Leaky Weekly – Details, episodes & analysis

On this latest episode of Leaky Weekly, host and security researcher Nick Ascoli covers recent news in the cybercrime space such as the LockBit arrests, an update to the Columbus ransomware attack, Bohemia arrests, and MC2 data leak.

Here are the resources Nick mentions:

• LockBit power cut: four new arrests and financial sanctions against affiliates (Europol)
• Evil Corp: Behind the Screens (National Crime Agency)
• LockBit Ransomware and Evil Corps Members Arrested and Sanctioned in Joint Global Effort (The Hacker News)
• LockBit Links to Evil Corp (Secureworks)
• Dark Web Drama: LockBit and the AN Security Breach Saga (Flare)
• Columbus pledges $3 million more to fix data breach (NBC4i)
• Internationale actie tegen werelds' grootste darkweb-markt 'Bohemia/ Cannabia' (Politie)
• One-third of the US population’s background info is now public (Cybernews)

Brought to you by Flare, the world's easiest to use and most comprehensive cybercrime database that integrates into your security program in 30 minutes. Check out what’s on the dark web (and more) about your organization.

Flare now offers Flare Academy training, which is our (free!) training series led by experts that cover critical topics such as threat intelligence, operational security, and advanced investigation techniques. You can also earn CPE credits toward your cybersecurity certifications. Join the Flare Academy Community Discord to keep up with upcoming training, check out previous training resources, chat with cybersecurity professionals (including Nick!), and more.

In Leaky Weekly’s third episode, host and security researcher Nick Ascoli covers recent news in the cybercrime space including the AWS takeover campaign, ransomware attack on Columbus, Ohio, and the city of Columbus suing a ransomware researcher whistleblower.

Here are the resources Nick mentions:

• Leaked Environment Variables Allow Large Scale Extortion Operation in Cloud Environments
• Ransomware Group Claims Columbus Attack, Selling 6 Terabytes of Passwords and More
• Researcher Sued for Sharing Data Stolen by Ransomware with Media
• He Proved the Columbus Data Leak Hurts the Public. Now, the City has Silenced Him

Brought to you by Flare, the world's easiest to use and most comprehensive cybercrime database that integrates into your security program in 30 minutes. Check out what’s on the dark web (and more) about your organization.

Flare now offers Flare Academy training, which is our (free!) training series led by experts that cover critical topics such as threat intelligence, operational security, and advanced investigation techniques. You can also earn CPE credits toward your cybersecurity certifications. Join the Flare Academy Community Discord to keep up with upcoming training, check out previous training resources, chat with cybersecurity professionals (including Nick!), and more.

In Leaky Weekly’s second episode, host and security researcher Nick Ascoli covers recent news in the cybercrime space such as the National Public Data breach, Dispossesser ransomware operation repossession, feuding forums, and the arrest of two “J.P. Morgans.”

Here are the resources Nick mentions:

• National Public Data confirms breach, scope unknown (TechTarget)
• National Public Data com Hack Exposes a Nation’s Data (Krebs on Security)
• Personal Data of 3 Billion People Stolen in Hack, Suit 1 (Bloomberg Law)
• Inside the “3 Billion People” National Public Data Breach (Troy Hunt)
• National Public Data Security Incident Announcement (National Public Data)
• FBI disrupts the Dispossessor ransomware operation, seizes servers (Bleeping Computer)
• Ransomware Evolution | How Cheated Affiliates Are Recycling Victim Data for Profit (SentinelOne Blog)
• Ransomfeednews’ X (formerly known as Twitter) Thread on Dispossessor Reposting Leaks
• A Threat Actor Has Allegedly Scraped the Data belonging to the Forum Leakbase (Dark Web Informer)
• Leakbase Information (Searchlight Cyber Dark Web Hub)
• Leader of International Malvertising and Ransomware Schemes Extradited from Poland to Face Cybercrime Charges (U.S. Department of Justice)

Brought to you by Flare, the world's easiest to use and most comprehensive cybercrime database that integrates into your security program in 30 minutes. Check out what’s on the dark web (and more) about your organization.

In Leaky Weekly’s first episode, host and security researcher Nick Ascoli covers recent news in the cybercrime space, such as the AT&T breach, Snowflake tenant breaches, the hacktivist group SiegedSec, and Disney hack.

Here are the resources Nick mentions:

• The Sweeping Danger of the AT&T Phone Records Breach (Wired)
• Massive Ticketmaster, Santander data breaches linked to Snowflake cloud storage (The Verge)
• UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion (Mandiant)
• Read the furious texts the Heritage Foundation sent furry hacking collective SiegedSec after breach (Daily Dot)
• Hackers Claim to Have Leaked 1.1 TB of Disney Slack Messages (Wired)

Brought to you by Flare, the world's easiest to use and most comprehensive cybercrime database that integrates into your security program in 30 minutes. Check out what’s on the dark web (and more) about your organization.

