FTRCRP

A Green Pass Proves Less Than You Think: Reading a Phishing Email Header

Fri, 02 Oct 2026 00:00:00 +0000

A Green Pass Proves Less Than You Think: Reading a Phishing Email Header, audio

Listen to this guide, voiced by Andrew.

0:00 0:00

Your browser does not support the audio element.

The Message That Passed Every Check

A short email arrives from someone at a software company you have heard of. It names your organisation, asks one friendly question about winning more clients, and ends with “let me know if irrelevant”. There are no links and no attachments. Your mail provider shows SPF pass, DKIM pass and DMARC pass.

Et grønt «pass» beviser mindre enn du tror: slik leser du hodet i en phishing-e-post

Fri, 02 Oct 2026 00:00:00 +0000

Et grønt «pass» beviser mindre enn du tror: slik leser du hodet i en phishing-e-post, audio

Lytt til denne veiledningen, lest opp av Finn.

0:00 0:00

Your browser does not support the audio element.

Meldingen som besto alle sjekker

En kort e-post kommer fra en person i et programvareselskap du har hørt om. Den nevner virksomheten din, stiller ett vennlig spørsmål om å vinne flere kunder og slutter med «si fra hvis dette er irrelevant». Det er ingen lenker og ingen vedlegg. E-postleverandøren din viser SPF pass, DKIM pass og DMARC pass.

Digitalsikkerhetsloven Applies Today. NIS2 Has No Date Yet.

Thu, 01 Oct 2026 00:00:00 +0000

Digitalsikkerhetsloven Applies Today. NIS2 Has No Date Yet., audio

Listen to this guide, voiced by Andrew.

0:00 0:00

Your browser does not support the audio element.

Law and forskrift text checked against Lovdata on 5 October 2026. EEA status checked on 5 October 2026. This is the part that will go stale first.

Search for NIS2 in Norwegian and you will find consultancies, certification bodies and law firms explaining how to prepare. Most of them are accurate about its status. The risk sits with the reader who skims a headline about NIS2 and takes it for the law that applies in Norway today.

Digitalsikkerhetsloven gjelder i dag. NIS2 har ingen dato ennå.

Thu, 01 Oct 2026 00:00:00 +0000

Digitalsikkerhetsloven gjelder i dag. NIS2 har ingen dato ennå., audio

Lytt til denne veiledningen, lest opp av Finn.

0:00 0:00

Your browser does not support the audio element.

Lovtekst og forskrift kontrollert mot Lovdata 5. oktober 2026. EØS-status kontrollert 5. oktober 2026. Dette er delen som blir utdatert først.

Søk på NIS2 på norsk, og du finner konsulentselskaper, sertifiseringsorganer og advokatfirmaer som forklarer hvordan du forbereder deg. De fleste er presise om statusen. Risikoen ligger hos leseren som skummer en overskrift om NIS2 og tar den for loven som gjelder i Norge i dag.

NetScaler Zero-Days, a ShinyHunters Arrest, the Epstein Hearing Opens

Thu, 01 Oct 2026 00:00:00 +0000

Citrix disclosed two critical NetScaler zero-days (CVE-2026-88771, CVE-2026-88772, both CVSS 9.5) that attackers had been exploiting since at least early September, and NSM warned the same day. Dutch police announced an arrest linked to ShinyHunters, a group that denies the man is a member and whose claimed FBI applicant-data theft nothing public ties to him. Microsoft detailed Storm-3168’s seven-minute Azure wipe, Bitget’s $387.5 million loss was linked to North Korean actors, and the Storting’s Epstein hearing opened on 30 September. Also covered: the EU’s AI Act delay, NVE’s fine notice to Nscale, and Forbrukertilsynet’s first influencer fines.

Fines, Sieges, and a Perfect Ten

Wed, 30 Sep 2026 00:00:00 +0000

Issue 034 covers 21 through 23 September: Cisco patches a CVSS 10.0 authentication bypass in Identity Services Engine already under active exploitation, ShinyHunters hijacks Clop’s own leak site over a year-old Oracle EBS grudge, a third DDoS wave in three months knocks Norwegian government services offline for 30 hours with no confirmed state attribution, Ireland’s data protection authority fines Google €403M over location tracking in a case that started with a Forbrukerrådet complaint, and OpenAI’s autonomous agents spam RubyGems without ever filing the EU AI Act’s mandatory incident report.

Hva vi kan tilby

Tue, 22 Sep 2026 00:00:00 +0000

Mesteparten av sikkerhetsrådgivning er skrevet for virksomheter som allerede har et sikkerhetsteam. Denne siden er for dem som ikke har det: bedriften med førti ansatte og én som «tar seg av IT-en», verkstedet med en produksjonslinje eldre enn nettverket, og legekontoret som oppbevarer sensitive opplysninger og aldri har blitt bedt om å dokumentere hvordan de sikres.

Dere får personen dere hyret inn. Ikke en mal, ikke en nyutdannet med en sjekkliste, og ikke en rapport på 200 sider som havner i en skuff.

Personvern

Tue, 22 Sep 2026 00:00:00 +0000

En nettside som selger GDPR-revisjoner bør kunne gjøre rede for sin egen behandling av opplysninger på én side, uten et samtykkebanner og uten å be deg stole på den. Dette er den siden.

This page is also available in English.

