Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Levi Gundert
Mobile Risk Belongs to You Even Though the Phone Doesn’t
Personal phones are the target... Enterprise security has largely addressed mobile phone threats through MDM (mobile device management) for corporate-issued phones and BYOD (Bring Your Own Device). However, MDM was primarily developed to address data security and privacy compliance issues. Employees’ personal phones remain a blind spot, and Recorded Future intelligence indicates the risks are changing. Older versions of iOS are being targeted by criminals via exploit chaining.
Ransomware is the Scoreboard
13,000. That’s the number of ransomware victims Recorded Future has observed over the past two years. Watching the near-real-time ransomware attacks on businesses, non-profits, and government agencies has left me, like many security professionals and board directors, pondering how and why cyber defense keeps losing this particular fight. Adversaries like Interlock and RansomHub have continued their successful march to riches over the past 18 months.
The Threat Isn’t the Frontier Model
Summer ‘26 vibes: international flights, Riyadh heat, and plentiful CISO conversations. Every conversation (regardless of geographic location or industry vertical) currently begins and ends with AI strategy. Let’s unpack the nuance. Every executive should be contemplating two questions at this moment: Are we building, testing, and scaling agents for the coming onslaught of AI-enabled adversary activity? Do we have the breadth of intelligence necessary to move at machine speed? Why Agents and Why Now?
Building with AI: Here's What No Briefing Will Tell You
I've spent the last three months building with AI. Not reading about it. Not sitting through vendor demos. Not nodding along to board presentations with gradient-colored slides about "transformation." Building. Writing code. Deploying applications. Breaking things. Shipping things. What follows are four gaps I didn't fully understand until I was in it. They won't show up in an analyst report. They're the kind of thing you only see when your hands are on the keyboard. 1.
Your Supply Chain Breach Is Someone Else's Payday
TeamPCP exploited a single stolen credential to gain write access to trusted software repositories, inject credential-harvesting malware, and cascade across five ecosystems in five days. Stolen credentials can enable payroll redirection, freight rerouting, and extortion — active campaigns Insikt Group is tracking that show how a software supply chain breach can quickly become a business operations crisis.
Network Intelligence: Your Questions, Global Answers
The Problem with Pre-Packaged Intelligence Security teams are drowning in threat intelligence feeds. Hundreds of vendors promise comprehensive coverage, real-time alerts, and actionable insights. Yet sophisticated adversaries continue to operate undetected, incidents take weeks to scope, and attribution remains elusive. The fundamental issue isn't quality but control. Traditional network visibility solutions force passive consumption: their alerts, their priorities, their timeline.
10 Years of the Same Mistake
CVE-2025-55182 Intelligence Card c/o Recorded Future There are now multiple publicly available exploit scripts (I forked one on GitHub here) for the React and Next.js vulnerabilities (CVE-2025-55182 and CVE-2025-66478). The underlying issue is data serialization/deserialization, which evoked thoughts about a blog I wrote in 2016, addressing the same issue (at the time, the topic was CVE-2015-4852, a serialization flaw in Java objects that affected Oracle and Apache products).
From Bazooka to Fake Nikes Original
Business impersonation is the hidden thread connecting old and new fraud. Discover how the same core tactic is fueling both a surge in commercial check fraud and an explosion of AI-powered online shopping scams targeting younger consumers. Tools like Positive Pay and 3D Secure authentication, while effective against the fraud they were built to stop, have pushed threat actors to evolve their schemes in ways that render those controls irrelevant. Ecosystem gaps are often the real vulnerability.
SharePoint, Webshells & the Modern Threat Landscape
SharePoint, webshells, and the intelligence advantage Everyone is tired of reading about yet another Microsoft SharePoint vulnerability, and understandably so. Each new critical SharePoint flaw (often enabling remote code execution) brings a sense of déjà vu and patch fatigue.
How Threat Actors Are Rizzing Up Your AI for Profit
Your LLM Failed the Vibe Check. Here's Why. Introduction AI is reordering search dominance. Conventional wisdom says Google’s traditional search engine is headed for the dustbin, something largely unimaginable even a few years ago. As people (and agents) migrate search habits from Google to LLMs, what happens to referrer monetization models? More importantly for enterprise defenders and risk managers, HOW will traffers and malicious Traffic Distribution Systems (TDS) adapt?