Flare now offers Flare Academy training, which is our (free!) training series led by experts that cover critical topics such as threat intelligence, operational security, and advanced investigation techniques. You can also earn CPE credits toward your cybersecurity certifications. Join the Flare Academy Community Discord to keep up with upcoming training, check out previous training resources, chat with cybersecurity professionals (including Nick and Tammy!), and more.

On this latest episode of Leaky Weekly, host and security researcher Nick Ascoli covers recent news in the cybercrime space such as the USDoD arrest, Judische/Waifu (Connor Moucka) arrest, RedLine infrastructure takedown and arrest(s), and MOVEit leaks.

Here are the resources Nick mentions:

• The unmasking of threat actor USDoD (Cybernews)
• USDoD, the hacker allegedly behind attacks on FBI and Airbus, arrested in Brazil (Cybernews)
• USDoD Hacker Behind $3 Billion SSN Leak Reveals Himself as Brazilian Citizen (Hackread)
• Man Arrested for Snowflake Hacking Spree Faces US Extradition (Wired)
• Here’s the indictment against two men allegedly responsible for Snowflake customer breach (Cyberscoop)
• Canadian Man Arrested in Snowflake Data Extortions (Krebs on Security)
• “Operation Magnus” Seized RedLine and META Infostealer Networks (Cyberinsider)
• Operation Magnus Update Announces Arrest of RedLine Malware Creator (Cyberinsider)
• Operation Magnus (operation-magnus.com)
• Millions of records from MOVEit hack released on dark web (SC Media)
• More data stolen in 2024 MOVEit attacks come to light (Computer Weekly)

Brought to you by Flare, the world's easiest to use and most comprehensive cybercrime database that integrates into your security program in 30 minutes. Check out what’s on the dark web (and more) about your organization.

Flare now offers Flare Academy training, which is our (free!) training series led by experts that cover critical topics such as threat intelligence, operational security, and advanced investigation techniques. You can also earn CPE credits toward your cybersecurity certifications. Join the Flare Academy Community Discord to keep up with upcoming training, check out previous training resources, chat with cybersecurity professionals (including Nick!), and more.

On this first episode of Leaky Weekly after our winter break, host and security researcher Nick Ascoli covers recent events in the cybercrime space the PowerSchool hack, Cracked & Nulled takedown & arrests, Otelier data leak, DeepSeek data leak, and Identity Theft Resource Center (ITRC) breach report findings.

Here are the resources Nick mentions:

• Children’s data hacked after school software firm missed basic security step, internal report says (NBC News)
• PowerSchool Cybersecurity Incident (PowerSchool)
• AT&T Paid a Hacker $370,000 to Delete Stolen Phone Records (WIRED)
• FBI has warned agents it believes hackers stole their call logs (Fortune)
• Law enforcement takes down two largest cybercrime forums in the world (Europol)
• Otelier data breach exposes info, hotel reservations of millions (Bleeping Computer)
• Wiz Research Uncovers Exposed DeepSeek Database Leaking Sensitive Information, Including Chat History (Wiz)
• ITRC Annual Data Breach Report (Identity Theft Resource Center)
• Canadian Man Arrested in Snowflake Data Extortions (Krebs On Security)

Brought to you by Flare, the world's easiest to use and most comprehensive cybercrime database that integrates into your security program in 30 minutes. Check out what’s on the dark web (and more) about your organization.

Flare now offers Flare Academy training, which is our (free!) training series led by experts that cover critical topics such as threat intelligence, operational security, and advanced investigation techniques. You can also earn CPE credits toward your cybersecurity certifications. Join the Flare Academy Community Discord to keep up with upcoming training, check out previous training resources, chat with cybersecurity professionals (including Nick!), and more.

On this episode of Leaky Weekly, Tammy Harper, Senior Threat Intelligence Researcher at Flare joins host and security researcher Nick Ascoli. They discuss ransomware in 2024, and how that affects the ransomware ecosystem of 2025.

Tammy goes over:

• 2024 ransomware ecosystem summary
• 2025 disruptions in the wake of 2024 takedowns
• Compromised credentials’ growing role in cybercrime

More episodes from Tammy and Nick’s conversation on ransomware will be coming in the following weeks.

Brought to you by Flare, the world's easiest to use and most comprehensive cybercrime database that integrates into your security program in 30 minutes.

Brought to you by Flare, the world's easiest to use and most comprehensive cybercrime database that integrates into your security program in 30 minutes. Check out what’s on the dark web (and more) about your organization.

