I often wonder how I would explain it to my son — barely into his teens now, hours spent staring at his phone — what is actually happening in the depths of the internet he takes to be a safe place.
How do you tell a child that whilst he checks his messages or downloads his latest app, somewhere in the hidden corners of the network, people are turning technology into a weapon? I don't want to frighten him. But I can't leave him defenceless, either.
And so I began writing this piece, thinking of him, of his friends, of all the adolescents growing up inside a digital world they don't fully understand. The year 2025 has brought with it an explosion of digital fraud so sophisticated it could serve as the backdrop for a film in the vein of William Gibson's Neuromancer or Blade Runner — worlds where the boundary between the real and the virtual blurs until it disappears entirely.
The Global Landscape of Cybercrime in 2025
When I look at the figures in this year's security reports, I feel a weight settle in my chest. The median cost of a security incident has risen from $190,000 to nearly $3 million over the past fifteen years. It is as though we are watching the inflation of a nightmare — one that worsens not gradually but exponentially. The IRIS 2025 report shows that extreme security events have grown roughly fivefold in financial impact, and I find myself thinking about all those small businesses, those family enterprises, those ordinary people who lose the savings of a lifetime to attacks they cannot even begin to comprehend.
Distributed denial-of-service attacks have reached dimensions without precedent. The attack on KrebsOnSecurity, for instance, peaked at 6.3 terabits per second. Try to hold that number in your mind: it is like trying to drink from a fire hose whilst you are already drowning. The Aisuru botnet, which I shall come to shortly, represents a tenfold escalation over the Mirai attacks of 2016. It is the evolution of a virus that keeps growing resistant to treatment.
What frightens me most — and here I think again of my son, with his diet of stories about lone-wolf genius hackers — is that we have witnessed a complete transition from individual operators to internationally organised cybercriminal syndicates. We are no longer talking about rebellious teenagers cracking passwords out of boredom. We are talking about organisations structured like legitimate corporations: with budgets, with specialist departments, with vast resources. Exactly as in Johnny Mnemonic, where criminal enterprises operate with precisely the same efficiency as lawful ones.
I wonder sometimes whether my son's generation will ever know a clear distinction between the physical and the digital world. For them, a digital identity is as real as a physical one — perhaps more so. But the vulnerabilities of that digital world are so numerous, so difficult for an ordinary user to grasp, that I feel an almost overwhelming responsibility: to explain, to teach, to protect him somehow.
Cybercrime in 2025 bears no resemblance to anything we have seen before. It is a mature industry, complete with well-organised black markets, attack-tool rental services, and technical support for criminals. We inhabit a world in which you can purchase a cyberattack as easily as you order a pizza online.
The Scattered LAPSUS$ Hunters: A New Wave of Coordinated Attacks
When I read about the merger of Scattered Spider, LAPSUS$, and ShinyHunters into a unified cyber force, I thought of those gangster films in which rival factions set aside their differences to unite against a common enemy. Except that here we are not talking about street gangs. We are talking about cybercriminals. The social engineering campaign of May 2025 that targeted Salesforce platforms through voice phishing was troubling in its subtlety and its efficiency alike.
These attackers did not breach systems through brute force or by exploiting arcane technical flaws. They used the oldest weapon in the manipulator's arsenal: they talked to people. They rang employees, impersonated colleagues or IT staff, asked the right questions, said the words that open doors. Think Catch Me If You Can — except that instead of forging cheques, they forge digital identities.
The result? The theft and publication of over one billion Salesforce customer records. One billion. I try to hold that quantity in my imagination — all those personal details, all those trade secrets, all those private conversations, suddenly rendered public property. It is as though the entire personal correspondence of a whole city had been tipped into the street for anyone to rifle through.
The public extortion of Fortune 500 companies through dedicated threat sites has become standard practice. Criminals build webpages dedicated to their victims, publish samples of the stolen data, and set countdown deadlines for ransom payments. It is blackmail conducted openly, transparently — and yet the victims have few options. Either they pay, or they watch their confidential information become public knowledge.
The Discord breach and the theft of terabytes of data from Red Hat's clients made me realise how deeply interconnected our systems have become. This is never a matter of a single isolated company under attack. When one domino falls, the rest follow. Red Hat supplies solutions to thousands of other companies, and each of those companies has its own clients in turn. It is a ripple effect, propagating outward through the entire digital ecosystem.
Operation Lighthouse: Phishing at Industrial Scale
The rotation of approximately 25,000 phishing domains across a mere eight days is a scale my mind struggles to contain. Think about that figure: nearly 3,000 new fraudulent sites every single day. It is like trying to stop an avalanche by replacing every falling snowflake with another one.
Over 600 phishing site templates targeting more than 400 entities: that is industrial-grade organisation. We are no longer discussing amateur attempts. We are talking about an operation that runs like a factory — mass-producing instruments of deception, each template tested, refined, and optimised to ensnare the greatest possible number of victims.
The inclusion of Google's logo on at least a quarter of those phishing templates is particularly insidious. Google is a brand people trust, a name that instils a sense of safety. When you see their logo on a page, your instinct tells you it must be legitimate. The criminals exploit that trust with a complete absence of scruple.
Google's legal action under the Racketeer Influenced and Corrupt Organizations Act — RICO, the legislation originally devised to pursue the Mafia — tells us something important. When a company of Google's size must invoke laws designed to fight organised crime, we understand that we are no longer dealing with run-of-the-mill online fraud. We are dealing with organised criminality at the highest level.
