Loading story…
France’s ANSSI/CERT-FR published its Panorama de la cybermenace 2025, reporting continued blurring between state-linked and cybercriminal activity, including broader misuse of legitimate tools/services and evolving social engineering beyond traditional fake IT support. The report notes ongoing opportunistic and targeted exploitation of vulnerabilities, with internet-exposed edge devices and perimeter solutions often exploited rapidly, and highlights sustained state interest—particularly actors assessed as linked to Russian and Chinese intelligence services—in compromising diplomatic networks for strategic intelligence collection.
Separately, analysis cited from Orange Cyberdefense’s Security Navigator 2026 indicates that individuals identified in publicly disclosed cybercrime law-enforcement actions are frequently mid-career adults, challenging the stereotype of predominantly very young offenders. Based on 418 publicly announced actions (2021 to mid-2025) and age data for 193 offenders, the 35–44 cohort represented 37% of identified offenders, followed by 25–34 (30%) and 18–24 (21%); the authors caution the dataset reflects disclosure and jurisdictional reporting biases rather than the full universe of cybercrime activity.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
France's Gendarmerie nationale and UNC warned that organized crime is becoming deeply cyber-enabled, with attacks increasingly focused on aggregating stolen data to support large-scale social engineering and coercive operations. Officials also said they were expanding cyber capabilities, including embedding expertise in elite units and deploying 1,000 high-end cyber investigators to counter the trend.
Recorded Future's Insikt Group published an assessment of cybercrime in Latin America and the Caribbean during 2025, finding financially motivated activity dominant and documenting 452 ransomware incidents across the region. The report identified Brazil, Mexico, and Argentina as the most targeted countries, highlighted healthcare, finance, and government as frequent targets, and described growing abuse of mobile malware and infostealers.
InterCert France published an incident-response report based on 366 cyber incidents reported by roughly half of its 130-plus member organizations. The report said attacks were detected after an average of 15 days, lasted 17 days on average, and were dominated by opportunistic activity, with about one-third involving data exfiltration and a similar share involving ransomware.
CERT-FR published its 2025 threat and incident report, summarizing trends including blurred state-crime boundaries, evolving social-engineering techniques, growing but non-transformative attacker interest in AI tools, and fast exploitation of exposed systems. The report framed these developments in the context of heightened geopolitical tensions and ongoing compromises of diplomatic networks for intelligence collection.
On publication of Security Navigator 2026, Orange Cyberdefense said identified cyber extortion and malware offenders frequently fell into the 35–44 age bracket, with younger cohorts more associated with broad hacking and skill-building. The report also noted that the dataset covered offenders of 64 nationalities, while cautioning that public disclosures introduce reporting bias.
In its 2026 threat and incident report, CERT-FR said that during 2025 it observed reduced use of ransomware and a marked increase in operations focused solely on data exfiltration. The report also highlighted rapid exploitation of internet-exposed and edge-device vulnerabilities and continued espionage activity linked to Russian- or Chinese-attributed tradecraft.
CERT-FR reported that in 2025 ANSSI benefited from data leaks affecting malicious actors, which improved understanding of how those actors operate. The agency also observed that attribution was becoming more complex as boundaries between state and criminal actors continued to blur.