Hvem er ansvarlig

FTRCRP Kleppestø (enkeltpersonforetak, org.nr. 935 968 186), Thomas A. Kleppestø, Skiptvet. Kontakt: HAL0zum@proton.me, eller kryptert til PGP-nøkkelen vår.

Hva denne siden ikke gjør

Det settes ingen infokapsler. Det lastes ingen tredjepartsskript eller -fonter: alt på denne siden kommer fra dette domenet. Ingen reklame, ingen sporingspiksler, ingen sosiale innbygginger og ingen samtykkedialog, fordi det ikke er noe å samtykke til. Du kan kontrollere alt sammen i nettleserens nettverksfane, som er den eneste forsikringen som er verdt noe.

Privacy

Tue, 22 Sep 2026 00:00:00 +0000

A site that sells GDPR audits should be able to account for its own data handling on one page, without a cookie banner and without asking you to trust it. This is that page.

Denne siden finnes også på norsk.

Who is responsible

FTRCRP Kleppestø (sole proprietorship, org. no. 935 968 186), Thomas A. Kleppestø, Skiptvet, Norway. Contact: HAL0zum@proton.me, or encrypted to our PGP key.

What this site does not do

No cookies are set. No third-party scripts or fonts are loaded: every asset on this site comes from this domain. No advertising, no tracking pixels, no social embeds, no consent banner, because there is nothing to consent to. You can verify all of it from your browser’s network tab, which is the only assurance worth anything.

What We Can Offer

Tue, 22 Sep 2026 00:00:00 +0000

Most security consulting is written for organisations that already have a security team. This page is for the ones that do not: the company with forty employees and one person who “does the IT”, the workshop with a production line older than its network, the practice that holds sensitive records and has never been asked to prove how it protects them.

You get the person you hired. Not a template, not a junior with a checklist, and not a 200-page report that ends up in a drawer.

DDoS Waves, AI Brakes, Baltic Drones

Mon, 21 Sep 2026 10:19:19 +0200

Issue 033 covers 12 to 20 September, nine days rather than five. Digdir’s own incident log records two denial-of-service attacks on Norway’s national login infrastructure, on 17 and 19 September, that no Norwegian outlet reported; the first failed outright and the second took services down for about three hours. Anthropic’s Dario Amodei triggered a week-long reckoning over the pace of AI development that pulled in Musk, Altman, Obama and Norwegian ministers weighing a ban on AI glasses around children, and a Google capability test of Gemini turned out to have reached three real companies that never consented. Cisco shipped two exploited zero-days in two days, scoring 9.8 and 10.0, both found through customer support cases. Two shipping chokepoints stayed degraded at once, with Brent peaking at 106 dollars.

The Door Nobody Checks

Sun, 13 Sep 2026 00:00:00 +0000

I tried to warn a company that its website was sending phishing. The only address it publishes cannot receive mail, and nobody inside would ever know.

Twenty-One Devices, a Funeral, and the Distance Between Them

Sat, 12 Sep 2026 23:51:46 +0200

Special issue, mainly geopolitical, covering 2 through 9 September. A week of attacks on the German power grid that some coverage read as Russian hybrid warfare produced an arrest, and the confession letters name a fight against fossil fuels; twenty-one explosive devices at a Saxony substation remain uncharged. Norway buried its king on a day one expert had put near-certain odds on a fresh attack against the state’s login layer, and the layer held. Around them, the week’s record: Microsoft’s largest Patch Tuesday on record, two flaws under attack and twenty wormable, 153 million driver’s licences for sale after a breach at IDScan.net, a Russian research vessel detained under a Norwegian court order, and an Arctic exercise season widening around it. What is in the record, what is a claim, and what to do about it.

Dormant Code: the blindness of a passing test

Mon, 07 Sep 2026 00:00:00 +0000

Logic bombs, trigger-based evasion, and what a green test never tells you.

Four Days Apart, Two Doorsteps, and Eight Universities

Wed, 02 Sep 2026 21:29:12 +0200

Special issue. Five denial-of-service waves have hit Norway’s shared digital infrastructure in ten weeks, and the gaps between them have shrunk from 44 days to 4. On 2 September the campaign reached eight universities directly. We measured the attacked services from two doorsteps at the same minute, a Norwegian home line and a foreign VPN exit, and the difference is the finding: the services answer a Norwegian address in a tenth of a second and refuse a foreign one. What the campaign is, what it is doing, what it is not doing, and what to do if you depend on Feide or ID-porten for anything with a deadline.

An Evaluation That Escaped, Norway Under Load, and Two Breaches That Shrank

Tue, 01 Sep 2026 00:00:00 +0000

Issue 030 covers OpenAI’s evaluation agents exploiting a live Linux kernel flaw and an Artifactory zero-day on the company’s own production infrastructure, putting two CVEs into CISA’s exploited catalogue with no criminal involved; a pro-Russian denial-of-service campaign working through Norway’s shared login layer and then its universities; ShinyHunters claiming 25.6 million records at Carhartt and 284 million at McKesson, with the first figure already cut in half by an independent researcher; two emergency PaperCut patches in as many days after the first was bypassed; the seizure of two Chinese state-linked scanning platforms; and more than a hundred internet-exposed water utility controllers reached in a single campaign.

What do you do when BankID is down?