Lazarus Doesn't Need AGI
Last week’s reporting on unauthorized access to Claude Mythos reads as an AI security story. It is also, structurally, a North Korea (DPRK) story. Even if the current suspects turn out to be Discord hobbyists. Mythos was meant to be contained. Within hours of the public Project Glasswing announcement, a third-party contractor environment became the access vector. Not because Anthropic did something wrong.
How CISOs Can Effectively Communicate Cyber-Risk
COMMENTARY More than half of chief information security officers (CISOs) struggle to effectively communicate cyber-risk to their leadership teams, according to FTI Consulting. If you're part of this majority, you're not alone. I spend countless hours each month in conversation with CISOs, talking about their concerns and challenges. Time and again, I hear the same frustration: translating complex cyber-risks into a digestible narrative for leadership is an uphill battle.
Why Law Firm Breaches Destroy More than Data
In the wake of the Salesforce/Gainsight breach (kudos to Salesforce for transparently sharing indicators of compromise and updated progress on remediation), third-party cyber and exposure risk is top of mind for many CISOs. Professional services firms are often overlooked in this context, with disastrous consequences. Law firms, specifically, are particularly vulnerable to creating downstream risk impacts given the nature and purpose of legal services, and adversary targeting is on the rise.
A New Cyber Insurance Model: Continuous Control Validation
February 1, 2022 • Levi Gundert Editor’s Note: The following post is an excerpt of a full report. To read the entire analysis, click here to download the report as a PDF. Insurance is a historical lever for hedging risk that dates to the ancient world.
Why cybersecurity should be the top priority right now for agencies
After the Obama administration increased sanctions on Iran in 2011 and the release of a perceived offensive video on YouTube, Iranian actors responded, launching distributed denial of service attacks against dozens of U.S. financial institutions, known as Operation Ababil. Today, relations between the two countries are further deteriorating and cyber attacks are ramping up and leaders of both countries engage in a war of words and threats. Now, more than ever, the U.S. needs to be on guard.
Digging In on Iran's Cyber Methods
There are a few more details coming out about last week’s cyber targeting of an Iranian-backed group by the U.S. military. Sources told CNN that the goal was to “disable and degrade” an Iranian-backed group that operates forces in Iraq and Syria by disabling their communications systems. The latest details shed light on the cyber battlespace and how it’s being exercised at a higher than usual degree as the rhetoric between the U.S. and Iran continues to escalate.
A Risk-Based Approach From Spammers to Nation-States
Recorded Future Blog By Zane Pokorny on May 13, 2019 Our guest today is Martijn Grooten. He’s editor at Virus Bulletin, an online forum for sharing the latest cybersecurity research and intelligence, which dates back to 1989. They’re also an independent testing and certification body, and they hold a popular international security conference annually.
Who’s Afraid of the Dark? Hype Versus Reality on the Dark Web
By Juan Sanchez and Garth Griffin on May 7, 2019 Click here to download the complete analysis as a PDF. Key Findings The collection of onion sites that is sometimes called the dark web is often portrayed as a vast and mysterious part of the internet. In reality, the number of onion sites is tiny compared to the size of the surface web. Our count of live reachable onion site domains comes to less than 0.005% of the number of surface-web site domains.
A Fresh Take on Defining Threat Intelligence
Recorded Future Blog By Zane Pokorny on May 6, 2019 In this episode, we check in with Recorded Future’s Levi Gundert and Allan Liska for a refresher on threat intelligence, including how they have come to describe it and why some people have a hard time wrapping their heads around what, exactly, it is and is not. We’ll find out whether threat intelligence is for everyone, and if so, how organizations of different sizes can best engage and make use of actionable threat intelligence.
