mullvad.net/en/blog/mull...

🦾 Two short blog posts from me, followups on Phantom Taurus 👻🐂 report by Unit42. Using our Kaibou Search Services (KSS) malware database of 780m files.

Phantom Taurus related samples - blog.ukatemi.com/blog/2025-10...

Analysis of .NET AMSI bypass assembly loaders - blog.ukatemi.com/blog/2025-10...

Google recently made incredibly misguided changes to Android security updates. Android security patches are almost entirely quarterly instead of monthly to make it easier for OEMs. They're giving OEMs 3-4 months of early access which we know for a fact is being widely leaked including to attackers.

NEW: Mercenary spyware is coming to the US.

ICE just quietly unsuspended their contract with spyware maker #Paragon.

Remember them? Caught earlier this year being used to hack Italian journalists.

This is bad, let's talk about how we got here 1/

jackpoulson.substack.com/p/exclusive-...

TL;DR I am launching my #startup and we are going to change how to evaluate,cluster and reason about #malware, delivering accurate,contextual intelligence on samples. Say Hi to RationalEdge
@rationaledge.bsky.social
rationaledge.io

#threatintel #threathunting #cti #reverseengineering #detection 1/9

💥ICYMI: The Trump admin's top think tank, The Heritage Foundation, works with Hungary’s MCC and Poland’s Ordo Iuris on proposals to dismantle key EU institutions. Their “Great Reset” plan aligns with Orbán’s agenda—and hopes to receive Trump's backing.

Don't trust Microsoft to decide what you can boot! On Linux, remove ALL keys from Secure Boot DB, add your own, build and sign a UKI at every kernel update.

(maybe also forget GRUB and use systemd-boot)

github.com/Zedeldi/CVE-...
kb.igel.com/security-saf...
arstechnica.com/security/202...

‼️ Hidden Bear: The GRU hackers of Russia's most notorious kill squad

As The Insider discovered, Unit 29155, the Kremlin’s most notorious black ops squad, also fielded a team of hackers that tried to destabilize Ukraine before Russia’s full-scale invasion.

We need an Android OEM or someone working at one to provide us with early access to the Android 16 sources in order to have a smooth port this year. We need this before June. We requested it to help with this very difficult situation and still need it.

bsky.app/profile/grap...

A prominent computer scientist who has spent 20 years publishing academic papers on cryptography, privacy, and cybersecurity has gone incommunicado, had his professor profile removed by employer Indiana University, & had his homes raided by the FBI. No one knows why.

arstechnica.com/security/202...

❗“Let’s hire an ISIS suicide bomber to blow him up in the street!”: Europe’s most wanted man plotted my murder — and that of my colleague

After today’s verdict, @christogrozev.bsky.social reveals the plot to kidnap — and possibly kill — him and @dobrokhotov.bsky.social.

securitylab.amnesty.org/latest/2025/...

Amnesty International’s Security Lab has a post about 3 vulnerabilities exploited by Cellebrite to extract data from locked Android devices. GrapheneOS blocked exploiting these vulnerabilities in multiple different ways. We also patched them much earlier.

Since this month's release of Android isn't available yet, we're currently building/testing an early March security update release providing the Android Security Bulletin backports of High/Critical severity patches. Android 15 QPR2 will be available in the near future though.