John Z Black
Brunswick, ME • (207) 245-1010 • contact@johnzblack.com
LockBit Won't Die: 207 Victims in 2026 and What Ransomware Resilience Actually Looks Like
Despite one of the most aggressive law enforcement operations in ransomware history, LockBit has claimed 207 victims in 2026. Winona County got hit twice in three months. The RaaS model is more durable than takedowns.
Read More
The Week the Clock Ran Out
Defenders got squeezed this week. AI sped up vuln discovery, OT attacks stayed active, and trusted update channels turned into incident response events.
Read More
The Week the Clock Ran Out
Defenders got squeezed this week. AI sped up vuln discovery, OT attacks stayed active, and trusted update channels turned into incident response events.
Read More
Russian Satellites. Iranian Missiles. A U.S. AWACS. Three Sources Now Document the Same Kill Chain.
A Russian satellite imaged Prince Sultan Air Base before the March 27 strike. Iran hit a U.S. E-3 Sentry AWACS. A Russian satellite returned the next day for damage assessment. A Ukrainian intelligence assessment, a Western military source, and a U.S. orbital analytics firm all now document pieces of that sequence.
Read More
Iran Cut Off 90 Million People From the Internet. Its Own Spies Kept Working.
Iran's internet blackout hit 1,055 hours, the second-longest national shutdown on record. The detail that makes this a security story: Iranian intelligence services ran active cyber operations throughout, using foreign-hosted infrastructure the blackout doesn't touch.
Read More
Six Federal Agencies Just Told You to Disconnect Your PLCs. Here's What Forced Their Hand.
FBI, CISA, NSA, EPA, DOE, and Cyber Command co-signed a single advisory on Iranian hackers disrupting PLCs at U.S. water, energy, and government facilities. This isn't theoretical.
Read More
Stryker Recovered from an Iranian Wiper Attack. It Took Three Weeks and 80,000 Devices.
Iran's Handala group wiped 80,000 devices across Stryker's global network. Maryland EMS lost digital ECG transmission. The DOJ confirmed Iran's government runs Handala.
Read More
The Week Toolchain Trust Collapsed, Again
TeamPCP kept hitting developer tooling. AI attack surfaces went from theoretical to exploited. Attackers logged in instead of breaking in. And Iran went after the FBI director's personal inbox.
Read More
Your Security Camera Is Probably Someone Else's Window Into the War
Nation-states are routinely hacking unpatched IP cameras to gather physical intelligence during active conflicts, and the cameras being targeted are the cheap, forgotten ones in your building's lobby.
Read More
Iran Is Running Every Cyberattack at Once
Iran isn't running a cyber campaign right now. It's running all of them simultaneously, and Unit 42's latest brief documents exactly that.
Read More
From Wiping 80,000 Devices to Hacking the FBI Director: Handala's March
Iran-linked Handala publicly warned they were coming for the FBI. Kash Patel said nothing. The next morning, his cigar photos were on the internet.
Read More
CanisterWorm: TeamPCP Hides Its C2 on a Blockchain You Can't Take Down
TeamPCP's new wiper, CanisterWorm, uses an ICP blockchain canister as its C2 resolver -- no domain to seize, no server to kill. And it now runs on any system, not just Kubernetes.
Read More
Stryker Finds a Malicious File in Its Systems. Production Is Coming Back Online.
Stryker's forensic investigation with Palo Alto Networks Unit 42 found a malicious file used to run commands and conceal activity, a separate finding from the initial Handala attack. Production recovery is underway.
Read More
Someone Is Broadcasting a Numbers Station Through the Iran War
Since US and Israeli strikes on Iran began on February 28, a shortwave numbers station at 7910 kHz has been broadcasting in Farsi twice daily. Signal analysis points toward Ramstein Air Base.
Read More
The Week the Infrastructure Fought Back (and Lost)
The week of March 16-22 hit management planes, identity infrastructure, and security tooling itself -- and North Korea kept hiring.
Read More
You Can't Seize the Internet: Iran's Handala Hackers Were Back Online Hours After the FBI Acted
The DOJ seized four Handala domains. Iran's MOIS-backed hackers had new infrastructure up within hours, called the action 'trivial,' and kept operating. That tells you everything about the limits of domain seizures as deterrence.
Read More
Handala, Publicly Attributed: What the FBI Seizure Changes About Iran Cyber Signaling
The FBI seized Handala's sites and released a 40-page warrant formally linking the group to Iran's intelligence ministry. Attribution just moved from analyst opinion to federal court filing.
Read More
Iran Didn't Need Malware to Cripple Stryker. They Just Used Microsoft Intune.
The Handala group wiped tens of thousands of Stryker devices using the company's own MDM platform. No malware. No exploit. Just admin access and the willingness to press the button.
Read More
Iran's Digital Battlefield: GPS Jamming, Hijacked Cameras, Internet Kill Switch, and AI Disinfo
The Iran conflict isn't just missiles and headlines. It's GPS spoofing that breaks delivery apps, hijacked security cameras used for pre-strike surveillance, a near-total internet blackout for 87 million people, and AI-generated war propaganda flooding social media.
Read More
Hackers Used Stryker's Own IT Tool to Nuke Its Entire Device Fleet
An Iranian-linked group called Handala reportedly hijacked Microsoft Intune and wiped Stryker's devices at scale. The tool designed to secure their fleet became the weapon that destroyed it.
Read More
Iran Hit a Medical Device Giant, a NATO Parliament, and Your Instagram Feed on the Same Day
March 11 wasn't three separate cyberattacks. It was one coordinated Iranian campaign across three fronts: a wiper on Stryker, a breach of Albania's parliament, and an influence op on Instagram. All in 24 hours.
Read More
The War Near Iran Is Breaking Your Apps: GPS Jamming, Cyber Escalation, and Civilian Collateral
GPS jamming near Iran is wrecking delivery and navigation apps across the region. Unit 42 warns of escalating Iranian cyber risk. Modern conflict has a civilian tech blast radius.
Read More