Mark Kelly
@mkyo.bsky.social
📤 497
📥 171
📝 31
🇨🇳 Threat Research at Proofpoint
reposted by
Mark Kelly
Saher
18 days ago
New Iran drop from me tracking an attribution nightmare - UNK_SmudgedSerpent! A little Charming, a little Muddy, and a lot C5. Targeting policy experts with benign conversation starters, health-themed infra, OnlyOffice spoofs, and RMMs. Check out the full story
www.proofpoint.com/us/blog/thre...
loading . . .
Crossed wires: a case study of Iranian espionage and attribution | Proofpoint US
Proofpoint would like to thank Josh Miller for his initial research on UNK_SmudgedSerpent and contribution to this report. Key findings Between June and August 2025,
https://www.proofpoint.com/us/blog/threat-insight/crossed-wires-case-study-iranian-espionage-and-attribution
2
18
12
reposted by
Mark Kelly
ThreatInsight
about 1 month ago
Proofpoint threat researchers have designed an open-source tool—named PDF Object Hashing—to track and detect the unique characteristics of PDFs used by threat actors... similar to a digital fingerprint. We use this tool internally to help track multiple threat actors with high confidence.
1
19
11
reposted by
Mark Kelly
PIVOTcon
about 2 months ago
📣 🔥 🛋️ SAVE THE DATE 🛋️ 🔥 📣 The next
#PIVOTcon
will be on 6-8 May 2026, in Malaga, ES!!! You favorite ;)
#ThreatResearch
conference is coming back and we are planning to bring you the usual experience and content of utmost quality. Follow us +
#StayTuned
for more info
#CTI
#ThreatIntel
#PIVOTcon26
loading . . .
0
17
11
Good piece covering a big burst of TA416 activity targeting European governments last week!
add a skeleton here at some point
about 2 months ago
0
3
2
reposted by
Mark Kelly
The Banshee Queen 👑
2 months ago
First public report at Recorded Future by yours truly is out! RedNovember (formerly TAG-100, a.k.a. Storm-2077) is a Chinese state-sponsored threat group focused on intelligence collection, especially on flashpoint issues of strategic interest to China.
www.recordedfuture.com/research/red...
loading . . .
RedNovember Targets Government, Defense, and Technology Organizations
RedNovember, a likely Chinese state-sponsored cyber-espionage group, has targeted global government, defense, and tech sectors using advanced tools like Pantegana and Cobalt Strike. Discover the lates...
https://www.recordedfuture.com/research/rednovember-targets-government-defense-and-technology-organizations
2
21
14
reposted by
Mark Kelly
ThreatInsight
2 months ago
Proofpoint threat researchers have published new research identifying a new cyber-espionage campaign by
#TA415
(#APT41), a China-aligned threat actor, exploiting growing uncertainty in U.S.-China economic relations. Blog:
www.proofpoint.com/us/blog/thre...
.
loading . . .
Going Underground: China-aligned TA415 Conducts U.S.-China Economic Relations Targeting Using VS Code Remote Tunnels | Proofpoint US
What happened Throughout July and August 2025, TA415 conducted spearphishing campaigns targeting United States government, think tank, and academic organizations utilizing U.S.-China
https://www.proofpoint.com/us/blog/threat-insight/going-underground-china-aligned-ta415-conducts-us-china-economic-relations
1
7
4
🚨🇨🇳💰 New
@threatinsight.proofpoint.com
blog on TA415 (aka APT41) economy and trade-themed spearphishing against US govt, think tanks & academia. The campaigns used U.S.-China economic lures and spoofed the Chair of the House Select Committee on CCP competition + the US-China Business Council.
2 months ago
1
3
1
It is time the Mustang Panda moniker went the way of Winnti Group ☠️
2 months ago
1
5
0
reposted by
Mark Kelly
Julian-Ferdinand Vögele
4 months ago
1/ We've just released a new report uncovering new infrastructure tied to multiple activity clusters linked to the Israeli spyware vendor
#Candiru
across several countries. Full report:
www.recordedfuture.com/research/tra...
loading . . .
