Will T

New Blog! 🇬🇧 UK Cybercrime Journal: Teenage Online Extremism Cases in 2026 - Scattered Spider Sentenced for TfL Hack - TheCom Sextortionist Sentenced - Teen Convicted of Cybersecurity Provisioning for Al-Qaeda - Man Caught Sharing Islamist Terror Videos blog.bushidotoken.net/2026/09/uk-c...

New Blog! 🇬🇧 UK Cybercrime Journal: Police Crypto Crime Operations in 2026 - Cryptocurrency Theft via Physical Violence - Gang Arrested for Seed Phrase Vishing - Gang Jailed Over £4 Million Police Impersonation Fraud - FCA Crackdown on Illegal P2P Crypto blog.bushidotoken.net/2026/10/uk-c...

📝 Looking to get into infrastructure analysis for CTI? I recommend studying the following aspects/topics in-depth to get started: PDNS WHOIS Records BGP Peers HTTP Titles, Response Headers & ETags X509 Cert Issuers & Subjects & JA4X JARM SSH Host Keys & HASSH Favicon Hashes OpenDirs

New Blog 🇬🇧 UK Cybercrime Journal: Manchester Airport Group Breached by FulcrumSec 🔗 blog.bushidotoken.net/2026/09/uk-c...

I am very glad to finally share publicly some interesting research I’ve been doing into ransomware infrastructure TTPs. This has been a long-running collaboration with a trusted partner who we can’t name but deeply appreciate their support. Read it here 👇 www.team-cymru.com/post/ransomw...

Heads up — @SANSEMEA #CyberThreat2026 lnkd.in/p/gWgqJita

New Blog! 🇬🇧 UK Cybercrime Journal: ExfilSquad Emerges - ExfilSquad’s extortion campaign targets UK public sector orgs, education, and law enforcement - ExfilSquad's primary attack vector involves exploiting CRM platforms and Microsoft Power Pages 🔗 blog.bushidotoken.net/2026/09/uk-c...

New Blog! 🇬🇧 UK Cybercrime Journal: ACRO Breach Report — Between July 2021 and June 2023, the UK Criminal Records Office had 3 separate breaches — It had an SQLi attack on its Kentico CMS followed by Mimikatz — 4x Trend Micro AV alerts were ignored 🔗 blog.bushidotoken.net/2026/08/uk-c...

New Blog! 🇬🇧 UK Cybercrime Journal: Carding Tactics & Youth Money Muling - UK law enforcement exposed domestic carding networks and the growing threat of teenage money mules recruited via Snapchat, Instagram, and online gaming services 🔗 blog.bushidotoken.net/2026/08/uk-c...

New Blog! 🇬🇧 UK Cybercrime Journal: Evolution of Courier Fraud Campaigns 🔗 blog.bushidotoken.net/2026/08/uk-c...

New Blog! 🇬🇧 UK Cybercrime Journal: Qilin Ransomware Rampage in H1 2026 - In H1 2026, Qilin averaged 8 UK victims per month, 37 in total - Most victims are Small/Medium Enterprises (SMEs) - Salford City College appeared on Qilin & DragonForce’s DLSs 🔗 blog.bushidotoken.net/2026/07/uk-c...

New Blog! 🇬🇧 UK Cybercrime Journal: H1 2026 Social Media Fraud Trends - HMRC Warns TikTok Users - Lloyds Bank says 66% of Fraud Cases Started on Meta  - UK Finance Recorded £221.5m Lost to Investment Scams - Fraudsters arrested in Nigeria by the NCA 🔗 blog.bushidotoken.net/2026/07/uk-c...

🔮 New CTI Resource Announcement! 🔮 Project ORBITAL (Operational Relay Box Intelligence, Tracking, & Analysis Lexicon) is the latest open source intelligence (OSINT) collection I’ve created to help educate the industry about ORB Networks. 🔗 blog.bushidotoken.net/2026/07/proj...

