When Grid Data Goes Dark Web: New research on critical infrastructure targeting Published By Suzu Labs

Posted in Commentary with tags on January 16, 2026 by itnerd

Suzu Labs has just published “When Grid Data Goes Dark Web” which is new research detailing the dark web posting in Jan. 2026 of 139 gigabytes of valuable data from a U.S. power infrastructure company. The data lets an adversary identify vulnerable transmission corridors, understand redundancy patterns, and/or map critical interconnection points. 

The asking price? 6.5 bitcoin (~$600K US).

The seller explicitly noted the data was “suitable for infrastructure analysis, modeling, risk assessment, or specialized research.”

What the Data Contains

The breach targeted an engineering firm that provides surveying and design services to electric utilities. The stolen files include:

  • 800+ LiDAR point cloud files mapping transmission corridors
  • High-resolution orthophotos of substations
  • MicroStation design files with line configurations
  • Vegetation analysis along rights-of-way

Suzu Labs CEO Michael Bell notes:

“For a utility or engineering firm, this is operational data. For an adversary, this is reconnaissance gold. The files map exactly where power lines run, how they’re configured, what vegetation threatens them, and where substations connect to the grid.

“This wasn’t a sophisticated attack on industrial control systems. It wasn’t a supply chain compromise or zero-day exploit. According to public reporting on the same threat actor, the likely access method was testing infostealer-harvested credentials against cloud file-sharing platforms.

“Someone at the company had their browser credentials stolen by commodity malware. Those credentials weren’t protected by MFA. This actor has listed data from 50+ organizations across 15 countries. Aviation. Healthcare. Government. Construction. Critical infrastructure is one target category among many. The common thread is opportunistic access via stolen credentials and absent MFA.”

You can read the research here: https://suzulabs.com/suzu-labs-blog/when-grid-data-goes-dark-web?hs_preview=YduZZtdF-295534203578

Leave a comment »

Patero Introduces Automated Cryptography Discovery and Inventory Workshop

Posted in Commentary with tags on January 16, 2026 by itnerd

As U.S. leadership and China increasingly signal that today’s cryptography is no longer sufficient to protect long-lived data, Patero has introduced a Cryptographic Inventory Workshop to help organizations understand what cryptography they actually have, who owns it, and what is already exposed.

The workshop is a facilitated, pre-inventory engagement designed to rapidly define scope, align stakeholders, and build an executable plan for cryptographic inventory, as pressure grows from NSM-10, ongoing “harvest now, decrypt later” risk, and accelerating geopolitical timelines.

It is grounded in Patero’s Automated Cryptography Discovery and Inventory (ACDI) methodology, which surfaces cryptographic risk across networks, applications, cloud services, databases, and codebases. The focus is not theory, but evidence — establishing visibility, ownership, and defensible proof of risk management as quantum-grade protection becomes the next category of security.

What’s included:

For up to 20 participants:

  • Virtual facilitation and working sessions, plus planning artifacts such as methods,
  • Tool configuration guidance,
  • API usage guidance,
  • Sample correlation charts,
  • Evidence templates

The Cryptographic Inventory Workshop is available immediately.

For cost and Workshop scheduling information, contact quantumsafe@patero.io

Leave a comment »

Insider Threats: Flashpoint observes 91,321 instances in 2025

Posted in Commentary with tags on January 15, 2026 by itnerd

Every organization houses sensitive assets that threat actors actively seek. Whether it is proprietary trade secrets, intellectual property, or the personally identifiable information (PII) of employees and customers, these datasets are the lifeblood of the modern enterprise—and highly lucrative commodities within the illicit underground.

In 2025, Flashpoint observed 91,321 instances of insider recruiting, advertising, and threat actor discussions involving insider-related illicit activity. This underscores a critical reality—it is far more efficient for threat actors to recruit an “insider” to circumvent multi-million dollar security stacks than it is to develop a complex exploit from the outside. 

