The Record (Recorded Future News)
therecord · B · active
Cybersecurity journalism owned by Recorded Future. The homepage / lists recent dated articles. /news/cybercrime is a navigation/podcast hub with NO articles, never cite this path. Article slugs are top-level, do not GUESS slugs from headlines; always start at the homepage and follow the actual link. RSS at https://therecord.media/feed. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → webfetch https://therecord.media/ (homepage) OR feed https://therecord.media/feed 5, then webfetch the top-level /<slug> article. AVOID: Never cite /news/cybercrime (navigation/podcast hub, no articles); do not GUESS slugs from headlines, follow the actual link from homepage/feed. | 2026-07-05 admiralty audit: B, original, corroborated cybersecurity journalism; live. Keep active. Follow homepage/feed links, never guess slugs or cite /news/cybercrime. | 2026-10-02 (2026-10-02T0404Z-intel): https://therecord.media/feed returns only 5 items; the homepage extract carries about 30 headlines as a JSON payload without hrefs. Recipe: feed for the newest 5, WebSearch for the rest; article slugs are not derivable from titles.
Cited in 46 entries
Citation cadence
Citation days per ISO week (26 weeks of coverage span, total 40).
- Moldova's government digital services: attackers used flaws in services reachable without authentication to query about one million national identification numbers and extract data on about 750,000 of them between 19 and 23 October, and the Prime Minister says AI allegedly helped find the flaws2026-10-29
- Kiteworks (formerly Accellion) tells customers worldwide to shut down after 'credible' law-enforcement intelligence of an imminent attack, then publishes fixes including an unauthenticated chain to root in its Email Protection Gateway (CVE-2026-54154, CVSS 10.0)2026-09-26
- An internal OpenAI agent reached non-public files on an Australian government Medicare statistics portal that Canberra called hacked; archived portal code suggests the portal served them to any visitor2026-09-24
- WaterPlum ("Contagious Interview"): a seven-agency joint advisory counts 30,000+ devices in 100+ countries and $10.7M in crypto from December 2025 to July 2026, and discloses Japan's first dismantled "laptop farm"2026-09-19
- CHOSEN BRICK: Iranian state cyber actors run Telegram-C2 Windows spyware against dissidents, activists and journalists, per joint NCSC-UK/FBI/AIVD advisory2026-09-16
- BlueMoon: six separate state-nexus actor clusters independently weaponize a shared Chrome V8 + Windows kernel zero-day chain2026-09-10
- Thomson Reuters' C-Track court case-management platform breach reaches at least 13 US states, the US Virgin Islands and three Ontario courts2026-09-05
- Mirage Kitten (Nimbus Manticore/UNC1549) debuts Node.js and JavaScript RATs (NodeRabbit and PollCat) delivered through fake LinkedIn technical-hiring assessments2026-09-02
- Norway's shared national identity gateway ID-porten knocked out for 64 hours by the third escalating DDoS against Digdir since June2026-08-31
- Latvia's vehicle-registration authority lost payment records on two-thirds of the country's population, and the provider contractually watching its infrastructure round the clock did not notice2026-08-20
- Medusa's joint advisory update puts a number on the patch race: affiliates weaponise newly announced flaws within 24 hours, and the agencies find no sign the group develops any of them itself2026-08-19
- Evooo1Bot: a Mirai-derived Linux botnet whose exploit arsenal reaches Confluence, WSO2 and Kubernetes ingress-nginx, and whose SSH dictionary is stocked with enterprise service accounts rather than router defaults2026-08-16
- Switzerland's federal IT provider BIT confirms a SharePoint Server intrusion: ~200 federal user and technical accounts compromised while the July patches were already being installed2026-08-05
- Liechtenstein's beneficial-ownership register breached: copies of ~31,000 legal entities' records taken, and four more e-government systems pulled offline as a precaution2026-08-04
- CVE-2026-18556 / CVE-2026-18577, N-able N-central: unauthenticated admin access to the RMM console, exploited in the wild, and the day-one fix was itself bypassable2026-08-03
- UK Department for Education confirms a breach of two public-facing portals and a police legal database, claimed by ExfilSquad, a five-day-old extortion brand whose other 14 claims look fabricated2026-07-31
