Leaky Weekly

On this episode of Leaky Weekly, host and security researcher Nick Ascoli covers the NPM supply chain attack, fake Europol bounty, and Operation Secure.Here are the resources on the stories:Largest NPM attack in crypto history stole less than $50: SEAL (Cointelgraph)Breakdown: Widespread npm Supply Chain Attack Puts Billions of Weekly Downloads at Risk (Palo Alto Networks)The largest supply-chain attack ever… (Fireship, The Code Report)2 Billion npm Downloads at Risk From Crypto Malware: A Wake-Up Call for Open-Source Supply Chain Security (OPSWAT) Self-Replicating Worm Hits 180+ npm Packages to Steal Credentials in Latest Supply Chain Attack (The Hacker News)Europol confirms $50,000 Qilin ransomware reward is fake (BleepingComputer)20,000 malicious IPs and domains taken down in INTERPOL infostealer crackdown (INTERPOL)Operation Secure: Trend Micro's Threat Intelligence Fuels INTERPOL's Infostealer Infrastructure Takedown (Trend Micro)Brought to you by Flare, Threat Exposure Management solution and industry-leading dataset on cybercrime that integrates into your security program in 30 minutes. Check out what’s on the dark web (and more) about your organization.Check out Flare Academy: Our free training series led by experts on critical topics such as threat intelligence, operational security, and advanced investigation techniques (earn CPE credits towards cybersecurity certifications)Our Discord community is a space to learn from and with cybersecurity professionals (including Nick!) and students, check out previous training resources, and keep up with upcoming training

On this episode of Leaky Weekly, host and security researcher Nick Ascoli gets into stealer logs and arrests in the last few weeks of the threat actors who targeted PowerSchool and Snowflake tenants. This is part 2 of a 2 part series, Use a Stealer Log, Go to Prison. Missed part 1? Check it out here on Apple Podcasts or Spotify.Here are the resources on the stories:Cybersecurity Incident Notice (PowerSchool)Matthew Lane Plea Deal (Thomson Reuters)United States v. Matthew D. Lane (U.S. Department of Justice)Update on New PowerSchool Data Breach and Ongoing Protection Measures (Union Intermediate School, Sampson County Schools)A hacker's ransom: Inside the cyberattack that compromised NC student and teacher records (WRAL)Leaky Weekly: PowerSchool Hack; Takedowns & Arrests & Leaks, Oh My!; and ITRC Breach Report (Flare)Hacker in Snowflake Extortions May Be a U.S. Soldier (Krebs on Security)United States v. Moucka (CourtListener)Former U.S. Soldier Pleads Guilty to Hacking and Extortion Scheme Involving Telecommunications Companies (U.S. Department of Justice)Leaky Weekly: Arrests, RedLine & META Infrastructure Takedown, and MOVEit Leaks (Flare)Brought to you by Flare, the world's easiest to use and most comprehensive cybercrime database that integrates into your security program in 30 minutes. Check out what’s on the dark web (and more) about your organization.Flare now offers Flare Academy training, which is our (free!) training series led by experts that cover critical cybersecurity topics. Check out Flare Academy to keep up with upcoming trainings, check out previous training resources, chat with cybersecurity professionals (including Nick!) in the Flare Academy Community Discord, and more.

On this episode of Leaky Weekly, Tammy Harper, Senior Threat Intelligence Researcher at Flare joins host and security researcher Nick Ascoli. Tammy explains:LockBit’s fall, the affiliate exodus, and rise of RansomHub“Ransomware without the ware” – cross-posting as the norm nowNoise in the ransomware undergroundMore episodes from Tammy and Nick’s conversation on ransomware will be coming in the following weeks.Brought to you by Flare, the world's easiest to use and most comprehensive cybercrime database that integrates into your security program in 30 minutes. Check out what’s on the dark web (and more) about your organization.Flare now offers Flare Academy training, which is our (free!) training series led by experts that cover critical topics such as threat intelligence, operational security, and advanced investigation techniques. You can also earn CPE credits toward your cybersecurity certifications. Sign up for Senior Threat Intelligence Researcher Tammy Harper’s Academy training, CRYPTOS: Hunting Adversaries in the Crypto Underground on Tuesday July 15, 2025 at 11:00-1:00 PM ET. Join the Flare Academy Community Discord to keep up with upcoming training, check out previous training resources, chat with cybersecurity professionals (including Nick and Tammy!), and more.