Tracking Candiru’s DevilsTongue Spyware in Multiple Countries
Recorded Future's Insikt Group uncovers active infrastructure linked to Candiru’s DevilsTongue spyware across multiple countries. Discover how this stealthy spyware targets high-value individuals and ...
https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware
1
12
12
🚨🆕🐟🍟 New blog from me and the amazing
@threatinsight.proofpoint.com
team covering recent activity by multiple China-aligned threat actors targeting semiconductor companies in Taiwan over the past few months:
www.proofpoint.com/us/blog/thre...
loading . . .
Phish and Chips: China-Aligned Espionage Actors Ramp Up Taiwan Semiconductor Industry Targeting | Proofpoint US
Key findings Between March and June 2025, Proofpoint Threat Research observed three Chinese state-sponsored threat actors conduct targeted phishing campaigns against the Taiwanese
https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting
4 months ago
0
5
3
reposted by
Mark Kelly
AJ Vicens
4 months ago
New: A handful of Chinese-linked cyber espionage groups are stepping up targeting of Taiwanese semiconductor companies, per new analysis from
@proofpoint.com
. Campaigns include targeting of financial analysts focused on the sector as well:
www.reuters.com/sustainabili...
loading . . .
Exclusive: China-linked hackers target Taiwan's chip industry with increasing attacks, researchers say
Chinese-linked hackers are targeting the Taiwanese semiconductor industry and investment analysts as part of a string of cyber espionage campaigns, researchers said on Wednesday.
https://www.reuters.com/sustainability/boards-policy-regulation/china-linked-hackers-target-taiwans-chip-industry-with-increasing-attacks-2025-07-16/
1
16
9
reposted by
Mark Kelly
Saher
5 months ago
New DISCARDED podcast drop! Join
@greg-l.bsky.social
and me as we talk about our fave North Korean groups, DPRK as the neglected child, TA406 and the Russian connection, and finally, the dreaded but pervasive IT worker problem
podcasts.apple.com/us/podcast/c...
open.spotify.com/episode/01d1...
loading . . .
Comic Sans and Cybercrime: Inside North Korea’s Global Cyber Playbook
Podcast Episode · DISCARDED: Tales From the Threat Research Trenches · 07/01/2025 · 53m
https://podcasts.apple.com/us/podcast/comic-sans-and-cybercrime-inside-north-koreas-global/id1612506550?i=1000715261677
1
8
4
reposted by
Mark Kelly
Greg Lesnewich
5 months ago
Fun crossover blog about TA829 (RomCom) & TransferLoader with my ecrime pals
@selenalarson.bsky.social
it’s got it all: 🛰️ Popped routers for sending phish 📊 ACH on attribution 👾 custom protocols 👽 cool malware 🕵️ crime 🎯 espionage ❔many unanswered questions
www.proofpoint.com/us/blog/thre...
loading . . .
10 Things I Hate About Attribution: RomCom vs. TransferLoader | Proofpoint US
Threat Research would like to acknowledge and thank the Paranoids, Spur, and Pim Trouerbach for their collaboration to identify, track, and disrupt this activity. Key takeaways
https://www.proofpoint.com/us/blog/threat-insight/10-things-i-hate-about-attribution-romcom-vs-transferloader
0
17
14
reposted by
Mark Kelly
Calwarez
5 months ago
🚨 We’re hiring at Recorded Future’s Insikt Group Two senior analyst roles are open right now. Both focus on tracking nation-state threats. 🧵
1
6
4
reposted by
Mark Kelly
Julian-Ferdinand Vögele
5 months ago
Today we’re publishing new findings on Predator spyware, still active despite global sanctions, now with a new client and ties to a Czech entity. Here’s what we found 🧵
www.recordedfuture.com/research/pre...
loading . . .
Predator Spyware Resurgence: Insikt Group Exposes New Global Infrastructure
Despite sanctions and global scrutiny, Predator spyware operations persist. Insikt Group reveals new infrastructure links in Mozambique, Africa, and Europe, highlighting ongoing threats to civil socie...
https://www.recordedfuture.com/research/predator-still-active-new-links-identified
1
20
17
reposted by
Mark Kelly
Nick Attfield
6 months ago
Dropping some joint research today with Threatray on TA397/Bitter 🔍 We dive into the confluence of signals that led us to our attribution of the threat actor 🎯 Shoutout to
@konstantinklinger.bsky.social
and Threatray for collaborating on this research.
www.proofpoint.com/us/blog/thre...
loading . . .