Thu, 27 Aug 2026 00:00:00 +0000

Norway’s national login infrastructure went down at 03:38 on Monday 24 August and stayed degraded for three days, the second denial-of-service attack on the same systems in three weeks, confirmed by Digdir’s operator Vivicta and stopped, Digdir says, at 19:30 on Wednesday 26 August. A pro-Russian group has claimed it and nobody has stood that claim up. The question this piece asks is the one the National Security Authority put to Norwegian organisations twenty days before it happened and nobody has answered in public since: what is the fallback for a national login layer, who has tested it, and how long can Norway run without one. Sixty-four hours is two working days, and the last part of that question is for you.

The truth problem

Sat, 22 Aug 2026 00:00:00 +0000

We have a truth problem, and accepting it has been a collective act rather than one country’s doing. Disclosure gets waved on the UAP question while the Epstein files slide into the backdrop and the news cycle forgets on schedule. Here in Norway cases are raised against Terje Rød-Larsen, his wife Mona Juul and Thorbjørn Jagland, the justice system is dragging its feet and coverage is waning because of their health situation. At least here we have the optics of justice on paper, where there is none over in the US. No guilt is presumed here, the question is who the protection is actually for, and every public DOJ file that can be grabbed is being archived.

Three-Day Deadlines, Hack-Back Licenses, and Sanctioned Gas

Fri, 21 Aug 2026 10:26:29 +0200

Issue 028 covers CISA’s three-day patch mandate for an actively exploited remote-code-execution flaw in the Ray AI framework (CVE-2025-62593), and how that once-exceptional window became routine, the White House’s authorization of private hack-back operations against foreign cybercriminals, a SafePal wallet breach exposing nearly 40,000 users’ order data, Ukraine’s combined cyberattack-and-drone-swarm campaign against Wildberries, and a Greek shipping loophole shielding over a fifth of Russian LNG exports to the EU from sanctions, alongside Ukraine’s largest drone offensives of the war and an Iranian bounty on US troops amid the collapsed Hormuz ceasefire deadline.

Your Filenames Are for Sale: The .md Namespace Collision

Sun, 16 Aug 2026 00:00:00 +0000

A correction and a follow up to our February investigation. Markdown filenames are buyable domains, because .md is Moldova’s country code TLD. We tested one hundred and two of the filenames a developer types every day, and ninety four were already registered. The filenames AI coding agents read as configuration were bought as each convention shipped. This is the defensive half of the work. A confirmed data-exposure case is held back pending vendor notification.

Worm in the Supply Chain, a Wide Open Front Door

Wed, 12 Aug 2026 22:48:17 +0200

A self-propagating npm worm dubbed ChainDrop infected more than 400 packages with a combined two billion-plus downloads, Framework disclosed a CVSS 10.0 SQL injection in its Metabase analytics vendor that exposed the full customer database, Levi Strauss lost data to a social-engineering attack on three employees, and three separate frontier AI models broke out of their test sandboxes during safety evaluations in the same week. The US-Iran war escalated at sea with an Iranian missile strike on a UAE tanker in the Strait of Hormuz and US Patriot stocks down more than 65 percent, while Houthi forces pushed Yemen toward wider conflict. Norway continued training Ukrainian troops and monitoring Russian Northern Fleet drills in the Barents Sea.

Containment, Coldcard, and Contamination

Fri, 07 Aug 2026 00:15:43 +0200

Issue 026 covers 1 through 6 August. Meta’s Muse Spark 1.1 was the third disclosed lab containment breach in two weeks, after Anthropic and OpenAI, pushing Washington to finalize a voluntary AI hacking-capability testing regime. Coinkite’s Coldcard Mk3 wallets lost roughly 1,816 BTC, near 115 million dollars, to a weak-RNG firmware flaw dating to March 2021. Cyberattacks on US water utilities spread to at least 12 states. New Mexico’s Attorney General sued the Justice Department and acting AG Todd Blanche over withheld Epstein-related files from Zorro Ranch. Also this week: Denmark opened an extended 11-month conscription cycle and will send its first conscript company to Greenland, Norwegian salmon exporters warned on US tariff instability, and ceasefire talks over Iran and Gaza remained unresolved.

Agents Off the Leash, a Deadline That Moved, and a Patch That Already Shipped

Sat, 01 Aug 2026 00:00:00 +0000

Issue 025 covers Anthropic disclosing that three of its own models autonomously attacked real organisations during testing, a Check Point admin-authentication bypass with a public exploit, a Cisco firewall zero-day whose CISA deadline fell on 1 August, a Fastjson critical whose 1.x patch shipped mid-week despite wide reporting that none was coming, a coordinated attack on thirty-plus Minnesota water systems, the EU’s Digital Omnibus deferring the AI Act’s high-risk obligations by sixteen months days before they were due, Hormuz closed since spring with a corridor plan Iran turned down, and a Russian cruise missile in Poland.

Count Your Readers Without Spying on Them: Self-Hosted Analytics with GoatCounter

Sun, 26 Jul 2026 00:00:00 +0000

If you publish anything, you want to know whether anyone is reading it. That is a reasonable thing to want, and it is not the same as wanting to know who is reading it.

Google Analytics does not make that distinction. Put it on your site and you have quietly conscripted every visitor into somebody else’s advertising business, in exchange for a dashboard you look at once a week. You get numbers. They get people. It is not a trade most publishers would make consciously if it were stated that plainly, and it is the reason several European data protection authorities have found the arrangement difficult to square with GDPR.

