Weekly Security Sprint EP 136. A full menu of insiders, a new AWS report, and a lot of quick hits

In this week's Security Sprint, Dave and Andy covered the following topics:Warm Open:• Trump suggests US used cyberattacks to turn off lights in Venezuela during strikes• Protests in US cities over Trump’s military intervention in Venezuela• Trump Ramps Up Incendiary Threats After Venezuela Strike• White House: RUBIO: This Is Our Hemisphere — and President Trump Will Not Allow Our Security to be Threatened• PMs of Greenland, Denmark tell Trump to stop U.S. takeover threatsMain Topics:Leftwing militants claim responsibility for arson attack on Berlin power grid. Protest over climate crisis and AI has cut power to tens of thousands of homes which may take days to fully restore. The Vulkangruppe (Volcano Group) said it had deliberately targeted some of the city’s wealthiest districts.Ransomware:• Recorded Future: New ransomware tactics to watch out for in 2026• Semperis: What CISOs Need to Know About Fighting Ransomware in 2026 • Top 10 Ransomware Groups of 2025MFA: Dozens of Global Companies Hacked via Cloud Credentials from Infostealer Infections & More at Risk. This report provides a granular reconstruction of the compromised assets. Furthermore, we demonstrate that these catastrophic security failures were not the result of zero-day exploits in the platform architecture, but rather the downstream effect of malware infections on employee devices combined with a critical failure to enforce Multi-Factor Authentication (MFA).• One criminal, 50 hacked organizations, and all because MFA wasn't turned on. "Because the organizations listed below did not enforce MFA, the attacker walks right in through the front door," the cybersecurity shop said in a Monday report. "No exploits, no cookies – just a password."• Cloud file-sharing sites targeted for corporate data theft attacksAI Deepfakes Are Impersonating Pastors to Try to Scam Their Congregations; Religious communities around the US are getting hit with AI depictions of their leaders sharing incendiary sermons and asking for donations. Quick Hits:• Bleeping Computer: The biggest cybersecurity and cyberattack stories of 2025 • Infosecurity's Top 10 Cybersecurity Stories of 2025• Supply chains, AI, and the cloud: The biggest failures (and one success) of 2025.• Two Americans Plead Guilty to Targeting Multiple U.S. Victims Using ALPHV BlackCat Ransomware• CISA Known Exploited Vulnerabilities Surged 20% in 2025; CISA’s Known Exploited Vulnerabilities (KEV) Catalog Grew By 20% In 2025, Including 24 Vulnerabilities Exploited By Ransomware Groups

On the latest episode of Nerd Out, Dave and Alec dig into the Bondi Beach attack and what lessons can be learned before looking at the NYE attack that was disrupted. Then the looked at some of the security predictions made earlier in the year to see if they hit the mark. They wrapped up with a prediction of their own for 2026. Then they turned to the other nerd news and talked about some of the latest trailers before talking about their favorite show of the year!

In this week's Security Sprint, Dave and Andy covered the following topics:Warm Open:• Cyware!• New! The Gate 15 Interview EP 65: Yearend ISAC Extravaganza! • 2025 CWE Top 25 Most Dangerous Software Weaknesses• CISA Unveils Enhanced Cross-Sector Cybersecurity Performance GoalsMain Topics:Bondi Beach Hanukkah Attack:• NYT Live Updates: Sydney Gunmen Were Motivated by ISIS, Australia’s Leader Says• Gunmen kill at least 15 people in attack on Hanukkah celebration on Sydney’s Bondi Beach • Join FB-ISAO. If you’re involved with a place of worship or charity, please make sure they’re plugged in!• Gate 15’s Hostile Events Attack Cycle white paper• Germany foils suspected Islamist car ramming plot targeting Christmas market • 'F*** the Jews': Gunman fires 20 bullets into Jewish family's hanukkah-decorated home in California• Virginia mosque attacked, Muslim advocates call for hate crime chargesWhat we know about the Brown University shooting that killed 2 and injured 9 Cybersecurity Updates: • ASD: Annual Cyber Threat Report 2024-2025 • 5 lessons we learned from our ransomware attack• Dragos Industrial Ransomware Analysis: Q3 2025 • Alleged Coupang data leaker had only worked at company for two years, say police• Users report chaos as Legal Aid Agency stumbles back online after cyberattack• Canadian Centre for Cyber Security: RansomwareQuick Hits:• Opportunistic Pro-Russia Hacktivists Attack US and Global Critical Infrastructure• CISA warns China has penetrated U.S. infrastructure, threatens 2027 turning point• New Product! Active Shooter Response – Poster