Orange Cyberdefense's Security Navigator 2026 report reviewed publicly announced cybercrime law-enforcement actions spanning 2021 through mid-2025. The analysis found that identified cyber offenders were often older than common stereotypes suggest, with the 35–44 age group the largest cohort in cases where age data was available.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
cert.ssi.gouv.fr
Open sourcezdnet.fr
Open sourcezdnet.fr
Open sourcerecordedfuture.com
Open sourcerecordedfuture.com
Open sourcecert.ssi.gouv.fr
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent reporting highlighted a multi-year shift in end-user security attitudes and behaviors, based on the National Cybersecurity Alliance and CybSafe’s *Oh, Behave! The Cybersecurity Attitudes and Behaviors Report: 2021–2025*, which surveyed more than **24,000** adults. The findings indicate people increasingly believe cybersecurity is “worth the effort” and more achievable, while also expecting more protection from apps and platforms—framing security as a **shared responsibility** between individuals and service providers. At the same time, the report notes growing feelings of confusion and overwhelm, suggesting a widening gap between awareness of risk and sustained adoption of protective behaviors. Separate analysis of **418** publicly announced law-enforcement actions (2021 to mid-2025), cited from Orange Cyberdefense’s *Security Navigator* and covered by *The Register*, found most arrested cybercrime suspects were **25–44** years old, with the **35–44** bracket the largest share. That demographic trend aligns with a shift toward more monetizable offenses (e.g., extortion and malware) among older cohorts. In a specific case illustrating extortion-driven cybercrime, a **22-year-old** Alabama man, **Jamarcus Mosley**, pleaded guilty to hacking and extorting hundreds of women by impersonating acquaintances to obtain account recovery codes and passwords, hijacking social-media accounts (including Snapchat and Instagram), and threatening to leak intimate content unless victims complied with demands for additional access, explicit material, or payments.
Jun 29, 2026
CrowdStrike’s 2025 global threat reporting says financially motivated intrusions are accelerating, with **average breakout time** (lateral movement after initial access) dropping to **29 minutes** and the fastest observed breakout time at **27 seconds**; the report also describes attackers increasingly using **social engineering**, **living-off-the-land** techniques, and abuse of **trusted systems** to move across *cloud, identity, enterprise,* and unmanaged device boundaries, alongside a reported **37% year-over-year increase** in cloud-focused attacks and a growing set of tracked adversaries (281 named groups plus additional activity clusters). Check Point Research’s 2025 retrospective similarly emphasizes that many 2025 operations relied on **familiar techniques combined in new ways**, highlighting themes such as early **ToolShell** exploitation assessed as Chinese-nexus activity against North American government targets and **identity-centric** intrusions (including **AiTM** credential theft) against US think-tank researchers. Several other items in the set are not about these annual threat-report findings and instead cover separate topics: Romania’s cyber chief warning that ransomware incidents against critical infrastructure may align with **Russian hybrid objectives**; sector-level reporting that **manufacturing** remains heavily targeted by ransomware due to IT/OT interconnectivity and downtime pressure; and US law-enforcement/FBI reporting on a surge in **ATM jackpotting** losses and related indictments. Additional entries are primarily **generic commentary, newsletters, or professional/educational content** (e.g., quantum-preparedness opinion, Enigma/RSAC history piece, a weekly video briefing, a malware-newsletter link roundup, a recon how-to article, and a governance/career feature page) and do not substantively corroborate the specific annual threat-report story.
Jun 29, 2026
Latvia’s National Security Service (SAB) reported that **2025 saw a record high in registered cyber threats** targeting the country, with **Russia** assessed as the primary source of cyber risk amid Latvia’s support for Ukraine. SAB said most activity was linked to cybercrime and digital fraud, but the most serious cases included **intrusion attempts, malware distribution, equipment compromise, and DDoS attacks**, and it warned that **operational technology (OT)** in energy, water, and transport often lacks sufficient protections. The agency also noted that Russian-linked hacktivist activity has shown willingness and capability to target industrial control systems for short-term disruption and intimidation, and that DDoS activity against government and critical services often aligns with politically sensitive events. In the UK, senior national security figures warned Parliament that resilience alone may be insufficient against **cyber and hybrid threats** (including sabotage and disinformation), arguing the country needs an **offensive deterrence** component to impose costs on hostile states rather than “absorbing” attacks. Separately, Check Point Research data cited by Dark Reading indicated **Latin America and the Caribbean** experienced the highest average weekly attack volume globally (3,065 attacks per week; **+26% YoY**), with prevalent activity including **information disclosure**, attempts at **remote code execution** and **authentication bypass**, and a shift toward **data-leak extortion**, credential theft, and **edge-device exploitation**; the report also projected continued ransomware growth, particularly affecting healthcare and manufacturing.
Jun 29, 2026