The Smishing Triad and the "colossal" scale of attacks documented by Google make me think about all the text messages we receive each day. How many are fraud attempts? How many are sent by automated bots working tirelessly around the clock, dispatching thousands of messages in the hope that at least a few victims will fall for the bait?
The Compromising of Software Development Ecosystems
The infection of at least 187 JavaScript packages via NPM is like poisoning a well from which thousands of people drink. Developers across the world use these packages as building blocks for their applications, unaware that something malevolent has been concealed within. It is precisely like The Matrix — apparently harmless code hiding agent programmes executing hidden agendas.
The self-replicating worm that steals developer credentials and publishes them to GitHub is of an almost breathtaking perfidy. It does not merely steal information — it propagates itself, exploiting each new installation as a vector of transmission. It is a biological virus spreading from host to host, multiplying exponentially.
The temporary contamination of CrowdStrike's own code packages — a company whose entire business is cybersecurity — proves that no one is safe. If even those whose purpose is to protect us are vulnerable, what hope is there for the rest of us? It is as though the hospital itself has caught the disease it is trying to treat.
The attack on 18 popular JavaScript packages downloaded over two billion times a week illustrates the full potential scale of the disaster. Two billion downloads means billions of potential victims, billions of compromised systems — a contagion effect of near-apocalyptic proportions.
The risk of malware spreading rapidly through omnipresent software dependencies makes me realise how fragile our entire digital edifice truly is. Everything depends on everything else. Every programme uses parts of other programmes. If a fundamental component is compromised, the whole structure can collapse like a house of cards.
The Abuse of Customer Service Platforms
The exploitation of authentication weaknesses in Zendesk for large-scale attacks is akin to using a hospital's emergency hotline to issue threats. Zendesk is a platform used by thousands of companies to communicate with their customers — a legitimate tool turned into a weapon.
Flooding inboxes with threatening messages appearing to originate simultaneously from hundreds of Zendesk corporate clients creates total confusion. Victims receive messages that appear to come from trusted sources, from companies they have worked with before. How do you distinguish real from false when everything looks authentic?
The theft of authentication tokens from Salesloft and the knock-on impact on corporate clients demonstrates that criminals are targeting not just the data itself, but the very tools through which we access it. It is as though they do not merely steal the key — they compromise the lock itself, making any attempt to change the bolt entirely futile.
The race against time to invalidate stolen credentials before they can be exploited creates a state of permanent tension. Companies must discover the breach, determine what has been compromised, notify users, and implement protective measures — all before the criminals succeed in leveraging the stolen information. It is bomb disposal with the clock already running.
The transformation of legitimate communication tools into attack vectors reveals the dark creativity of cybercriminals. Anything can be turned into a weapon: a customer support system, a sales platform, the very applications we use daily for work. Nothing is entirely safe anymore.
Connected Device Networks: The Weapon of Choice in 2025
The Aisuru botnet's dominance in record-breaking DDoS attacks makes me think about every internet-connected device in our home: the smart television, the security cameras, even the internet-enabled fridge my wife wanted so badly. Each of these devices can become part of a digital army deployed to take down entire websites.
Most of the firepower in these attacks originates from compromised IoT devices hosted within the United States itself — meaning that victims become unwitting contributors to the very problem. Your streaming box, purchased for an evening's relaxation after a long day at work, may be used to attack someone else, entirely without your knowledge.
The shift of these device networks from DDoS attacks towards residential proxy services represents a worrying evolution. Criminals no longer merely use these devices to knock sites offline — they turn them into access points from which to cover their own tracks. It is as though they steal masks from their victims' homes in order to commit further crimes elsewhere.
The rental of hundreds of thousands of infected IoT devices for criminal traffic anonymisation demonstrates that an entire market has been built on the backs of innocent users. Criminals need not purchase their own servers or assume the attendant risks. They hire computational power from your devices, making you an involuntary accomplice.
Superbox streaming devices and their transformation into nodes for criminal activity are a perfect illustration of the hidden danger. People buy these boxes to watch television and films, never realising that in the background their device is working for criminals — processing illegal transactions, serving as a relay point for criminal activity.
Vulnerabilities in the Technology Supply Chain
The infiltration of malware through compromised developer accounts shows that the problem does not begin with the end user — it begins much further up the supply chain. It is as though the poison has been introduced at the source, not in the individual's glass. By the time it reaches the consumer, it is already too late.
The automatic theft and publication of credentials with every installation of an infected package creates a vicious cycle of compromise. Each new victim becomes in turn a vector of transmission, spreading the infection further without the faintest awareness. It is precisely the mechanism of a biological virus, propagating from person to person.
The inherited dependency risks in modern software development are like time bombs buried in the foundations of a building. Contemporary programmes are built from layer upon layer of code written by others, and if a single layer is compromised, the entire structure becomes vulnerable. Nobody checks every line of borrowed code anymore — practically speaking, it would be impossible.
The absence of basic security in consumer devices shipping with weak default passwords is a problem that exasperates me every time I encounter it. Manufacturers release devices with passwords like "admin" or "12345", and the majority of users never change them. It is like selling padlocks with identical keys and hoping that people will have the good sense to change the cylinders themselves.
Attacks on critical infrastructure through the exploitation of cheap, unsecured consumer technology remind us that the threats extend far beyond personal data or money. We are talking about water systems, electricity grids, hospitals, transport networks. When these infrastructures are compromised through inexpensive and unsecured devices, the consequences can be catastrophic. People can die.
