Risky Bulletin: Two TeamPCP members arrested in Australia

More from Risky Bulletin All episodes →

1. 

   3 Sep 2026 · 22 min

   Srsly Risky Biz: China's botnets are worth disrupting

   Tom Uren and James Wilson talk about China’s long-term shift to getting private companies to build botnets for cyberespionage. A disruption effort from the US this week is good news, but China has been using these networks for a surprisingly long time and will rebuild. They also discuss a hack at the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). It looks like the Qilin ransomware group might have stolen data from the ATF’s CALEA, or lawful intercept system. That’s a big deal! Finally, they discuss efforts to fix US water sector security. Sprinkling free tools on the problem will…

2. 

   2 Sep 2026 · 9 min

   Risky Bulletin: BGP hijack delivers malicious Virtualizor updates

   A BGP hijack delivered malicious Virtualizor updates, the White House launches Project Watershed 250, Indian authorities take down a Telegram doxing bot, and Composer packages deliver iOS badness.

3. 

   31 Aug 2026 · 29 min

   Between Two Nerds: The perfect hacker

   In this edition of Between Two Nerds Tom Uren and The Grugq talk about how AI is the perfect hacker, but what makes it perfect for states is the opposite of what makes it perfect for criminals. This episode is also available on YouTube.

4. 

   31 Aug 2026 · 7 min

   Risky Bulletin: New powers for Dutch intelligence services

   Dutch intelligence services will get new powers, a security expert has been arrested in Israel for hacking, the BTS hacker gets a 20 year sentence in South Korea, and an AfD politician in Germany has been linked to a Russian cybercrime hosting service.

5. 

   30 Aug 2026 · 21 min

   Sponsored: Attackers need to be right more than once

   In this Risky Business sponsored interview, James Wilson chats with Dropzone AI’s founder and CEO Edward Wu to debunk the adage, “an attacker only has to be right once”. Modern intruders need to be successful across multiple steps before actually reaching an organisation’s “crown jewels”. The pair chat about where AI helps attackers, why autonomous post-compromise agents aren’t quite here yet, and how AI can bolster the capacity of security teams when investigating alerts and reducing response times.

6. 

   27 Aug 2026 · 20 min

   Srsly Risky Biz: China's AI-Enabled APT Operations Are Getting Interesting

   Tom Uren and James Wilson talk about evidence that Chinese APT groups are using AI in a really sensible way, to beef up their malware arsenal. This will make it harder for threat intel firms to cluster activity for attribution. They also discuss the US disrupting Iranian hackers by revealing that some of them are hacking the country’s own firms. That’s a new tactic, but making that information public in a Treasury Department sanctions package doesn’t really make sense. This episode is also available on YouTube

7. 

   26 Aug 2026 · 9 min

   Risky Bulletin: Russia starts blocking DoH and DoT

   Russia begins blocking the DoH and DoT protocols, Russian hacktivists leak Spanish police and military personnel data, China and South Korea detain a vishing gang, and AI malware is not that common.

8. 

   24 Aug 2026 · 33 min

   Between Two Nerds: Attribution is dead, long live attribution

   In this edition of Between Two Nerds Tom Uren and The Grugq talk about whether the increasing use of AI will make it harder for forensics teams to determine who is responsible for a hack. This episode is also available on YouTube.

9. 

   24 Aug 2026 · 6 min

   Risky Bulletin: Expired credit cards can be used for malicious transactions

   Expired credit cards can be used for malicious transactions, Iranian hackers shut down a UK power plant, the Lazarus Group hacks South Korea’s Presidential Office, and an Android malware strain is infecting smart cars.

10. 

    23 Aug 2026 · 20 min

    Sponsored: Passkeys won’t stop authorisation phishing

    In this Risky Business sponsored interview, James Wilson chats with Luke Jennings, Push Security’s VP of Research, about how stronger authentication is pushing attackers towards the authorisation layer. Device code phishing is on the rise. Luke explains how these attacks can survive passkeys and phishing-resistant MFA and, importantly, how defenders can check if their controls against these attacks actually work.