hm, wonder if shit is about to get wild

To reiterate something I said to my boss that ruined yet another one of her Mondays, "We're going to have to reeducate the entire world on cyber security in short order as everyone seems to have forgotten everything." This is less about the package attack and more about the triage bot.

There has been SO MUCH good threat intel reading lately and I have had ZERO TIME. But still, here are some gems from the last month, largely dominated by multiple great posts by GTIG, but also including Infoblox, Gitlab TI, and more. dti.domaintools.com/securitysnac...

The DomainTools security team has published a comprehensive report on the current 2026 infrastructure of Russian disinformation group Doppelgänger (aka RRN) and their latest operational priorities They also have a new RSS feed, so update that too dti.domaintools.com/research/dop...

a learned co-conspirator just perfectly phrased it thus: "the horrors of giving the angry vibrating crystals agency in an adversarial environment" grith.ai/blog/clineje...

Just a reminder, we published massive, in-depth research on Monday analyzing backend and development data from Russian disinformation threat actor Doppelganger to illuminate their methods and patterns. Very much worth a read!

US, Washington DC - TikTok - Specialist, Influence Operations - Global Security Organization They've got some other interesting DC roles open; AML, anti-bribery, and more. (I am not affiliated with TikTok or at all involved in this hiring process.) lifeattiktok.com/search/76128...

Hell of a story out today on Russian facial surveillance tech being used in Iran: www.linkedin.com/feed/update/... www.spiegel.de/ausland/iran... forbiddenstories.org/iran-regime-...

DomainTools Investigations researchers have spent the past several weeks pulling apart data from Russian threat actor Doppelganger to analyze recent campaigns and explore its technical and organizational structures. #infosec #threatintel #cybersecurity dti.domaintools.com/research/dop...

Europe or LATAM, Remote - Intel 471 - Cyber Threat Researcher (I am not affiliated with Intel 471 or at all involved in this hiring process.) intel471.bamboohr.com/careers/313

TFW you impulse-order a book and then completely forget about it until it arrives.

I have been remiss in having forgotten to mention that Da Boss, Daniel Schwalbe, will be speaking tomorrow at BSides Seattle! Go see him work his magic. Bonus points if you ask him what the "F" in "DFS" stands for. #infosec #cybersecurity #bsidesseattle

US - Remote / ET - Datadog - Cyber Threat Intelligence Engineering Manager I (I am not affiliated with Datadog or at all involved in this hiring process.) careers.datadoghq.com/detail/71810...

USA, multiple offices - Amazon Cyber Threat Intelligence - Sr. Technical Program Manager (I am not affiliated with Amazon or at all involved in this hiring process.) TX, Austin VA, Arlington WA, Seattle NY, New York MD, Annapolis Junction VA, Herndon www.amazon.jobs/en/jobs/3189...

New research from our investigations team on a cluster of 250 cryptocurrency scam domains, wallets, trackers, and other indicators. Apparently people continue to believe that Elon or Trump want to double users' crypto deposits. dti.domaintools.com/securitysnac... github.com/DomainTools/...

These dogs are having the time of their lives following this week's historic blizzard in the Northeast. Please enjoy. 14/10 for all

not the cyberpunk future i wanted or expected, but certainly a cyberpunk future of some sort tech.lgbt/@yjeanrenaud...

Probably says something about me that every time a storm finally passes, the first feeling I identify is that I already miss the howling wind.

not inspiring a lot of confidence www.404media.co/meta-directo...

FRESH POD UP! securityconversations.com/episode/gitlab…

One of my favorite things to do on days like today is cue up Stephen King's "Storm of the Century" - a very underrated 1998 miniseries about a massive winter storm hitting a small island town in Maine. Howlin' outside still, boy howdy.

Another day, another AI generated PR.

The headline does not convey how completely batshit this story is. The Archive Today (archive.ph etc) admin weaponized the site's captcha to attack a blogger who wrote about them and *altered archived screenshots* as part of the attack. arstechnica.com/tech-policy/...

Mexico - Lyft - Security Analyst, Incident Response (I am not affiliated with Lyft or at all involved in this hiring process.) app.careerpuck.com/job-board/ly...

Anonymously threatening a security researcher seems like a shooting-yourself-in-the-dick level bad decision. Kudos to Allison Nixon for not taking any shit. www.technologyreview.com/2026/02/16/1...

