In the latest Security Sprint, Dave and Andy covered the following topics:
Warm Open:
• (TLP:CLEAR) WaterISAC – EPA: National Security Information Sharing Bulletin - Q2 2025
• REGISTER NOW! WaterISAC’s 2025 H2OSecCon! Happening virtually Tuesday May 20th from 11am-5pm ET. Learn more and register here!
• Crypto ISAC Expands Leadership Team to Support Next Phase of Industry Collaboration and Operational Scale & Crypto Hacks and Scams Hit $364M in April, Says CertiK
• Continuity Planning: Conducting Tabletop Exercises; Facilities teams need to participate in Tabletop exercises to prepare for emergency events and situations.
Main Topics:
Physical Security
• Brazil police thwart bomb attack on Lady Gaga concert
o Two Arrested in Plot to Bomb Lady Gaga’s Rio Concert
• Florida Man Arrested in Foiled Mass Shooting Plot – Church Listed Among Targets
o Arrest in Florida reveals love link, conspiracy between man and Wisconsin school shooter
o Loxahatchee man linked to WI school shooter accused of 7 mass shooting threats
• Eight arrests in connection with two separate terrorism investigations
o UK Met: Five arrested as part of Counter Terrorism Policing operation
o UK Met: Three people arrested as part of Counter Terrorism Policing operation
o ‘Iranian terror attack’ foiled with hours to spare; Authorities feared attack on ‘specific premises’ was imminent as seven arrested
• Teen Arrested In German Synagogue Attack Plot
Severe Weather
• NOAA: Hurricane Prep: social media (English). The Hurricane Preparedness Week Social Media Plan.
• Monster quake could sink swath of California.
o Tsunami Warning Issued After Huge Earthquake Off Argentina
o Earthquake of magnitude 5.83 strikes La Rioja Province, Argentina, GFZ says
Cybersecurity
• Q1 Ransomware Report: The organizational structure of ransomware threat actor groups is evolving before our eyes.
• Surefire Cyber: Ransomware Threat Evolution Q1 2025
• Retail Ransomware Attacks Claimed by DragonForce:
o Incidents impacting retailers – recommendations from the NCSC
o Co-op cyber attack affects customer data, firm admits, after hackers contact BBC
o Co-op confirms data theft after DragonForce ransomware claims attack
o DragonForce Ransomware Gang | From Hacktivists to High Street Extortionists
o DragonForce Ransomware Cartel attacks on UK high street retailers: walking in the front door
o Marks & Spencer breach linked to Scattered Spider ransomware attack
o NCSC statement: Incident impacting retailers
o Luxury store Harrods is latest retail victim of cyber attackers
o Harrods is latest British retailer to be hit by cyber attack
o UK Retailers Co-op, Harrods and M&S Struggle With Cyberattacks
o Harrods the next UK retailer targeted in a cyberattack
Quick Hits:
• Hello 0-Days, My Old Friend: A 2024 Zero-Day Exploitation Analysis
• FBI PSA: Threat Actors Use "Swatting" to Target Victims Nationwide, April 29, 2025
• TLP CLEAR FBI FLASH Phishing Domains Associated with LabHost PhaaS Platform Users (PDF)
• With Love, From North Korea… 🇰🇵
o North Korea Stole Your Job
o Malicious North Korean actors attempt to infiltrate technology companies
o North Korean operatives invent identities to infiltrate industries
o How we identified a North Korean hacker who tried to get a job at Kraken
o Recruitment Red Flags: Spotting DPRK IT Remote Workers
• Noem calls for reauthorization of cyberthreat information sharing law during RSA keynote
• Some DHS employees told to send selfies to prove they are in-office as department suddenly ends remote work
• CISA restructuring plan release date unknown and likely to be slowed by Plankey nomination
• Spain, Portugal switch back on, seek answers after biggest ever blackout
o The Agonizing Task of Turning Europe’s Power Back On
o NERC: Statement on European Outages
o What Caused the European Power Outage?
Our TOPPODCAST Picks 
Stay Connected
