www.climatecentral.org/climate-matters/weather-related-power-outages-risingAnti-government group threatens crucial weather radars, NOAA warns - https://www.washingtonpost.com/nation/2025/05/07/anti-government-weather-radar-conspiracy/How to Prepare for a Hurricane - https://www.fema.gov/blog/how-prepare-hurricaneFrance Sabotage AttacksFrance blames sabotage for second Riviera blackout, boosts security - https://www.france24.com/en/europe/20250526-france-sabotage-power-blackout-cannes-nice-rivieraHeightened Political Violence and Nihilistic Violent ExtremismWhy White Supremacists Are Trying to Attack Energy Grids - https://www.nytimes.com/2024/08/08/us/white-supremacist-power-grid-attacks.htmlJewish Museum killings show how hard it is to stop radicalized lone wolf attacks - https://www.nbcnews.com/news/amp/rcna208656The Escalating Attacks on Tesla Facilities - https://www.csis.org/analysis/escalating-attacks-tesla-facilitiesHow Burning Teslas and Killing Billionaires Became a Meme Aesthetic for Political Violence - https://networkcontagion.us/wp-content/uploads/NCRI-Assassination-Culture-Brief.pdf‘Welcome Spring, Burn a Tesla’: The Insurrectionary Anarchist Campaign Against Tesla - https://gnet-research.org/2025/05/21/welcome-spring-burn-a-tesla-the-insurrectionary-anarchist-campaign-against-tesla/Nihilistic Violent Extremism: A Valuable Stride Forward in American Counterterrorism - https://www.justsecurity.org/113463/nihilistic-violent-extremism-american-counterterrorism/

In this episode of The Gate 15 Interview, Andy Jabbour speaks with Cathy Lanier, Senior Vice President and Chief of Security at the National Football League. Prior to serving in her current role as Senior Vice President and Chief of Security at the National Football League, Lanier held the position of Chief of Police with the Washington, D.C. Metropolitan Police Department (MPD) from 2007 to 2016. From 1990, Cathy rose through the ranks of the MPD to earn various commendable honors including becoming the first female police chief of the nation’s capital, the first commanding officer of Homeland Security and Counter-Terrorism for D.C. Police, one of a small number of female chiefs in the nation at the time, and the longest serving chief on the D.C. force. Now, as the Chief of Security for the National Football League, Lanier safeguards the security of all 32 NFL teams and their venues, liaises and collaborates with federal, state and local law enforcement, and ensures security for League events like the Super Bowl. Learn more about Cathy on LinkedIn.“We can do everything right and bad things can still happen” – Cathy Lanier, Senior Vice President and Chief of Security at the National Football League.In the discussion Cathy and Andy cover:Cathy’s Background.The 2013 Washington Navy Yard Shooting and Hostile EventsThe importance of exercises, challenging our assumptions, and after-action reports.Her two biggest lessons learnedThe ever-growing mission of securing the NFLCybersecurity, socio-political divisiveness and radicalizationGetting leadership buy-inPrivate-public partnershipThe Human Factor: Getting immersed and getting intelligenceHaving empathy and understanding the other sideDealing with adversityWe play 3 Questions!Lots more!Selected links:NFL Videos:Cathy Lanier explains her role as the NFL's Chief Security Officer. Cathy Lanier, the NFL’s Chief Security Officer, describes her transition from protecting the President of the United Sates as the first female police chief in Washington D.C. to providing the same security for the largest sporting event.NFL 360 | THE CHIEF. NFL senior vice president of security Cathy Lanier faces extraordinary crises and challenges on a daily basis, in one of the most high-profile pressure cooker positions in the sports world.MPD Navy Yard After Action ReportGuard Killed In Holocaust Museum Shooting

In this week's Security Sprint, Dave and Andy talked about the following topics:Warm Opening:• Gate 15 - Blueprints Before Breaches: Planning for Ransomware Resilience. This blog is part of Gate 15’s Summer of Security: Ransomware Resilience Series, highlighting the essential considerations for organizational leaders and cybersecurity professionals. Planning for a ransomware attack is a vital component of any organization’s cybersecurity strategy. Having a ransomware plan is important because it helps organizations prepare for, respond to, and recover from ransomware attacks effectively.