On this episode of Leaky Weekly, Tammy Harper, Senior Threat Intelligence Researcher at Flare joins host and security researcher Nick Ascoli. They discuss ransomware in 2024, and how that affects the ransomware ecosystem of 2025.Tammy goes over:2024 ransomware ecosystem summary2025 disruptions in the wake of 2024 takedownsCompromised credentials’ growing role in cybercrimeMore episodes from Tammy and Nick’s conversation on ransomware will be coming in the following weeks.Brought to you by Flare, the world's easiest to use and most comprehensive cybercrime database that integrates into your security program in 30 minutes.Brought to you by Flare, the world's easiest to use and most comprehensive cybercrime database that integrates into your security program in 30 minutes. Check out what’s on the dark web (and more) about your organization.Flare now offers Flare Academy training, which is our (free!) training series led by experts that cover critical topics such as threat intelligence, operational security, and advanced investigation techniques. You can also earn CPE credits toward your cybersecurity certifications. Sign up for Senior Threat Intelligence Researcher Tammy Harper’s Academy training, CRYPTOS: Hunting Adversaries in the Crypto Underground on Tuesday July 15, 2025 at 11:00-1:00 PM ET. Join the Flare Academy Community Discord to keep up with upcoming training, check out previous training resources, chat with cybersecurity professionals (including Nick and Tammy!), and more.

On this latest episode of Leaky Weekly, host and security researcher Nick Ascoli covers recent news in the cybercrime space such as the USDoD arrest, Judische/Waifu (Connor Moucka) arrest, RedLine infrastructure takedown and arrest(s), and MOVEit leaks.Here are the resources Nick mentions:The unmasking of threat actor USDoD (Cybernews)USDoD, the hacker allegedly behind attacks on FBI and Airbus, arrested in Brazil (Cybernews)USDoD Hacker Behind $3 Billion SSN Leak Reveals Himself as Brazilian Citizen (Hackread)Man Arrested for Snowflake Hacking Spree Faces US Extradition (Wired)Here’s the indictment against two men allegedly responsible for Snowflake customer breach (Cyberscoop)Canadian Man Arrested in Snowflake Data Extortions (Krebs on Security)“Operation Magnus” Seized RedLine and META Infostealer Networks (Cyberinsider)Operation Magnus Update Announces Arrest of RedLine Malware Creator (Cyberinsider)Operation Magnus (operation-magnus.com)Millions of records from MOVEit hack released on dark web (SC Media)More data stolen in 2024 MOVEit attacks come to light (Computer Weekly)Brought to you by Flare, the world's easiest to use and most comprehensive cybercrime database that integrates into your security program in 30 minutes. Check out what’s on the dark web (and more) about your organization.Flare now offers Flare Academy training, which is our (free!) training series led by experts that cover critical topics such as threat intelligence, operational security, and advanced investigation techniques. You can also earn CPE credits toward your cybersecurity certifications. Join the Flare Academy Community Discord to keep up with upcoming training, check out previous training resources, chat with cybersecurity professionals (including Nick!), and more.

In Leaky Weekly’s third episode, host and security researcher Nick Ascoli covers recent news in the cybercrime space including the AWS takeover campaign, ransomware attack on Columbus, Ohio, and the city of Columbus suing a ransomware researcher whistleblower.Here are the resources Nick mentions:Leaked Environment Variables Allow Large Scale Extortion Operation in Cloud EnvironmentsRansomware Group Claims Columbus Attack, Selling 6 Terabytes of Passwords and MoreResearcher Sued for Sharing Data Stolen by Ransomware with MediaHe Proved the Columbus Data Leak Hurts the Public. Now, the City has Silenced HimBrought to you by Flare, the world's easiest to use and most comprehensive cybercrime database that integrates into your security program in 30 minutes. Check out what’s on the dark web (and more) about your organization.Flare now offers Flare Academy training, which is our (free!) training series led by experts that cover critical topics such as threat intelligence, operational security, and advanced investigation techniques. You can also earn CPE credits toward your cybersecurity certifications. Join the Flare Academy Community Discord to keep up with upcoming training, check out previous training resources, chat with cybersecurity professionals (including Nick!), and more.

In Leaky Weekly’s first episode, host and security researcher Nick Ascoli covers recent news in the cybercrime space, such as the AT&T breach, Snowflake tenant breaches, the hacktivist group SiegedSec, and Disney hack.Here are the resources Nick mentions:The Sweeping Danger of the AT&T Phone Records Breach (Wired)Massive Ticketmaster, Santander data breaches linked to Snowflake cloud storage (The Verge)UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion (Mandiant)Read the furious texts the Heritage Foundation sent furry hacking collective SiegedSec after breach (Daily Dot)Hackers Claim to Have Leaked 1.1 TB of Disney Slack Messages (Wired)Brought to you by Flare, the world's easiest to use and most comprehensive cybercrime database that integrates into your security program in 30 minutes. Check out what’s on the dark web (and more) about your organization.Flare now offers Flare Academy training, which is our (free!) training series led by experts that cover critical topics such as threat intelligence, operational security, and advanced investigation techniques. You can also earn CPE credits toward your cybersecurity certifications. Join the Flare Academy Community Discord to keep up with upcoming training, check out previous training resources, chat with cybersecurity professionals (including Nick and Tammy!), and more.