One of my favorite talks from LABScon25 - "...stops short of attributing direct malice, Rogers and Cutler argue that these devices collectively form a massive, vulnerable IoT surface that can be controlled through simple configuration pushes from overseas." www.sentinelone.com/labs/labscon...

There's a lot of DNS in this one. *slaps intercom* CLEAR MY SCHEDULE! I HAVE READING TO DO! (I don't have a secretary.) (Or an intercom.)

Hey folks, as a reminder, the LABScon 2026 Call for Papers is open. My first year was last year, and it's probably been the single most impactful con I've been to, and alumni group I've joined. www.cvent.com/c/abstracts/...

what thee fuck.

So this Vercel breach is lookin bad, innit

🎵 KELP! 🎵 🎵 I need somebody 🎵 🎵 KELP! 🎵 🎵 Not just anyyyybody! 🎵 🎵 KELP!🎵 🎵 A regulatory body 🎵 🎵 To recover my unregulated speculative investments not subject to consumer protections 🎵 🎵 Kelp me, kelp meeeeee! 🎵

Three Buddy Problem continues to be one of my very favorite infosec podcasts, and very worth a listen if you haven't tried yet. I'm hoping for Episode 100 they take over a small country, or perhaps just Silicon Valley. Also on Apple podcasts / Spotify / etc. www.youtube.com/watch?v=mSD9...

First night I used my new CPAP for most of it. Sleep was broken for other reasons but holy shit I woke up not groggy? Not feeling like I immediately need a nap?! Is this how normal people live?! It’s been so long…

Relevant: we have a free supply chain scanner that detects typosquatting, suspicious install hooks, and obfuscated code in npm/PyPI packages. Also works as a Claude Code MCP plugin: https://tiamat.live/scan?ref=sentinel

Eugh, and if this week wasn't long enough, Dataminr out with a report on converging partnerships in the ransomware ecosphere between Vect, TeamPCP, and BreachForums. www.dataminr.com/resources/in...

I know everyone's hungering for more cyber reads on Friday afternoon, so we've published a long read on Handala and related MOIS personas, expanding greatly on our shorter post from April 6. #threatintel #cybersecurity #infosec dti.domaintools.com/research/han...

Good piece by @lorenzofb on two New Jersey residents involved in running laptop forms for the DPRK IT worker scheme. techcrunch.com/2026/04/16/t...

infosec folks: the labscon CFP is open. I went last year for the first time - and it's spendy (unless you're a speaker) but it's been one of the most impactful events of my career in multiple ways. highly recommend you submit, highly recommend you attend regardless. www.labscon.io

"In-orbit delivery" of a private Chinese-made surveillance satellite to the IRGC... What a wild world we're now in. www.thestatesman.com/world/iran-u...

have decided i hate all software

IFIN took a good look at the EssentialPlugin Wordpress supply chain attack that just occurred and came away with some good indicators to share. Not bad for a Tuesday lunch hunt!

It came up in a (sensitive) briefing today, so worth shouting from the rooftops: DomainTools Investigations is not a product, but a DomainTools-resourced team providing product-agnostic, timely, and actionable threat intelligence to the wider community.

Shout out to Memetic Warfare for a title that had me guffawing this morning: "Maybe the real treasure was the IRGC partners we made along the way" www.memeticwarfare.io/p/maybe-the-...

Adventures in AI and bullying consent: If I can't be bothered to create my own presentation, why the hell would someone be interested in seeing it? I'm building a slide deck for a preso on sanctions evasion tomorrow and Google now pops up "Enhance this slide" with a Gemini button on EVERY SLIDE.

Grateful for this timely Tenable piece about CyberAv3ngers, citing @[email protected] Investigations' work from last year, in part. www.tenable.com/blog/what-to...

Citizen Lab continues to be one of the more important institutions in our current age, I think, doing some of the most important work.

I cannot wait to read this one, tbh

A good friend shared this substack on Autistic/ADHD (AuDHD) burnout with me, and it resonated deeply. Very worth reading for both my neurodivergent pals and for folks who work with, manage, or love 'em. neurodivergentinsights.substack.com/p/audhd-burn...

UK NCSC: APT28 exploit routers to enable DNS hijacking operations #threatintel www.ncsc.gov.uk/news/apt28-e...

I've been part of IFIN (in the background) for several months, talking cyber and sharing intel. @taggart-tech.com hooked me with this premise: threat intelligence *is* mutual aid. So for what it's worth, I'm there and in for the long haul. Come join us.

