🔥 NEW research published: We uncover #DKnife, a China-nexus gateway-monitoring framework that intercepts network traffic, monitors user activity, and delivers malware #Shadowpad & #DarkNimbus via routers and edge devices. blog.talosintelligence.com/knife-cuttin...

1/ Today we release a new report exposing previously undisclosed entities connected to the wider #Intellexa ecosystem as well as newly identified activity clusters in Iraq and indications of activity in Pakistan: www.recordedfuture.com/research/int...

So excited that I’m going to present my latest research at @districtcon.bsky.social in January! The last round of tickets are going on sale on this Sunday (Nov 16th @12pm EST). Looking forward to see you in DC!

New Iran drop from me tracking an attribution nightmare - UNK_SmudgedSerpent! A little Charming, a little Muddy, and a lot C5. Targeting policy experts with benign conversation starters, health-themed infra, OnlyOffice spoofs, and RMMs. Check out the full story www.proofpoint.com/us/blog/thre...

Gonna be in Belgium for the first time after living in Europe for 7 years. Come catch me if you are at @what-is-sos.bsky.social tomorrow!!!

Great work and thanks for referencing our research on redefining IAB! The four-tier classification framework is insightful for identifying collaborative campaigns!

Great investigation from Trend Micro with the contributions from Joey Chen! Threat actor are actively targeting the SNMP protocol on routers for exploitation. www.trendmicro.com/en_us/resear...

Quite a bit of CN APT activity in europe in the past week strikeready.com/blog/cn-apt-... As always, if you're interested in tuning your skills, download the samples here github.com/StrikeReady-...

There's was a mad dash on SOS tickets over the weekend. SOS is two weeks away, if you've been putting off getting a ticket... your time is now. stateofstatecraft.com/register

Another major surveillance provider exposed: First Wap Its product was used to track some very high-profile figures www.lighthousereports.com/investigatio...

👾 Had a great time at the DC4131 Padawan CTF with the Swiss @defcon.bsky.social community! Back to CTFs after a while teamed up with J & M and knocked out a few challenges. Go, pwnrpuffgirls girl power! 💪 Big thanks to the organizing team. Looking forward to the next one! #CTF

Caught a Pokémon at @defcon.bsky.social 😍 Big fan of @lauriewired.bsky.social. It was so interesting to discuss about reverse engineering with her. Please can we all have a card like this?

At @defcon.bsky.social today. Come find me!

Heading to Hacker Summer Camp next week? 🌵If you’re curious about the journeys behind the hacks, the challenges and the stories that shaped us, come join our panel: "Hacking the Status Quo”. With Valentina Palmiotti (Chompie), Natalie Silvanovich, and Vandana Verma. #BHUSA #blackhatusa

The SOS conference is officially THREE months away! On October 28, we gather to discuss the latest developments in nation-state operations with leading experts! ⏰ CFP Ends September 1st! 🐧 Early Bird Tickets almost sold out! 🕵️ Come talk espionage, sabotage, ORBATs, and more! stateofstatecraft.com

Excited to see another threat intel focused conference taking place in Europe, and it’s organized by threat analyst in the field! The CFP is opened until Sept 1st. Looking forward to see your amazing research! #What_is_SOS #StateOfStatecraft www.stateofstatecraft.com

Had a great time on the @malspace.bsky.social podcast with Julien talking about my PIVOTcon presentation from tracking compartmentalized attacks to thoughts on attribution. Fun convo (and I loved the theme song at the end!). 🎶 Thanks for having me! malspace.com/episodes/mul...

I'm excited to return to Black Hat USA this year and have the opportunity to give away one briefings pass to the conference. If you're a student or someone who could use a little support to attend, I'd love to hear from you. DM me if you're interested! #BHUSA

Looking forward to my week at @botconf.infosec.exchange.ap.brid.gy ! Please come say hi if you are around! #Botconf2025

Talks from the OffensiveCon 2025 security conference, which took place last week, are now available on YouTube www.youtube.com/playlist?lis...

📡 New blogs out: Compartmentalized attacks are no longer limited to financially motivated actors, state-sponsored groups are adopting them too. We propose a new taxonomy for initial access groups to reflect broader motivations and affiliations. (1/3)

@greg-l.bsky.social drops knowledge on TA406 (Konni) as North Korea shows new interest in Ukraine, likely to keep tabs on the progress of the war and Russia's ability to keep pace on the battlefield www.proofpoint.com/us/blog/thre...

Had an amazing time speaking at @pivotcon.bsky.social last week! Grateful for the chance to share insights and connect with the brilliant minds. PIVOTcon remains my favorite threat intel event in Europe. Huge thanks to the organizers for creating this community and the memorable experience.

A lot of you have been asking, YES! HITCON 2025 CFP is open! The conference will be host on August 15 - August 16. Submit your talk before June 8th. Looking forward to your submissions! #HITCON #HITCON2025 CFP: cfp2025.hitcon.org/en/

Come work with us! We are looking for a creative and self-motivated communications professional to join our team this summer in the role of Digital Communications Specialist. This is a FT, hybrid position based at @uoft.bsky.social in downtown Toronto. Learn more: citizenlab.ca/2025/05/job-...