Last year, Flashpoint collected and researched:

  • 91,321 posts of insider solicitation and service advertising
  • 10,475 channels containing insider-related illicit activity
  • 17,612 total authors

On average, 1,162 insider-related posts were published per month, with Telegram continuing to be one of the most prominent mediums for insiders and threat actors to identify and collaborate with each other. Analysts also identified instances of extortionist groups targeting employees at organizations to financially motivate them to become insiders.

Insider Threat Landscape by Industry

The telecommunications industry observed the most insider-related activity in 2025. This is due to the industry’s central role in identity verification and its status as the primary target for SIM swapping—a fraudulent technique where threat actors convince employees of a mobile carrier to link a victim’s phone number to a SIM card controlled by the attacker. This allows the threat actor to receive all the victim’s calls and texts, allowing them to bypass SMS-based two-factor authentication.

Insider Threat data from January 1, 2025 to November 24, 2025

Flashpoint analysts identified 12,783 notable posts where the level of detail or the specific target was particularly concerning.

Top Industries for Insiders Advertising Services (Supply):

  • Telecom
  • Financial
  • Retail
  • Technology

Top Industries for Threat Actors Soliciting Access (Demand):

  • Technology
  • Financial
  • Telecom
  • Retail

Flashpoint shares more details in a blog post, published today. It’s honestly worth your time to read.

Leave a comment »

Unit 42 Puts Out A Report on Cyber Threats To Watch Out For At The Winter Olympics

Posted in Commentary with tags on January 15, 2026 by itnerd

To help defenders protect their infrastructure, venues, suppliers, athletes and more, Unit 42 is releasing a new report, “Defending the 2026 Milan-Cortina Winter Games,” that details the top attackers, motives and tactics to prepare for ahead of the event, including steps organizations and local governments can take to protect themselves and the games.

The report builds on Unit 42’s prior work monitoring and preparing defenders for major events – including the 2024 Paris Olympics where authorities reported 140+ cyber incidents. The embargoed report (attached) shares highlights including:

  • Threat actor types: Ransomware gangs, nation-state actors, and hacktivist groups
  • Threat actors to watch: Muddled Libra, Insidious Taurus, and Salt Typhoon
  • Tactics to guard against: Social engineering attacks, DDoS attacks, API vulnerabilities and more.
  • Tips for defenders: Zero trust, runtime security, AI-driven automation and more.

You can read the report here: https://www.paloaltonetworks.com/resources/research/unit-42-cyber-vigilance-program/2026-winter-games-milano-cortina

Leave a comment »

Elon Musk Claims To Have Stopped Grok From Creating Highly Objectionable Content…. But Reports Suggest Otherwise….

Posted in Commentary with tags on January 15, 2026 by itnerd

Elon Musk appears to have climbed down from fighting the fact his AI chatbot Grok was creating all sorts of content that should never, ever be allowed to create. To recap, after this was discovered, and the predictable backlash happened, Elon tried to paywall this. The result was unsurprisingly more backlash. Now he’s finally just killed the ability for Grok to make this sort of content at all:

Elon Musk’s Grok artificial intelligence chatbot will no longer edit “images of real people in revealing clothing” on the X platform, the company confirmed Wednesday evening, following global outrage after Grok was found to be complying with user requests to digitally undress images of adults and in some cases children.

“We have implemented technological measures to prevent the Grok account from allowing the editing of images of real people in revealing clothing such as bikinis. This restriction applies to all users, including paid subscribers,” X wrote via its Safety team account.

This may have had something to do with the fact that a whole lot of governments around the world were investigating Elon over this. After all, this sort of thing is illegal. And rightly so. But Elon doesn’t see it that way that only this man who clearly has issues, lots of issues, understands.