The Evolution of Social Engineering
Voice phishing as the dominant tactic for gaining access to organisations makes me reflect on how much trust we still place in the human voice. Someone rings you, sounds convincing, knows the right technical terminology, and before you have time to think you have handed over your passwords without blinking. It is psychological manipulation at its most refined — a form of malevolent artistry, perfected over years of practice.
Business email compromise attacks that target managers' accounts to defraud their clients are of a sophisticated perfidy. Criminals compromise a manager's account, study his correspondence, learn his writing style, understand his business relationships, and then dispatch messages that appear perfectly legitimate — requesting money transfers or confidential information. Think Invasion of the Body Snatchers: the person you trust has been replaced by someone who is not what they appear.
The Nigerian cybercrime ring targeting the transport and aviation industries demonstrates how thoroughly these criminal groups have specialised — seeking out sectors where profits are high and payment processes complex enough to generate confusion. We are no longer in the territory of the old "Nigerian prince" emails sent blindly to millions of addresses. These are sophisticated, carefully researched, precisely targeted operations.
Fake physical letters purporting to come from ransomware groups such as BianLian show that criminals will exploit every channel available, including the old-fashioned post. You receive something at home on high-quality paper, in formal, legally flavoured language, and suddenly the threat feels far more real, far more tangible than any email could.
The emotional manipulation and advanced psychological techniques deployed in social engineering attacks exploit the deepest human vulnerabilities: fear, urgency, the desire to be helpful, respect for authority. Criminals do not attack computer systems — they attack people. And in this domain, no firewall or antivirus software can protect you. The only defence is education and constant vigilance.
Underground Markets and the Shadow Economy
BreachForums and its repeated FBI seizures, each followed by the platform's resurrection, brings to mind the mythological Hydra: cut off one head and two grow back in its place. Authorities shut down a forum, arrest the administrators, seize the servers — and within weeks a new version appears, sometimes better organised, harder to trace than the one before.
The Russian XSS forum and the arrest of its 38-year-old administrator in July 2025 proves that no one is invincible — but it also demonstrates that such arrests are drops in the ocean. For every administrator taken into custody, there are dozens of others ready to assume control, carry on the business, keep the entire shadow economy running.
Digital payment platforms such as Cryptomus, which facilitate Russian cryptocurrency exchanges, reveal that criminals require financial infrastructure in order to launder their proceeds. Cryptocurrencies have become the instrument of choice because they offer a degree of anonymity, and the platforms that enable these transactions become accomplices — willingly or otherwise — in organised crime.
The $176 million fine levied by Canadian authorities for facilitating criminality is an impressive sum, but I find myself wondering whether it is sufficient. When the profits of cybercrime are measured in the billions, a fine of hundreds of millions can be absorbed as a business cost — a predictable line item in an annual criminal budget.
The dark web as a marketplace for intrusion tools and unsolicited messaging services makes visible an entire parallel economy — a capitalism of criminality in which anything can be purchased or rented. Want to attack a competitor? There's a service for that. Want to destroy someone's reputation? It can be arranged. It is like a virtual shopping centre of malice, open around the clock, with guaranteed delivery.
The Impact on Financial Services and Banking
Online banking fraud targeting small and medium-sized businesses is particularly devastating because these enterprises lack the resources of large corporations either to defend themselves or to recover from an attack. A small business can be ruined entirely by a single security incident — years of a family's labour erased in a moment by a criminal who does not even know the victim's name.
The theft of tens of millions of pounds through compromised online banking systems demonstrates that financial systems, for all their layers of security, remain vulnerable. Banks invest millions in protection, yet criminals always find new methods, new vulnerabilities, new ways through what appear to be impenetrable digital fortresses.
The exposure of 40 million credit cards in the 2013 Target Corporation breach remains a textbook example of how a single incident can affect millions of ordinary people. You visit a trusted shop, use your card with every expectation of safety, and suddenly your financial information is in the hands of criminals on the other side of the world.
The black market in which card details are sold for up to $100 each makes clear that your financial data carries a real, tangible value for criminals. It is not an abstract threat — it is a commodity actively traded, with market prices, with supply and demand, with intermediaries and distributors, just like any other product.
The full costs of recovering from a financial security incident go well beyond direct losses. They include investigation, customer notification, potential regulatory fines, reputational damage, and the erosion of client trust. A security breach is like a wound that never fully heals — it leaves permanent scars.
Mass Compromises of Personal Data
The McDonald's breach — gaining access through the password "123456" on a Paradox.ai account — is so absurd it tips over into the tragic. One of the largest companies in the world, protected by the weakest password imaginable. It is like leaving your front door unlocked in a rough neighbourhood and hoping no one will notice.
The exposure of personal information belonging to millions of job applicants is particularly troubling because these individuals shared their data in good faith — hoping to find work, to improve their circumstances. They now find themselves vulnerable to identity theft and multiple forms of fraud.
The leak of hundreds of millions of documents from First American Financial Corp in 2019 is a reminder that security failures recur year after year, company after company. Lessons are not learnt. The same mistakes are repeated. And the victims are always ordinary consumers who trusted that their information would be kept safe.
The theft of contact lists from the personal devices of government officials is a reminder that no one is immune — not even those who should be the most carefully protected. If government employees, with access to significant security resources, can be compromised, what chance do the rest of us have?
The proliferation of identity protection services and the paradox of their own vulnerabilities is ironic in the saddest possible way. You pay for a service that promises to protect your identity, and then you discover that the service itself has been compromised — and your data is now in the hands of precisely the criminals you were trying to guard against.