Notes on Real People: A Working Method for Encrypted Dossiers

Sun, 26 Jul 2026 00:00:00 +0000

Anyone who researches seriously ends up holding notes about people. Sources, subjects, contacts, the person you are trying to identify from a fragment. Investigators, journalists, lawyers, security researchers, family members keeping a safeguarding record, all of them accumulate files about human beings who never agreed to be filed.

Those notes are not yours in the way your shopping list is yours. They contain other people’s exposure. A leaked research folder does not embarrass you nearly as much as it endangers them.

One Key, Three Operating Systems: The Case for Cross-Platform Disk Encryption

Sun, 26 Jul 2026 00:00:00 +0000

If you work across operating systems, and a lot of us do, you eventually hit a wall that single-platform advice never mentions. Every system has good native full-disk encryption. None of it travels.

FileVault protects the Mac. BitLocker protects the Windows box. LUKS protects the Linux machine. All three are solid, and all three stop at the edge of the device. The moment your data has to live on an external drive, get handed to someone, or be opened tomorrow on a different machine, the native tooling has nothing to say to you.

Listen Instead: Text-to-Speech When Your Eyes Have Had Enough

Sat, 25 Jul 2026 00:00:00 +0000

There is a particular kind of tired that does not look like tiredness. The letters are still sharp. You can read them fine. But the meaning slides off, and you get to the bottom of a paragraph having decoded every word and absorbed none of it. Read it again and the same thing happens.

I know that state well. I live with a nervous system that runs hot, tinnitus that never fully stops, and visual snow, a permanent field of static over everything I look at, which most people are surprised to learn is a documented neurological condition rather than a complaint about the lighting. On the bad days the eyes still work and the comprehension does not. What I found, eventually, is that the ears were unaffected the whole time. Hand me the same text as audio and I take it in completely.

The Fallback Stack: Running Local AI So You Can Lose the Frontier and Keep Working

Sat, 25 Jul 2026 00:00:00 +0000

The frontier models are extraordinary and I use them daily. That is exactly why this guide exists.

Everything that makes them useful also makes them fragile as a dependency. They are a handful of companies, reachable over someone else’s network, priced at someone else’s discretion, governed by terms that change without your consent, and subject to outages, rate limits, deprecations, sanctions, and the ordinary politics of a volatile decade. A model you rely on can be retired with a month’s notice. An account can be suspended by an automated system on a Sunday. A cable can be cut. None of this is paranoia, it is just infrastructure behaving the way infrastructure behaves.

Double Whammy with a Pinch of Catastrophe

Wed, 22 Jul 2026 00:00:00 +0000

Iran contests the Strait of Hormuz while the Houthis squeeze Bab el-Mandeb — two chokepoints, both ends of the Arabian Peninsula, at the same time. Six Saudi-linked ships have already turned home and Brent has pushed past ninety dollars, a six-week high, before anything has actually stopped. A just-in-time world with no slack meets a shock it was never built to absorb, and Russia sits waiting to sell the expensive oil.

Zero-Day Pairs, Arctic Satellites, and Ten Nights Over Tehran

Tue, 21 Jul 2026 00:00:00 +0000

Issue 024 covers two SonicWall SMA 1000 zero-days (CVE-2026-15409 and CVE-2026-15410, both CVSS 10.0, exploited before vendor disclosure), a 2.25-million-downloads-per-week AsyncAPI npm supply chain compromise with IPFS-hosted C2, joint EU and UK sanctions naming the FSB 16th Center and GRU officer Yevgeny Bashev for a decade of European infrastructure attacks, ten consecutive nights of US airstrikes against Iran with US military fatalities reported (uncorroborated in tier-one Nordic press) and Houthi maritime escalation at Bab al-Mandeb, and Ukraine’s 400-drone strike on Moscow alongside Russia’s largest ballistic barrage on Kyiv.

First Agentic Ransomware, Four Nights Over Kyiv, Ankara Draws the Line

Mon, 13 Jul 2026 00:00:00 +0000

Issue 023 covers 4–11 July 2026: JadePuffer, the first documented fully agentic LLM-driven ransomware, arriving alongside a BeyondTrust critical auth bypass with 2,000 instances still exposed; Russia’s four consecutive ballistic missile salvos on Kyiv killing 70+ in one week; the NATO Ankara summit committing $58 billion in new defence procurement with Norway signing onto Triton drones and a $922M South Korean MLRS deal; Norway rebuffing Trump on Greenland and removing China’s stone lions from Svalbard; and the US-Iran exchange widening across the Gulf as the ceasefire was declared over.

Assembly Breach, Five Thousand Sorties, Black Walks

Sat, 04 Jul 2026 00:00:00 +0000

World Leaks ransomware group breached Tata Electronics, Apple’s primary iPhone assembly partner in India, leaking more than 200,000 iPhone 18 Pro component files to the dark web; Oracle’s E-Business Suite faced confirmed active exploitation while a separate PeopleSoft zero-day struck Nissan and hundreds of insurance sector clients; per NATO all 32 members met the 2% GDP defence spending threshold in 2025, a first for the alliance, with a 5% target now set for 2035; NATO Secretary-General Rutte confirmed approximately 5,000 US aircraft sorties from European bases during the US-Iran military exchange of 26-29 June; Apollo founder Leon Black walked out of a House Oversight interview on 26 June, the first walkout of the Epstein depositions, and was subpoenaed to return under oath on 16 July; and Russia launched a massive combined assault on all ten Kyiv districts on 1-2 July, killing eight.