Flare now offers Flare Academy training, which is our (free!) training series led by experts that cover critical topics such as threat intelligence, operational security, and advanced investigation techniques. You can also earn CPE credits toward your cybersecurity certifications. Sign up for Senior Threat Intelligence Researcher Tammy Harper’s Academy training, CRYPTOS: Hunting Adversaries in the Crypto Underground on Tuesday July 15, 2025 at 11:00-1:00 PM ET. Join the Flare Academy Community Discord to keep up with upcoming training, check out previous training resources, chat with cybersecurity professionals (including Nick and Tammy!), and more.

On this episode of Leaky Weekly, Tammy Harper, Senior Threat Intelligence Researcher at Flare joins host and security researcher Nick Ascoli. They talk about shifts in the ransomware ecosystem in 2025.

Tammy explains:

• Ransomware group adaptations based on 2024 events
• Why data-only extortion isn’t catching on
• How access to leaked data is shaping both victim decision-making and long-term exposure

More episodes from Tammy and Nick’s conversation on ransomware will be coming in the following weeks.

Brought to you by Flare, the world's easiest to use and most comprehensive cybercrime database that integrates into your security program in 30 minutes. Check out what’s on the dark web (and more) about your organization.

Flare now offers Flare Academy training, which is our (free!) training series led by experts that cover critical topics such as threat intelligence, operational security, and advanced investigation techniques. You can also earn CPE credits toward your cybersecurity certifications. Sign up for Senior Threat Intelligence Researcher Tammy Harper’s Academy training, CRYPTOS: Hunting Adversaries in the Crypto Underground on Tuesday July 15, 2025 at 11:00-1:00 PM ET. Join the Flare Academy Community Discord to keep up with upcoming training, check out previous training resources, chat with cybersecurity professionals (including Nick and Tammy!), and more.

On this episode of Leaky Weekly, Tammy Harper, Senior Threat Intelligence Researcher at Flare joins host and security researcher Nick Ascoli.

Tammy explains:

• LockBit’s fall, the affiliate exodus, and rise of RansomHub
• “Ransomware without the ware” – cross-posting as the norm now
• Noise in the ransomware underground

More episodes from Tammy and Nick’s conversation on ransomware will be coming in the following weeks.

Brought to you by Flare, the world's easiest to use and most comprehensive cybercrime database that integrates into your security program in 30 minutes. Check out what’s on the dark web (and more) about your organization.

Flare now offers Flare Academy training, which is our (free!) training series led by experts that cover critical topics such as threat intelligence, operational security, and advanced investigation techniques. You can also earn CPE credits toward your cybersecurity certifications. Sign up for Senior Threat Intelligence Researcher Tammy Harper’s Academy training, CRYPTOS: Hunting Adversaries in the Crypto Underground on Tuesday July 15, 2025 at 11:00-1:00 PM ET. Join the Flare Academy Community Discord to keep up with upcoming training, check out previous training resources, chat with cybersecurity professionals (including Nick and Tammy!), and more.

On this episode of Leaky Weekly, host and security researcher Nick Ascoli gets into stealer logs and arrests in the last few weeks of threat actor IntelBroker and threat actors who targeted retail companies in the U.K. using the DragonForce encryptor. This is part 1 of a 2 part series, Use a Stealer Log, Go to Prison. Here's part 2: on Apple Podcasts or Spotify.

Here are the resources on the stories:

• 2025 Data Breach Investigations Report (DBIR) (Verizon)
• The Rising Role of Stolen Credentials in Cybercrime: 3 Insights from the 2025 Verizon DBIR (Flare)
• IntelBroker Threat Actor (TheSecMaster)
• Following the Bitcoin Trail: The IntelBroker Takedown (Chainalysis)
• United States of America v. Kai West (“IntelBroker,” “Kyle Northern”) Complaint (U.S. Department of Justice)
• Four arrested in connection with M&S and Co-op cyber-attacks (BBC)
• Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods (National Crime Agency)
• UK police arrest four over cyberattacks on M&S, Co-op and Harrods (Reuters)
• Inside DragonForce, the Group Tied to M&S, Co-op and Harrods Hacks (Infosecurity Magazine)
• Inside the Dragon: DragonForce Ransomware Group (Group-IB)

Brought to you by Flare, the world's easiest to use and most comprehensive cybercrime database that integrates into your security program in 30 minutes. Check out what’s on the dark web (and more) about your organization.

Flare now offers Flare Academy training, which is our (free!) training series led by experts that cover critical cybersecurity topics. Check out Flare Academy to keep up with upcoming trainings, check out previous training resources, chat with cybersecurity professionals (including Nick!) in the Flare Academy Community Discord, and more.