Embed Notice

Colt appear to be outright lying in their latest cyber incident comms to customers. They’re saying the threat actor only post document titles to the dark web, however they neglect to mention they know the attacker C2 server, and they know what files were exfiltrated by the threat actor.

Their IR made a bunch of Opsec errors, including putting their IR reports into public sandboxes and submitting URLs of customer files to VirusTotal. I have receipts.