Drew Bollmann

The U.S. government today imposed economic sanctions on Funnull Technology Inc., a Philippines-based company that provides computer infrastructure for hundreds of thousands of websites involved in virtual currency investment scams known as “pig butchering.” In January 2025, KrebsOnSecurity detailed how Funnull was being used as a content delivery network that catered to cybercriminals seeking to route their traffic through U.S.-based cloud providers. “Americans lose billions of dollars annually to these cyber scams, with revenues generated from these crimes rising to record levels in 2024,” reads a statement from the U.S. Department of the Treasury, which sanctioned Funnull and its 40-year-old Chinese administrator Liu Lizhi. “Funnull has directly facilitated several of these schemes, resulting in over $200 million in U.S. victim-reported losses.” The Treasury Department said Funnull’s operations are linked to the majority of virtual currency investment scam websites reported to the FBI. The agency said Funnull directly facilitated pig butchering and other schemes that resulted in more than $200 million in financial losses by Americans. https://lnkd.in/g3AQhyVJ

4

Half of exposed React servers remain unpatched amid active exploitation Wiz says React2Shell attacks accelerating, ranging from cryptominers to state-linked crews

3

Quantum will change security audits forever. My mind was racing reading about this. This shift is bigger than most people realize. SOC 2 audits are the gold standard for proving you can protect customer data. But quantum computing is about to flip the script. Right now, SOC 2 compliance depends on encryption like RSA and ECC. These methods are strong against today’s threats. But quantum computers can break them fast. Shor’s algorithm can crack RSA and ECC in a fraction of the time. That means data encrypted today could be exposed tomorrow. Attackers know this. They are already collecting encrypted data now, planning to decrypt it later when quantum computers are ready. This is called “harvest now, decrypt later.” It’s a real risk. SOC 2’s core principles—confidentiality and security—are at stake. The industry is not standing still. Post-Quantum Cryptography (PQC) is the answer. NIST has picked new algorithms like CRYSTALS-Kyber and Dilithium. These are built to resist quantum attacks. SOC 2 audits will soon check if you are ready for this shift. Here’s what forward-thinking organizations are doing: ↳ Migrating to quantum-resistant encryption ↳ Updating key management and vendor risk processes ↳ Adding quantum threats to risk assessments ↳ Training teams on quantum security basics ↳ Reviewing contracts and third-party agreements for quantum readiness Early adopters will win. They will be ready for new compliance rules. They will earn more trust from clients. SOC 2 in the quantum era is not just about today’s threats. It’s about future-proofing your security for what’s next. The organizations that move now will lead tomorrow.

7

The "Computer Glitch" Defense is Dead. In a court of law, we often hear the same defense from software vendors after a major failure: "It was a sophisticated, unforeseeable attack," or "It was a coding error." As a Forensic Systems Consultant with 35 years in advanced engineering, I am here to state: That is often an admission of Architectural Negligence. When I investigate a failure—whether it’s a breach at a major retailer or a self-driving car accident—I don't look for bugs. I look for Duty of Care. 🔹 The Failure: A system allowed a single compromised admin account to rewrite critical infrastructure. 🔹 The Defense: "The hacker stole the password." 🔹 The Forensic Reality: Why did the architecture allow a single point of failure for a critical event? In advanced engineering, we use a Twin Captain Protocol. Two distinct keys must turn simultaneously. If the "Digital Twin" does not validate the context, the second key refuses to turn. If a vendor builds a safety-critical system without this logic, they haven't just built "buggy code." They have failed to foresee a known risk. I help legal teams distinguish between a "Glitch" and "Structural Negligence." #LegalTech #ExpertWitness #ProfessionalNegligence #ForensicArchitecture #DutyOfCare __________________________________________________________________________________ I am currently retaining capacity for new expert witness and forensic consulting instructions for Q1/Q2. DM me for a confidential discussion.

2

1 Comment