Austin Larsen
@austinlarsen.me
📤 1152
📥 314
📝 19
Principal Threat Analyst - Google Threat Intelligence Group
pinned post!
🚨 New: Zero-day vulnerability
#CVE-2025-0282
in Ivanti Connect Secure VPN is being actively exploited, including by suspected China-nexus cyber espionage groups. Our team at Mandiant in partnership with Ivanti just published our initial findings. 🧵
cloud.google.com/blog/topics/...
loading . . .
Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation | Google Cloud Blog
Zero-day exploitation of Ivanti Connect Secure VPN vulnerabilities since as far back as December 2024.
https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day
10 months ago
1
9
1
reposted by
Austin Larsen
2 months ago
Join
@austinlarsen.me
and me next Tuesday for a deep-dive into PRC-nexus threat actor capabilities! Learn about advanced social engineering tactics, novel malware delivery, and strategies to defend your organization.
www.brighttalk.com/webcast/7451...
0
1
1
reposted by
Austin Larsen
Catalin Cimpanu
2 months ago
A story in two acts
3
19
3
reposted by
Austin Larsen
John Hultquist
2 months ago
Major Update: We now believe this incident impacts other Salesloft Drift integrations, not just Salesforce. We’re advising Salesloft Drift customers to treat any and all authentication tokens stored in or connected to the Drift platform as potentially compromised.
add a skeleton here at some point
0
15
11
reposted by
Austin Larsen
Catalin Cimpanu
2 months ago
A threat actor (UNC6395) is accessing Salesforce accounts and data through the Salesloft Drift AI chat agent
cloud.google.com/blog/topics/...
loading . . .
Widespread Data Theft Targets Salesforce Instances via Salesloft Drift | Google Cloud Blog
A widespread data theft campaign targeting Salesforce instances via the Salesloft Drift third-party application.
https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift/
1
15
12
reposted by
Austin Larsen
John Hultquist
2 months ago
An actor we are tracking as UNC6395 is targeting Salesforce customer instances through compromised OAuth tokens associated with the Salesloft Drift third-party application. This is ongoing and widespread.
cloud.google.com/blog/topics/...
loading . . .
Widespread Data Theft Targets Salesforce Instances via Salesloft Drift | Google Cloud Blog
A widespread data theft campaign targeting Salesforce instances via the Salesloft Drift third-party application.
https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift?e=48754805
2
17
6
reposted by
Austin Larsen
Catalin Cimpanu
3 months ago
APT folks... is UNC3886 becoming a top-tier actor?
www.trendmicro.com/en_us/resear...
www.sygnia.co/blog/fire-an...
supportportal.juniper.net/s/article/20...
cloud.google.com/blog/topics/...
2
15
3
New
@mandiant.com
research: UNC6032 (Vietnam-nexus actor 🇻🇳) is exploiting interest in AI tools, using fake AI video generator sites & malicious ads to spread malware. The campaign, active since mid-2024, aims to steal credentials, cookies & financial data.
5 months ago
1
7
0
reposted by
Austin Larsen
6 months ago
🚨 Heads up! 🚨 APT41 is using Google Calendar 🗓️ as their latest C2 trick. GTIG just pulled back the curtain 🎭 on the TOUGHPROGRESS malware campaign and how we shut it down 💪. Dive into the details here: 🚀https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics
1
8
7
reposted by
Austin Larsen
Eric Geller
7 months ago
Confirming that CISA has stopped using VirusTotal and Censys. "Makes their jobs a lot harder," a person familiar with the matter told me, adding, "There's a possibility that more services might be limited or cut due to budget."
add a skeleton here at some point
3
52
27
reposted by
Austin Larsen
gab 🇺🇦🇵🇸
7 months ago
Excellent breakdown of the “Rogue RDP” TTP we’ve seen susp Russian APT UNC5837 using in their campaigns written by my colleague Rohit (@IzySec over on X)
loading . . .
