International Cyber Digest Profile picture
Nov 5 3 tweets 1 min read Read on X
🚨Peter Williams, 39, an Australian, pleaded guilty today in U.S. District Court to selling his employer’s trade secrets to a Russian cyber-tools broker.

The material, stolen over three years from the U.S. defense contractor where he worked, comprised national security-focused software, including at least eight sensitive, protected cyber-exploit components intended for exclusive sale to the U.S. government and select allies. The broker publicly advertises as a reseller of cyber exploits to various customers, including the Russian government.

His employer released the following statement today.Image
Correction he pleaded guilty on Wednesday, October 29, 2025.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with International Cyber Digest

International Cyber Digest Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @IntCyberDigest

Oct 22
‼️ When Collins Aerospace shut down its Multi-User System Environment (MUSE), it informed the press and filed with the SEC, claiming a ransomware attack.

This caused major European airports to halt passenger processing, stranding thousands and delaying numerous flights.

Turns out they didn't have to turn off the systems.

The threat actor claims no ransomware or compromise occurred, alleging Collins Aerospace disabled the servers for insurance money.

They admit breaching an FTP server, exfiltrating data over days until access was blocked, and claim to have obtained 1,533,900 passenger records.

Screenshots of conversations between Everest and RTX, Collins Aerospace's parent company, are included in this post and they don't seem to mention any encrypted data.Image
Image
Image
Image
This is the compromised SFTP server. Username: aiscustomer, password: muse-insecure. Insecure indeed. Why store sensitive files like passenger data, SQL, service documentation, and configurations on a publicly accessible, insecure SFTP server? Image
We couldn't fully confirm this story's validity, but it's unclear why the threat actor would strongly oppose ransomware and deny deploying it on Collins Aerospace's systems if untrue. No definitive evidence confirms or refutes its deployment.

It's uncertain why @enisa_eu confirmed the ransomware deployment to Reuters. Did @enisa_eu investigate and confirm the ransomware, or did they relay RTX's statement?

cc @RTX_News @CollinsAero, a lessons-learned session detailing the deployed malware (so we can all learn) would be appreciated. Thanks!Image
Read 4 tweets
Oct 17
🚨 Multiple cybercriminals were arrested during Operation SIMCARTEL.

Europol and Latvian law enforcement dismantled five servers, seized 1,200 SIM box devices and 40,000 active SIM cards.

The criminals were linked to over 1,700 cyber fraud cases in Austria and 1,500 in Latvia, causing losses of several million euros, including EUR 4.5 million in Austria and EUR 420,000 in Latvia.
“Yep, that’s me. You’re probably wondering how I got into this situation …” Image
Image
Image
Image
Image
Read 4 tweets
Oct 8
🚨 Discord Breach Update

- Discord negotiated with the threat actor for two weeks, promising payment.
- Discord then ceased communication.
- The threat actor, now angry, is releasing files individually.

Leaked tables will be posted next. Image
Tables:

id
username
email
verifiedlocation
premium_until
premium_type
pending_deletion
country
phone
mfa_enabled
last_seen Image
cc @discord
Read 5 tweets
Oct 3
🚨 Scattered LAPSUS$ Hunters launched an onion website, listing all victims with a deadline of October 10, 2025.

We've made a thread with screenshots of the victims below 👇 Image
FedEx Image
Toyota Motor Corporation Image
Read 26 tweets
Oct 1
‼️🚨 Red Hat breached: Crimson Collective stole 28k private repositories, including credentials, CI/CD secrets, pipeline configs, VPN profiles, and infrastructure blueprints.

Our analysis of obtained data: 👇 Image
The file tree includes thousands of repositories referencing major banks, telecoms, airlines, and public-sector organizations, such as Citi, Verizon, Siemens, Bosch, JPMC, HSBC, Merrick Bank, Telstra, Telefonica, and even mentions the U.S. Senate...
What's in the file tree dump?

Inventories, hosts, Ansible playbooks, OpenShift install blueprints, CI/CD runners, VPN profiles, Quay/registry configs, Vault integrations, backups, and exported GitHub/GitLab configs.
Read 12 tweets
Sep 26
‼️ Meet the Chinese man who has sold over 6,500 counterfeit licenses to Americans and Canadians, making over $750k. He used more than 83 domains and multiple social media accounts to promote his services. Image
He sent every order very discreetly packaged, going to great lengths to hide the true contents: counterfeit IDs. Image
Image
Image
Image
He has 24/7 chat support and even a video manual on how to unpack the fake IDs. Image
Image
Read 7 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(