the first generation of agentic ecrime is learning that operational memory cuts both ways.
the agent did not just help automate the attack. it helped automate the confession.
the agent did not just help automate the attack. it helped automate the confession.
October 15, 2026 at 12:53 PM
the first generation of agentic ecrime is learning that operational memory cuts both ways.
the agent did not just help automate the attack. it helped automate the confession.
the agent did not just help automate the attack. it helped automate the confession.
crowdstrike assesses the actor as likely a chinese speaker and financially motivated, with moderate confidence. the basis is narrow. the operator used a chinese-developed tool and chinese-language prompts.
the evidence currently points toward financially motivated ecrime, not espionage.
the evidence currently points toward financially motivated ecrime, not espionage.
October 15, 2026 at 12:53 PM
crowdstrike assesses the actor as likely a chinese speaker and financially motivated, with moderate confidence. the basis is narrow. the operator used a chinese-developed tool and chinese-language prompts.
the evidence currently points toward financially motivated ecrime, not espionage.
the evidence currently points toward financially motivated ecrime, not espionage.
The siphoning of profits, instead of maintaining infrastructure. Feeding shareholders, starving public safety and endangering our lives through naked profiteering on a public utility.
This man was killed. LA was burned. Still this company is allowed to profit.
#PG&ECrime
youtu.be/xs_YWbdcy28?...
This man was killed. LA was burned. Still this company is allowed to profit.
#PG&ECrime
youtu.be/xs_YWbdcy28?...
San Francisco ag-tech entrepreneur’s death tied to rusting wire that had supported PG&E power line
YouTube video by NBC Bay Area
youtu.be
October 14, 2026 at 4:12 PM
The siphoning of profits, instead of maintaining infrastructure. Feeding shareholders, starving public safety and endangering our lives through naked profiteering on a public utility.
This man was killed. LA was burned. Still this company is allowed to profit.
#PG&ECrime
youtu.be/xs_YWbdcy28?...
This man was killed. LA was burned. Still this company is allowed to profit.
#PG&ECrime
youtu.be/xs_YWbdcy28?...
the ecrime ecosystem treats the information space as an attack surface too. aliases are shared, borrowed, stolen, and planted. attribution was already hard. these groups now actively poison it, which means even a cooperating insider has to be treated as evidence rather than gospel.
October 7, 2026 at 7:41 AM
the ecrime ecosystem treats the information space as an attack surface too. aliases are shared, borrowed, stolen, and planted. attribution was already hard. these groups now actively poison it, which means even a cooperating insider has to be treated as evidence rather than gospel.
i wrote recently that you cannot arrest a collective, and shinyhunters is the cleanest proof of it. this is not a gang with a leader and an org chart. it is a brand sitting inside a broader ecrime ecosystem built to survive disruption.
authorities seized raidforums in 2022.
authorities seized raidforums in 2022.
October 7, 2026 at 7:41 AM
i wrote recently that you cannot arrest a collective, and shinyhunters is the cleanest proof of it. this is not a gang with a leader and an org chart. it is a brand sitting inside a broader ecrime ecosystem built to survive disruption.
authorities seized raidforums in 2022.
authorities seized raidforums in 2022.
clickfix alone, the copy-paste-into-your-terminal trick, ran on more than 1.1 million devices, an eightfold jump in four months.
this is the ecrime machine working in unison.
this is the ecrime machine working in unison.
October 6, 2026 at 2:37 AM
clickfix alone, the copy-paste-into-your-terminal trick, ran on more than 1.1 million devices, an eightfold jump in four months.
this is the ecrime machine working in unison.
this is the ecrime machine working in unison.
spanish police arrested a 16-year-old in alicante, accusing him of being the brains behind killsec. this is a ransomware operation investigators have tied to roughly 500 successful attacks and close to 1,000 attempts worldwide. teenagers running real ecrime operations are not new.
October 4, 2026 at 11:35 AM
spanish police arrested a 16-year-old in alicante, accusing him of being the brains behind killsec. this is a ransomware operation investigators have tied to roughly 500 successful attacks and close to 1,000 attempts worldwide. teenagers running real ecrime operations are not new.
No shit.
27 sec: Fastest eCrime breakout time on record
Interpol should use AI to speed up their reporting.
27 sec: Fastest eCrime breakout time on record
Interpol should use AI to speed up their reporting.
October 2, 2026 at 12:05 AM
No shit.
27 sec: Fastest eCrime breakout time on record
Interpol should use AI to speed up their reporting.
27 sec: Fastest eCrime breakout time on record
Interpol should use AI to speed up their reporting.