The Response of Authorities and Law Enforcement
The Europol operations led by the French police, which produced arrests in July 2025, are encouraging signs that the authorities are taking the threat seriously. But the pace of arrests is vastly outstripped by the rate at which new criminals appear. It is like trying to empty the sea with a bucket — a noble effort, but most likely a futile one.
The FBI's seizure of BreachForums domains in October 2025 demonstrates that law enforcement agencies are becoming increasingly sophisticated in their methods. But the criminals are evolving too, constantly. It is a permanent arms race in which each side attempts to outpace the other in technology and tactics.
The European Union's financial sanctions against Stark Industries Solutions Ltd demonstrate that authorities are deploying every tool available — including economic penalties — to combat cybercrime. But for companies extracting billions from illegal activities, such fines may well be absorbed as operational costs.
International collaboration to identify the operators of compromised device networks is essential, because cybercrime recognises no borders. A criminal may be in Russia, the servers in China, the victims in the United States, the money laundered through intermediaries in Africa. Only through genuine international cooperation is there any realistic hope of progress.
The tracking and identification of "Rey" from the Scattered LAPSUS$ Hunters group through investigative journalism demonstrates the indispensable role that specialist security journalists play. They do not merely report crimes — they actively participate in investigations, uncovering connections and identities that it would take the authorities months or years to discover unaided.
Microsoft Vulnerabilities and the Windows Ecosystem
172 security flaws patched in a single Microsoft update is a number that takes my breath away. How can a system so widely used, so fundamental to the global digital infrastructure, have that many vulnerabilities discovered simultaneously? It is like finding that the foundations of your house contain 172 separate cracks.
CVE-2025-62215, a memory corruption vulnerability in Windows that was already being exploited before the patch became available, is the nightmare of every systems administrator. Criminals know about the problem before the fix exists — giving them a window of opportunity to exploit the weakness whilst users can do nothing to protect themselves.
CVE-2025-60274, a critical flaw in a graphics component used everywhere, affects not only Windows itself but countless applications that rely on this component for displaying images and graphics. It is as though every pair of spectacles in the world were found to have a fundamental defect in the lens.
The impact on Microsoft Office, web servers, and third-party applications demonstrates how interconnected the software ecosystem truly is. A vulnerability in one fundamental component propagates through the entire system, potentially affecting billions of devices and applications worldwide.
The relative ease of exploiting these vulnerabilities — thanks to precedent established by similar attacks — means that criminals can quickly adapt old attack code to new flaws. Once they have learnt how to exploit a particular class of weakness, every new similar vulnerability becomes an easy target.
Proactive Protection and Cyber Defence Services
Google Project Shield's provision of free protection for journalism platforms is a remarkable gesture — demonstrating that some companies are willing to invest real resources in defending the freedom of the press and public access to information. Journalists who investigate cybercrime become targets themselves, and without such protection many would be forced to stop.
Akamai Technologies and the challenges of withstanding massive DDoS attacks remind us that even the largest protection providers struggle. Attacks are growing in scale faster than defensive capacity can keep pace; what was effective last year may be wholly inadequate against this year's attacks.
The cost of millions to counter sustained attacks is a burden that few organisations can bear. When defending against a single attack costs several million pounds, only very large companies or well-resourced institutions can survive. Small and medium-sized organisations remain vulnerable, unable to invest adequately in protection.
The need to continuously adapt defences for ever-larger attack volumes means a permanent, perpetual investment in infrastructure and technology. You cannot install a solution once and hope it will hold forever. The threat landscape shifts daily, and defences must be updated and improved constantly to remain effective.
The lesson for businesses is clear: adjusting your defensive strategy to match the current level of threat is not optional — it is a condition of survival. Companies that fail to invest in security, that believe it will never happen to them, that cut corners on protection, are effectively signing their own death warrant. The question is not whether they will be attacked. It is when, and whether they will be ready.
Prospects for the Future, and Conclusions
I think about it often, in those nights when sleep won't come: the world my son is growing up into. Security professionals are dealing with a profound exhaustion born of relentless breaches — a chronic state of depletion from fighting every day against an enemy that never rests. It is like an A&E doctor working endless shifts without respite, knowing that a single moment of inattention can cost lives.
Most incidents are preventable, yet they go undetected for months or even years — which is perhaps the most maddening aspect of cybersecurity. Vulnerabilities exist, sometimes for years, unnoticed, unexploited, but present nonetheless: time bombs ticking silently. When they are finally discovered, we realise they were there all along, waiting.
The alarming trend towards ever more sophisticated and coordinated attacks tells us that we are not moving in the right direction. Rather than becoming safer, the digital world is becoming more dangerous. Criminals evolve faster than defences, learn faster, adapt more efficiently, and collaborate more effectively with one another than the authorities do across national borders.
The need for international cooperation between law enforcement agencies and security experts has never been greater — yet it remains far from realised. Bureaucracy, jurisdictional differences, conflicting political priorities: all of these impede a coordinated and effective response to a threat that knows no borders and respects no national sovereignty.
The importance of ongoing education and vigilance — for businesses and consumers alike — is the message I most want to leave with my son and his generation. There is no perfect technological solution. There is no such thing as absolute security. The only real defence is knowledge: understanding the threats, maintaining constant vigilance, and cultivating a healthy scepticism towards anything that seems too good to be true. In the digital world of 2025, paranoia is not an illness. It is a form of wisdom.
I often sit and watch my son navigate apps and websites with an ease that frightens me a little. He has grown up in this digital world; he is native here in a way I never will be. But that is precisely why I need to give him this understanding: that every click, every download, every shared password is a potential door opened onto the dangers I have described in these pages. I do not want to make him afraid. I want to make him careful. I do not want to drive him away from technology — I want to teach him to use it wisely.