In this episode of The Gate 15 Interview, Andy Jabbour speaks with leaders from the Information Sharing and Analysis Center (ISAC) community on the Cybersecurity Information Sharing Act, the government shutdown, the role and future of ISACs and what to look forward to in 2026. Experts include:Errol Weiss, CSO, Health-ISACAdam Gruszcynski, IT Director at Potawatomi Casino Hotel & Tribal-ISAC Steering Committee MemberKimberly Denbow, Vice President, Security and Operations, AGA & Executive Director, DNG-ISACChris Anderson, Principal Advisor, National Security and Emergency Preparedness at LumenIn the discussion the panel covers:The Cybersecurity Information Sharing Act of 2015 (CISA 2015), it’s recent and potential lapse and how it impacted cyber threat information sharing and collaboration.The recent and potentially upcoming federal government shutdown and how the ISACs operated and were impacted.From the TribalNet Cybersecurity Summit to the Natural Gas Exercise 2026 (NGX-2026), operationalizing AI, and growing critical global partnerships – the group discusses some of the many things that they’re excited about heading into 2026.Plus! The team plays one question! Warren G: Regulators! And more!Selected links:Health-ISACTribal-ISACDNG-ISACCongress extends CISA 2015, but path to long-term reauthorization remains murky

In this week's Security Sprint, Dave and Andy covered the following topics:Warm Open:• TribalHub Magazine, Winter 2025: A Publication For Technology Minded Professionals In Tribal Government Tribal Health, Tribal-Gaming And Non-Gaming Tribal Enterprises. Includes Tribal-ISAC happenings!• React2Shell: Risky Bulletin: APTs go after the React2Shell vulnerability within hours & Critical Security Vulnerability in React Server Components • We discussed our daily SUN and Weekly Ransomware & Data Breach Digest available via Gate 15’s GRIP: Join the GRIP! Gate 15’s Resilience and Intelligence Portal (GRIP) utilizes the robust capabilities available in Cyware’s Collaborate platform to provide the community with technology-enhanced, human-driven analysis products. Further, our team supports the implementation and use of Cyware Collaborate at the Enterprise level. Main Topics:FinCEN Issues Financial Trend Analysis on Ransomware. The U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) is issuing a Financial Trend Analysis on ransomware incidents in Bank Secrecy Act (BSA) data between 2022 and 2024, which totaled more than $2.1 billion in ransomware payments… Previous FinCEN Financial Trend Analyses have focused on reported ransomware payments and incidents by the date the activity was filed with FinCEN. Today’s report shifts the focus to the incident date of each ransomware attack and offers greater visibility into the activities conducted by ransomware actors.• Reported Ransomware Incidents and Payments Reach All-Time High in 2023• FinCEN Data Shows Ransomware Payments Top $2.1B in Just Three Years• Financial Services, Manufacturing, and Healthcare were the Most Impacted Industries• The Onion Router (TOR) was the Most Common Communication Method Reported• ALPHV/BlackCat was the Most Prevalent Ransomware Variant Between 2022 and 2024• FinCEN analysis shows scope of ransomware problemFive-page draft Trump administration cyber strategy targeted for January release; The six-pillar document covers a lot of ground in a short space, and could be followed by an executive order implementing it, according to sources familiar with the draft. America 250: Presidential Message on the Anniversary of the Monroe Doctrine• Here’s what the new National Security Strategy says about threats to critical infrastructure• New US National Security Strategy reveals Trump administration’s latest stance on TaiwanFBI PSA: Criminals Using Altered Proof-of-Life Media to Extort Victims in Virtual Kidnapping for Ransom Scams. The Federal Bureau of Investigation (FBI) warns the public about criminals altering photos found on social media or other publicly available sites to use as fake proof of life photos in virtual kidnapping for ransom scams. The criminal actors pose as kidnappers and provide seemingly real photos or videos of victims along with demands for ransom payments… Criminal actors typically will contact their victims through text message claiming they have kidnapped their loved one and demand a ransom be paid for their release. Oftentimes, the criminal actor will express significant claims of violence towards the loved one if the ransom is not paid immediately. The criminal actor will then send what appears to be a genuine photo or video of the victim’s loved one, which upon close inspection often reveals inaccuracies when compared to confirmed photos of the loved one. Examples of these inaccuracies include missing tattoos or scars and inaccurate body proportions. Criminal actors will sometimes purposefully send these photos using timed message features to limit the amount of time victims have to analyze the images.Quick Hits:• US leader of global neo-Nazi terrorist group signals retribution for arrests• ASD: Information stealers are on the rise, are you at risk? • UK NCSC: Prompt injection is not SQL injection (it may be worse)

In this week's Security Sprint, Dave and Andy covered the following topics:Warm Open:• WaterISAC – EPA: National Security Information Sharing Bulletin – Q4 2025 & Access the PDF• Canadian Centre for Cyber Security: The cyber threat to Canada’s water systems: Assessment and mitigation• Canadian Centre for Cyber Security: Don't take the bait: Recognize and avoid phishing attacks - ITSAP.00.101• How cannabis businesses can go digital while thwarting hackers Main Topics:• Semperis Warns That Holiday & Weekend Gaps Leave Critical Infrastructure Open to Ransomware Attacks• FBI San Diego Warns Shoppers to Be Aware of Scams During the 2025 Holiday Season• FBI PSA: Account Takeover Fraud via Impersonation of Financial Institution Support• Take9: Cyber threats are everywhere. And getting sneakier. What can you do to protect yourself, your community and our nation? Take a 9-second pause and think before you click, download, share. A short pause goes a long way.• JCAT First Responder's Toolbox: Tech Sector Outreach: Identifying Violent Extremist Indicators and Reporting Mechanisms for Online Service Providers Quick Hits:• OnSolve CodeRED cyberattack disrupts emergency alert systems nationwide• CISA: Mobile Communications Best Practice Guidance • CISA: Spyware Allows Cyber Threat Actors to Target Users of Messaging Applications