CoreWeave and CrowdStrike rethink AI-native cybersecurity
->SiliconANGLE | More on "AI-native cybersecurity and defense" at BigEarthData.ai | #cybersecurity
->SiliconANGLE | More on "AI-native cybersecurity and defense" at BigEarthData.ai | #cybersecurity
CoreWeave and CrowdStrike rethink AI-native cybersecurity
AI-native cybersecurity requires defenses that can keep pace with attackers while protecting infrastructure that never stops running. That challenge is bringing security expertise and specialized computing closer together, with automation embedded throughout the systems enterprises use to train and run models. CrowdStrike’s fastest observed eCrime attacker breakout time in 2025 was 27 seconds, underscoring the urgency of faster response, according to Bartley Richardson (pictured, left), chief of AI at CrowdStrike Holdings Inc. Meeting that challenge requires computing capacity for both training and inference. “You can’t have humans combat this alone,” he said. “You need machine-speed defense, and that relies on critical infrastructure.” Richardson and Jim Higgins (right), chief information security officer of CoreWeave Inc., spoke with theCUBE Research’s Dave Vellante and John Furrier at the Fully Connected event, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed machine-speed defense, infrastructure-level security and operational trust. (* Disclosure below.) Cyber models turn attacks into training data The partnership combines CrowdStrike’s security data and adversary expertise with CoreWeave’s infrastructure capabilities. CoreWeave supplies training and inference capacity for SafeMind and serves as a design partner for CrowdStrike’s Cyber Superintelligence Lab, according to the company. “The name of the game … is...
siliconangle.com
October 2, 2026 at 11:07 PM
(this is a joke asking when AIs will do a niche eCrime thing from 5+ years ago, I’m not saying it’s happening now)
September 24, 2026 at 8:47 PM
(this is a joke asking when AIs will do a niche eCrime thing from 5+ years ago, I’m not saying it’s happening now)
these ecrime operators aren't a federal agent's ex, the cops will have no idea how to stalk them!
Scoop: Data allegedly stolen from the FBI provides sensitive assignment descriptions for named employees, exposing members of the "China criminal enterprise unit” & “Russia Operations Section" among others.
One ex-employee described it as a foreign intel "goldmine."
www.reuters.com/world/hacked...
One ex-employee described it as a foreign intel "goldmine."
www.reuters.com/world/hacked...
EXCLUSIVE: Hacked FBI data has sensitive information about employees’ intelligence roles
FBI data allegedly stolen by the hacking group ShinyHunters carries granular detail about scores of bureau officials’ job assignments, including sensitive work against Chinese spies, Russian intellig...
www.reuters.com
September 24, 2026 at 12:10 AM
these ecrime operators aren't a federal agent's ex, the cops will have no idea how to stalk them!
everyone treats cyber crime as the attack. the phishing email, the ransomware, the stolen keys. but the attack is where the damage starts, not where the operation ends. financially motivated ecrime does not stop when the attacker gets in. that is where the money starts moving.
September 25, 2026 at 3:06 AM
everyone treats cyber crime as the attack. the phishing email, the ransomware, the stolen keys. but the attack is where the damage starts, not where the operation ends. financially motivated ecrime does not stop when the attacker gets in. that is where the money starts moving.
it leaks credentials for sale in the ecrime ecosystem. all of that is visible in intelligence before it becomes an intrusion, and all of it is something you can act on early.
this is detection shifted left.
this is detection shifted left.
September 24, 2026 at 10:34 AM
it leaks credentials for sale in the ecrime ecosystem. all of that is visible in intelligence before it becomes an intrusion, and all of it is something you can act on early.
this is detection shifted left.
this is detection shifted left.
iamnotavillain is an ecrime threat actor making claims about what it possesses and what it intends to do. a ransom page and a countdown clock do not prove every assertion beside them. ecrime adversaries are notoriously loud, boasting claims nobody has verified.
September 18, 2026 at 7:06 AM
iamnotavillain is an ecrime threat actor making claims about what it possesses and what it intends to do. a ransom page and a countdown clock do not prove every assertion beside them. ecrime adversaries are notoriously loud, boasting claims nobody has verified.
attacks running as swarms of agents. a full compromise for a few dollars in tokens. crowdstrike's own numbers say ai-adversary activity is up 89% year-over-year. average ecrime breakout time has collapsed to 29 minutes, with the fastest observed at 27 seconds. none of that is invented.
September 17, 2026 at 10:34 AM
attacks running as swarms of agents. a full compromise for a few dollars in tokens. crowdstrike's own numbers say ai-adversary activity is up 89% year-over-year. average ecrime breakout time has collapsed to 29 minutes, with the fastest observed at 27 seconds. none of that is invented.
the self-rebuilding-malware trick a russian intelligence service just ran is the kind of thing that trickles down to the ecrime ecosystem within months, just as every other capability has moved from nation state to ecrime.
yesterday, detection bought defenders time.
yesterday, detection bought defenders time.