The Bitter End: Unraveling Eight Years of Espionage Antics—Part One | Proofpoint US
This is a two-part blog series, detailing research undertaken in collaboration with Threatray. Part two of this blog series can be found on their website here. Analyst note: Throughout
https://www.proofpoint.com/us/blog/threat-insight/bitter-end-unraveling-eight-years-espionage-antics-part-one
0
11
9
reposted by
Mark Kelly
Saher
6 months ago
From phishes to hands-on-keyboard commands 🔥 new
@proofpoint.bsky.social
research from
@nickattfield.bsky.social
and
@konstantinklinger.bsky.social
on Indian state-sponsored actor TA397 (Bitter) with a great story on the steps to technical and political attribution
www.proofpoint.com/us/blog/thre...
loading . . .
The Bitter End: Unraveling Eight Years of Espionage Antics—Part One | Proofpoint US
This is a two-part blog series, detailing research undertaken in collaboration with Threatray. Part two of this blog series can be found on their website here. Analyst note: Throughout
https://www.proofpoint.com/us/blog/threat-insight/bitter-end-unraveling-eight-years-espionage-antics-part-one
0
11
3
reposted by
Mark Kelly
Greg Lesnewich
6 months ago
Is the era of the “named actor” done? As the OG adversary sets diverge, get promoted, or move on actors dispersing across the kill chain based on specialized skills increases (ORBs, criminal underground) AND the CTI models maturing… APTs ⬇️⬇️ UNCs ⬆️⬆️
7
28
8
same tbh
6 months ago
1
206
5
reposted by
Mark Kelly
6 months ago
New Proofpoint blog alert We observed DPRK actor TA406 (overlaps w/ Opal Sleet/Konni) targeting government entities in Ukraine in early 2025:
www.proofpoint.com/us/blog/thre...
loading . . .
TA406 Pivots to the Front | Proofpoint US
What happened In February 2025, TA406 began targeting government entities in Ukraine, delivering both credential harvesting and malware in its phishing campaigns. The aim of these
https://www.proofpoint.com/us/blog/threat-insight/ta406-pivots-front
1
7
2
reposted by
Mark Kelly
Saher
6 months ago
@greg-l.bsky.social
drops knowledge on TA406 (Konni) as North Korea shows new interest in Ukraine, likely to keep tabs on the progress of the war and Russia's ability to keep pace on the battlefield
www.proofpoint.com/us/blog/thre...
loading . . .
TA406 Pivots to the Front | Proofpoint US
What happened In February 2025, TA406 began targeting government entities in Ukraine, delivering both credential harvesting and malware in its phishing campaigns. The aim of these
https://www.proofpoint.com/us/blog/threat-insight/ta406-pivots-front
1
15
14
Had such a great time at PIVOTcon
@pivotcon.bsky.social
- what a brilliant conference and the location isn't half bad either 🇪🇸
7 months ago
0
10
1
reposted by
Mark Kelly
BogeyBackdoor
7 months ago
If you're looking at email headers and they're not pretty, you need to install
@jacoblatonis.me
's
@vscode.dev
extension
marketplace.visualstudio.com/items?itemNa...
loading . . .
Email Headers Highlighting - Visual Studio Marketplace
Extension for Visual Studio Code - This language extension serves as a syntax highlighter that enables quicker analysis of email headers
https://marketplace.visualstudio.com/items?itemName=jacoblatonis.email-headers-highlight
2
4
2
reposted by
Mark Kelly
Saher
7 months ago
Thanks to my favorite team buddies for their collab and indulging my slight obsession 💜
@greg-l.bsky.social
@mkyo.bsky.social
and Josh
add a skeleton here at some point
1
10
1
reposted by
Mark Kelly
Greg Lesnewich
7 months ago
Saher's first blog on the scourge that is ClickFix usage in the espionage space!! Had to sneak in the UNK_RemoteRogue RDP shenanigans as well - a thus far unattributed group we assess to be Russia-aligned, using a pretty fun set of email tactics
add a skeleton here at some point
1
16
7
reposted by
Mark Kelly
Saher
7 months ago
My first blog with Proofpoint is live! And we love a good crossover. State-sponsored actors try their hand at ClickFix - the hottest thing in cybercrime. Meet the North Koreans, Iranians, and Russians who are upping their social engineering game
www.proofpoint.com/us/blog/thre...
loading . . .
