In the latest Security Sprint, Dave and Andy covered the following topics:

Warm Open:

• (TLP:CLEAR) WaterISAC – EPA: National Security Information Sharing Bulletin - Q2 2025

• REGISTER NOW! WaterISAC’s 2025 H2OSecCon! Happening virtually Tuesday May 20th from 11am-5pm ET. Learn more and register here!

• Crypto ISAC Expands Leadership Team to Support Next Phase of Industry Collaboration and Operational Scale & Crypto Hacks and Scams Hit $364M in April, Says CertiK

• Continuity Planning: Conducting Tabletop Exercises; Facilities teams need to participate in Tabletop exercises to prepare for emergency events and situations.

Main Topics:

Physical Security

• Brazil police thwart bomb attack on Lady Gaga concert

o Two Arrested in Plot to Bomb Lady Gaga’s Rio Concert

• Florida Man Arrested in Foiled Mass Shooting Plot – Church Listed Among Targets

o Arrest in Florida reveals love link, conspiracy between man and Wisconsin school shooter

o Loxahatchee man linked to WI school shooter accused of 7 mass shooting threats

• Eight arrests in connection with two separate terrorism investigations

o UK Met: Five arrested as part of Counter Terrorism Policing operation

o UK Met: Three people arrested as part of Counter Terrorism Policing operation

o ‘Iranian terror attack’ foiled with hours to spare; Authorities feared attack on ‘specific premises’ was imminent as seven arrested

• Teen Arrested In German Synagogue Attack Plot

Severe Weather

• NOAA: Hurricane Prep: social media (English). The Hurricane Preparedness Week Social Media Plan.

• Monster quake could sink swath of California.

o Tsunami Warning Issued After Huge Earthquake Off Argentina

o Earthquake of magnitude 5.83 strikes La Rioja Province, Argentina, GFZ says

Cybersecurity

• Q1 Ransomware Report: The organizational structure of ransomware threat actor groups is evolving before our eyes.

• Surefire Cyber: Ransomware Threat Evolution Q1 2025

• Retail Ransomware Attacks Claimed by DragonForce:

o Incidents impacting retailers – recommendations from the NCSC

o Co-op cyber attack affects customer data, firm admits, after hackers contact BBC

o Co-op confirms data theft after DragonForce ransomware claims attack

o DragonForce Ransomware Gang | From Hacktivists to High Street Extortionists

o DragonForce Ransomware Cartel attacks on UK high street retailers: walking in the front door

o Marks & Spencer breach linked to Scattered Spider ransomware attack

o NCSC statement: Incident impacting retailers

o Luxury store Harrods is latest retail victim of cyber attackers

o Harrods is latest British retailer to be hit by cyber attack

o UK Retailers Co-op, Harrods and M&S Struggle With Cyberattacks

o Harrods the next UK retailer targeted in a cyberattack

Quick Hits:

• Hello 0-Days, My Old Friend: A 2024 Zero-Day Exploitation Analysis

• FBI PSA: Threat Actors Use "Swatting" to Target Victims Nationwide, April 29, 2025

• TLP CLEAR FBI FLASH Phishing Domains Associated with LabHost PhaaS Platform Users (PDF)

• With Love, From North Korea… 🇰🇵

o North Korea Stole Your Job

o Malicious North Korean actors attempt to infiltrate technology companies

o North Korean operatives invent identities to infiltrate industries

o How we identified a North Korean hacker who tried to get a job at Kraken

o Recruitment Red Flags: Spotting DPRK IT Remote Workers

• Noem calls for reauthorization of cyberthreat information sharing law during RSA keynote

• Some DHS employees told to send selfies to prove they are in-office as department suddenly ends remote work

• CISA restructuring plan release date unknown and likely to be slowed by Plankey nomination

• Spain, Portugal switch back on, seek answers after biggest ever blackout

o The Agonizing Task of Turning Europe’s Power Back On

o NERC: Statement on European Outages

o What Caused the European Power Outage?