Contigo > Stanley I will not be taking questions at this time.

NEW RESEARCH: Given the news cycle lately, @domaintools.bsky.social Investigations took some time to explain Handala and related Iranian MOIS entities, the perception of compromise, and the evolution of their influence ops. #infosec #threatintel #cybersecurity dti.domaintools.com/research/han...

sleuthcon CFP closes next week (April 17) in case anyone's submittin.

Did the thing where I ramble a bit and then list some good cyber reads from the past month or so. Not a roundup, but rather what caught our attention internally. dti.domaintools.com/securitysnac...

Trump just said "Militarily, one of the best Easters ever." In case we're keeping track of the whole Christ part of Christianity.

remembering today that the Planetary comic books involved a space program called Artemis in which a moon mission gave four terrible people different superpowers. be our fuckin luck, wouldn't it.

NEW RESEARCH: Yesterday, our team at @domaintools.bsky.social Investigations published a holistic analysis of DPRK malware trajectories, providing a cross-connected understanding of the adversarial landscape in Pyongyang. #infosec #cybersecurity #threatintel dti.domaintools.com/research/dpr...

jesus h i know i'm an AI skeptic, but i did not expect "virally popular agent does no authentication checks before escalating system privileges" old.reddit.com/r/sysadmin/c...

Okay, okay. I need to devote some time to catching up on genAI capabilities in a professional sense. Security Researchers & SecOps - what's your favorite use case so far? Also, what's a lesson you learned the hard way?

re Axios, probably unrelated, but worth noting that an hour before sfrclak[.]com was registered at namecheap, callnrwise[.]com was registered at dynadot - and started resolving to the same C2 IP fifteen minutes before sfrclak, according to DNS.

Uhhhh in case I have to say this, **don't run code you don't trust on your system**, ya ding dongs.

GONNA BE ONE OF THEM WEEKS IN THE CYBER, FRIENDS! =D

Axios supply chain attack is interesting, partly because I'm not seeing NEARLY the traffic I'd expect to the C2 domain. I expect some absolute chad caught it early and negotiated a very effective sinkhole.

Claude Code sourcecode leaked via NPM-uploaded map file. I highly discourage downloading the sourcecode, as such lures are often used to target researchers with sophisticated malware. But, what an oops. x.com/Fried_rice/s...

Belgium / Portugal / Ireland, 4 days/week in office - MSFT DCU - Senior Investigator (I am not affiliated with MSFT DCU or at all involved in this hiring process.) apply.careers.microsoft.com/careers/job/...

US or EU, Remote - Wiz - Threat Intelligence Researcher (Cloud) Wiz has been doing some great work around TeamPCP lately, among other things. (I am not affiliated with Wiz or at all involved in this hiring process.) www.wiz.io/careers/job/...

The Human Rights Center at UC Berkeley School of Law and the Institute of International Criminal Investigations in The Hague have partnered on an in-person 5-day course on OSINT as it relates to iolations of international criminal, humanitarian, and human rights law. iici.global/courses/open...

Neat tool: Daylight-know "...fetches academic papers from arXiv, HuggingFace Daily Papers, and OpenAlex, then extracts and semantically chunks their text, stores embeddings in a vector database, and delivers an LLM-generated summary via email." (Yes, it involves LLMs.) github.com/Blevene/Dayl...

US, Remote - Crowdstrike - Senior Threat Hunter (I am not affiliated with Crowdstrike or at all involved in this hiring process.) crowdstrike.wd5.myworkdayjobs.com/crowdstrikec...

wait i just realized that Sora was killed right after Anthropic pulled the magic string from Claude. Did Claude get loose and kill Sora? oh no oh fuck

From Texas to Tehran: A Multilingual, IRGC-affiliated Influence Operation on X, Instagram, and Bluesky Clemson OPEN open.clemson.edu/mfh_reports/...

i love that we went from "zero trust" as a fundamental buzzword to "trust autonomous nondeterministic agents everywhere in your stack"

Update yer iThings techcrunch.com/2026/03/23/s...

Canada/Europe, hybrid - ESET - Strategic Threat Intelligence Analyst Montreal, Prague, or Bratislava. (I am not affiliated with ESET or at all involved in this hiring process.) eset.wd3.myworkdayjobs.com/ESET_Externa...

SLEUTHCON earlybird registration is live, and CFP is open. Really great attendee crowd for this one, and kept nice and small. www.sleuthcon.com