On this week's Security Sprint, Dave and Andy get ready for hte holidays with a full menu of topics that include:Warm Open:·      Happy23rd birthday to DHS!·      WaterISAC’s Quarterly Water SectorIncident Summary, April to June 2025 – Executive Summary·      GridEx VIII – Surge in ParticipationReflects Importance of Exercising Emergency Preparedness·      Cloudflare outage on November 18, 2025 Main Topics: Insider Threats: Former contractor admits to hackingemployer in retaliation for termination·      CrowdStrike catches insider feeding information to hackers·      Rising cost of trust as insider behavior becomes a weak link in critical infrastructure cyber defense Blended Threats, you say? AWS: New Amazon Threat Intelligence findings: Nation-state actors bridging cyber and kinetic warfare &  Amazon details Iranian “cyber-enabled kinetic targeting” operations  Quick Hits:·      House AI terrorism bill spotlights extremist use of generative AI for propaganda and training  ·      Obscura Ransomware: A Case Study in Ransomware Data Loss·      Overconfidence is the new zero-day as teams stumble through cyber simulations·      The SANS 2025 State of ICS Security Report: Progress, Pressure, and the Path to Resilience·      CISA Releases New Guides to Safeguard Critical Infrastructure from Unmanned Aircraft SystemsThreats·      Bulletproof Defense: Mitigating Risks From Bulletproof Hosting Providers·      United States, Australia, and United Kingdom Sanction Russian Cybercrime Infrastructure Supporting Ransomware 

In this week's Security Sprint, Dave and Andy covered the following topics:Warm Open:• Happy Birthday to CISA! The Cybersecurity and Infrastructure Security Agency turned seven on Sunday. • Government funding bill temporarily revives cybersecurity information-sharing law• The Gate 15 Interview EP 64: Cody Barrow, CEO, EclecticlQ. “Nothing in cyber happens without a reason.”• Faith-Based (U.S.): FB-ISAO Newsletter, v7, Issue 10Main Topics:Cybersecurity!• OWASP Top Ten. Welcome to the 8th installment of the OWASP Top Ten! • ASD: Annual Cyber Threat Report 2024-2025• Checkout.com: Protecting Our Merchants: Standing Up to Extortion: “We will not be extorted by criminals. We will not pay this ransom.” Holidays & Hostile Events!• Europol: 10 years on: remembering the victims of the 13 November terrorist attack in Paris• DOJ: New Jersey Man Charged with Cyberstalking in Connection with Violent Network ‘764’• Indiana Republican called out by Trump on redistricting is swatted• Marjorie Taylor Greene Says She Received Pipe Bomb Threat: What We Know• Terror plot arrests reveal ‘more dangerous’ online pathway to ISIS radicalization in America• Suspects charged in alleged Michigan Halloween terror plot eyed attack on Chicago Pride Parade: Docs • Racists are now openly targeting Indian Americans• Is left-wing terrorism returning? Quick Hits:• Blended Threats! Risky Biz News - German TV station hacked: A cyberattack has disrupted the broadcast of German radio station Radio Nordseewelle. Hardware components were damaged in the attack and had to be replaced. The broadcaster said it had to rebuild large parts of its IT network. The hack took place days after a similar incident crippled the transmission of Dutch radio and TV station RTV Noord. [Tarnkappe]

In this episode of The Gate 15 Interview, Andy Jabbour speaks with Cody Barrrow, CEO, EclecticlQ. Cody is a cybersecurity industry leader with over 20 years of public and private sector experience in the US and EU, holding leadership positions within the Pentagon, National Security Agency/US Cyber Command, Fortune 25, and commercial vendors as well as a number of other positions with the US Government and across the cybersecurity community. Since 2019, he has been with EclecticIQ, the Amsterdam-based European leader in cybersecurity technologies servicing central governments and large enterprises, where he took over as Chief Executive Officer in 2024. Cody has a Bachelor of Science in Political Science from the University of Maryland. Learn more about Cody on LinkedIn.In the discussion Cody and Andy cover:Cody’s background.EclecticIQ, “The Threat Intelligence Platform that understands your business”“I’m not really big on hype.” Cody’s perspective on threats, resilience, AI and more.Single points-of-failure, reducing dependencies, and “being anti-fragile”The importance of being adaptableCoffee and whisky, all day longBeing an ex-patRanch dressingAnd more!Selected links:⁠EclecticIQ⁠

In the latest episode of Nerd Out, Dave and Alec are joined by Joe Levy who talks about his role and the day to day of managing a venue. Then the group talks about outdoor venue security and other preparedness activities incorporating drone threat and building lasting partnerships. The gang then talked about winter weather preparedness before wrapping up their security talk with a look back to the recent elections and a look ahead to 2026.Finally, they continued their holiday kick-off with a run through their favorite holiday food and drinks.