Veteran-owned (SDVOSB) cybersecurity. 24/7 SOC · Pentesting · Incident Response · CMMC · SOC2 · HIPAA · Texas HQ, nationwide · Real engineers, no tickets.
Corpus Christi, TX
Joined July 2015
- Tweets7.2K
- Following745
- Followers595
- Likes941
One vendor. Seven airlines. Three years of undetected access.
Cathay Pacific, Singapore Airlines, Qantas, JAL, ANA, Malaysia Airlines and Asiana have all reported customer data breaches. Several said an unauthorized party used credentials assigned to an Amadeus system account. Booking data was exposed, including names, itineraries and booking references. The reported access window ran from August 2023 to September 2026.
As one analyst put it, "access that long without detection is the central question."
Many leaders tell us, "Our IT team has it covered." Your IT team may be excellent, but they keep systems running. They aren't built to watch, around the clock, for a valid login that's acting like an attacker. Your vendors and shared platforms are part of your attack surface too.
That's where independent oversight comes in. CoreRecon's 24/7 SOC gives you third-party overwatch. We monitor, investigate, and escalate the suspicious activity that can otherwise go unnoticed for years.
Is anyone watching the logins you already trust?
#Cybersecurity #DataBreach #ThirdPartyRisk #SupplyChainSecurity #SOC #ThreatDetection #CyberResilience #AviationSecurity #IdentitySecurity #CoreRecon #Texas
112
4.9 million people. One website.
The Florida Department of Education has confirmed that hackers breached the financial aid website - the state's portal for scholarships and grants. Names, Social Security numbers, dates of birth, home addresses, phone numbers, and email addresses may have been exposed.
The intrusion was discovered on October 19. FLDOE says it is contained, and the Florida Digital Service and FDLE are helping with the investigation. How the attackers got in has not been disclosed, and no group has claimed responsibility.
Here's what public-sector and education leaders should take from this:
→ Public-facing portals hold a lot of sensitive data. Every application form puts more PII in one place, so it becomes a target.
→ SSNs plus dates of birth are the full kit for identity fraud. Many of the people affected are students who may not check their credit for years.
→ Containment matters, but detection speed matters more. The real question is how long attackers were inside before anyone noticed.
→ Your website is part of your attack surface. Treat it with the same rigor as your internal network, including regular penetration testing, vulnerability management, and 24/7 monitoring.
If your organization runs public-facing systems that collect personal data, ask yourself this: if someone were in your environment right now, would you know?
At CoreRecon, our 24/7 SOC exists to answer that question before attackers do.
#cybersecurity #databreach #publicsector #education #incidentresponse #SOC #CoreRecon #florida #finanicalaid
1
7
Breach hits operator of the South Texas Project nuclear plant. Names, SSNs & birthdates of ~1,200 Texans exposed.
The NRC says the plant is running safely, but attackers don't need the reactor. They hit HR, email & employee data first.
#CoreRecon #aep #cps #Cybersecurity #DataBreach #CriticalInfrastructure #cyberAttack #ZeroTrust
12
Ransomware is encrypting Synology NAS boxes right now.
The bug behind it was patched in December 2024. What Synology has confirmed:
On Oct 29, Synology said attackers are encrypting NAS devices running outdated or end-of-life DSM. It points to advisory Synology-SA-24:20, which covers CVE-2024-10441: a CVSS 9.8 remote code execution bug from Pwn2Own 2024—no password needed.
Synology also shipped fixes for the PHP2Shell bugs in its PHP add-ons (Web Station, WordPress, Calendar, and more), dating back to DSM 6.2.
What's NOT confirmed:
Posts on X and Qihoo 360 call the malware C3RB3R and say it renames files to .L0CK3D. Synology hasn't confirmed that name. 360 also says the samples it analyzed used newer bugs patched in September 2026, so "latest DSM" is the real target, not just the 2024 fix. Victims in Korea were shown a note demanding about $3,000 in Bitcoin, doubling after 5 days.
Why it matters:
Small clinics, county offices, and field sites often keep their backups and shared files on one of these boxes. Usually in a closet. Usually untouched for years.
