Malware hunting with Caribou and Ucatemi

(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.)

Three Buddy Problem - Episode 85: Top stories this week include drone incursions over El Paso and the murky line between cartel activity, anti-drone tech testing, and full-blown hybrid warfare; updates on the Notepad++ supply chain fallout; Microsoft’s zero-day treadmill and AI-enabled attack surfaces; and Apple’s “extremely sophisticated” iOS exploits.

Plus, Europe’s growing appetite for offensive cyber, Palo Alto and the uncomfortable politics of cyber attribution, Singapore on telco intrusions, and the economics of end-of-life infrastructure.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Links:

• Transcript (unedited, AI-generated)
• Thinkst Canary - Customer Love
• What We Know About the El Paso Airspace Shutdown
• El Paso Closure Caused by Firing Anti-Drone Laser
• Notepad++ supply chain hack (new IOCs)
• Ukatemi: Notepad++ attack related samples
• Notepad's new Markdown powers served with a side of RCE
• Microsoft: Windows Notepad App RCE Vulnerability
• iOS 26.3 security advisory (exploited 0day)
• Estonian Foreign Intelligence Service annual report
• PSIRT | FortiGuard Labs High-Risk Advisory
• Germany prepares to attack cyber enemies
• Palo Alto chose not to tie China to hacking campaign for fear of retaliation
• The Shadow Campaigns: Uncovering Global Espionage (Palo Alto)
• Singapore .gov on nation-state telco hacks
• TLP-BLACK
• LABScon 2026