One of our biggest issues as a cybersecurity community and industry is that we inflicted dozens of partly overlapping cryptonyms on the world and just expect them to deal with it because we can't.

Still consistently the best cyber-related podcast out there

Considering that one of Israel's overt goals for the war is to destabilize the Iranian government, a nation-wide shutdown of public internet access plays well into Israel's hands. And it may not even stop further attacks.

Predatory Sparrow has dumped the Nobitex crytpo platform source code on Telegram They previously stole $90mil worth of assets in a hack yesterday t.me/gonjeshkdara...

My hot take is that it isn't a lack of strategy, Israel has many viable, ambitious strategies. It's a constant failure of political will, unity, and patience to enact a strategy.

Interesting! In my book, Offensive Cyber Operations, I talk a lot about the convergence of tactical offensive cyber and electronic warfare. The resources, approach and desired outcomes are deeply connected. The UK's move is in line with trends seen elsewhere. Will dive more into it all later.

The most interesting bit here is that the best Western gov cyber outfits overhauled their operational approach after the mid-10s to focus more on avoiding detection. The era of the "factory ops" was too risky with the rise of threat intel. Harder to reliably spot 2025's Regin, Careto, Flame, etc

"the technical team's analysis indicates that the attacker's methods and related technical proficiency were relatively low-level." Nothing in the article to explain what makes this "cyber warfare".

If you’ve been laid off from a cyber intel position, please reach out if you’d like to come to @sleuthcon.bsky.social.

NEW: Hundreds of victims are surfacing across the world from zero-day cyberattacks on SAP, in a campaign that one leading cyber expert is comparing to the vast Chinese government-linked Salt Typhoon and Volt Typhoon breaches. cyberscoop.com/sap-cyberatt...

Drama over at X/xAI. Whatever you ask Grok, it pivots to “white genocide” in South Africa. The last panel is what Grok claims was a “verbatim” system prompt that caused the behavior. Jury out. It’s now fixed but they haven’t yet bothered explaining. This, not those AGI fantastical scenarios.

New from 404 Media: the Signal clone the Trump administration uses was just hacked. TeleMessage makes a modified version of Signal that archives messages for government agencies, Waltz used it. A hacker got some users' messages, group chats. Hugely significant breach www.404media.co/the-signal-c...

The literal birth of my firstborn child was less anxiety inducing than a full week of driving and parking in Tel Aviv.

New tech class, new vulnerability class

THREAD: When @thekrebscycle.bsky.social and his workplace, @sentinelone.com, were singled out by Donald Trump on Wednesday, I thought it was an opportunity to weigh the cybersecurity industry's rhetoric against their real world actions.

Cybersecurity is built on trust, I can only imagine how CISA staff must be feeling.

👀 China reportedly acknowledged to outgoing Biden officials in December that it was responsible for the Volt Typhoon critical infrastructure intrusions, linking them to "increasing U.S. policy support for Taiwan." www.wsj.com/politics/nat...

I was there. It was meant literally. “JD Work — now on the US NSC — shocked some by warning that the US would take lethal action against malicious actors in commercial cyber operations. Participants who heard [it said] they were unsure if it was meant literally or figuratively”

The Swiss population doesn’t want to buy the F35 anymore, given everything that’s going on in Trump’s US. In 2020, a 50,1% majority had voted for the acquisition in a referendum. www.watson.ch/schweiz/wirt...

Why is the headline on all X outage stories about Musk blaming Ukraine for the DDoS? Why aren't media outlets putting the emphasis on the security lapse that allowed script kiddies (or whoever) to launch the attack against X as well as the lack of any evidence that the traffic came from Ukraine IPs?

DDoS attacks frequently use compromised or otherwise co-opted IP addresses. The global distribution helps avoid geofencing defenses. Public high-confidence attribution takes time and effort. So take any quickfire claims with healthy skepticism.

Great coverage by @kimzetter.bsky.social. In this ecosystem we need to be doubly suspicious of major claims even if published by reputable sources. Considering the denials it's hard to pin down the truth. That said if things continue we may still see a gradual derisking of Russia by the US.