In the world of 2025, digital crime is no longer an abstract problem afflicting distant corporations and government bodies. It is a daily, immediate threat that can strike anyone, at any time. And our only true defence — beyond all the technical tools and software protections — is a constant awareness of that reality. Vigilance is no longer an optional virtue. In the digital age, it is an existential necessity.
Twenty Memorable Observations by Brian Krebs
I have spent hours reading Brian Krebs's work, and I have come to recognise something distinctive in this man — this journalist who risks his personal safety every day to expose cybercrime. He has an uncommon ability to communicate painful truths about our digital world. I found myself writing out these observations in a notebook, late at night, after my son had gone to sleep, wondering how I might convey to him the essence of what Krebs has been trying to tell us all.
1. On the vulnerability of systems
"Most security breaches are entirely preventable, yet organisations often discover they have been compromised only months or years after the event."
When I first read this, I felt a cold shiver. I thought of all my personal data, my family's data, drifting somewhere through systems I know nothing about, protected by companies that may not even realise they have already been breached. It is like discovering you have spent years living with a crack in the wall of your house — one you never noticed until the whole structure began to threaten collapse.
2. On the cost of digital crime
"The median cost of a security incident has risen from $190,000 to nearly $3 million over fifteen years. This is not inflation. This is a criminal industry becoming ever more sophisticated and ever more profitable."
These figures haunt me. I have calculated and recalculated them, trying to work out what they mean for my small business, for friends who have started their own enterprises. A single security breach could wipe out everything we have built. Everything.
3. On botnets and distributed attacks
"The Aisuru botnet represents a tenfold escalation over the Mirai attacks of 2016. When we talk about 6.3 terabits per second, we are talking about a digital weapon capable of bringing down virtually anything."
I tried to explain to my son what 6.3 terabits per second actually means. I told him it was like the entire internet of our city trying to squeeze simultaneously through a single pipe. Even that didn't capture it. It is a force that exceeds the imagination.
4. On compromised IoT devices
"Most of the firepower behind DDoS attacks originates from compromised IoT devices located within the United States. Your smart fridge, your security camera, even your smart lightbulbs can become soldiers in a digital army you know nothing about."
I looked around my house after reading this. The smart television. The thermostat. The camera above the front door. All the things I bought for comfort and safety could now be turned against someone else — or against me — without my having any idea.
5. On social engineering
"You don't need to break into systems when you can persuade people to hold the doors open. The most sophisticated cyberattacks begin with a simple phone call or a convincingly worded email."
This made me think of all the calls I receive, all the emails urging "urgent account verification." Krebs is right. They are not attacking technology — they are attacking our trust, our fatigue, our haste.
6. On underground markets
"BreachForums is like a Hydra. Cut off one head and two grow back. The FBI seizes the domains, arrests the administrators — and within weeks the platform reappears, perhaps even better organised than before."
The persistence of digital evil unsettles me deeply. This is not like catching a thief and having done with it. It is an endless fight against an enemy that regenerates constantly, that learns from every setback, that grows stronger with every attempt to stop it.
7. On Microsoft vulnerabilities
"When Microsoft patches 172 vulnerabilities in a single update, we must ask ourselves: how many of these had already been exploited? How many systems had been compromised whilst we waited for the fix?"
I installed that Windows update the day it came out, standing by my desk watching the progress bar creep across the screen. But I couldn't shake the thought that perhaps it was already too late — that my system might have been compromised before I'd had the chance to apply any protection at all.
8. On weak passwords
"The McDonald's breach via the password '123456' ought to be a joke. It is not. One of the largest companies in the world, protected by the most foolish password imaginable."
I laughed when I read this, but it was a bitter sort of laugh. Because I have a relative who uses "password123" for her email account. I have told her any number of times. She insists that nobody would bother hacking her — she's not important enough. But she doesn't get to decide that.
9. On organised syndicates
"We have witnessed a complete transition from lone hackers operating out of their bedrooms to internationally organised cybercriminal syndicates functioning like genuine corporations — with specialist departments and multi-million-pound budgets."
This changes everything about how I understand the threat. We are no longer talking about rebellious teenagers trying to impress their peers. We are talking about paid professionals, organisations that view digital crime as a legitimate, profitable business — with a five-year development plan.
10. On software supply chain contamination
"Infecting 187 JavaScript packages via NPM is like poisoning the well at the source. Millions of developers download these packages, integrate them into their own applications, and the poison spreads exponentially through the entire digital ecosystem."
I work with developers. I understand what this means. They don't check every line of code in every package they use — it would be impossible. But that means that anyone who compromises a popular package potentially compromises millions of applications that depend on it.
11. On security fatigue
"Cybersecurity professionals suffer from a chronic exhaustion born of relentless breaches. It is like being an A&E doctor in an endless war — the patients keep arriving in waves, without pause, with no prospect of a ceasefire."
I have a friend who works in cybersecurity. I have watched what it has done to him over the years. Always tired, always on alert, never quite able to switch off. Krebs captures this state of permanent depletion perfectly.
12. On attacks against journalists
"My website was hit with a 620-gigabit-per-second DDoS attack in 2016, launched from one million compromised IoT devices. This was not about taking down a website. It was about silencing a voice that was making too many criminals uncomfortable."
This courage impresses me profoundly. Krebs knows that every article he publishes makes him a larger target — and he continues regardless. Because someone has to tell the truth, even if it means becoming a victim yourself.
