📝 Show notes
CyberAware Daily — 2026-09-16
- DarkWatch mid-week numbers: 5275 captures, 9957 entities, 1697 alerts, 10 active targets
- LockBit leak activity, Interlock leak site, and a new ransomware-as-a-service operation starting up
- Low-risk alert: two email addresses linked to the Nightspire leak site — what to do if one appears in your inbox
- In the news: Iranian hackers using Telegram-controlled malware against dissidents and journalists
- In the news: BambooToken malware using MQTT to control Windows and Linux systems
- Why most households aren't the target of these campaigns, and what actually protects you
- Report suspicious emails to the NCSC at report at ncsc dot gov dot uk
- Today's takeaway: check for and install updates on your phone and computer tonight
More at https://cyberawareuk.co.uk
📄 Full transcript
It's Wednesday, the 16th of September, and this is CyberAware UK,
the show that helps ordinary British families stay one step ahead of the scammers.
I am Bully.
And I am Alex.
Wednesday means midweek intel.
So we're running through what our Darkwatch monitoring has picked up
and the stories worth knowing about.
Let's start with the numbers.
Darkwatch is tracking just under 10,000 entities now,
and it's raised around 1,700 alerts, with 10 active targets on its radar.
And what's actually landing on that radar this week?
A few familiar names.
Lockbit has leaked something, the interlock leak site is active,
and there's a new ransomware as a service operation that's just started up.
There are also a couple of quieter items,
including two email addresses tied to something called the Nightspire leak site.
That's rated low risk.
Low risk, and that's the important bit.
These are email addresses that showed up on a dark website,
not a breach of your inbox.
So what should a listener actually do if they see one of those addresses pop up in a message?
Treat it as a red flag.
If an email arrives from an unfamiliar address like that and it's asking you to click,
pay, or log in, don't engage.
Delete it and report it to the National Cyber Security Center if you're unsure.
On to the news.
A report out this week says Iranian hackers are using malware controlled through Telegram
to spy on dissidents and journalists.
That one is targeted at specific people,
so for most of us it's not something we need to worry about day to day.
But it is a reminder that encrypted chat apps can be abused.
Should people be worried about using Telegram then?
No, not for normal family use.
Just keep the app updated and never install a file or an app someone sends you through a chat,
even if it looks like it's come from someone you know.
The second headline is called Bamboo Token.
It uses a messaging protocol to control Windows and Linux machines that have already been compromised.
Again, that's about machines that were already infected.
The lesson is the same as it always is.
Update your devices and don't run downloads from links you didn't go looking for.
You're noticing a theme here.
There is one every week and it's not exciting.
Updates and not clicking strange links stop most of this before it ever reaches your front door.
One more thing before we go.
If you get an email that doesn't look right, forward it to report at ncsc.gov.uk.
That's a free service and they do act on it.
If you've already given details away, contact your bank straight away.
For today's takeaway, let's keep it simple.
Go into your phone and your computer settings, check for updates and install them.
Two minutes of your evening and it's the single best thing you can do this week.
That's it from us.
We'll be back tomorrow for the Thursday show.
Stay sharp and keep those updates rolling.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.