Ransomware is not a hurricane. It is not an earthquake. It is not “weather.” It is a human-built criminal economy – and like any economy, it runs on money, incentives, and people who profit from keeping the engine running. The September 2026 indictment of Zohar Pinhasi and his firm MonsterCloud LLC is a wake-up call for every CEO, CISO, general counsel, and incident response lead. Prosecutors allege that from 2018 to 2023, MonsterCloud billed hundreds of victim organizations more than $19… Read More
Your Ransomware “Rescuer” Might Be Part of the Problem – BCPs from the MonsterCloud Indictment
Ransomware is not a hurricane. It is not an earthquake. It is not “weather.” It is a human-built criminal economy – and like any economy, it runs on money, incentives, and people who profit from keeping the engine running. The September 2026 indictment of Zohar Pinhasi and his firm MonsterCloud LLC is a wake-up call Read More
Essential Guide: Mitigating MikroTik Threats on Your Network
In case you missed it, we have +2.6 million exposed MikroTik instances. Top: Brazil, Indonesia, USA. Time to check your networks. I’ve had several peers ask to dust off the MikroTik security guide from 2023. Here is an update:Essential Guide: Mitigating MikroTik Threats on Your Networkhttps://www.senki.org/essential-guide-mitigating-mikrotik-threats-on-your-network/Shadowserver now has a new dedicated report for MikroTik. These started reporting out (daily) MikroTik instances with exposed… Read More
Essential Guide: Mitigating MikroTik Threats on Your Network
Active exploitation of the September 2026 MikroTrick vulnerability chain has put exposed MikroTik devices at immediate risk of full unauthenticated takeover. Learn the fixed RouterOS builds, how to identify compromise indicators like the new Flagged state, and how to harden your management plane against Internet-wide abuse. Read More
Threat Researchers Leveraging Shadowserver for Responsible Disclosure
Discover how a threat researcher turned an exposed SNMP risk on an untracked ISP network into a global remediation win. Learn how to leverage the Shadowserver Foundation and National CSIRTs as your responsible disclosure allies to validate threats, protect networks, and get proper credit for your findings. Read More
CEO’s Wake Up! Operation Ramz, Shadowserver, and the Case for Funding Public-Benefit Cyber Defense
“Cybercrime is a borderless, multi-billion-dollar enterprise. We cannot defend against it solely by building taller walls around individual networks. Operation Ramz proves that actionable intelligence, combined with trusted public-private partnerships, results in actual arrests and dismantled infrastructure.” The organizations most concerned about cybercrime must fund the non-profit engine that actually disrupts it. Call to Action: Visit shadowserver.org/partner/ to invest in action. Read More
In Tribute to Peter G. Neumann (1932–2026) – Service, Sound Systems, and the Work That Remains
Peter Neumann said, “Security is a set of end-to-end total-system emergent properties,” and “Strength in Depth is desirable, but we have Weakness in Depth.” He quotes Einstein — “Everything should be made as simple as possible, but no simpler” — and warns that oversimplifying security leads to flaws. Read More
Origin of Protective DNS and RPZ
The Architectural Evolution of Protective DNS: From Academic Prototyping to Global Security Standard The historical trajectory of the Domain Name System (DNS) has transitioned from a rudimentary directory service into the fundamental control plane of modern internet security. This transformation was neither accidental nor purely market-driven; it was the result of a protracted conflict between Read More
Meaningful Security Conversations with Your Vendors: The 2026 Q1 Guide to Digital Safety & Resilience
Executive Summary: The Imperative for a New Dialogue In the contemporary operational environment, defined by industrialized cyber warfare and systemic supply chain compromises—exemplified by the Salt Typhoon and Volt Typhoon campaigns—the evaluation of network vendors has shifted from a procurement checklist to a strategic imperative. Organizations can no longer rely solely on perimeter defenses; they Read More
FAQ – Which Shadowserver Reports list CVEs
FAQ – Which Shadowserver Reports list CVEs? Many people frequently ask how Shadowserver includes CVEs (Common Vulnerabilities and Exposures) in its reports. Currently, there are over 140 reports published, with more on the way. The Shadowserver Alliance is active, working together to support the Shadowserver initiative and develop new report types. It’s a logical question to ask. The wonders of today make it soooo easy to find answers. You don’t need to ask gurus to kick-start your journey…. Read More