I'm still thinking about the Emu War.

Fuck me there’s an Emu War cinematic universe

The Great Emu War is so good.

In case you are wondering, the Australian army were sent in with machine guns.. but they lost the war as the emus just ran away, they’re pretty quick.

It’s 1am. I googled emus, ended up on the Emu War page (sorry, “Great Emu War” as it was called). Nobody show James Cameron this page or we’ll end up with another 12 Avatar movies.

What would you say to Windows?

What's also shocking from their arrest and appearance in court today and the US charges is the allegation businesses paid them 9 figures (!) in ransoms to avoid disclosure - the court was told today Thalha allegedly has $200m in cryptocurrency and Owen has $8m.

How is it normal businesses are funding that?

Achievement unlocked for LAPSUS$, got a court drawing

"In October 2024 and January 2025, Jubair participated in a scheme to gain unauthorized access to the networks of a U.S.-based critical infrastructure company and the U.S. Courts."

Related: not very stealthy, they posted screenshots of their access this week.

https://databreaches.net/2025/09/15/hackers-claim-access-to-law-enforcement-portals-but-do-they-really-have-access/

For the record, since I think it's now safe to say - Thalha Jubair (a teen) is the key guy behind LAPSUS$/Scattered Spider/ShinyHunters and allegedly most of the big cyber incidents of the past 5 years.

He's been running rings around everybody since he was 14.

Justice.gov are pissed at Thalha Jubair and have also charged him, he faces 95 years of jail in the US.

https://www.justice.gov/opa/pr/united-kingdom-national-charged-connection-multiple-cyber-attacks-including-critical

"From as early as May 2022 to as recently as September 2025, Jubair and his associates were involved in approximately 120 network intrusions, including accessing the computer networks of at least 47 U.S.-based victims. Collectively, victims paid more than $115 million to Jubair and his associates in efforts to recover their data and prevent its disclosure. "

I believe this is the fourth time Thalha Jubair has been arrested btw.

Suspect arrested for M&S hack have been rearrested (again), this time for Transport for London hack last year. Also charged for it: https://therecord.media/scattered-spider-teenage-suspects-arrested-britain-nca

Marks and Spencer CTO leaves, CISO still in role.

It’s difficult to see what happened as her fault - eg the decision to outsource the frontline IT helpdesk that did the password resets dates 5 years before she joined.

https://www.computerweekly.com/news/366630565/MS-parts-ways-with-CTO-after-cyber-attack

When vulnerabilities influence product usage, Microsoft Exchange Server edition with @shodan data.

272k OWA servers when ProxyLogon RCE vuln was revealed. With follow on vulns ProxyShell and ProxyNotShell, numbers fell to 96k and still falling.

Microsoft have hidden a vulnerability in M365 Copilot from customers.

Copilot allowed access to enterprise files without generating access logs, MS patched it but didn’t issue a CVE or tell anyone about it.

https://pistachioapp.com/blog/copilot-broke-your-audit-log

M&S still working on system recovery. https://www.bbc.com/news/articles/cewyyjdzql4o

I understand the people released have not been charged.

The people arrested as part of the Co-op and M&S hack investigation have been released on bail.

https://nation.cymru/news/four-people-bailed-after-arrests-over-cyber-attacks-on-ms-co-op-and-harrods/

Previously when this happened with LAPSUS$, they just continued hacking stuff.

Personally I think Co-op did a really good job getting out of that situation and minimising impact.

I definitely think if you have a LAPSUS$ style advanced persistent teenagers situation, tilt towards open and honest comms as those kids will use secrecy against ya. It’s 2025, it’s okay to say you got hacked, people largely understand. Also, in IR, lawyers are usually stuck in 1980 advice - it’s just advice, they ain’t yo boss.