Windows Remote Desktop Protocol: Remote to Rogue | Google Cloud Blog
A novel phishing campaign by Russia-nexus espionage actors targeting European government and military organizations.
https://cloud.google.com/blog/topics/threat-intelligence/windows-rogue-remote-desktop-protocol/
0
16
8
reposted by
Austin Larsen
Shane Harris
8 months ago
In 25 years of covering national security, I’ve never seen a story like this: Senior Trump officials discussed planning for the U.S. attack on Yemen in a Signal group--and inadvertently added the editor-in-chief of The Atlantic.
www.theatlantic.com/politics/arc...
loading . . .
The Trump Administration Accidentally Texted Me Its War Plans
U.S. national-security leaders included me in a group chat about upcoming military strikes in Yemen. I didn’t think it could be real. Then the bombs started falling.
https://www.theatlantic.com/politics/archive/2025/03/trump-administration-accidentally-texted-me-its-war-plans/682151/?gift=kPTlqn0J1iP9IBZcsdI5IVJpB2t9BYyxpzU4sooa69M&utm_source=copy-link&utm_medium=social&utm_campaign=share
790
16696
9135
🚨 Following a months-long investigation stemming back to mid-2024, Mandiant just published details on a campaign by China-nexus actor UNC3886 targeting Juniper routers. Our investigation uncovered a custom malware ecosystem on end-of-life Juniper MX devices.
cloud.google.com/blog/topics/...
loading . . .
Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers | Google Cloud Blog
We discovered China-nexus threat actors deployed custom backdoors on Juniper Networks’ Junos OS routers.
https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers
8 months ago
0
5
1
reposted by
Austin Larsen
Kristine ❌👑
8 months ago
Hundreds protested at the national labs today in Boulder, Colorado.
#SaveOurServices
#resist
#NOAA
#NIST
#NCAR
#ScienceSavesLives
loading . . .
12
837
231
reposted by
Austin Larsen
Tom Nichols
8 months ago
Today was a grim, terrible day for the United States and the cause of democracy. Putin, along with other dictators around the world, can finally look at Trump with confidence and think: one of us.
www.theatlantic.com/ideas/archiv...
loading . . .
It Was an Ambush
Today marked one of the grimmest days in the history of American diplomacy.
https://www.theatlantic.com/ideas/archive/2025/02/ukraine-us-relations-trump/681880/?gift=otEsSHbRYKNfFYMngVFweGv4UX7UfPGsjCiyiwxP-8I&utm_source=copy-link&utm_medium=social&utm_campaign=share
282
5320
1577
reposted by
Austin Larsen
Matt Kapko
8 months ago
A 21-year-old U.S. Army soldier linked to last year's Snowflake attack spree allegedly tried to sell stolen data to a foreign intelligence service after searching for information about how to defect to Russia. Hat tip to
@nixonnixoff.bsky.social
@austinlarsen.me
cyberscoop.com/army-soldier...
loading . . .
Army soldier linked to Snowflake attack spree allegedly tried to sell data to foreign spies
Federal prosecutors accuse Cameron Wagenius of searching how to defect to Russia days after he tried to sell stolen data to a foreign intelligence service.
https://cyberscoop.com/army-soldier-alleged-cybercriminal-foreign-spies/
2
27
12
reposted by
Austin Larsen
Allison Nixon
9 months ago
The no-opsec Army guy who was part of the group that leaked Trump's call logs (and worse, threatened me) google searched how to defect to Russia and "can hacking be treason" 💀💀💀💀 He was never going to get away.
8
142
38
reposted by
Austin Larsen
Richard Branson
9 months ago
For the US to side with Russia and North Korea to oppose a UN resolution condemning the illegal invasion of Ukraine defies all common sense and adds insult to the countless injuries suffered by the brave Ukrainian people.
edition.cnn.com/2025/02/24/p...
loading . . .