- Coordinated two-day cyberattack disrupts operational technology at 30+ Minnesota water and wastewater utilities; no authority has attributed it2026-07-29
- Russian state actor LAUNDRY BEAR weaponised a Zimbra webmail zero-click (CVE-2025-66376) for mailbox exfiltration, now exposed in a 16-nation joint advisory2026-07-24
- CERT.LV: ransomware crew breaches Latvia's state forestry operator LVM via a 2-year-unpatched system, hits essential-services provider Olpha, and is probing other EU/NATO institutions2026-07-10
- Citizen Lab: a European Parliament spyware-inquiry member was himself infected twice with Pegasus2026-07-03
- Turla's STOCKSTAY: a four-component .NET backdoor for diplomatic intelligence collection2026-06-27
- Citizen Lab: Cellebrite UFED used by Russian authorities three months after the vendor's Russia pull-out2026-06-27
- Ukrposhta digital services disrupted by an overnight attack; pro-Russian hacktivists claim a prior data theft2026-06-26
- UK Information Commissioner resigns with immediate effect, regulator left leaderless mid-restructure2026-06-21
- The Gentlemen (Storm-2697) claims OT-adjacent Mackay Sugar attack; operator attributed to a Russian national2026-06-20
- South Korea fines Coupang a record ₩624.7 bn over an unrevoked signing key held by a former employee2026-06-13
- ShinyHunters Oracle PeopleSoft campaign: gadget-chain access, SSH default-credential lateral movement, mass exfiltration2026-06-11
- Five Eyes joint bulletin: Chinese military intelligence recruiting cleared personnel through LinkedIn and job platforms2026-06-06
- Microsoft calls Nightmare Eclipse's six uncoordinated Windows zero-day releases "never justifiable"; the three May drops were fixed in June 20262026-05-30
- Carnival Corporation confirms 5.99 M-record ShinyHunters breach, passport + driver's-licence numbers exposed across four cruise brands2026-05-29
- Iran MOIS attributed to LACMTA destructive breach via "Ababil of Minab" hacktivist front, 700 GB exfiltrated, backups and VMs deliberately destroyed2026-05-28
- FBI FLASH CSA 260526, Silent Ransom Group sends operatives physically into US law-firm offices to insert USB exfiltration devices when remote social engineering fails2026-05-28
- Dutch National Police arrest 35-year-old over AFC Ajax fan-data breach, misconfigured API access-control and shared keys exposed 300,000+ accounts and 42,000 season-ticket records2026-05-28
- Lithuania's Centre of Registers loses ~600,000 state-register records to abused institutional credentials; foreign-state actor suspected2026-05-27
- Six German university hospitals lose ~97,600+ patient records to a breach at billing processor Unimed2026-05-24
- Kimwolf / "Dort" DDoS-for-hire operator arrested, 30+ Tbps IoT botnet, U.S. DoD-range targeting, AISURU variant2026-05-23
- FBI PSA260521, Kali365 OAuth device-code PhaaS bypasses M365 MFA without credential capture2026-05-23
- Microsoft DCU disrupts Fox Tempest, a malware-signing service that enabled Rhysida deployments and is linked to INC, Qilin and Akira affiliates2026-05-20
- Previously unknown flaw in Huawei enterprise router software caused POST Luxembourg's nationwide telecom outage of July 2025; no CVE ten months later2026-05-20
- THORChain vault drain, about $10.7M from one vault: a newly joined validator exploited GG20 threshold signing (Switzerland-based protocol)2026-05-18
- Suspected Dream Market main administrator "Speedstepper" arrested in Germany; US indictment traces reactivated marketplace wallets and gold purchases2026-05-16
- Foxconn confirms a cyberattack on some North American factories after Nitrogen claims theft of 8 TB of customer project data2026-05-13
- ICO fines South Staffordshire Water £963,900 under UK GDPR for the 2020 to 2022 intrusion: phishing foothold, ZeroLogon on two unpatched domain controllers, 5% of IT monitored2026-05-12
- DAEMON Tools Lite supply-chain compromise: signed installers deliver a profiler worldwide, with a backdoor and QUIC RAT reserved for a dozen targets in Russia, Belarus and Thailand2026-05-09
- Qilin claims a ransomware attack on the German party Die Linke; the party has not confirmed data theft2026-05-08
- Instructure Canvas breach: ShinyHunters exploits a Free-for-Teacher flaw twice, defaces about 330 login portals, and Instructure reaches an agreement with the actor2026-05-08