13. On international cooperation
"Cybercrime knows no borders. A criminal in Russia uses servers in China to attack victims in the United States, laundering the proceeds through intermediaries in Africa. Without genuine international cooperation, we have no chance."
This explains why it is so difficult to stop digital crime. Different jurisdictions, different laws, different priorities. Whilst the authorities argue over competencies and protocols, criminals collaborate perfectly — no bureaucracy, no barriers.
14. On self-replicating malware
"The worm that steals developer credentials and automatically publishes them to GitHub with every new installation is a masterpiece of malice. Each victim becomes a vector of transmission, spreading the infection further."
I thought of biological pandemics when I read this. Exactly the same mechanism: every infected host passes the disease onwards, exponentially, until the entire system is compromised. Except here we are talking about code — things we could, in theory, control. And yet we cannot.
15. On Operation Lighthouse
"The rotation of 25,000 phishing domains in eight days reveals an industrial-scale operation. This is no longer a cottage industry. It is mass production of deception, optimised for maximum efficiency."
The numbers turn my stomach. Three thousand fake sites a day. How do you track them? How do you stop them? It is like trying to halt a factory producing bombs by throwing a bucket of water at it once an hour.
16. On compromised service platforms
"Zendesk, Salesloft, Paradox.ai — legitimate customer communication platforms turned into weapons. Like using an ambulance to deliver poison rather than save lives."
The perversity of it — using instruments designed to help in order to harm — disturbs me deeply. The very trust we place in these platforms becomes the vulnerability that criminals exploit.
17. On recovery costs
"The costs of a security incident are not merely the direct losses. They are the investigations, the notifications, the potential fines, the reputational damage, the erosion of client trust. A security breach is a wound that never fully heals."
I saw this happen to a local business that suffered a breach. Two years on, they are still contending with the consequences. Clients have gone, good staff have left, the reputation is tarnished. Krebs is exactly right. The scars remain.
18. On the evolution of threats
"Attacks grow more sophisticated and better coordinated every year. What worked as a defence last year may be wholly ineffective today. It is an arms race in which the criminals always seem to be one step ahead."
This is my constant anxiety in business. I invest in security now, but how relevant will it be in six months? In a year? I am always running simply to stand still — to maintain the same level of protection I had before.
19. On Superbox devices
"Superbox streaming devices, bought by ordinary people to watch films, are running in the background as nodes for criminal activities. You think you're watching television. Your device is working for criminals."
I checked every device in my home after reading this. What else are they doing in the background, whilst I believe they are simply serving my needs? How much of the traffic on my internet connection is generated by me, and how much by hidden programmes I know nothing about?
20. On the future of security
"Vigilance is no longer an optional virtue in the digital age. It is an existential necessity. Every click, every download, every shared password is a potential open door onto threats that most people do not even begin to understand."
This is the message I want to pass on to my son. Krebs is not trying to frighten us — he is trying to wake us up. The digital world we inhabit is extraordinary. It is also dangerous. And our only real protection is to understand the dangers, to remain vigilant, and never to assume we are too small or too obscure to become a target.
I sit now and look at these twenty observations drawn from Krebs's work, and I see that each of them is a lesson about the world we live in — about the dangers we overlook, the vulnerabilities we prefer not to see. Brian Krebs is the kind of person I admire deeply, not because he brings good news — he rarely does — but because he has the courage to see and to say uncomfortable truths that most people would rather ignore.
When I think about my son, about his generation inheriting this ever more complicated and ever more dangerous digital world, I understand that the work of people like Krebs is indispensable. They are the sentinels who warn us, the voices crying in the wilderness, the journalists who put their own safety at risk to keep us informed. And perhaps the most important thing I have taken from reading Krebs is this: in the digital world, ignorance is not bliss. Ignorance is vulnerability.
Bibliography and Sources
Primary Sources — Brian Krebs Articles and Reporting
Krebs, B. (2025). Scattered LAPSUS$ Hunters: Rey's Identity Revealed. KrebsOnSecurity.com. Available at: https://krebsonsecurity.com/
Krebs, B. (2025). Aisuru Botnet Shifts from DDoS to Proxy Services. KrebsOnSecurity.com, 28 October 2025.
Krebs, B. (2025). Google Sues Lighthouse Phishing Operation Under RICO Act. KrebsOnSecurity.com.
Krebs, B. (2025). Cybercriminals Abuse Zendesk Platform for Mass Extortion. KrebsOnSecurity.com.
Krebs, B. (2025). McDonald's Job Applicant Data Exposed via Paradox.ai Breach. KrebsOnSecurity.com, 19 July 2025.
Krebs, B. (2025). 187 JavaScript Packages Infected with Self-Replicating Worm. KrebsOnSecurity.com.
Krebs, B. (2025). XSS Russian Forum Administrator Arrested by French Police. KrebsOnSecurity.com, 22 July 2025.
Krebs, B. (2025). Twitter/X Knocked Offline by DDoS Attack. KrebsOnSecurity.com, March 2025.
Krebs, B. (2025). Superbox Streaming Devices Function as Botnet Nodes. KrebsOnSecurity.com, 24 November 2025.
Books and Academic Publications
Krebs, B. (2014). Spam Nation: The Inside Story of Organized Cybercrime — from Global Epidemic to Your Front Door. Sourcebooks. ISBN: 9781402295614. Winner of the PROSE Award, 2015.
Technical Reports and Security Studies
QiAnXin XLab (2024). Aisuru Botnet Analysis Report. Identification and analysis of the Aisuru IoT botnet, August 2024.