US joins Russia to vote against UN resolution condemning Russia’s war against Ukraine | CNN Politics
The United States joined Russia to vote against a UN General Assembly resolution condemning Russia’s war against Ukraine Monday in a stunning shift from years of US policy.
https://edition.cnn.com/2025/02/24/politics/us-joins-russia-ukraine-un-vote
3636
62746
15583
reposted by
Austin Larsen
Dan Black
9 months ago
Today, Google Threat Intelligence is alerting the community to increasing efforts from several Russia state-aligned threat actors (GRU, FSB, etc.) to compromise Signal Messenger accounts.
cloud.google.com/blog/topics/...
loading . . .
Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger | Google Cloud Blog
Russia state-aligned threat actors target Signal Messenger accounts used by individuals of interest to Russia's intelligence services.
https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger
3
168
134
reposted by
Austin Larsen
Eric Geller
10 months ago
DHS has terminated the memberships of everyone on its advisory committees. This includes several cyber committees, like CISA's advisory panel and the Cyber Safety Review Board, which was investigating Salt Typhoon. That review is "dead," person familiar says.
www.documentcloud.org/documents/25...
54
1070
791
reposted by
Austin Larsen
Joseph Cox
10 months ago
A bug in Cloudflare (and just the nature of how CDNs work) let an attacker learn the broad location of Discord, Signal, Twitter users by just sending them an image, according to a security researcher. It works because check which data center cached the image
www.404media.co/cloudflare-i...
loading . . .
Cloudflare Issue Can Leak Chat App Users' Broad Location
A security researcher made a tool that let them quickly check which of Cloudflare's data centers had cached an image, which allowed them to figure out what city a Discord, Signal, or Twitter/X user mi...
https://www.404media.co/cloudflare-issue-can-leak-chat-app-users-broad-location/
98
2429
693
reposted by
Austin Larsen
Cynthia Brumfield
10 months ago
"FBI leaders have warned that they believe hackers who broke into AT&T Inc.’s system last year stole months of their agents’ call and text logs, setting off a race within the bureau to protect the identities of confidential informants."
www.bloomberg.com/news/article...
loading . . .
FBI Has Warned Agents It Believes Hackers Stole Their Call Logs
FBI leaders have warned that they believe hackers who broke into AT&T Inc.’s system last year stole months of their agents’ call and text logs, setting off a race within the bureau to protect the ...
https://www.bloomberg.com/news/articles/2025-01-16/fbi-has-warned-agents-it-believes-hackers-stole-their-call-logs
0
6
2
reposted by
Austin Larsen
John
10 months ago
🔥 new blog detailing 0day exploitation of Ivanti appliances as well as some newly observed malware families tracked as PHASEJAM and DRYHOOK. We also detail activity related to the previously observed SPAWN* malware ecosystem tied to China-nexus cluster UNC5337.
cloud.google.com/blog/topics/...
loading . . .
Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation | Google Cloud Blog
Zero-day exploitation of Ivanti Connect Secure VPN vulnerabilities since as far back as December 2024.
https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day
0
34
27
🚨 New: Zero-day vulnerability
#CVE-2025-0282
in Ivanti Connect Secure VPN is being actively exploited, including by suspected China-nexus cyber espionage groups. Our team at Mandiant in partnership with Ivanti just published our initial findings. 🧵
cloud.google.com/blog/topics/...
loading . . .
Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation | Google Cloud Blog
Zero-day exploitation of Ivanti Connect Secure VPN vulnerabilities since as far back as December 2024.
https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day
10 months ago
1
9
1
reposted by
Austin Larsen
Horkos
10 months ago
Probably the most comprehensive narrative to date about the Volt and Salt Typhoon campaigns.
loading . . .