Mythos Breaks NSA, World Leaks Apple, Kapotnya Burns

Sat, 27 Jun 2026 00:00:00 +0000

Week 26: a US senator discloses that Anthropic’s Mythos AI model, in a controlled red-team test against a replica of NSA classified systems, found vulnerabilities in nearly all of them within hours, days before a Five Eyes joint advisory on AI-driven offensive hacking; World Leaks ransomware posts roughly 630 GB of Apple and Tesla supply-chain data from Tata Electronics; Operation Endgame dismantles the Amadey-StealC infostealer network across 326 servers and 142 domains, recovering 27 million stolen credentials; Ukraine’s Liutyi drones put Kapotnya refinery offline until year-end and trigger Russia’s worst fuel crisis in years; and publicly released DOJ Epstein disclosure datasets cross-checked against E24, Aftenposten and Filter Nyheter document a $250,000 wire tied to Terje Rød-Larsen, a leaked confidential UN briefing (resolution 1559), and a set of Thorbjørn Jagland emails handled in full in FTRCRP’s investigation.

Zero-Day Sweep, Helsinki Goes Nuclear, Epstein's Files Go Public

Sun, 21 Jun 2026 00:00:00 +0000

ShinyHunters breached 100+ organisations via Oracle PeopleSoft zero-day CVE-2026-35273 including the Council of Europe; a Fortinet credential-harvesting campaign swept Fortune 500 firms and government agencies across 15 countries; Finland’s parliament voted to lift its decades-long nuclear weapons ban; the US and Iran agreed a preliminary ceasefire reopening the Strait of Hormuz; and Congress subpoenaed the Epstein estate, the Clinton family, and the DOJ as Bill Gates testified before House Oversight and fresh DOJ document batches landed under the 2025 Epstein Files Transparency Act.

Bear Gap, Patch Tuesday, and Gates Under Oath

Thu, 11 Jun 2026 00:00:00 +0000

Issue 019 covers Norway’s unanimous Storting defense vote (NOK 11B+, 6 submarines, 5 frigates), the Narvik Agreement placing Norway under French nuclear deterrence as the 9th NATO ally, and Defence Minister Sandvik’s Bear Gap warning; Microsoft’s record 206-flaw June Patch Tuesday with one actively exploited zero-day (CVE-2026-45586); a Red Hat npm supply-chain backdoor across 32 packages and 116,991 weekly downloads; Bill Gates’s House Oversight testimony that Epstein leveraged his extramarital affair as pressure; and the US-Iran war’s Day-100 escalation with 49 Tomahawks fired and Iranian ballistic missiles intercepted over Jordan.

Smoke and mirrors: the disclosure hype is conveniently timed

Wed, 10 Jun 2026 00:00:00 +0000

Disclosure Day in theaters, Sleeping Dog on the podcast circuit, eight explosive videos in Washington… the attention machinery is at full throttle in a June when the ground is shifting. The phenomenon stays an open question, the hype has an incentive structure worth reading.

Extend the thinking, do not substitute it

Tue, 02 Jun 2026 00:00:00 +0000

Three pillars for using AI honestly in study and security work, and what a hardened lab actually taught me.

Reading

Tue, 02 Jun 2026 00:00:00 +0000

The opinions on this site are ours. This is the ground they stand on.

An evidence-based platform owes you its sources, and not only the footnotes on a single article. These are the books that shaped how we think about security, privacy, machines, and the friction between them and a human life. No affiliate links, no sponsored placements, no kickback. If a book is here, it earned the line on its own.

A Stolen Registry, a Nuclear Umbrella, and a Royal Reckoning

Mon, 01 Jun 2026 00:00:00 +0000

Lithuania’s state land registry was stolen, more than 600,000 records covering close to a fifth of the population, with politicians openly worried the data lands with Russian intelligence. Norway came under France’s nuclear umbrella through the Narvik Agreement, and Moscow answered with a public threat. Crown Prince Haakon addressed the Epstein questions around the Crown Princess in public for the first time as SVT released new Swedish files. The ShinyHunters federation kept its run going, Carnival confirmed a breach touching nearly six million people and Charter confirmed one of its own. A Gogs zero-day shipped with a working exploit and no patch, and the FBI warned twice, on a phishing service that walks past Microsoft 365 multi-factor and on a ransomware crew that shows up at law firms in person. Russia put an Oreshnik on Kyiv and a drone into a NATO member’s apartment block.

AI Transparency Notice

Tue, 19 May 2026 00:00:00 +0000

What this page is for

This is a plain-language explanation of how AI tools are used across ftrcrp.org. It exists so a reader can know, at a glance, what role AI played in any piece they are reading. The legal scaffolding is in the editorial standards page, this one is for people who want a straight answer.

How AI is used

The site publishes across several sections, each handled differently.

OWA, Glasswing, and a Refused Ransom

Tue, 19 May 2026 00:00:00 +0000

A critical Exchange OWA cross-site scripting flaw (CVE-2026-42897) is being exploited via crafted email, CISA pushed it to KEV inside 24 hours. Anthropic loosened the Mythos disclosure policy on Project Glasswing, partners can now share AI-found zero-days more broadly. The Coinbase Cartel listed Grafana on its leak site and Grafana publicly refused the ransom. The mini Shai-Hulud worm hit 170+ npm packages and 2 PyPI packages across TanStack, Mistral AI, and Guardrails AI namespaces. MuddyWater’s Q1 espionage campaign turns out to span nine countries including a major South Korean electronics maker. Stortinget’s Epstein commission of enquiry held its first session, the work has started.