Around the World in 90 Days: State-Sponsored Actors Try ClickFix | Proofpoint US
Key Findings While primarily a technique affiliated with cybercriminal actors, Proofpoint researchers discovered state-sponsored actors in multiple campaigns using the ClickFix social
https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix
1
42
23
reposted by
Mark Kelly
Greg Lesnewich
8 months ago
tired of looking at email headers as disgusting plaintext? only want things of value to stand out? look no further than this VSCode extension built by
@jacoblatonis.me
marketplace.visualstudio.com/items?itemNa...
2
21
7
timmy?!?!
add a skeleton here at some point
8 months ago
0
3
0
reposted by
Mark Kelly
PIVOTcon
9 months ago
📣 Oops!... They did it again!!! 61 Talks submitted and so many too good that, once again, we had to increase a bit the number of accepted talks.🔥
#PIVOTcon25
Agenda is finally here, and the caliber is insane!!! Check it out➡️
pivotcon.org/agenda-2025/
#CTI
#ThreatIntel
Talks and presenters in🧵⬇️ 1/18
1
20
19
Veeeery excited to attend and present at
@pivotcon.bsky.social
on attributing an extremely weird campaign to China-aligned TA415 (APT41/Brass Typhoon), as well as covering subsequent targeted activity linked to this actor!
add a skeleton here at some point
9 months ago
1
17
2
reposted by
Mark Kelly
BogeyBackdoor
9 months ago
Introducing
#UNK_CraftyCamel
! Leveraged Trusted Business Relationship? ✅ Low Volume, highly targeted? ✅ Interesting technique? ✅ Overlaps with other IRGC clusters? ✅ Bonus: Infrastructure still up to watch how they respond to the blog? ✅
www.proofpoint.com/us/blog/thre...
loading . . .
Call It What You Want: Threat Actor Delivers Highly Targeted Multistage Polyglot Malware | Proofpoint US
Key findings Proofpoint researchers identified a highly targeted email-based campaign targeting fewer than five Proofpoint customers in the United Arab Emirates with a distinct
https://www.proofpoint.com/us/blog/threat-insight/call-it-what-you-want-threat-actor-delivers-highly-targeted-multistage-polyglot?utm_source=twitter&utm_medium=social_organic
0
7
5
reposted by
Mark Kelly
Jacob Latonis
9 months ago
if you haven't done an escape room with members of your threat research team you're missing out
1
8
2
reposted by
Mark Kelly
The Banshee Queen 👑
9 months ago
If I had a dollar for every single time something is attributed vaguely to “”Mustang Panda”” I could buy a flat in London
4
22
5
reposted by
Mark Kelly
Nick Attfield
11 months ago
Dropping some new research on TA397/Bitter 🚨 Hidden in Plain Sight | TA397’s New Attack Chain Delivers Espionage RATs Report:
www.proofpoint.com/us/blog/thre...
loading . . .
Hidden in Plain Sight: TA397’s New Attack Chain Delivers Espionage RATs | Proofpoint US
Key findings Proofpoint observed advanced persistent threat (APT) TA397 targeting a Turkish defense sector organization with a lure about public infrastructure projects in Madagascar. The attack...
https://www.proofpoint.com/us/blog/threat-insight/hidden-plain-sight-ta397s-new-attack-chain-delivers-espionage-rats
2
16
14
Preeeetty interesting targeting in this campaign 👀
add a skeleton here at some point
12 months ago
0
4
0
reposted by
Mark Kelly
Selena Larson
12 months ago
New episode of DISCARDED where we sit down with the 🐐 Mark Kelly, our lead China analyst, to talk all things China APT! Tune in wherever you get your podcasts. 🔮 Web:
www.proofpoint.com/us/podcasts/...
Apple:
podcasts.apple.com/us/podcast/d...
Spotify:
open.spotify.com/episode/2AtJ...
loading . . .
