insider-threat

One IT Admin Locked 254 Servers. T-Mobile Lost Another Insider. Same Day.

John Z Black Apr 4, 2026

Incidents & Breaches #insider-threat #t-mobile #privileged-access #extortion #data-breach

A Kansas City engineer held his employer hostage for 20 bitcoin while T-Mobile quietly filed yet another insider breach. Privileged access is still the hardest problem in security.

Inside the North Korean IT Worker Playbook: IBM and Flare's New Research Shows Exactly How They Get In

John Z Black Mar 23, 2026

Threat Intelligence #north-korea #threat-intelligence #insider-threat #identity-fraud #dprk #remote-work-security

IBM and Flare published the most detailed technical breakdown yet of how North Korean IT workers infiltrate US companies, including specific detection controls security and HR teams can actually use.

How a Virginia Security Firm Set a Trap and Caught a North Korean Spy Applying for a Remote Job

John Z Black Mar 22, 2026

Threat Intelligence #north-korea #dprk #it-worker-fraud #nisos #ofac #hiring-fraud #insider-threat #remote-work

Nisos set up a fake hiring scenario, handed a suspected DPRK worker a monitored laptop, and caught them. The most unsettling part: the companies already infiltrated had no idea until Nisos called.

He Hacked Companies, Then Billed Them $75 Million to Recover From His Own Attacks

John Z Black Mar 22, 2026

Ransomware & Cybercrime #ransomware #digitalmint #angelo-martino #insider-threat #ransomware-negotiation #fraud #cybercrime

Angelo Martino allegedly orchestrated ransomware attacks and then helped victims pay ransoms through DigitalMint -- the firm where he worked. Federal charges now implicate the co-founder too.

The Insider Front Door: How Legitimate Access Keeps Becoming Extortion

John Z Black Mar 21, 2026

Incidents & Breaches #insider-threat #north-korea #extortion #access-management #workforce-fraud #contractor-risk

A data analyst extorted his employer for $2.5M using access his job gave him. Three Americans helped North Korean operatives infiltrate US companies as fake IT workers. Different crimes, same root problem.

Breach Impact Without a Single Archetype: Vendor, Insider, and Nation-State Pressure

John Z Black Mar 20, 2026

Incidents & Breaches #breach-response #insider-threat #nation-state #incident-governance #disclosure #board-risk

Navia, Aura, an insider ransomware conviction, and Lazarus attribution show why breach readiness should be built around resilient process, not assumptions about attacker type.

The Insider No One Suspected: DOJ Says a Ransomware "Helper" Was Running the Attack

John Z Black Mar 14, 2026

Ransomware #blackcat #ransomware #incident-response #doj #trust #insider-threat #alphv #digitalmint

A ransomware negotiator was secretly feeding BlackCat operators confidential victim data to jack up ransom payments. The DOJ just charged him.