Welcome to my weekly cybersecurity roundup! Here, I share updates on the projects I’m currently working on, along with the most insightful cybersecurity videos I watched, articles I found valuable, and podcasts I tuned into this week.

Featured Analysis

When Governments Unplug the Bad Guys: Inside the Massive Dutch Server Seizure

International cyber law enforcement just pulled off a massive win, and if you love a good digital detective story, this one is a masterclass in how modern cyber warfare is fought behind the scenes. On May 18, Dutch financial crime investigators (FIOD) raided multiple locations across the Netherlands, arresting two men and seizing a staggering 800+ servers. This wasn’t just a routine bust targeting a lone hacker; it was a coordinated strike aimed at dismantling a major “bulletproof hosting” pipeline that Russian-backed threat actors have used for years to launch devastating DDoS attacks, espionage campaigns, and disinformation ops across the European Union.

To understand why this is such a big deal, you have to look at how threat actors hide their tracks. Think of bulletproof hostings like a shady landlord who rents out apartments, promises never to ask questions, and actively ignores the police when neighbors complain about illegal activity. In this case, a massive hosting provider called Stark Industries Solutions, which popped up right before the 2022 invasion of Ukraine, had been providing the digital muscle and proxy services for state-sponsored Russian hackers. When the EU slapped sanctions on Stark last year, the operators scrambled, quickly transferring their server infrastructure to a web of new front companies in the Netherlands (like WorkTitans and MIRhosting) to keep the data flowing and bypass the law.

But the Dutch authorities caught onto the shell game. By tracking the network traffic and connectivity back to data centers in places like Dronten and Schiphol-Rijk, investigators proved that these “new” companies were just fresh paint on the same old malicious infrastructure. When they finally flipped the switch and seized the hardware, the impact was immediate. In fact, a notification sent out to the-hosting customers shortly after the raid bluntly stated that all stored data was completely lost and unrecoverable. For a massive chunk of pro-Russian botnets, the lights went out instantly.

For anyone learning the ropes in networking or digital forensics, this bust is a textbook reminder that cybersecurity isn’t just about software patches and firewalls; it’s about infrastructure. Hacking groups can write all the malicious code they want, but without physical servers and internet service providers willing to shield them from the law, they are completely dead in the water. Tearing down these hidden digital fortresses requires serious forensic accounting and network tracking, proving that sometimes the best way to stop a cyber attack is to simply go to the data center and pull the plug.

Projects

• TryHackMe – Secure Network Architecture – Completed
• TryHackMe – AI/ML Security Threats – In Progress

Videos

Articles

• Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
• 7-Eleven Data Breach Confirmed After ShinyHunters Ransom Demand – The hackers claimed to have stolen more than 600,000 Salesforce records, including personal information and corporate data.
• NYC Health + Hospitals says hackers stole medical data and fingerprints during breach affecting at least 1.8 million people – New York public health provider NYC Health + Hospitals says a months-long data breach that allowed hackers to steal personal data, medical records, and fingerprints scans affects at least 1.8 million people.
• Fired hacker twins forget to end Teams recording, capture own crimes – One little mystery—solved.
• Grafana Confirms Breach After Hackers Claim They Stole Data – Grafana appears to have been targeted by Coinbase Cartel, a cybercrime group linked to ShinyHunters, Scattered Spider, and Lapsus$.
• FBI: Americans lost over $388 million to scams using crypto ATMs in 2025 – The FBI says Americans have lost over $388 million last year to scams using cryptocurrency kiosks, also known as crypto ATMs or Bitcoin ATMs.
• ‘The Worst Leak That I’ve Witnessed’: U.S. Cybersecurity – Agency Leaves Its Digital Keys Out in Public on GitHub Passwords were stored as plain text in a public GitHub repository.
• Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach Vector – Verizon’s 2026 DBIR finds vulnerability exploitation has overtaken credential abuse as the leading breach vector, as AI accelerates attacks, patching delays worsen, and ransomware and third-party compromises continue to surge.
• GitHub confirms breach of 3,800 repos via malicious VSCode extension – GitHub has confirmed that roughly 3,800 internal repositories were breached after one of its employees installed a malicious VS Code extension.
• US and Canada arrest and charge suspected Kimwolf botnet admin – U.S. and Canadian authorities arrested and charged a Canadian man with operating the KimWolf distributed denial-of-service (DDoS) botnet, which infected nearly two million devices worldwide.