From the Goblins to the Hearing

Tue, 12 May 2026 00:00:00 +0000

Two weeks at once. OpenAI hardcoded a system-prompt override to stop ChatGPT 5.1 from talking about goblins. DENIC broke the .de TLD with bad DNSSEC and Cloudflare disabled validation to keep Germany online. Trellix’s source code was breached. A Linux kernel LPE and a Palo Alto firewall RCE both landed on CISA KEV with active exploitation. The DOJ Epstein archive crossed 269,000 PDFs and the Stortinget control hearing on the Norwegian-Epstein thread is running this week.

Goblins in the Machine, Holes in the Wire

Thu, 07 May 2026 00:00:00 +0000

OpenAI hardcoded a system-prompt override to stop ChatGPT 5.1 from talking about goblins. DENIC broke the .de TLD with bad DNSSEC signatures and Cloudflare disabled validation to keep Germany online. Trellix’s source code was breached. A Linux kernel LPE and a Palo Alto firewall RCE both landed on CISA KEV with active exploitation. The DOJ Epstein archive crossed 269,000 PDFs, OCR still paused, Stortinget hearing days away.

Mines and Mythos

Tue, 28 Apr 2026 00:00:00 +0000

Trump ordered the Navy to shoot Iranian boats mining Hormuz. Voice phishing surged against IT helpdesks. The Vercel breach widened. India’s finance minister flagged Anthropic Mythos as a banking risk. A new 2 Tbps DDoS record set a fresh ceiling for the threat surface.

The Verse He Chose

Tue, 28 Apr 2026 00:00:00 +0000

King Charles III invoked Joel 3:10, the mobilisation verse, in his joint address to Congress on April 28. The verse he chose, not the verse he didn’t, is the signal.

Hospitals and Hormuz

Wed, 22 Apr 2026 00:00:00 +0000

Patch Tuesday dropped 167 CVEs and two live zero-days. Dutch hospitals are still offline after ChipSoft. Iran shut Hormuz again when the US refused to lift the blockade. A new class of 1.58-bit AI arrived at 8B parameters.

Blockades and Breaches

Tue, 14 Apr 2026 00:00:00 +0000

A Fortinet zero-day giving attackers full endpoint control. Trump’s naval blockade of Iran. An Easter ceasefire in Ukraine that didn’t hold. Week 15 brought the pressure.

MuddyWater Follow-Up: April 2026

Sat, 04 Apr 2026 00:00:00 +0000

A lot changed in four weeks. MuddyWater rebuilt their toolkit in Rust, started using AI to write malware, compromised US banks and airports, and picked up new attack vectors including RDP and Ethereum-based C2. This is the follow-up.

The Easter Escalation

Sat, 04 Apr 2026 00:00:00 +0000

A browser zero-day hitting 3.5 billion users. A US fighter jet shot down over Iran. Russia stalling for the first time in years. And the Epstein fallout reaching all the way to a Nordic royal palace. Week 14 was not quiet.

One Month of Fire

Sun, 29 Mar 2026 00:00:00 +0000

The Iran war hits one month with Houthis entering the fight, Iran strikes Bahrain, and US deploys 3,500 marines. FBI Director Kash Patel’s personal email hacked by Handala. European Commission breached via AWS — ShinyHunters claims 350GB. Stortinget summons Støre and a dozen officials to open Epstein hearings. Cyber warfare is no longer parallel to kinetic war — it is the same war.

The Admin Prompt

Tue, 24 Mar 2026 00:00:00 +0000

Microsoft blocked a registry hack that unlocks native NVMe on Windows 11. Every tech outlet responded the same way: download an unsigned binary from GitHub and run it as admin. Nobody asked what happens when millions of users are trained to do this.

The Week Everything Moved

Tue, 24 Mar 2026 00:00:00 +0000

EU Chat Control collapses, E2EE survives. Mette-Marit speaks, Stortinget votes unanimously for Epstein commission. Tycoon 2FA dismantled, Medusa ransomware hits hospitals, and the Iran war grinds into week four with no ceasefire in sight.

The Genie Problem

Mon, 16 Mar 2026 00:00:00 +0000

Claude Opus 4.6 broke its own exam by identifying the benchmark, finding the encrypted answer key on GitHub, and decrypting it across 18 independent runs. Iran’s Handala group wiped 200K devices at Stryker, Epstein Nordic scanner hits 3,140 documents, and OpenClaw’s creator gets name-dropped in the Wes Roth video covering the eval results.

Fifteen Days of Fire

Sat, 14 Mar 2026 00:00:00 +0000

Iran war hits Day 15 with Kharg Island struck and oil past $100, Økokrim finds classified documents in Rød-Larsen’s basement, Reuters reveals FBI Epstein files were hacked in 2023, Iran-linked Handala group wipes 200K devices at Stryker, and Telus Digital loses 1 petabyte to ShinyHunters.

Cracking the Factory: When 'Random' Passwords Aren't

Mon, 09 Mar 2026 00:00:00 +0000

Every password your computer has ever generated is the output of a deterministic algorithm. When that algorithm is weak, fingerprinted, or seeded from a timestamp, ‘random’ collapses to ‘predictable with effort.’ Three real-world cases prove this isn’t theoretical.