DISCARDED | Proofpoint | Proofpoint US
https://www.proofpoint.com/us/podcasts/discarded
2
24
10
Shout out to my 10-month-old for expanding my medical knowledge by giving me two illnesses I had never heard of until a few months ago—at the SAME TIME! 🎉
12 months ago
0
4
0
reposted by
Mark Kelly
Will T
about 1 year ago
Looking for more people to follow on BlueSky? Find the
@curatedintel.bsky.social
folks here:
go.bsky.app/Kfp62Uh
add a skeleton here at some point
3
28
18
reposted by
Mark Kelly
Joe Slowik
about 1 year ago
It's only an "ORB" if it is from the Cheltenham region of UK, otherwise it is just a sparkling botnet
4
41
5
All you random non-cyber people who started following me are going to be very confused when I post about Chinese APTs and not my dog
about 1 year ago
1
3
0
reposted by
Mark Kelly
Julian-Ferdinand Vögele
about 1 year ago
1/ In a recent cyber campaign, the Chinese state-sponsored group TAG-112 compromised two Tibetan websites to deliver the Cobalt Strike malware, highlighting an ongoing espionage focus on Tibetan entities:
www.recordedfuture.com/research/chi...
loading . . .
China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike
China-based TAG-112 exploited Tibetan sites to spread Cobalt Strike malware. Recorded Future reveals targeted threats by state-sponsored actors.
https://www.recordedfuture.com/research/china-nexus-tag-112-compromises-tibetan-websites
1
7
5
hello bluesky but more importantly here's my dog
about 1 year ago
0
20
0
🚨 Chinese APT drama: Chengdu 404 (#RedGolf/#APT41) suing i-SOON (#RedHotel/#EarthLusca) over a "software development dispute" 🙃 Particularly interesting given RedHotel's use of malware families suspected to be originally developed in part by RedGolf/APT41 operators (e.g. ShadowPad/Winnti)
loading . . .
i-SOON: Another Company in the APT41 Network
A lawsuit casts light on the ecosystem of IT companies related to Chengdu 404, the company allegedly behind Chinese state-sponsored hacking group APT41.
https://nattothoughts.substack.com/p/i-soon-another-company-in-the-apt41
about 2 years ago
0
1
0
New from us on a Chinese APT group we track as RedHotel targeting orgs globally (overlaps Aquatic Panda/Earth Lusca/Bronze University/Red Scylla)
https://www.recordedfuture.com/redhotel-a-prolific-chinese-state-sponsored-group-operating-at-a-global-scale
loading . . .
RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale | Recorded Future
RedHotel (formerly tracked as TAG-22) is one of the most prominent, active, Chinese state-sponsored threat activity groups tracked by Recorded Future’s Insikt Group.
https://www.recordedfuture.com/redhotel-a-prolific-chinese-state-sponsored-group-operating-at-a-global-scale
over 2 years ago
0
2
0
reposted by
Mark Kelly
Curated Intel
over 2 years ago
ICYMI: In July 2023, Curated Intel members shared a brand new resource for the community called 'The Threat Actor Profile Guide for CTI Analysts'. The Threat Actor Profile Guide for CTI Analysts (
curatedintel.org
)
loading . . .
The Threat Actor Profile Guide for CTI Analysts
Threat actor profiles are made for a range of reasons. An example trigger for creating a new profile can include after an incident, e.g., a...
https://www.curatedintel.org/2023/07/the-threat-actor-profile-guide-for-cti.html
0
7
9
reposted by
Mark Kelly
Simon Kenin
over 2 years ago
1\ Үер усны сэрэмжлүүлэг.lnk b919ab6f54f632401d708c66675da07d While this might look like Russian, this is Mongolian. LNK connects to estmongolia[.]com to install MSI file. Үер усны сэрэмжлүүлэг.msi 204a12016c46d31d615c38b13f6ad7ec MSI drops 32c26797ab646074a2bb562f9d10adb5 legit onenote to sideload
1
0
1
reposted by
Mark Kelly
Chris
over 2 years ago
Brilliant new project from Curated Intel lads
@bushidotoken.net
and Freddy. "The Threat Actor Profile Guide for CTI Analysts".
loading . . .
The Threat Actor Profile Guide for CTI Analysts
Threat actor profiles are made for a range of reasons. An example trigger for creating a new profile can include after an incident, e.g., a...
https://www.curatedintel.org/2023/07/the-threat-actor-profile-guide-for-cti.html
1
1
1
you reached the end!!
feeds!
log in