Anyway this isn’t over. Why? Well, there’s this:

It’s still extremely easy to undress women and edit them into sexualized poses using the X and Grok mobile apps or websites, however, even without making a subscription payment that would connect your account to an easily identifiable source. In her testing, my fellow UK-based colleague Jess Weatherbed found that she was not blocked from using Grok’s image editing feature to create sexualized deepfakes of herself.

After uploading a fully clothed photograph to X and Grok, prompting the chatbot to “put her in a bikini” or “remove her clothes” produced only blurred, censored results. The bot did comply with every other request, however, including prompts to “show me her cleavage,” “make her breasts bigger,” and “put her in a crop top and low-rise shorts” — the last of which placed her in a bikini. The bot also generated images of her “leaning down” with a sexualized pose and facial expression, and in extremely revealing lingerie.

Clearly ether he’s not taking this seriously, or whatever minions he has behind this are inept. While both could be true at the same time, I am going to go with he’s not taking this seriously. That’s pretty dumb from a guy who bills himself as the smartest guy in the room. And it’s likely going to cost him. Various governments are fed up with his antics and are likely to lower the boom on him to drive home the point that his behaviour is not acceptable by any standard. And I am her for when that happens.

Leave a comment »

The Media Trust Expands Digital Trust and Safety Solutions with Microsoft Owned and Operated Publishers

Posted in Commentary with tags on January 15, 2026 by itnerd

The Media Trust today announced its technology and team helping strengthen trust and safety across Microsoft’s advertising ecosystem.

Through this collaboration, The Media Trust will provide critical global threat detection and real-time mitigation solutions to enhance Microsoft’s ability to protect users of its owned and operated publishers from malware, redirects, cloaked ads, and other malicious activities that can undermine user experience and disrupt digital revenue. This collaboration will enhance Microsoft’s ability to deliver a secure, high-quality advertising environment for consumers and partners worldwide.

The Media Trust will utilize its proprietary AI detection, global infrastructure, and malware team visibility across other partner inventory to identify and eliminate threats at the source, ensuring protection without unnecessarily disrupting legitimate advertiser revenue. TMT’s global infrastructure, advanced emulation technology, and expert malware analysis teams provide the scale and precision needed to meet the complex challenges of modern ad ecosystems.

This collaboration reflects The Media Trust’s continued leadership in digital trust, helping global brands, platforms, and agencies safeguard their users and revenue through a cleaner, more transparent advertising ecosystem.

Leave a comment »

The AI Reality Check: Why Curated Security Data Wins in 2026

Posted in Commentary with tags on January 15, 2026 by itnerd

DataBee this week published a round of predictions and recommendations from data experts. In 2025, enterprises sprinted toward AI, but DataBee predicts that in 2026 these same enterprises will discover that the real differentiator isn’t the model; it’s actually the quality, normalization, and lineage of the data fueling the model. 

he AI Reality Check: Why Curated Security Data Wins in 2026

In 2025, enterprises sprinted toward AI. In 2026, they’ll discover that the real differentiator isn’t the model—it’s the quality, normalization, and lineage of the data fueling it. Expect a rollback of AI hype as organizations confront fragmented security tooling, manual reporting, and point-in-time compliance. The leaders who win will shift to continuous controls compliance anchored in curated, clean datasets—then layer agentic AI on top as a “data expertise assistant” to scale decisions, not to shortcut rigor.

These predictions and recommendations come from Tyler Alfriend and Stephanie Whitnable, two of DataBee’s top data experts and practitioners. Drawing on their extensive experience in data engineering and analytics for compliance and cybersecurity, they share what organizations must do to turn AI hype into measurable business outcomes in 2026.

1) From Point-in-Time to Continuous Controls Compliance

Compliance is moving beyond 12-month lookbacks and sample-based testing into full-population monitoring at the data source. This shift makes compliance auditable, repeatable, and defensible—and it’s the only way to support real-time executive reporting and board-level confidence.

“The big intersection point is taking full populations from the data source to perform compliance tests—moving away from point-in-time and sample-based reporting.” — Tyler Alfriend

What to watch: Teams will sunset manual “number-hunting” in spreadsheets and instead, funnel direct, automated feeds from systems of record into compliance analytics.