How Chinese Hackers Graduated From Clumsy Corporate Thieves to Military Weapons
Massive “Typhoon” cyberattacks on U.S. infrastructure and telecoms sought to lay the groundwork for potential conflict with Beijing, as intruders gathered data and got in position to impede response a...
https://www.wsj.com/tech/cybersecurity/typhoon-china-hackers-military-weapons-97d4ef95?st=6T6MP9&reflink=article_copyURL_share
3
49
13
reposted by
Austin Larsen
Allison Nixon
10 months ago
>IQ levels when you are a cybercriminal that tries to extort the president, but you are government property and Krebs is calling your mom :(
1
80
16
reposted by
Austin Larsen
SwiftOnSecurity
11 months ago
Something completely underappreciated in how Google Chrome revolutionized the web and security and software in general — was the silent background auto-update + and non-admin user-level installs. It set a bar that changed everything on ability to make progress & address threats. Broke IT paradigms.
16
728
75
reposted by
Austin Larsen
Allison Nixon
11 months ago
Who wants to be next? (Waifu arrest footage released by WSJ)
www.wsj.com/tech/cyberse...
loading . . .
12
124
26
reposted by
Austin Larsen
Allison Nixon
12 months ago
Who wants to be next? (radio edition)
www.cbc.ca/listen/live-...
loading . . .
https://www.cbc.ca/listen/live-radio/1-104-the-morning-edition-k-w/clip/16112097-kitchener-man-arrested-international-hacking-scheme-affecting-millions
3
115
11
reposted by
Austin Larsen
John Scott-Railton
12 months ago
BREAKING:
#ExxonMobil
lobbyist investigated over hacking of American nonprofits. Hacked material fed PR campaigns & lawsuits against environmental advocacy orgs. Latest chapter in sprawling
#infosec
&
#cybersecurity
tale 1/ By
@raphae.li
&
@chrisbing.bsky.social
www.reuters.com/business/ene...
6
145
77
reposted by
Austin Larsen
Andy Greenberg
12 months ago
Russian spies—likely Russia's GRU intelligence agency—used a new trick to hack a victim in Washington, DC: They remotely infected another network in a building across the street, hijacked a laptop there, then breached the target organization via its Wifi.
www.wired.com/story/russia...
loading . . .
Russian Spies Jumped From One Network to Another Via Wi-Fi in an Unprecedented Hack
In a first, Russia's APT28 hacking group appears to have remotely breached the Wi-Fi of an espionage target by hijacking a laptop in another building across the street.
https://www.wired.com/story/russia-gru-apt28-wifi-daisy-chain-breach/
12
581
375
reposted by
Austin Larsen
Alexandra Posadzki
12 months ago
EXCLUSIVE: Connor Moucka, the Kitchener, Ont. man accused in the massive Snowflake customer hacking case, mused online about obtaining firearms and carrying out mass killings, authorities allege.
www.theglobeandmail.com/business/art...
loading . . .
Ontario man accused in Snowflake customer hacking case posted threats to carry out mass killings, authorities allege
Law enforcement in Canada and U.S. say Connor Moucka of Kitchener, Ont., is behind Discord posts about wanting to kill Black people and fire shots into crowds
https://www.theglobeandmail.com/business/article-ontario-man-in-alleged-snowflake-hacking-case-also-accused-of-posting/
0
4
5
I’ve been tracking this group including Joel since 2022, great to see this!
add a skeleton here at some point
12 months ago
0
2
1
reposted by
Austin Larsen
Lorenzo Franceschi-Bicchierai
12 months ago
NEW: The U.S. government has announced charges against five alleged hackers who targeted several companies stealing millions of dollars in crypto, and corporate data. DOJ says the hackers are part of the infamous Scattered Spider cybercrime group.
techcrunch.com/2024/11/20/u...
loading . . .
US charges five accused of multi-year hacking spree targeting tech and crypto giants | TechCrunch
The five alleged hackers are accused of stealing millions of dollars in crypto, and corporate data from several victims all over the world.
https://techcrunch.com/2024/11/20/us-charges-five-accused-of-multi-year-hacking-spree-targeting-tech-and-crypto-giants/
0
29
5
reposted by
Austin Larsen
dell cameron
12 months ago
WIRED has tracked thousands of US military & intel personnel coming & going from classified sites, incl. NSA hubs & nuclear vaults. We know where they sleep, what they eat, and which brothels they visit. It's an ocean of blackmail & national secrets within reach of every spy agency in the world.
loading . . .