The Need for Context in Vulnerability Management Programs (Part 3)
By The Recorded Future Team on May 2, 2019 In the first blog of this three-part series, we examined the current state of vulnerability management, which evidence suggests may very well have reached the crisis stage. In our second blog, we illustrated how vulnerability management programs without targeted threat intelligence make it difficult for security professionals to win the “cybersecurity race” and protect their company’s digital assets against cyberattacks.
9 SOAR Use Cases
By The Recorded Future Team on March 29, 2019 In our last blog, we examined how SIEM solutions have fallen short in helping IT security teams automate incident response processes, and how a new, more effective approach is emerging — security orchestration automation and response (SOAR). In this blog, we present several security use cases in which a SOAR platform can streamline and accelerate how quickly threats are discovered, contained, and mitigated.
Recorded Future Is Feeling the Love With a High Net Promoter Score
Recorded Future Blog By Amanda McKeon on May 14, 2019 For anyone that knows the team at Recorded Future, you may have caught on to the fact that we’re a bunch of overachievers. The company is always striving to be the best and provide our clients with a solution that goes above their expectations. That’s why we’re thrilled to receive the highest Net Promoter Score of any other cybersecurity analytics or intelligence company. What Is a Net Promoter Score?
5 steps for a successful public-private cyber crime fighting partnership
INDUSTRY INSIGHT 5 steps for a successful public-private cyber crime fighting partnership By Levi Gundert Feb 28, 2019 Whether it’s a ransomware attack that temporarily halts newspaper deliveries, a cyber attack targeting gas pipelines or financial cyber crime attributed to North Korea, foreign attacks on U.S. industries are keeping the nation's law enforcement officers busy.
Taming the Digital Wild West
Congress must do more to encourage good Samaritan efforts in the cybersecurity community and make it easier for law enforcement to consistently collaborate with them. Fred Wolens, VP of Policy and Communications at Recorded Future, also contributed to this article. The Internet is the digital Wild West, more so now than ever before.
Information Security Buzz
Scope Note: Insikt Group conducted interviews with a former Iranian hacker with first-hand knowledge of the information shared and was living in Iran when he started one of Iran’s first security forums. This source’s commentary forms the basis for the background on the genesis of Iran’s offensive cyber efforts. Additional research was facilitated with Recorded Future and by leveraging third-party metadata and open source intelligence (OSINT) techniques using a variety of tools.
Iran Retaliation Likely After Nuclear Deal Dropped
For the past six month or so, researchers in Recorded Future’s Insikt Group have been dissecting the structure of cyber operations groups within the Islamic Republic of Iran. In recent years that nation has regularly used offensive cyber campaigns in response to sanctions or other provocations. On May 8, 2018, President Trump announced the U.S. will withdraw from the Iran nuclear deal, leading to concerns that Iran is likely to respond with cyberattacks on Western businesses.
Ransomware: Carding's Replacement for the Criminal Masses - Dark Reading
Ransomware is not only here to stay, it's going to proliferate by orders of magnitude and cause substantial risk to businesses for the foreseeable future. The digital souks, where actors buy, sell, and trade criminal goods and services, exist to facilitate anonymity and illicit revenue, and this underground information economy's most popular asset has historically been stolen credit cards. That is changing. For over 15 years, creating spurious credit cards was the quickest way to a large payday.
Fiesta Exploit Pack is No Party for Drive-By Victims
Update 2014-05-26: Thank you to Fox-IT for providing the Fiesta logo image. We updated the caption to accurately reflect image attribution. Cisco’s Cloud Web Security (CWS) service provides TRAC researchers with a constant fire hose of malicious insight and now that we are collaborating with Sourcefire’s Vulnerability Research Team (VRT) we have additional capabilities to quickly isolate and prioritize specific web exploit activity for further analysis.
Russian-Speaking Hacker Breaches Over 60 Universities and Government Agencies
In December 2016, Recorded Future collaborated with law enforcement on the U.S. Election Assistance Commission (EAC) hack and subsequent database sale — committed by an actor Recorded Future named Rasputin. The EAC database breach was the result of SQL Injection (SQLi), an attack that is technically easy, but expensive to defend. Recorded Future continues to monitor Rasputin’s campaigns, which are now sequentially targeting specific industry verticals.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Levi
Contact Levi, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack