SKBSec

Decoding how attacks unfold, why defenses fail, and how AI is reshaping the threat landscape. Newsletter

[SKBSec @skbsec]

Most security content keeps you informed.
SKB Decoded keeps you sharp.
Every week I break down one real attack, one defense failure, and how AI is changing the threat landscape.
Free. Weekly. No fluff.
👇 Subscribe here
https://t.co/t7Ja2CWZdL

[SKBSec @skbsec]

The numbers:

~45% of all data breaches now
happen in cloud environments.

~80% of orgs had a cloud
security incident in the past
year.

[SKBSec @skbsec]

Below the line (provider's job):
physical servers, data centers,
core network, the layer that
walls off your data from other
customers'.

They're extraordinarily good
at this part.

[SKBSec @skbsec]

A researcher finds a company's
entire customer database sitting
in a cloud storage bucket.

Unprotected. Reachable by anyone
with the link.

No hacking. No exploit 🧵

[SKBSec @skbsec]

Above the line (yours):
your data, access permissions,
configs, identity management,
which storage buckets are public
vs. private.

The provider locks the building.
You lock your own apartment door.

[SKBSec @skbsec]

The misunderstanding: "the cloud"
isn't a place. It's a rented
arrangement with a dividing line
through it.

That line has a name: the shared
responsibility model.

[SKBSec @skbsec]

A researcher finds a company's
entire customer database sitting
in a cloud storage bucket.

Unprotected. Reachable by anyone
with the link.

No hacking. No exploit 🧵

[SKBSec @skbsec]

A setting, left on its default,
had simply never been changed
by anyone.

That's the plot behind a huge
share of the biggest cloud
breaches of the last 2 years.

[SKBSec @skbsec]

A market doesn't get arrested.

Wrong question: "could a skilled
hacker breach us?"

Right question: "which specialized
role in this supply chain could
reach us?"

[SKBSec @skbsec]

Jan 2026: US law enforcement seized
RAMP, a major forum connecting IABs,
affiliates, and RaaS operators.

Activity dipped for weeks.

It's already resurfacing under new
names.

[SKBSec @skbsec]

Q1 2026 ransomware revenue: $529.2M.
Up 39%.

That scale doesn't come from lone
operators. It comes from a market.

[SKBSec @skbsec]

Around the core: packer services to
dodge antivirus, bulletproof hosting,
money-laundering specialists.

And real customer support — scripts,
live chat, decryption-testing tools.

[SKBSec @skbsec]

One group, "The Gentlemen," offers
affiliates a 90% cut — specifically
to poach talent from rival platforms.

Affiliate recruitment, run like a
sales incentive.

[SKBSec @skbsec]

Affiliate.

Buys that access. Rents ready-made
ransomware from a RaaS platform.
Deploys it. Negotiates.

Keeps 70–90% of whatever gets paid.

[SKBSec @skbsec]

Modern ransomware isn't one hacker.
It's a supply chain of specialists
who often never speak to each other.

Here's who actually gets paid:

[SKBSec @skbsec]

Initial Access Broker.

Breaks into networks. Doesn't touch
them further. Sells the access for
$500–$5,000 on criminal forums.

Made $14M+ in 2025 doing only this.

[SKBSec @skbsec]

Modern ransomware isn't one hacker.
It's a supply chain of specialists
who often never speak to each other.

Here's who actually gets paid:

[SKBSec @skbsec]

Same tone as a telecom retention
line.

That chat wasn't staffed by the
person who broke in.

It almost never is anymore.

[SKBSec @skbsec]

Follow newsletter out.

Join weekly Free: https://t.co/BhNBFOSlgE

[SKBSec @skbsec]

A hospital's files get encrypted.

The ransom note has a link to live chat.

They open it expecting silence.

Instead: a support rep, replying in minutes, walking them through payment🧵

[SKBSec @skbsec]

Same tone as a telecom retention
line.

That chat wasn't staffed by the
person who broke in.

It almost never is anymore.

[SKBSec @skbsec]

An Uber contractor gets a login approval request.

He declines it.

Another. Decline. Another — every few minutes,
for over an hour.

Exhausted, he finally taps approve just to
make it stop.

Attacker is in. Slack, VPN, source code 🧵

[SKBSec @skbsec]

An Uber contractor gets a login approval request.

He declines it.

Another. Decline. Another — every few minutes,
for over an hour.

Exhausted, he finally taps approve just to
make it stop.

Attacker is in. Slack, VPN, source code 🧵

[SKBSec @skbsec]

The shift:

Every dependency is a trust decision you made
without realizing it.

Trust extended is risk inherited.

Full breakdown (free): https://t.co/BhNBFORNr6

#Cybersecurity #SupplyChainSecurity

[SKBSec @skbsec]

In September 2025, a piece of malware did something new:

It copied itself.

A poisoned software package spread on its own across
1,000+ packages — and exposed ~25,000 code repositories
downstream.

Nobody hacked them. They installed it themselves 🧵

[SKBSec @skbsec]

The invisible part:

6 companies use the same accounting software.
None can see that shared dependency from their own
vendor list.

But to an attacker, it's one door with 6x the payoff.

Invisible to every victim. Obvious to the attacker.