IRIS (2025). IRIS 2025 Cyber Security Report. Statistics on median incident costs: increase from $190,000 to $3 million over 15 years.
Silent Push (2025). Smishing Triad Domain Analysis Report. May 2025 report documenting approximately 25,000 active phishing domains within 8-day windows.
Google Threat Intelligence (2025). Lighthouse Phishing Campaign Analysis. Documentation of the "colossal" scale of phishing attacks.
Legal Actions and Official Documents
Google Inc. v. Lighthouse Phishing Enterprise (2025). Complaint filed under the Racketeer Influenced and Corrupt Organizations (RICO) Act regarding the Lighthouse phishing operation.
Federal Bureau of Investigation (2025). BreachForums Domain Seizure Announcement. Press release, 5 October 2025.
Europol (2025). XSS Forum Administrator Arrest. Press release, 22 July 2025, coordinated operation by French police.
Canadian Financial Regulators (2025). Cryptomus Platform Sanctions. $176 million fine for facilitating Russian cryptocurrency services.
European Union (2025). Stark Industries Solutions Ltd. Financial Sanctions. May 2025.
Vulnerabilities and Security Bulletins
Microsoft Security Response Center (2025). Security Update Release Notes. 172 vulnerabilities patched, including CVE-2025-62215 (zero-day) and CVE-2025-60274 (GDI+ critical).
SANS Technology Institute (2025). Ullrich, J. Analysis of CVE-2025-62215 Memory Corruption Vulnerability.
Immersive Labs (2025). McCarthy, B. Critical Assessment of Windows GDI+ Vulnerability CVE-2025-60274.
Press Articles and Analysis
Hackread.com (2025). KrebsOnSecurity Hit with 6.3 Tbps DDoS Attack via Aisuru Botnet. Available at: https://hackread.com/krebsonsecurity-6-3-tbps-ddos-attack-aisuru-botnet/
NetworkWorld (2016). Ellis, A. (Akamai Chief Security Officer). Analysis of Mirai Botnet Attack on KrebsOnSecurity. The 620 Gbps attack using 1 million compromised IoT devices.
CISO MAG (2019). Brian Krebs Named Cybersecurity Person of the Year. December 2019. Available at: https://cisomag.com/brian-krebs-cybersecurity-person-of-the-year/
The Washington Post (1995–2009). Archive of Brian Krebs articles on computer security, technology policy, and cybercrime.
Protection Platforms and Services
Google Project Shield. Pro-bono DDoS protection service for journalism and news platforms, protecting KrebsOnSecurity since September 2016.
Akamai Technologies (2016). Reports on DDoS attack volumes and the cost of mitigation for pro-bono protected sites.
Online Resources and Specialist Blogs
KrebsOnSecurity.com. Daily blog dedicated to cybersecurity news and investigations into digital crime. Available at: https://krebsonsecurity.com/
InfoSec Industry. Krebs on Security Category Archive. Collection of articles and reports. Available at: https://infosecindustry.com/category/news/krebs-on-security/
Muck Rack. Brian Krebs Journalist Profile. Full archive of articles and investigations. Available at: https://muckrack.com/briankrebs/articles
Author Context
George Mason University (1994). Krebs, B. Bachelor of Arts in International Relations.
AAE Speakers Bureau (2025). Brian Krebs Speaker Profile. Biography and presentation themes on alarming trends in cybercrime. Updated 9 October 2025.
Wikipedia (2025). Brian Krebs. Biographical profile and timeline of journalistic career. Updated 3 September 2025.
Methodological Note
This bibliography comprises sources verified and documented during research conducted on 2 December 2025. Brian Krebs's articles on KrebsOnSecurity.com constitute primary sources of investigative journalism, widely recognised within the cybersecurity industry for their accuracy and depth of research. Technical reports and statistics are drawn from credible industry sources, including major service providers and specialist research institutes.
All references to events, figures, and incidents are extracted from publicly available technical documentation and journalistic reporting. This article was written with the aim of making complex cybersecurity concepts accessible to a general readership — including younger readers — whilst maintaining factual accuracy.
Author's Note
Limits, tensions, comparisons, and rhetorical tools
Why I Wrote It This Way
There is a moment when you realise that you are no longer writing about a subject — you are writing from inside it. I cannot tell you exactly when that happened with this piece. Perhaps when I understood that I had no way of explaining botnets without thinking of my son; no way of talking about vulnerabilities without feeling that I was talking about my own ignorance. Cybersecurity is a technical subject, yes. But beneath the technical, there is always a human being.
I chose to write in the first person not out of narrative vanity, but from a practical conviction: abstractions convince no one. Statistics alone convince no one. People recognise themselves in stories, not in data, and everything I tried to do was to make each statistic into a story in which the reader — the teenager, the parent, the ordinary person with an email account — could see themselves.
The Limits of the Method
I need to be honest, with myself and with the reader, about where journalism ends and parable begins.
The limit of the emotional. My son appears repeatedly in the text as a kind of moral compass — the ideal witness to whom I am explaining things. It is a legitimate rhetorical device — personalisation makes complexity accessible — but it contains a tension I cannot resolve neatly: a real child is not a literary instrument. I have used him as a principle, as the idea of a new generation, not necessarily as a concrete person with full rights to their own privacy. The attentive reader will notice that "my son" functions more as a narrative device than as a portrait — and it is worth knowing that.