New Blog! 🇬🇧 UK Cybercrime Journal: H1 2026 Dark Web Seizures & Arrests - Nemesis Dark Web Drug Dealers Arrested - AEGIS Dark Web Drug Market Seizure - Online Killers Marketplace (OKM) Admins Arrested 🔗 blog.bushidotoken.net/2026/07/uk-c...

New Blog! 🇬🇧 UK Cybercrime Journal: University of Nottingham Breached by ShinyHunters The education sector in the UK has suffered repeated, significant data breaches in recent years, but ShinyHunters campaign has been one of the worst yet. 🔗 blog.bushidotoken.net/2026/07/uk-c...

New Blog! 🇬🇧 UK Cybercrime Journal: SMS Blaster Gang Convicted - New details emerge about the use of an SMS Blaster device to send fraudulent text messages as part of an organised criminal operation in London 🔗 blog.bushidotoken.net/2026/07/uk-c...

New Phishing Campaign: Fake Interviews Offered at Top Brands to harvest Gmail creds, IOCs inside gist.github.com/BushidoUK/57...

New Blog! 🇬🇧 UK Cybercrime Journal: Argos Account Takeover Fraud - Cybercriminals are using leaked credentials to hijack Argos user accounts - They then order and then collect the goods in-person at a physical store and pay with stolen credit cards 🔗 blog.bushidotoken.net/2026/07/uk-c...

New Blog! 🇬🇧 UK Cybercrime Journal: Hargreaves Landsdown Extortion Attempt by Bashe It appears Bashe weaponised HL’s recent, IT outages & glitches (in Sept 2025 and March 2026) to construct a plausible, but false, narrative of a successful hack. 🔗 blog.bushidotoken.net/2026/06/uk-c...

Two of my fav 🇬🇧 🇨🇦 experts when it comes to discussing cyber warfare, Philip Ingram and Ian Thornton-Trump, released an interview reviewing in detail the threat landscape of 🇷🇺 Russian cyber operations in the context of the ongoing war in 🇺🇦 Ukraine. 🔗 youtu.be/p1vl5t4fVWA

New Blog! 🇬🇧 UK Cybercrime Journal: Sustained DragonForce Campaign Throughout May 2026, the DragonForce RaaS operation claimed seven UK-based companies as its victims by posting them on their Tor data leak site. 🔗 blog.bushidotoken.net/2026/06/uk-c...

New Blog! Ransomware Tool Matrix Project Updates: Three Groups To Track 🔒🛠️ 🔗 blog.bushidotoken.net/2026/06/rans...

I recently experimented with turning one of my blogs from back in 2020 (the pre-AI era!) into an AI-generated video via @NotebookLM and was surprised with the result. 🎥 Video: The Law of the Jungle 🐍 🦁 🦈 🦀 youtu.be/gb1aOjXly7E Original blog: blog.bushidotoken.net/2020/05/cybe...

New 🇬🇧 UK Cybercrime Journal Entry: Arup Group Breached by FulcrumSec What do AWS DCs, Disneyland, Wembley Football Stadium, HS2 and HS1 Channel Tunnel Rail Link network, and the Eden Project all have in common? They were engineered by Arup Group 👀 blog.bushidotoken.net/2026/06/uk-c...

New 🇬🇧 UK Cybercrime Journal Entry: British Universities Struck by ShinyHunters Before Exam Season blog.bushidotoken.net/2026/05/uk-c...

New 🇬🇧 UK Cybercrime Journal Entry: £102 million Lost to Scams in 2025 blog.bushidotoken.net/2026/05/uk-c...

📣 I have been wanting to write more regularly for my site blog.bushidotoken.net and have made a new series: The UK Cybercrime Journal. These are short UK cybercrime incident reports with a BLUF, Analyst Comment, and Defensive Takeaways. Starting here: blog.bushidotoken.net/2026/05/uk-c...

New Blog! Stranger Strings: Yurei Ransomware Operator Toolkit Exposed Through my research with Team Cymru’s data, we have discovered another ransomware operator’s server with Stranger Things-themed tools, check it out👇 www.team-cymru.com/post/yurei-d...