If you look after client networks, here's the checklist:
1. List every client Synology and its DSM version
2. Update DSM, then update the PHP add-ons in Package Center
3. Turn off QuickConnect and close open ports
4. Make sure there's a backup the NAS itself can't reach
#CoreRecon #Cybersecurity #Ransomware #Synology #MSP #InfoSec #Texas #IncidentResponse #DigitalForensics #SOC #ManagedSecurityServices #CISO #BusinessContinuity #DataProtection #managedsecurity #NetworkSecurity #MSP #MSSP #CMMC #CyberThreats #Business
1
1
32,592
Trick or treat? A fake "help desk" caller asking you to open a remote session is all a trick. Cisco Talos says they got in with just names and emails. Hang up, call IT back on a known number.
#CoreRecon #Halloween #Vishing #CyberSecurity
ALT Trick or treat? A fake "help desk" caller asking you to open a remote session is all a trick. Cisco Talos says they got in with just names and emails. Hang up, call IT back on a known number. #CoreRecon #Halloween #Vishing #CyberSecurity
13
Your employees can now get hacked without clicking anything.
Researchers at iVerify found a World Cup–themed Instagram ad that delivered DarkSword spyware to an iPhone. The employee, who works at a financial institution, was just scrolling the feed. The code ran as soon as the ad loaded. It checked the iOS version, used a matching exploit, stole login credentials, and searched for crypto wallets.
This one wasn't a phishing email or a bad download. It was a social media feed on a phone your team carries into every meeting.
What to do now:
🔹 Update iOS right away on every company and BYOD device
🔹 Turn on Lockdown Mode for executives and finance staff
🔹 Put mobile devices under MDM and threat monitoring
🔹 Watch for unusual logins after a device is compromised
Antivirus and firewalls don't watch the phone in your CFO's pocket. CoreRecon's 24/7 Security Operations Center does. Our analysts look for the credential misuse that comes after an attack like this and step in before it turns into a breach.
Is mobile part of your cybersecurity plan, or a blind spot?
Secure Your Tomorrow with CoreRecon today.
#CyberSecurity #MobileSecurity #Spyware #Malvertising #iPhone #SOC #CoreRecon #ThreatIntelligence #Texas #IncidentResponse #DigitalForensics #Ransomware #SOC #ManagedSecurityServices #CISO #BusinessContinuity #DataProtection #managedsecurity #NetworkSecurity #MSP #MSSP #CMMC #CyberThreats #Business
🤖 Made with AI
ALT Your employees can now get hacked without clicking anything. Researchers at iVerify found a World Cup–themed Instagram ad that delivered DarkSword spyware to an iPhone. The employee, who works at a financial institution, was just scrolling the feed. The code ran as soon as the ad loaded. It checked the iOS version, used a matching exploit, stole login credentials, and searched for crypto wallets. This one wasn't a phishing email or a bad download. It was a social media feed on a phone your team carries into every meeting. What to do now: 🔹 Update iOS right away on every company and BYOD device 🔹 Turn on Lockdown Mode for executives and finance staff 🔹 Put mobile devices under MDM and threat monitoring 🔹 Watch for unusual logins after a device is compromised Antivirus and firewalls don't watch the phone in your CFO's pocket. CoreRecon's 24/7 Security Operations Center does. Our analysts look for the credential misuse that comes after an attack like this and step in before
1
12
SafePay ransomware has hit ~600 victims, per CISA and the FBI. It gets in via stolen passwords and VPNs, then kills backups. Turn on MFA, patch your firewall, keep offline backups. CoreRecon has your six.
#Ransomware #CyberSecurity #InfoSec #CoreRecon
ALT SafePay ransomware has hit ~600 victims, per CISA and the FBI. It gets in via stolen passwords and VPNs, then kills backups. Turn on MFA, patch your firewall, keep offline backups. CoreRecon has your six. #Ransomware #CyberSecurity #InfoSec #CoreRecon
10
Cisco has patched a critical flaw in Expressway, rated CVSS 9.8, that could let a remote attacker run commands as root.