BREAKING: jury awards massive $167 million in punitive damages against spyware company NSO Group. Precedent-setting win against notorious #Pegasus spyware maker. Very consequential for victims to see this. Congratulations to #WhatsApp on sticking this case through since 2019. Some thoughts 1/

We just published our investigation into a Cactus ransomware campaign, uncovering TOYMAKER, an IAB group using a custom backdoor LAGTOY. It’s still challenging to identify compartmentalized attacks. We’ll share our approach and solutions at @pivotcon.bsky.social in 2 weeks! #toymaker

New blog from TeamT5 warns a China-nexus APT is exploiting a vulnerability in #Ivanti Connect Secure VPN appliances to target victims in EMEA and the US. Today Shadowserver's CVE-2025-22457 tracker shows 4,098 unpatched instances remain, mostly in Asia and the US. pse.is/7esf4n

Wrapped up 2 panels at Black Hat Asia 🥳 ! Had such a great time meeting everyone. Thank you to all who stopped by the Community Lounge! I truly enjoyed the discussions and hope our answers were helpful. See you next year! #BHASIA

Lego of Black Hat Operations Center 😍😍 Love the Bricks & Picks zone at Black Hat Asia this year! #BHASIA

After nearly 9 years on the Black Hat Asia review board (ufff time flies!), I’m honored to take on more responsibility and join the Black Hat USA review board this year. The CFP closes in 2 days—get your brilliant research in! #BlackHat #BHUSA 💻Submit CFP: usa-briefings-cfp.blackhat.com

Come join us at the Ask A Security Expert session at Black Hat Asia on April 4th! I'll be there with Orange Tsai, Ryan Flores, and Dr. Marina Krotofil answering your cybersecurity questions. Submit your topics in advance using the form on the event page. Looking forward to seeing you there!

Introducing: abuse.ch Hunting Platform abuse.ch/blog/introdu...

I had an amazing time at the Devcore conference last weekend! It was an honor to share my thoughts on exploit hunting there. Super impressed by the quality of talks and really enjoyed meeting so many great people. Huge thanks to the Devcore team for the wonderful experience!

It looks like Microsoft has been quietly updating its 2023 new APT naming table with new entries The table used to have 20-30 entries... it's now gigantic! Bookmark it: learn.microsoft.com/en-gb/unifie...

Love the swags from @devco.re.web.brid.gy conference 2025 😍

Here we go!!

✈️  Heading to Taiwan this week for @devco.re.web.brid.gy Conference 2025! I’ll give an intro on exploit hunting and its challenges. Excited to speak in Taiwan again and looking forward to the great talks and meeting everyone there! conf.devco.re/2025/agenda/

Honored and excited to be speaking at @pivotcon.bsky.social again this year! 🎉 Huge shoutout to the co-authors @_vventura, @b4n1shed.bsky.social and @asheermalhotra —couldn’t have done this research without you! Looking forward to seeing everyone in Málaga. This year I must join the Karaoke!😆

📣 @talosintelligence.com investigated #SaltTyphoon and discovered a custom-built tool called JumbledPath, used for packet capturing. While no new exploits were observed, their tactics remain a significant threat to targeted organizations. blog.talosintelligence.com/salt-typhoon...

I have the honor of giving away two passes to the Black Hat Asia 2025 conference! Priority goes to students and anyone who needs support to attend. Please DM me if interested. #BHASIA

Had a 0day at the hacker bar in Taipei today. This is where you meet real hackers in the wild in Taiwan 😂

Had a good time attending #ThreatAnalystSummit organised by TeamT5 today. Good to be back and see some old and new faces!! I enjoyed the talks and discussions during the conference. Thanks for having me!

Natto Thoughts is honored to have guest contributor Eugenio Benincasa discussing China’s pubic opinion analysis systems and how Bluesky should outsmart them. @euben.bsky.social nattothoughts.substack.com/p/bluesky-sh...

New research from @jspchc and @thehellu.bsky.social uncovers a campaign leveraging the Moonshine framework to deliver Chrome Nday exploits targeting Android devices. Thanks for giving the credit to my research!

bughunters.google.com/blog/6355265... This is my favorite ethical hacking exercise that a company can run – the "Leaving Tradition" at Google. This spawned so many amazing hacking stories over the years and let to mitigating so many complex exploitation paths!

To all folks moving to Bsky - It'd be very helpful if you follow https://bsky.app/profile/ap.brid.gy. This automatically enable folks in Mastodon to follow you back automatically via a Bridged Account! If you however, decided, to stay on Mastodon, you can follow @bsky.brid.gy - This will do […]

In the absolutely hands-down worst meeting I've ever been in (thanks, Elon) I had to explain repeatedly that the security engineers didn't check in much code because they were: a) doing their jobs of helping everyone else do their job without getting us hacked b) yes security engineers are technical

Pretty bad at managing my socials. But hello world Bluesky!