New Blog! The Beast Returns: Analysis of a Beast Ransomware Server 👹 In March 2026, Team Cymru detected a Beast operator’s server that enabled us to understand the flow of their attacks from start, to middle, to the end, including ransomware binaries. www.team-cymru.com/post/beast-r...

My latest article for Feedly is about how CTI and Threat Hunting can actually fuse into a single, intelligence-driven workflow instead of operating in silos. If you’re trying to build a more proactive security program, I think you’ll find it useful. 👉 Read it here: feedly.com/ti-essential...

𝗣𝗢𝗗𝗖𝗔𝗦𝗧 🎧 𝗛𝗼𝘄 𝟮𝟬𝟮𝟱 𝗦𝗵𝗮𝗽𝗲𝗱 𝘁𝗵𝗲 𝗙𝘂𝘁𝘂𝗿𝗲 𝗼𝗳 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 We sat down with Rebecca Taylor from Sophos and @bushidotoken.net from @teamcymrus2.bsky.social to discuss 2025’s highs and lows in cyber and make educated guesses on what to look for in 2026. feeds.soundcloud.com/users/soundc...

New Blog 👀 This blog discusses the topic of cybercrime counterintelligence to highlight the growing threat toward the cyber threat intelligence (CTI) and law enforcement (LE) communities ⚠️ 🔗 www.sans.org/blog/for589-...

Spotted a rather Team Cymru looking fountain here in the Netherlands 🇳🇱 this week! 📸

New Blog! Lessons from the BlackBasta Ransomware Attack on Capita When a company that manages data for millions of UK citizens falls victim to ransomware, the whole industry should pay attention to it. 📝 blog.bushidotoken.net/2025/10/less...

New Blog! 👀 In this research, I take a look at the Qilin RaaS in-depth, which has emerged as one of the leading and most innovative ransomware gangs following the takedown of LockBit, the exit scam by ALPHV/BlackCat, and the shutdown of RansomHub. 🔗 www.sans.org/blog/evoluti...

New Blog! 👀 After the last few large breaches, I discuss several cases in which the customers of major SaaS providers, such as Salesloft, Salesforce, and Snowflake have been extorted by adversaries from the English-speaking #cybercrime communities. 🔗 www.sans.org/blog/hunting...

#ThreatHunting

Pleased to share I’ll be speaking at Adversary Village in DEFCON33!

Pleased to share my first official Team Cymru blog that follows on from my webinar last month 🙌 “Uncovering DPRK Remote Workers: Detecting Hidden Threats Through Internet Telemetry” 🇰🇵 🔍 www.team-cymru.com/post/uncover...

⚠️ IntelBroker was arrested in France 🇫🇷 in February 2025, and the US 🇺🇸 is seeking his extradition. How did Law Enforcement Deanonymize IntelBroker? 🔍 TL;DR: He messed up on the Bitcoin opsec after an undercover officer made a controlled buy 💰 www.justice.gov/usao-sdny/me...

www.curatedintel.org/2025/05/new-...

blog.bushidotoken.net/2025/05/rans...

@bushidotoken.net explored a Meta-themed credential phishing campaign (not "Reality"). From those indicators, I pulled the "Threads" & this is far from an isolated campaign. Found great pivots in registration "Meta"data. (I'll see myself out.) All 762 indicators 💥⤵️ www.validin.com/blog/not_rea...

New Blog! Tracking Adversaries: EvilCorp, the RansomHub affiliate blog.bushidotoken.net/2025/04/trac...

UNC3886 is a very interesting China-nexus APT that I encourage more to CTI analysts to investigate. They are one of the more skilled ones, like Salt or Volt. To help make life easier for some, I’ve manually mapped their TTPs to ATT&CK: github.com/BushidoUK/MI...

@bushidotoken.net has dug up some IOCs for the FBI's recent warning about online file format converters being used to distribute malware Link: x.com/BushidoToken...