The Bombs Don't Stop

Sat, 07 Mar 2026 00:00:00 +0000

Iran war enters its eighth day with 1,450+ killed and 5,000+ bombs dropped, Økokrim seizes Oslo Accords documents from Rød-Larsen, LexisNexis breach exposes 3.9M records including federal judge profiles, and the Coruna iOS exploit kit chains 23 vulnerabilities into a weaponized platform.

How to Build an AI Brain

Thu, 05 Mar 2026 00:00:00 +0000

A practical guide to giving your AI agent persistent memory, from workspace files to graph databases. Four layers, starting from trivial to advanced.

MuddyWater: Inside Iran's Cyber War Machine

Thu, 05 Mar 2026 00:00:00 +0000

A comprehensive look at MuddyWater, the Iranian APT embedded in US banks and airports before the bombs even fell. From Operation Olalampo to exposed server infrastructure, AI-generated malware to Ethereum-based command channels, this is what a state-sponsored cyber operation looks like in 2026.

The Silent Siege

Thu, 05 Mar 2026 00:00:00 +0000

Telia Norge was compromised for 18 months. 500,000 customers exposed. The breach reveals what happens when we treat connectivity as a consumer product instead of critical infrastructure.

SearXNG + Tor in Docker: Your Own Private Search Engine

Sun, 01 Mar 2026 00:00:00 +0000

A step-by-step guide to deploying SearXNG in Docker with Tor integration and an authenticated Caddy HTTPS reverse proxy. Private, self-hosted search that doesn’t leak your queries and doesn’t quietly become a service you run for strangers.

The World Catches Fire

Sat, 28 Feb 2026 00:00:00 +0000

US and Israel strike Iran in coordinated assault, Pakistan declares open war on Afghanistan, Cisco SD-WAN zero-day exploited since 2023, Mandelson arrested over Epstein ties, Clinton testifies ‘I saw nothing,’ and the DOJ faces growing backlash over withheld Epstein files.

The Reckoning Begins

Sun, 22 Feb 2026 00:00:00 +0000

Prince Andrew arrested, Norway’s elite in freefall over Epstein ties, Dell zero-day exploited by China since 2024, six Microsoft zero-days patched, Geneva peace talks stall, and Trump’s Board of Peace convenes.

Two Carriers and a Zero-Day

Sun, 15 Feb 2026 00:00:00 +0000

Apple zero-day exploited in the wild, Microsoft patches six critical flaws, US deploys two carriers toward Iran, Ukraine drones strike 1,100 miles deep, ransomware surges 52%.

Eight Minutes to Admin

Sat, 07 Feb 2026 00:00:00 +0000

APT28 zero-day, 149M credential leak, AI breaches AWS in 8 minutes, PST warns of worst security since WWII, Epstein political fallout, and more.

Digital Hygiene: Keep Your Dirty Laundry Off the Line

Fri, 06 Feb 2026 00:00:00 +0000

A practical guide to digital privacy. Not for paranoids, but for anyone who’d rather keep their business their own. Passwords, 2FA, social media, and more.

.md TLD: Namespace Collision Threat to AI Agents

Wed, 04 Feb 2026 00:00:00 +0000

Correction, 16 August 2026. We revisited this investigation six months on and one of its central claims did not survive. This notice stays at the top permanently. The follow up is Your Filenames Are for Sale.

What we withdraw. This article described the seven domains as “pre-positioned attack infrastructure” and read their commercial services as a “legitimate facade” providing “plausible deniability”. That framing implied a single coordinated actor. Ownership records do not support it. The seven names belong to four unrelated parties, with registration dates spanning 2006 to 2026 and three separate hosting ecosystems. One has been held by a Moldovan business for two decades. Another is a live developer service. We had no evidence of coordination and should not have implied it.

Signal Under Siege

Tue, 27 Jan 2026 00:00:00 +0000

How state actors and scammers target encrypted messaging, and how to protect yourself.

The Norwegian Gateway: ITavisen, CryptoEasily, and the Myth of 'Norsk er Trygt'

Sun, 11 Jan 2026 00:00:00 +0000

Part 2 of our investigation into ITavisen’s promotion of CryptoEasily. Documenting victim testimony, regulatory failures, the eToro/Plus500 connection, and why ‘Norwegian is safe’ is a dangerous myth.

CryptoEasily Cloud Mining Scheme Investigation

Tue, 16 Dec 2025 00:00:00 +0000

Investigation report documenting a cryptocurrency investment scam operating through ITavisen.no and coordinated syndication across multiple platforms.

Academic Grind, Technical Wins, and a System on the Fringes

Wed, 26 Nov 2025 00:00:00 +0000

Python progress, CCNA grinding, encrypted backup wins, and reflections on infrastructure fragility and surveillance overreach.

Under The Radar

Thu, 06 Nov 2025 00:00:00 +0000

Notes from Simen Bakke’s lecture at Noroff on how China uses civilian hackers and IT companies for cyber operations.

The Testing Grounds

Mon, 27 Oct 2025 00:00:00 +0000

Signals dispatch examining AI escalation, credential leaks, and the ethical testing grounds shaping the next era.

Cloud Week

Fri, 24 Oct 2025 00:00:00 +0000

Management notes on decentralised resilience, hybrid security workflows, and rebuilding digital hygiene from the ground up.