Anyone Can Buy Data Tracking US Soldiers and Spies to Nuclear Vaults and Brothels in Germany
More than 3 billion phone coordinates collected by a US data broker expose the detailed movements of US military and intelligence workers in Germany—and the Pentagon is powerless to stop it.
https://www.wired.com/story/phone-data-us-soldiers-spies-nuclear-germany/
160
4215
1980
Last week a DOJ indictment was unsealed, charging Alexander ‘Connor’ Moucka AKA
#UNC5537
, and his co-conspirator, John Binns AKA
#UNC2978
, with 20 counts of conspiracy, computer fraud and abuse, wire fraud, and aggravated identity theft.
www.theregister.com/2024/11/12/s...
loading . . .
Here's what we know about the Snowflake data theft suspects
A Canadian and an American living in Turkey 'walk into' cloud storage environments…
https://www.theregister.com/2024/11/12/snowflake_hackers_indictment/
12 months ago
1
5
1
reposted by
Austin Larsen
TechCrunch
12 months ago
US confirms China-backed hackers breached telecom providers to steal wiretap data
loading . . .
US confirms China-backed hackers breached telecom providers to steal wiretap data
CISA and the FBI say they have uncovered a 'broad and significant' PRC-linked cyberespionage campaign © 2024 TechCrunch. All rights reserved. For personal use only.
https://tcrn.ch/3Z6V692
3
78
27
reposted by
Austin Larsen
Lorenzo Franceschi-Bicchierai
12 months ago
NEW: The U.S. government accused two hackers of stealing 50 billion customer records from AT&T, including call and text logs. The hackers, Connor Moucka and John Binns, were charged with a series of data breaches linked to cloud giant Snowflake.
techcrunch.com/2024/11/12/s...
loading . . .
Snowflake hackers identified and charged with stealing 50 billion AT&T records | TechCrunch
The U.S. Department of justice indicted two hackers for breaking into the systems of AT&T and several other companies.
https://techcrunch.com/2024/11/12/snowflake-hackers-identified-and-charged-with-stealing-50-billion-att-records/
0
19
4
reposted by
Austin Larsen
Joseph Cox
about 1 year ago
New from 404 Media: the hacker suspected to be behind the recent wave of Snowflake breaches has been arrested in Canada. The hacker went dark on Telegram last week, started to tell me their origin story. Canada confirmed it’s arrested Connor Moucka
www.404media.co/suspected-sn...
loading . . .
Suspected Snowflake Hacker Arrested in Canada
For more than a week Judische, the hacker linked to the AT&T, Ticketmaster and other breaches, has not been responding to messages. That's because he's been arrested.
https://www.404media.co/suspected-snowflake-hacker-arrested-in-canada/
2
40
17
reposted by
Austin Larsen
Joseph Cox
about 1 year ago
New from 404 Media: the walls are closing in on the Snowflake hacker. Mandiant has tracked the hacker for months, had servers shutdown in Ukraine, working with US authorities. I got leaked texts showing how a researcher works on extortions with the hacker
www.404media.co/the-walls-ar...
loading . . .
The Walls Are Closing in on the Snowflake Hacker
As security researchers circle around Judische, and authorities takedown his servers, how much longer will a hacker responsible for breaching Ticketmaster, AT&T, and many more companies remain free?
https://www.404media.co/the-walls-are-closing-in-on-the-snowflake-hacker/
0
17
5
reposted by
Austin Larsen
Lorenzo Franceschi-Bicchierai
about 1 year ago
NEW: This is the behind-the-scenes story of how the FBI and Google's Mandiant caught a "serial hacker" who tried to fake his own death to avoid paying child support. Jesse Kipf worked for years as a pro cybercriminal selling access to sites and systems he had hacked.
techcrunch.com/2024/10/01/h...
loading . . .
