In partnership with
| ~7 MIN READ |
|
Attackers keep skipping the front door for the suppliers and platforms that already have a key, while courts and cops try to send the bill. PS: Was this forwarded to you? Subscribe free at exzeccyber.com/subscribe → |
In this edition
|
Ransomware / Critical Infrastructure SafePay Went After 600 Critical Infrastructure Orgs Without a Single Affiliate Intro Most ransomware gangs rent their malware to affiliates. SafePay does its own dirty work, and the feds say it has been busy. What Happened A joint advisory (AA26-293A) from CISA, the FBI, the Secret Service and police in Germany and the UK says SafePay has hit at least 600 organizations across multiple critical infrastructure sectors since August 2024, in North America, South America, Europe and Australia. The private crew steals data before encrypting and gets in through exposed credentials, brute force, phished accounts, VPN access (often from Mullvad VPN addresses) and scripts that exploit edge-device CVEs. Then it deletes shadow copies and resets the NAS devices holding backups. Why It's Important CISA calls SafePay "one of the most active ransomware groups," and it has reportedly filled the gap LockBit and BlackCat left behind. Its leak site lists only victims who don't pay, so 600 is a floor. The Other Side Nothing in this playbook is new. Stolen passwords, unpatched edge gear and reachable backups are problems most organizations already know they have.
TL;DR: A ransomware crew with no affiliates has hit 600+ critical infrastructure orgs through doors defenders already know about. Further reading: BleepingComputer |
|
How Jennifer Aniston’s LolaVie brand grew sales 40% with CTV ads
For its first CTV campaign, Jennifer Aniston’s DTC haircare brand LolaVie had a few non-negotiables. The campaign had to be simple. It had to demonstrate measurable impact. And it had to be full-funnel.
LolaVie used Roku Ads Manager to test and optimize creatives — reaching millions of potential customers at all stages of their purchase journeys. Roku Ads Manager helped the brand convey LolaVie’s playful voice while helping drive omnichannel sales across both ecommerce and retail touchpoints.
The campaign included an Action Ad overlay that let viewers shop directly from their TVs by clicking OK on their Roku remote. This guided them to the website to buy LolaVie products.
Discover how Roku Ads Manager helped LolaVie drive big sales and customer growth with self-serve TV ads.
The DTC beauty category is crowded. To break through, Jennifer Aniston’s brand LolaVie, worked with Roku Ads Manager to easily set up, test, and optimize CTV ad creatives. The campaign helped drive a big lift in sales and customer growth, helping LolaVie break through in the crowded beauty category.
|
|
|
Turn today's calls into tomorrow's proposal
Wispr Flow Notetaker brings your meetings into Claude or ChatGPT through a built-in connector. Ask for a proposal draft or a deal recap, and your AI works from an accurate record of what was said.
 Strange but real The Air Force Planned Missions on Thumb Drives From the Local Market. Somebody Noticed. Intro Some supply chain attacks need a zero-day. This one needed a market stall. What Happened SolarWinds CISO Justin Henkel told The Register that in the early 2000s, when he worked Air Force IT security, crews moved mission data from unclassified to classified systems and into aircraft on USB drives instead of burned CDs. Personnel bought the drives from local vendors rather than military contractors, which in Afghanistan could mean a shop in Kabul. Henkel says US enemies noticed and started selling infected drives to those vendors. Why It's Important Anything that crosses a security boundary is part of your supply chain. In 2008, an infected USB drive put the Agent.BTZ worm on a laptop with access to US Central Command, and the Pentagon took 14 months to remove it. The Other Side This is one man's recollection from two decades ago, and The Register didn't independently verify the practices he describes.
TL;DR: Air Force crews carried mission data on locally bought thumb drives, and adversaries reportedly started seeding those shops. Further reading: The Register |
Your name is on every client site, so excellence isn't optional. With Lovable, you show your client a working version in the first meeting, launch it on their own domain, and tackle bugs fast with project monitoring. $5 off your first month.