Welcome in! You’ve entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today’s most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York’s exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel.
Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. This month our hosts dive into the growing Chinese-speaking cybercrime ecosystem and the rise of threat actors behind large-scale credential phishing operations. They explore a major disruption targeting Chinese-language phishing kits CoGUI, CoAceV, and CoFish_Ws, which have fueled hundreds of millions of malicious messages, particularly targeting Japanese organizations, and examine what the takedown could mean for the broader cybercrime landscape. Malware
Welcome in! You’ve entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today’s most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York’s exclusive upper west side, Selena is joined by her co-hosts N2K Networks Dave Bittner and Keith Mularski, former FBI cybercrime investigator and now Chief Global Ambassador at Qintel.
Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. This month our hosts dive into the growing Chinese-speaking cybercrime ecosystem and the rise of threat actors behind large-scale credential phishing operations. They explore a major disruption targeting Chinese-language phishing kits CoGUI, CoAceV, and CoFish_Ws, which have fueled hundreds of millions of malicious messages, particularly targeting Japanese organizations, and examine what the takedown could mean for the broader cybercrime landscape. Malware
Cybersecurity News
SpyCast
CyberWire Daily
Daily Briefing
Signals and Space
T-Minus
Research Saturday
Today we are joined by Subhajeet Singha, Senior Security Researcher at Acronis Threat Research Unit, discussing their work on "Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit." A Chinese-speaking threat actor tracked as Red Heron exploited a critical Gitea remote code execution vulnerability, CVE-2026-60004, within days of its public disclosure, compromising organizations across five countries and stealing source code, credentials, and sensitive infrastructure data.
The campaign involved deploying persistent backdoors and a newly identified Linux implant called JITTERLY, which contains an undocumented rootkit, SIXZUT, capable of hiding files, processes, and network connections while protecting the malware from removal. Acronis assesses with moderate confidence that Red Heron operates within a PRC-linked context, highlighting how quickly attackers can weaponize newly disclosed vulnerabilities and turn exposed development platforms into gateways for broader network compromise. 
Week that Was
CyberWire Daily
Daily Briefing
CyberWire Daily
Story
Caveat