The limit of the analogies. I have drawn heavily on science fiction cinema — Neuromancer, Blade Runner, The Matrix, Johnny Mnemonic, Invasion of the Body Snatchers — with a frequency that some will find excessive. I acknowledge the tension: on the one hand, analogies make visible a reality that is otherwise invisible; on the other, fiction risks aestheticising danger rather than presenting it directly. An attack that stole one billion records is no less real for my comparing it to a scene from The Matrix. But perhaps the analogy makes it more bearable than it ought to be. I oscillated between illustrating and dramatising, and I did not always manage to keep the balance.
The limit of volume. The piece contains an enormous quantity of incidents — dozens of criminal groups, hundreds of statistics, events spread across an entire year. This accumulation is deliberate: I wanted to convey the feeling of an avalanche, of unrelenting pressure. The risk is that the reader feels overwhelmed, and that precisely because of the abundance, nothing sticks. The articulation of a central message sometimes buckles under the weight of the exhaustive inventory.
The limit of authority. I am not a cybersecurity specialist. I am a person who reads carefully and writes with care. I have verified sources, cited reports and institutions, and invoked Brian Krebs not as a mere pretext but as a genuinely recognised authority in the field. But the distance from the subject exists, and I am not ashamed to acknowledge it: it is the distance of someone trying to translate for others a world he himself only partially understands.
The Internal Tensions
There are several tensions I have left deliberately unresolved, because resolving them would have been artificial.
The tension between panic and pragmatism. Throughout the piece, two tones coexist: one apocalyptic — houses of cards, ticking time bombs, avalanches — and one didactic, almost calm — change your password, enable two-factor authentication. This tension is real, not cosmetic. The world is, simultaneously, genuinely threatened and genuinely capable of defending itself through mundane gestures. Both are true, and to hold them together without forcing a reconciliation seemed to me more honest than choosing one.
The tension between individual and systemic. I repeat throughout that individual solutions are insufficient — that what is needed is international cooperation, regulation, manufacturer accountability. And yet I close with a message addressed to a single person, my metaphorical son, with a list of concrete actions he can take tomorrow morning. This is not a contradiction: it is an acknowledgement that I cannot change the system alone, but I can change someone's behaviour. And sometimes that is enough to begin.
The tension between urgency and fatigue. Security professionals suffer from alert fatigue — I have said so explicitly. But the text itself risks producing a form of emotional exhaustion in the reader. I do not know whether I have resolved this tension or amplified it. I chose not to hide it.
Rhetorical Tools — A Self-Critical Inventory
I have used several techniques consciously, and it seems worth naming them plainly.
The materialising analogy. I have turned every abstract number into a physical object or a bodily experience. Six point three terabits per second becomes drinking from a fire hose whilst you are already drowning. One billion stolen records becomes the entire personal correspondence of a city tipped into the street. The technique works because the human brain does not process large numbers — it rejects them. You have to make it process images instead.
Cumulative escalation. The sections are structured to rise in intensity. I have not distributed the material evenly but dosed it — from global context to development ecosystems, from compromised platforms to critical infrastructure — so that each chapter appears more grave than the one before. It is a preacher's technique, I admit. It is not always entirely fair to the reader, because it was not the moral hierarchy of the situations that dictated the order — it was dramatic effect.
The rhetorical question. I have asked many questions — how many of our daily text messages are fraud attempts? If even those who are supposed to protect us are vulnerable, what hope do the rest of us have? — without waiting for an answer. Rhetorical questions create intimacy with the reader; they draw the reader into the author's anxiety; they activate their own unease. It is a powerful tool, but potentially a manipulative one if overused. I have overused it.
Personal witness as guarantor of authenticity. My wife's fridge, the bedroom television, the camera above the front door — I listed them because naming your own home as vulnerable is more persuasive than saying your home is vulnerable too. It is a rhetorical move of humilitas: I expose myself in order to earn your trust. It works. And precisely because it works, it deserves to be acknowledged.
The quotation as borrowed authority. I built an entire section around observations attributed to Krebs, each followed by my personal commentary. This device does several things at once: it borrows the credibility of a recognised journalist, creates the sensation of a dialogue between expertise and experience, and justifies my emotional reactions through someone else's words. It is honest in its intention, but it should be noted that the selection of quotations is subjective — I chose the ones that spoke to me, not necessarily the ones most representative of Krebs's thought as a whole.
What the Text Leaves Out
Every text is also a list of absences. I chose not to enter into deep technical detail — network architectures, security protocols, code instructions — because my intended audience is not the specialist but the ordinary person. This choice carries a cost: specialists will find the piece superficial, will feel that simplification is a form of distortion. They are not entirely wrong. Simplification is always, in some measure, an act of violence against complexity. I chose it knowingly.
I have also omitted a perspective that deserved more space: that of states as offensive actors. Russian, Chinese, and North Korean groups are mentioned in passing, but the scope of their state-level operations is treated superficially. I chose instead to focus on private cybercrime — its economy, its motivations — because it is discussed less frequently and, paradoxically, because it is closer to the daily reality of an ordinary user.
A Final Note About My Son
There is a temptation to close neatly, with my son asleep and a father still writing. I have partly resisted that temptation, but not entirely. The ending of the main article is sentimental in a way I do not retract — but which I acknowledge as sentimental. I do not know whether my real son will ever read any of this. I do not know whether, by the time he reaches the age at which these things truly matter, he will still be living in the same digital world I have described.
What I know is that I wrote out of fear. Not the paralysing kind — the kind that sets you in motion. And that this fear, with all its limits and its tools and its unresolved tensions, felt more honest to me than the alternative: a correct, neutral, comprehensive, and sterile article that no one would have read to the end.