CVE-2026-76466 affects Expressway-C and Expressway-E when clustering is turned on. Versions X15.5.3 and earlier are vulnerable, and the fix is in X15.5.20. There is no workaround. Cisco has not seen anyone exploiting it yet, so now is the time to patch.
What CoreRecon recommends:
✅ List every Expressway instance you run and note its version
✅ Upgrade to X15.5.20 or later
✅ Lock down network access to Expressway services
Need help checking your exposure? CoreRecon's 24/7 SOC team can help.
#Cybersecurity #Cisco #CVE202676466 #VulnerabilityManagement #PatchNow #InfoSec #ThreatIntelligence #SOC #NetworkSecurity #CoreRecon
🚀 SOMETHING BIG IS COMING! 🦖
CoreRecon is gearing up to launch something NEW, …..code name: VELOCIRAPTOR! ⚡🔥
📅 Launch Date: December 31, 2026
The countdown is ON! Get ready to be amazed. 👀 The future in cybersecurity is about to get a whole lot more exciting!
#CoreRecon #Velociraptor #ComingSoon #BigThingsAhead #StayTuned #LaunchDay #SI #cybersecurity 🚀
12
Last week, French aerospace and defense supplier Egide partially shut down its Bollène plant after a cyberattack involving an external IT service provider. Egide builds sealed electronic packages used in radar, aircraft sensors and electronic warfare systems.
The lesson for every manufacturer and defense supplier: your IT provider's access is your attack surface.
What a 24/7 SOC brings to an incident like this:
• Around-the-clock monitoring of every vendor and remote-access session, not just business hours
• Alerts on unusual vendor logins, privilege changes and lateral movement within minutes
• An analyst who can isolate a machine or cut vendor access at 3am, before it spreads to production systems
• Incident response ready to contain, preserve evidence and keep operations running
CoreRecon runs 24/7 SOC operations from two Texas locations. Call us and a real engineer answers, no ticket queue. We also help defense suppliers get CMMC-ready.
Know what's happening on your network before anyone else does.
corerecon.com
#Cybersecurity #SOC #CMMC #DefenseIndustry #Manufacturing #CoreRecon
🤖 Made with AI
“We’re fine” is not a cybersecurity strategy. Neither is assuming your IT department has every threat covered.
CoreRecon reached out to CenterPoint Energy about taking a proactive approach through our SOC services and 24/7 cybersecurity monitoring. The response we received, in essence: "We’re fine and doing great without anyone else’s services."
Now, CenterPoint has confirmed that customer information was stolen through an external-facing system, with the investigation still ongoing, according to The Cool Down’s reporting. This is not an “I told you so” moment. It is a reminder that confidence should never replace independent validation.
CenterPoint Energy has officially confirmed a significant data breach, with reports indicating nearly 7.5 million records were exposed. This highlights the ongoing volatility in the utility sector and the necessity for rigorous data safeguarding protocols.
In my experience, too many organizations treat “our IT team has it covered” as the end of the cybersecurity conversation. It should be the beginning of a much more important one: Who is independently validating that confidence?
Independent cybersecurity oversight is not an insult to your IT department. It is reinforcement: another set of eyes, a different perspective, and dedicated attention to threats that could otherwise go unnoticed.
That is the role CoreRecon’s 24/7 SOC services are designed to support. Not to replace your people, but to provide independent overwatch and help strengthen detection and response.
No provider can guarantee a breach will never happen. But leadership should demand more than reassurance when customer data and business trust are on the line.
Trust your team. Validate your defenses. Make cybersecurity proactive.
@CenterPoint @AEPenergy @cpsenergy
#Cybersecurity #CoreRecon #SOC #RiskManagement #Leadership #centerpoint #centerpointenergy #cpsenergy #cps #aep #aepenergy #texas #sdvosb #vethub #IncidentResponse #DigitalForensics #Ransomware #ManagedSecurityServices #CISO #BusinessContinuity #DataProtection #managedsecurity #NetworkSecurity #MSP #MSSP #CMMC #CyberThreats #Business
1
1
77