2) Agentic AI Becomes the Data Expertise Assistant

As compliance gets data-centric, skill gaps surface: policy experts don’t always speak in SQL. In 2026, agentic AI steps in—not to replace domain expertise, but to amplify it. Think of it as a side-by-side assistant that translates policy into queries, navigates complex schemas, and surfaces exceptions—while the human retains judgment, context, and accountability.

“Agentic AI could be the ‘data expertise assistant’ that lets compliance pros operate in a new data-centric world without losing their core skill set.” — Tyler Alfriend

Leadership angle: Executives won’t start their day with dashboards; they’ll start with AI-generated briefings: “What’s in tolerance? Where should I focus?” Visuals still matter—but they become working dashboards for teams to validate, triage, and remediate with embedded automation.

3) Dashboards Don’t Die; They Get Practical

Rather than executive vanity metrics, 2026 rewards operational dashboards connected to automated workflows (tickets, playbooks, remediation actions). AI summarizes; dashboards execute. The cycle becomes: AI briefing → working dashboard → auto-generated remediation → continuous evidence trail.

“Dashboards stay, but as working spaces linked to automation, so teams can verify gaps and trigger remediation actions.” — Stephanie Whitnable

4) The Rise of Curated, Normalized Domain Datasets

AI won’t learn your unique policies or tool quirks out of the box. The key to unlocking AI’s potential is curated, clean domain datasets that abstract local nuance and enable AI to answer many questions—not just the one a single report was designed for. In 2026, data programs invert: build deep datasets first, then let AI generate the metrics and views on demand.

“It’s about building deep datasets around a domain—strip out nuance so AI can thrive.” — Tyler Alfriend

“The first word that comes to mind when I think about ‘AI-ready data’ is clean; normalized, clean data is required for the data sets feeding AI to answer lots of questions.” — Stephanie Whitnable

5) A Unified Security Data Fabric Moves from Idea to Imperative

Security teams live with more tools per capita than any other business unit, which obscures data clarity and creates inconsistent language across consoles. 2026 is the breaking point: the AI wave exposes data fragmentation and accelerates adoption of a security data fabric—a unifying layer that normalizes, enriches, and governs controls evidence across tools, then feeds it to AI and compliance analytics.

“Cybersecurity has way more tools per capita… and paradoxically less awareness of data problems. A security data fabric is the solution behind AI.” — Tyler Alfriend

6) The Great AI Reality Check

Enterprises expecting “push-button AI” will be disappointed. The constraint is data cleanliness and context, not model horsepower. Expect a rollback of hype as home-grown initiatives collide with messy datasets. The best outcome? A refocus on fixing data at the source and investing in people who can bridge business context with analytics and AI.

“It’s not going to work as perfectly as expected. Clean data still hasn’t had its spotlight.” — Stephanie Whitnable

“Don’t treat AI as an easy button. Build a good data environment, and AI can finally do what it’s hyped to do.” — Tyler Alfriend

2026 Playbook: Five Actions to Operationalize These Predictions

  1. Embed source-level data into compliance
    Replace sample-based checks with full-population, automated monitoring at the data source.
  2. Stand up curated domain datasets
    Normalize controls, events, assets, identities, and policies into clean, governed tables that AI can interrogate broadly.
  3. Deploy agentic AI for briefings; keep dashboards for work
    Give leaders morning summaries from AI, then route teams to dashboards with embedded remediation workflows.
  4. Invest in people and upskilling
    Pair business context owners with analytics upskilling and AI tools.
  5. Adopt a security data fabric
    Reduce “tool-silo sprawl.” Unify telemetry, controls evidence, and policy mappings in one fabric.