How the FBI and Mandiant caught a 'serial hacker' who tried to fake his own death | TechCrunch
Jesse Kipf was a prolific hacker who sold access to systems he hacked, had contacts with a notorious cybercrime gang, and tried to use his hacking skills to get off the grid for good.
https://techcrunch.com/2024/10/01/how-the-fbi-and-mandiant-caught-a-serial-hacker-who-tried-to-fake-his-own-death/
0
11
5
Our team at Mandiant just released details on 🇨🇳
#UNC5325
, who exploited CVE-2024-21893 and CVE-2024-21887 to deploy novel malware in an attempt to remain embedded in compromised Ivanti appliances even through factory resets, system upgrades, and patches.
www.mandiant.com/resources/bl...
loading . . .
Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts
Mandiant observed mass attempts to exploit Ivanti vulnerabilities by China-nexus threat actors.
https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence
over 1 year ago
0
3
1
Mandiant’s new blog post provides our latest assessment of North Korea’s 🇰🇵 cyber program and operations in 2023. The shifting DPRK cyber landscape is increasingly characterized by resource sharing and temporary collaboration.
www.mandiant.com/resources/bl...
about 2 years ago
0
2
2
reposted by
Austin Larsen
Allan “Ransomware Sommelier” Liska
about 2 years ago
My thoughts on the ridiculous note posted by the ALPHV / BlackCat ransomware group after the attack on MGM Casinos.
ransomwaresommelier.com/p/you-are-th...
0
7
2
reposted by
Austin Larsen
Dmitri Alperovitch
about 2 years ago
In the this episode of Geopolitics Decanted, I sat down with Bryan Vorndran, FBI Assistant Director of Cyber Division, to discuss why 702 is by far the most valuable intelligence program of US government. We talked about its successes and compliance issues
loading . . .
https://podcast.silverado.org/episodes/why-702-is-americas-most-valuable-intelligence-program-interview-with-the-fbi
1
5
3
Our team at Mandiant just released additional information on the #UNC4841 🇨🇳 espionage campaign that targeted Barracuda ESG appliances. The report includes newly identified malware families, IOCs and details on targeting and attribution.
www.mandiant.com/resources/bl...
loading . . .
Diving Deep into UNC4841 Operations Following Barracuda ESG Zero-Day Remediation (CVE-2023-2868)
UNC4841 has continued operations despite Barracuda ESG zero-day remediation efforts.
https://www.mandiant.com/resources/blog/unc4841-post-barracuda-zero-day-remediation
about 2 years ago
0
4
4
#Mandiant is releasing details on a targeted North Korean 🇰🇵 supply chain attack that leveraged JumpCloud. Our investigation at a downstream victim uncovered useful MacOS artifacts, OPSEC fumbles, and continued targeting of cryptocurrency verticals.
loading . . .
North Korea Leverages SaaS Provider in a Targeted Supply Chain Attack
We responded to a supply chain compromise by a likely DPRK-nexus threat actor, who we believe leveraged JumpCloud.
https://www.mandiant.com/resources/blog/north-korea-supply-chain
over 2 years ago
0
4
1
reposted by
Austin Larsen
Allan “Ransomware Sommelier” Liska
over 2 years ago
Chinese hackers target European embassies with HTML smuggling technique.
loading . . .
Chinese hackers target European embassies with HTML smuggling technique
The espionage effort, labeled SmugX by cybersecurity researchers at Check Point, has similarities to previous campaigns linked to China. HTML smuggling helped the malware avoid detection.
https://therecord.media/html-smuggling-china-espionage-europe
0
3
1
reposted by
Austin Larsen
gab 🇺🇦🇵🇸
over 2 years ago
huge reporting from some unreal mandiant analysts yesterday that has already garnered official denials 🫠
https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
loading . . .
Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868) Exploited Globally by Aggressive and Skilled Ac...
Mandiant is investigating a Barracuda ESG appliance zero-day vulnerability being exploited in the wild.
https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
0
5
2
Load more
feeds!
log in