That's genuinely lovely but if we are to establish soft power diplomatic momentum that isn't dependent on the US establishment maybe do it on a network that isn't Elon's X.

Madness

New from 404 Media: anyone can push updates to the Doge.gov site. Two sources independently found the issue, one made their own decision to deface the site. "THESE 'EXPERTS' LEFT THEIR DATABASE OPEN." www.404media.co/anyone-can-p...

I'm sorry but that's the most unhinged paragraph I ever read

Meeting my past self: 2025 Danny: "So yeah that's when DOGE Big Balls took over the gov database" 2015 Danny: "oh no" 2025 Danny: "don't worry we can still buy Melania coin" 2015 Danny: "please stop, what happened to you" 2025 Danny: "to all of us past Danny, to all of us"

crawl_depth=5

Yeah, I really don't need the Nazi-account-empowering, Nazi-party-supporting, Nazi-conspiracy-espousing, Nazi-salute-making guy to actually say "gosh I'm a Nazi"

This and also - we never signed up for social media as this grand attempt at societal discourse. We wanted to reach out with our ideas and content, find connections that we otherwise wouldn't, and consume content we find interesting. We don't owe troll engagement as a mandatory tax.

I like this and will add one bit - LLM outputs must be verified, always. Follow sources, double-check claims, scrutinize cited data. LLMs create an information bootstrap, but their fundamental limitations mean they may use their training data to fabricate or modify facts.

The Google reviews for the GCHQ Bude location are amazing

New Year. Newly renewed commitment to reading long form on topics. First up, Offensive #Cyber Operations by @moore.bsky.social

Stop this, media. Be better. He did this specifically to bait all of you to write the exact headlines you then handed him.

Telecoms are golden targets. Poorly defended, they give adversaries access to metadata, geolocation, content, ISP customers & infra, and billing personal info for millions of people, including sensitive targets. Of COURSE they're top on the list for many groups.

Cyber ops, criminal or state-backed, often take the path of least resistance. Good security controls & practices force adversaries to take riskier and costlier approaches, or seek other targets. That's good! Especially if you're an incidental target rather than high on someone's shitlist.

The United States is already one of the most globally aggressive, methodical, and pervasive threat actors in cyber.

I'm on board, I always hated that term. It's weirdly violent/graphic, does nothing to describe the type of scam, and portrays victims poorly.

It's okay to admit that many folks want centralized verification as a way to easily distinguish who they should take more seriously on a given topic, even if that is obviously not great. We're human, looking for heuristics to simplify an overloaded information environment is normal.

This is a story a lot of reporters have been chasing: Starting in 2015, a massive cyberespionage campaign targeted some of America's most prominent environmentalists. Now, we can reveal that the FBI has been probing whether a longtime Exxon lobbyist was involved. www.reuters.com/business/ene...

For every repo retraction, there's a hundred more. unstoppable without a lot of internal Bluesky resources dedicated to anti-scraping. I'm enjoying myself here and I hate to be this guy. But the frictionless borderline utopian vibe we have here is the product of a platform in its honeymoon period.

A big day: Virtual Routes launches! This is a major milestone for our team and mission. Really excited to see what lies ahead!

8 a day is still incredibly low, and I have no idea how they scale operations to meet global legal and regulatory requirements without drastically changing their revenue model.

One reason I'm cautiously excited that we reached critical mass here is that Bluesky finally has the same intersection of people I cared about on Twitter - natsec, infosec, academia, and journos.

I'm sorry that I'm not able to address "Elon Musk's critique of the F-35" at face value. Even writing that sentence causes physical pain.

The linked reports makes a few observations I agree with and a few conclusions I don't. importantly it calls out the limited visibility on PLA activity for "unclear reasons". Visibility is the gap here, which is why we should be very careful in assessing who is doing more vs who we see doing more.

I love GAO reports. While their methodology may be technically incomplete and they suffer from limited resourcing, what they *do* find is often shockingly honest. They do not shy away from making direct claims on failures and gaps in government programs.

As more folks migrate away from a certain crowded, corrupted social media hellscape and arrive here, a couple lists below of accounts to follow in the cybersecurity community and my fellow WIRED reporters and editors:

Unlike Israel, at least the US has term limits.