• H2OSecConPalm Springs Bombingo FBI links California fertility clinic bombing to anti-natalist ideologyo Online manifesto threatened clinic attack; FBI probes Palm Springs bomb suspect’s motiveo 25-year-old suspect in fertility clinic bombing left behind ‘anti-pro-life’ writings, officials sayo What we know about the Palm Springs bombero Palm Springs IVF clinic bomber ID’d as Guy Edward Bartkus, a ‘pro-mortalist’ who opposed people being born ‘without their consent’o Palm Springs Bombing Suspect Burned Down Family Home Aged 9, Father Says• Hate Amplified: Online Posts About U.S. Judges Take Increasingly Violent Turn• Michigan Man Arrested and Charged with Attempting to Attack Military Base on Behalf of ISIS• The Delirious, Violent, Impossible True Story of the Zizians• The world’s largest incel forum reacts to Netflix’s Adolescence with hate and conspiracies• First Responders Toolbox: Large Public Gatherings Attractive Targets for Violent ExtremistsCoinbase & Insider Threat• Protecting Our Customers - Standing Up to Extortionists • Coinbase Global, Inc. & 8-K filed on 2025-05-15• Coinbase flips $20M extortion demand into bounty for info on attackers; The largest cryptocurrency exchange in the U.S. said cybercriminals bribed insiders to steal data on customers, some of whom were duped into handing over crypto assets.• Coinbase says customers’ personal information stolen in data breach• Insider Bribes Behind Coinbase Hack Exposing Customer Data• Coinbase responds to USD 400 million insider threat attack | Cyber Intelligence Briefing: 16 May 2025Weather. 28 dead, half a million without power as deadly storms, tornadoes sweep across central, eastern US. At least 28 people have died and dozens more were injured after a devastating wave of severe weather swept across the central United States late Friday into Saturday, leaving a trail of catastrophic destruction. Large tornadoes have been reported in Missouri, Kentucky, Illinois and Indiana with hard-hit southeastern Kentucky reporting a majority of the fatalities. According to Kentucky Governor Andy Beshear, there were 18 confirmed deaths in the state connected to the severe weather. The fatalities include 17 people in Laurel County and one in Pulaski County. Quick Hits: • FBI PSA: Senior US Officials Impersonated in Malicious Messaging Campaign• FBI PSA: Impersonation Scheme Targeting Middle Eastern Students in the United States• Update to How CISA Shares Cyber-Related Alerts and Notifications• Securing Critical Infrastructure: GitGuardian Partners with ONE-ISAC to Protect Oil & Natural Energy Operations• AMWA throws support behind CISA reauthorization• Major Crypto Firms Spending Millions on Personal Security• Crypto elite increasingly worried about their personal safety• France Launches Crypto Security Measures After Targeted Kidnapping Surge• The US hasn’t seen a human bird flu case in 3 months

On this week's Security Sprint, Dave and Andy covered the following topics:Warm Open:• ICYMI: REGISTER NOW! WaterISAC’s 2025 H2OSecCon! (20 May) From cybersecurity to climate resilience, operational continuity to public trust, we must collaborate across sectors to build smarter, stronger, and more adaptive systems. That’s why we’re inviting leaders like you to join the WaterISAC’s 2025 H2OSecCon. Connect with peers and leaders committed to enhancing the resilience of our nation's critical systems.Main Topics:Ransomware & Data Breaches: • Monday was Anti-Ransomware Day 2025! What a great time to invest in ransomware resilience! Contact Gate 15 today to get to work building your Cyber Incident Response Plan and ransomware procedures, to start planning your next ransomware workshop or tabletop exercise, to plan for post-incident analysis or to take advantage of our new very price-friendly ransomware exercise for executives – designed especially for small and medium businesses! • Explore the latest cyber risks and claims trends from Coalition. LockBit ransomware gang hacked, victim negotiations exposed• Reminder! Criminals lie and NEVER DELETE YOUR DATA! School boards hit with ransom demands linked to PowerSchool cyberattack• M&S 'had no plan' for cyber attacks, insider claims, with 'staff left sleeping in the office amid paranoia and chaos' • The Very Real Costs of Ransomware: IT warning after hackers close 160-year-old firm. Extremism:• Ohio Man Charged with Threatening State Public Officials • Texas Man Convicted of Making Threats to Kill Nashville District Attorney Glenn Funk • FBI has opened 250 investigations tied to violent online network '764' that preys on teens, top official says• Teenage Terrorists Are a Growing Threat to Europe’s SecurityUSG Transitions• Trump’s 2026 budget proposes $163 billion cut to non-defense spending, slashes CISA and FEMA funding• White House Proposes $500 Million Cut to CISA• Hegseth orders Pentagon to cut number of senior generals by 20%• Lawmakers question Noem over cuts to CISA, FEMA, TSA• Lawmakers grill Noem over CISA funding cuts, demand Trump cyber plan• NSA to cut up to 2,000 civilian roles as part of intel community downsizing• NIST loses key cyber experts in standards and researchIndia strikes Pakistan over tourist killings, Pakistan says it will retaliate• Kashmir crisis live: Pakistan PM authorises armed forces to undertake ‘corresponding action’ after India strikes kill 26• Pakistan vows to respond after India launches strikes in wake of Kashmir massacre• Pakistan claims to have downed Indian warplanes, vows response to strikes• China urges restraint as India-Pakistan tensions escalate with