September 15, 2026 at 2:37 AM
the self-rebuilding-malware trick a russian intelligence service just ran is the kind of thing that trickles down to the ecrime ecosystem within months, just as every other capability has moved from nation state to ecrime.
yesterday, detection bought defenders time.
yesterday, detection bought defenders time.
this is no longer just an access problem. it is an identity problem.
and slim spider does not stand alone. brazil's financial sector now has at least two distinct, professionalized ecrime adversaries, each with a different specialty.
and slim spider does not stand alone. brazil's financial sector now has at least two distinct, professionalized ecrime adversaries, each with a different specialty.
September 11, 2026 at 2:34 AM
this is no longer just an access problem. it is an identity problem.
and slim spider does not stand alone. brazil's financial sector now has at least two distinct, professionalized ecrime adversaries, each with a different specialty.
and slim spider does not stand alone. brazil's financial sector now has at least two distinct, professionalized ecrime adversaries, each with a different specialty.
recently i wrote about plump spider, a brazilian crew that gets inside bank software and makes fraudulent transfers look legitimate. here is its cousin. a second brazil-based ecrime threat actor, slim spider, and this one is not after your transfers. it is after the keys to your crypto.
September 11, 2026 at 2:34 AM
recently i wrote about plump spider, a brazilian crew that gets inside bank software and makes fraudulent transfers look legitimate. here is its cousin. a second brazil-based ecrime threat actor, slim spider, and this one is not after your transfers. it is after the keys to your crypto.
consider what that means for ecrime economics. for as long as ransomware has existed, there was a natural limit on it. human attention is finite. a skilled operator could only work so many targets at once, because each one took real time and real expertise.
September 10, 2026 at 10:34 AM
consider what that means for ecrime economics. for as long as ransomware has existed, there was a natural limit on it. human attention is finite. a skilled operator could only work so many targets at once, because each one took real time and real expertise.
the entire ai cost of breaking into a target, stealing data, and building a ransom demand can run as little as US$0.40 and as much as US$4 per victim. not US$4000. four. fscking. dollars. that is what it costs for ai to do the work, and it is the most important figure in ecrime right now.
September 10, 2026 at 10:34 AM
the entire ai cost of breaking into a target, stealing data, and building a ransom demand can run as little as US$0.40 and as much as US$4 per victim. not US$4000. four. fscking. dollars. that is what it costs for ai to do the work, and it is the most important figure in ecrime right now.
full story here: jark.me/blog/plump-s...
Breeze Comet / PLUMP SPIDER Hijacks Brazil Bank Software
Most financial ecrime is theft. PLUMP SPIDER does something worse. This Brazil-based crew gets inside the bank's own software and pushes fraudulent transfers through the real payment rails, in a real ...
jark.me
September 8, 2026 at 4:34 AM
full story here: jark.me/blog/plump-s...
old vulnerable servers left exposed. and the one that should worry every security team, they try to recruit insiders. they do not always break in. sometimes they just hire someone who is already inside.
this is more than a mere ecrime story relegated solely to brazil.
this is more than a mere ecrime story relegated solely to brazil.
September 5, 2026 at 11:13 AM
old vulnerable servers left exposed. and the one that should worry every security team, they try to recruit insiders. they do not always break in. sometimes they just hire someone who is already inside.
this is more than a mere ecrime story relegated solely to brazil.
this is more than a mere ecrime story relegated solely to brazil.
plump spider is a brazil-based ecrime threat actor, active since 2023, and their specialty is genuinely different. they compromise the payment systems and banking software themselves, then create fraudulent transfers in the name of a legitimate company with real funds sitting in real accounts.
September 5, 2026 at 11:13 AM
plump spider is a brazil-based ecrime threat actor, active since 2023, and their specialty is genuinely different. they compromise the payment systems and banking software themselves, then create fraudulent transfers in the name of a legitimate company with real funds sitting in real accounts.
most financial ecrime is theft. steal the card, steal the login, sell it, move on. plump spider does something a bit more sophisticated. they do not steal the money. they get inside the bank's own software and tell it to move the money for them.
September 5, 2026 at 11:13 AM
most financial ecrime is theft. steal the card, steal the login, sell it, move on. plump spider does something a bit more sophisticated. they do not steal the money. they get inside the bank's own software and tell it to move the money for them.
a dark web service called nexus launched this week on a russian ecrime forum, claiming searchable access to more than 153 million us and canadian driver's-license records, over 10 million other id cards, more than 3 million passports, and over 579,000 medical cards.
September 5, 2026 at 8:29 AM
a dark web service called nexus launched this week on a russian ecrime forum, claiming searchable access to more than 153 million us and canadian driver's-license records, over 10 million other id cards, more than 3 million passports, and over 579,000 medical cards.