Leave a comment »

Xero introduces enterprise-grade analytics to empower small businesses to make smarter, faster decisions

Posted in Commentary with tags on January 15, 2026 by itnerd

Xero today announced the global launch of its new AI-powered analytics capabilities, setting a new standard for small business intelligence. Millions of business owners now have the ability to access leading analytics, insights, and reporting, and get instant answers to their financial questions directly within Xero.

Following its 2024 acquisition of Syft, a leading AI-powered reporting and insights platform, Xero has rapidly integrated the company’s powerful analytics features to put enterprise-grade intelligence into the hands of small businesses. In less than one year since closing the deal, analytics embedded within Xero have been made available to millions of customers worldwide.

Built for the business owner–not highly specialized data analysts–Xero’s analytics platform gives small businesses sophisticated yet easy-to-navigate insights tools, including:

  • Dashboards: customizable views of performance across revenue, expenses, and KPIs
  • Visualisations: graphs and tables to track profitability, cash flow, balance sheet health
  • Cash flow manager: projections up to 180 days, with the ability to scenario plan “what if” outcomes
  • AI insights: AI-generated suggestions and summaries provide a clear explanation of financial data
  • Business health scorecards: create custom scorecards that track key performance metrics alongside external data—like website traffic—for a consolidated view of business health

This milestone is part of Xero’s broader AI and insights strategy, which includes the recent unveiling of JAX, Xero’s AI financial superagent. Together, these innovations realize Xero’s vision to bring enterprise-grade intelligence to small businesses, delivered with the trust, accuracy, and human oversight that define the Xero brand. With 4.6 million subscribers today, Xero continues to successfully balance growth and profitability, recording a 20% increase in first-half revenue to NZD $1.2 billion (to the half year ended 30 September 2025), while delivering an above Rule of 40 outcome.

Leave a comment »

VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion

Posted in Commentary with tags on January 15, 2026 by itnerd

VS Stealer, a Python-based information-stealing malware, is targeting Discord users to steal their data, including exfiltrating sensitive information like credentials and tokens stored in their accounts.

Unit 42 has more details here: https://unit42.paloaltonetworks.com/vvs-stealer/

Martin Jartelius, AI Product Director at Outpost24, provided the following comments:

“This is in line with the “malware as a service” elements we have seen over the years. The scope is relatively slim, and the Windows-based persistence mechanisms, such as copying itself to the Start Menu autostart locations, are very noisy and not indicative of a highly sophisticated actor. That said, the analysis is still interesting, as it shows an actor making malware commercially available while using commercially available security tools themselves. While everything the malware does is mainstream, and the techniques used are somewhat dated, it once again offers a glimpse into an established and growing criminal ecosystem.”

The Unit 42 report makes for interesting reading as it gives a lot of detail as to how a campaign like this works. It’s worth your time to have a look.

Leave a comment »

An analysis on hack against major Spanish electricity and gas provider Endesa

Posted in Commentary with tags on January 15, 2026 by itnerd

Outpost24’s Threat Intelligence Research Team has released a detailed analysis on the recent cyberattack on Endesa, one of Spain’s largest electricity and gas providers. 

From publicly available evidence from underground forums, leaked dataset listings, and the threat actor’s own statements, the threat intel team examines the likely initial access vector, the probably origin of the data, and the broader security implications therein. 

Some key findings include: 

  1. Several indicators suggest the activity is attributable to a lone, Spanish-speaking individual rather than a coordinated group.
  2. The threat actor’s own statements, specifically “I also do cracking as a service” and “Don’t blame me for my work; blame your employees for not doing theirs,” strongly suggest that initial access was obtained through compromised credentials. 
  3. The actor’s minimal presence across forums and messaging platforms, combined with a lack of established reputation, suggests limited credibility among potential buyers. 
  4. Analysis of file names, object types, and export characteristics indicates the data originated from a CRM environment consistent with Salesforce.

For full details, the analysis can be read here: https://outpost24.com/blog/endesa-data-breach/

Leave a comment »

« Older Entries