military strikes• A Timeline of Tensions Between India and Pakistan Over Kashmir• India, Pakistan accuse each other of attacks as hostilities rise• AlQaeda Statement On Indian Strikes In PakistanQuick Hits:• Crypto millionaires targeted in brutal kidnappings across France and Europe; Attackers' modus operandi: cutting off victims' fingers to pressure payments. • The father of a cryptocurrency entrepreneur was kidnapped in Paris and found held captive with his finger severed. (article in French)• Assessing the U.S. Climate in April 2025Assessing the U.S. Climate in April 2025• FBI PSA - Cyber Criminal Proxy Services Exploiting End of Life Routers• FBI FLASH: Cyber Criminal Services Target End-of-Life Routers to Launch Attacks and Hide Their Activities (PDF)• Risky Bulletin: France says Russian influence operations are getting better, achieving results• Unsophisticated Cyber Actor(s) Targeting Operational Technology • Primary Mitigations to Reduce Cyber Threats to Operational Technology• US Warns of Hackers Targeting ICS/SCADA at Oil and Gas Organizations• Primary Mitigations to Reduce Cyber Threats to Operational Technology• UK NCSC: UK pioneering global move away from passwords• Classic Rock - Hunting A Botnet That Preys On The Old

In the latest Security Sprint, Dave and Andy covered the following topics:Warm Open:• (TLP:CLEAR) WaterISAC – EPA: National Security Information Sharing Bulletin - Q2 2025• REGISTER NOW! WaterISAC’s 2025 H2OSecCon! Happening virtually Tuesday May 20th from 11am-5pm ET. Learn more and register here! • Crypto ISAC Expands Leadership Team to Support Next Phase of Industry Collaboration and Operational Scale & Crypto Hacks and Scams Hit $364M in April, Says CertiK• Continuity Planning: Conducting Tabletop Exercises; Facilities teams need to participate in Tabletop exercises to prepare for emergency events and situations. Main Topics:Physical Security• Brazil police thwart bomb attack on Lady Gaga concerto Two Arrested in Plot to Bomb Lady Gaga’s Rio Concert• Florida Man Arrested in Foiled Mass Shooting Plot – Church Listed Among Targetso Arrest in Florida reveals love link, conspiracy between man and Wisconsin school shootero Loxahatchee man linked to WI school shooter accused of 7 mass shooting threats• Eight arrests in connection with two separate terrorism investigations o UK Met: Five arrested as part of Counter Terrorism Policing operationo UK Met: Three people arrested as part of Counter Terrorism Policing operationo ‘Iranian terror attack’ foiled with hours to spare; Authorities feared attack on ‘specific premises’ was imminent as seven arrested• Teen Arrested In German Synagogue Attack PlotSevere Weather• NOAA: Hurricane Prep: social media (English). The Hurricane Preparedness Week Social Media Plan.• Monster quake could sink swath of California.o Tsunami Warning Issued After Huge Earthquake Off Argentinao Earthquake of magnitude 5.83 strikes La Rioja Province, Argentina, GFZ saysCybersecurity• Q1 Ransomware Report: The organizational structure of ransomware threat actor groups is evolving before our eyes.• Surefire Cyber: Ransomware Threat Evolution Q1 2025• Retail Ransomware Attacks Claimed by DragonForce:o Incidents impacting retailers – recommendations from the NCSCo Co-op cyber attack affects customer data, firm admits, after hackers contact BBCo Co-op confirms data theft after DragonForce ransomware claims attacko DragonForce Ransomware Gang | From Hacktivists to High Street Extortionistso DragonForce Ransomware Cartel attacks on UK high street retailers: walking in the front dooro Marks & Spencer breach linked to Scattered Spider ransomware attacko NCSC statement: Incident impacting retailerso Luxury store Harrods is latest retail victim of cyber attackers o Harrods is latest British retailer to be hit by cyber attacko UK Retailers Co-op, Harrods and M&S Struggle With Cyberattackso Harrods the next UK retailer targeted in a cyberattackQuick Hits:• Hello 0-Days, My Old Friend: A 2024 Zero-Day Exploitation Analysis • FBI PSA: Threat Actors Use "Swatting" to Target Victims Nationwide, April 29, 2025• TLP CLEAR FBI FLASH Phishing Domains Associated with LabHost PhaaS Platform Users (PDF)• With Love, From North Korea… 🇰🇵o North Korea Stole Your Jobo Malicious North Korean actors attempt to infiltrate technology companieso North Korean operatives invent identities to infiltrate industrieso How we identified a North Korean hacker who tried to get a job at Krakeno Recruitment Red Flags: Spotting DPRK IT Remote Workers• Noem calls for reauthorization of cyberthreat information sharing law during RSA keynote• Some DHS employees told to send selfies to prove they are in-office as department suddenly ends remote work• CISA restructuring plan release date unknown and likely to be slowed by Plankey nomination• Spain, Portugal switch back on, seek answers after biggest ever blackouto The Agonizing Task of Turning Europe’s Power Back Ono NERC: Statement on European Outageso What Caused the European Power Outage?