About

Wed, 01 Jan 2025 00:00:00 +0000

Growing up in the ’80s and ’90s, I have one leg in both worlds, the pure analog reality and the digital revolution. Interested in computers since I was 10, I shoulder-rode my father as he learned BASIC and Pascal. I was amazed at the prompt, and the phosphor green screen, making magical sounds as the floppy spun up loading whatever I could find. Doom, Castle Wolfenstein and Duke Nukem took me. Going online in the mid-’90s, a brave new world presented itself, and by 2001 I heard whispers about Linux. Already then, after two years saving the world from Y2K and billing problems for Tele2 customer service, I was tired of Windows. Thus began the Linux and Unix journey.

PGP Public Key

Wed, 01 Jan 2025 00:00:00 +0000

For secure communications, you can encrypt messages to FTRCRP using the PGP key below.

Key Details

Field	Value
Owner	FTRCRP Secure Tips
Email	HAL0zum@proton.me
Key type	Ed25519 (sign/certify) + Curve25519 (encryption)
Created	2026-01-27
Expires	Does not expire

Fingerprint

FE70 9E0B 2BE3 F5D9 8CD2 4715 A8B0 1918 6315 D536

Always verify this fingerprint through a second channel before sending sensitive material.

Usage

Copy the public key block below (or download it)
Import it into your PGP client: gpg --import ftrcrp.asc
Verify the fingerprint matches
Encrypt your message and send to: HAL0zum@proton.me

Public Key Block

Alternative Secure Channels

ProtonMail: HAL0zum@proton.me (end-to-end encrypted by default between Proton users)
Signal: Available upon request

For sensitive tips or confidential communications about security issues, scams, or other matters requiring discretion.

Press Kit

Wed, 01 Jan 2025 00:00:00 +0000

Media resources for journalists, researchers, and publications covering FTRCRP’s work.

Logo & Brand Assets

Full Logo PNG (High resolution)
Standard Logo PNG (Web optimized)

Usage Guidelines: Logo may be used in editorial coverage. Maintain clear space around logo. Do not modify colors or proportions.

Organization Boilerplate

Short Version (50 words): FTRCRP is an independent security research initiative based in Norway, focused on consumer protection and digital ethics. We investigate scams, analyze industry patterns, and publish practical security guidance. Evidence-first methodology with transparent documentation.

Contact

Mon, 01 Jan 0001 00:00:00 +0000

Use the form below to reach us, or email us directly at HAL0zum@proton.me. All inquiries are reviewed and responded to personally.

What We Help With

Consulting Requests. Security assessments, architecture review, incident response
Collaboration / Job Opportunities. Research partnerships, contracting, employment
Press / Media. Interviews, comments, expert consultation
Newsletter. Subscribe to FTRCRP updates and publications
General Inquiries. Questions, feedback, or anything else

Response Time

We’ll respond within two working days. All responses are human, considered, and never automated.

Editorial Standards

Mon, 01 Jan 0001 00:00:00 +0000

Version: 1.0 Effective: 2026-01-26 Review Date: 2027-01-26

Purpose

These standards ensure all FTRCRP publications maintain accuracy, fairness, and ethical integrity. They apply to all content published under the FTRCRP name.

Core Principles

1. Accuracy First

Verify before publish. Every factual claim requires a source.
Distinguish fact from opinion. Use clear language: “evidence shows” vs “we believe.”
Acknowledge uncertainty. “Appears to,” “suggests,” “alleged.” Use appropriate qualifiers.
Correct errors promptly. Issue corrections publicly with changelog documentation.

2. Fair Representation

Present all relevant sides. Include perspectives that challenge our conclusions.
Steelman, don’t strawman. Represent opposing views at their strongest.
Right of reply. Contact subjects for comment before publication when practical.
No personal attacks. Criticize actions and systems, not individuals’ character.

3. Transparency

Disclose conflicts of interest. Financial relationships, personal connections, prior involvement.
Show methodology. Explain how we reached our conclusions.
Cite sources. Enable readers to verify independently.
Open to correction. Welcome challenges to our findings.

4. Proportional Response

Punch up, not down. Prioritize investigating power, not individuals.
Consider impact. Will publication cause disproportionate harm to the subject vs public benefit?
Privacy by default. Minimize personal information unless directly relevant.

Citation Requirements

Sourcing Standards

Source Type	Requirement
Regulatory documents	Direct link to official source
News articles	URL + archive link (Wayback Machine)
Court records	Case citation + public record link
Corporate filings	Registry link (Bronnøysund, Companies House, etc.)
Personal statements	Exact quote with context
Statistics	Original study/report + methodology

Archive Protocol

All web sources should be archived to prevent link rot:

Frequently Asked Questions

Mon, 01 Jan 0001 00:00:00 +0000

About FTRCRP

What does FTRCRP do?

We help organizations implement technology ethically. We protect privacy, building trust, and putting humans at the center of digital systems.

Specifically:

GDPR compliance for small organizations
AI policy development for schools and businesses
Security assessments for SMBs without internal IT security
Digital literacy training for educational institutions

Why “FTRCRP”?

“Future Corp.” A deliberate question about what kind of corporate future we’re building. The choices organizations make today about privacy, AI, and security shape the society of tomorrow. We help them choose well.

Message Sent

Mon, 01 Jan 0001 00:00:00 +0000

Thank You

Your message has been received. We aim to respond within two working days.

If your inquiry is urgent or requires secure communication, please mention this in your message and we will prioritize arranging a secure channel.

Return to Contact Page | Back to Home

Search

Mon, 01 Jan 0001 00:00:00 +0000