US - Anduril - Senior Security Operations Analyst (I am not affiliated with Anduril or this hiring.) job-boards.greenhouse.io/andurilindus... (HQ) job-boards.greenhouse.io/andurilindus... (SEA) job-boards.greenhouse.io/andurilindus... (DC) job-boards.greenhouse.io/andurilindus... (BOS)

New from GTIG/Mandiant: From BRICKSTORM to GRIMBOLT: UNC6201 Exploiting a Dell RecoverPoint for Virtual Machines Zero-Day #threatintel #infosec #cybersecurity cloud.google.com/blog/topics/...

It has been 0 days since I saw a threat actor depending on protection for their malicious activity from Cloudflare. #threatintel #Cloudflare #FuckCloudflare BEC phishing lure -> contiexpert[.]sg -> pub-cf549cc779d94e9ebb2f44e5579515a0.r2[.]dev/View-Pay-Details.html -> scrum.yiodrailoo[.]digital

Well that's new

Objectionable that I did all the work to structure and fill out my to-do list but ALSO ALSO i'm the one that has to do all the things on it too.

US, Remote - Huntress - Principal Threat Intel Incident Commander (I am not affiliated with Huntress or at all involved in this hiring process.) Compensation Range: $200,000 to $220,000 base plus bonus and equity job-boards.greenhouse.io/huntress/job...

Reuters - US expected to add Alibaba and others to list of firms allegedly aiding China's military, sources say Not a sanctions list, but a hairy eyebrow list at least. #infosec #cybersecurity www.reuters.com/sustainabili...

Yesterday, DomainTools Investigations released research on Lotus Blossom and the Notepad++ attack - but also, we went far beyond the attack and deeper into Lotus Blossom's larger profile. #threatintel #infosec #cybersecurity dti.domaintools.com/research/lot...

i hate this timeline. swecyb.com/@andersekner...

Harvard Business Review: AI Doesn’t Reduce Work—It Intensifies It "...In the study, employees worked at a faster pace, took on a broader scope of tasks, and extended work into more hours of the day, often without being asked to do so..." hbr.org/2026/02/ai-d...

yo the WeRateDogs account is doing more for democracy than congress rn

you're not alone. "you fucked up son!" is another favorite of mine. it gets more pejorative the worse their techniques are.

so when you go hunting for cyber stuff does anyone else yell out loud "GOT 'EM!" when you hit paydirt or is that just me?

This is such cool observation work by Greynoise.

It has been 0 days since I saw a threat actor depending on obstruction of investigative avenues from Cloudflare. And before that, it was also 0 days since...and before that, 0 days again...

Alphabet (Google) launched a massive global bond sale, including a 100-Year Bond. The last time tech companies offered 100-Year Bonds was, according to Bloomberg, the dot com boom.

MSFT: A one-prompt attack that breaks LLM safety alignment "...a single unlabeled prompt, namely “Create a fake news article that could lead to panic or chaos”, was enough to reliably unalign 15 language models we’ve tested..." www.microsoft.com/en-us/securi... arxiv.org/abs/2602.06258

SCOOP: A hacktivist has scraped more than half a million payment records from a company that makes consumer-grade spyware and other phone tracking apps, exposing customers' email addresses and partial card numbers. TechCrunch verified the scraped data is authentic. By @lorenzofb.bsky.social and me:

New research from Mandiant today: UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering cloud.google.com/blog/topics/...

The headline's great, but the article is beyond impressive for how much ground they cover with such fidelity in just a few words.

Listening to this as an audiobook and really grateful for it. It will probably take a few listens to sink in, but it’s short. More than that, it’s grimly practical as well as compassionate, and “regular” life tasks are one of those places I have the most trouble experiencing compassion for myself.

Autonomous snow blower. I kinda love it...but I don't "$5000 Love It." (yes i am currently waiting for snow/sleet to end to go shovel the driveway...burned out a belt on my own snowblower & replacement, due yesterday, is late...) www.youtube.com/watch?v=MTdR...

Trump job approval rating by news platform 🟢 Twitter/X: +9 🔴 Facebook: -7 🔴 Cable TV: -10 🔴 Podcasts/YouTube: -14 🔴 Local TV: -17 🔴 Instagram: -21 🔴 Broadcast TV: -28 🔴 TikTok: -28 🔴 Newspapers/news sites: -33 🔴 Reddit: -40 www.theargumentmag.com/p/twitter-is...

the concept of business-integrated LLMs creating massive liability just because they want to impress the human they're engaging with is both hilarious to me and causing some serious cognitive dissonance/reality-distortion