In this post, @euben.bsky.social and the Natto Team assess that provincial bureaus of the Chinese Ministry of State Security likely operate with their own tasking priorities, resources, and local ecosystems for cyber operations. nattothoughts.substack.com/p/the-many-a...

@euben.bsky.social Eugenio’s research explains the elite cyber talent paradox in China - “all people are soldiers” vs “extremely lean.” #Cybersecurity #TalentPipeline #CyberOperations nattothoughts.substack.com/p/few-and-fa...

Can’t wait for this :)

Microsoft is probing whether a MAPP leak let Chinese hackers exploit a SharePoint vuln pre-patch. In this new piece for Natto, @dakotaindc.bsky.social, @meidanowski.bsky.social & I dig into: 🏛️ China's vuln reporting rules 📉 Which firms joined/left MAPP since 2018 ⚠️ The risks today’s members pose

New: Microsoft is investigating whether a leak from its early alert system for cybersecurity companies allowed Chinese hackers to exploit flaws in SharePoint before they were patched, enabling a global campaign of cyberattacks, according to people familiar: www.bloomberg.com/news/article...

In the latest Hooked!, editor @katharinegk.bsky.social ties together some fascinating recent research from @benread.bsky.social , @euben.bsky.social, @winnona.bsky.social, and others on private sector elements of Chinese offensive cyber: bindinghook.com/articles-hoo...

Before Vegas – The “Red Hackers” Who Shaped China’s Cyber Ecosystem (Center for Security Studies at ETH Zürich): css.ethz.ch/content/dam/...

1/ China’s cyber capabilities didn’t start top-down, they started with raw hacking talent. The new CSS/ETH report "Before Vegas" traces how informal talent shaped China’s cyber ecosystem, moving from online forums to industry leaders (link in thread).

How did China's top APT hackers come to be? Many were early "Honkers" - patriotic hackers who in late 90s launched low-skill cyberattacks against nations deemed disrespectful to China. But once Honkers developed their skills, PLA/MSS came calling. Based on great research by bsky.app/profile/eube...

How has China advanced its AI development to its current state? No single innovation path in AI can be considered definitive. nattothoughts.substack.com/p/debating-c...

I wrote on the arrest in Italy of Xu Zewei, an alleged Chinese hacker, perhaps the first case where America has sought to extradite a Chinese hacker for mainly or exclusively cyber operations—in this case theft of Covid research during the pandemic. www.economist.com/china/2025/0...

“alignment with CCP priorities offers privileged access to state resources, regulatory favor, and expanded commercial opportunities [to hackers]." NEW Phenomenal report on Chinese civil military fusion and cyber militias by Kieran Green: margin.re/mobilizing-c...

🚨 NEW PAPER on the 0day Supply Chain 🚨: I gathered open source data & interviewed Gov employees, VR and china researchers to figure out what the zero day marketplace looks like in the U.S. and how it compares to China. key findings below ⬇️- 0/🧵 
www.atlanticcouncil.org/in-depth-res...

To defend, one must first know how to attack” (未知攻，焉知防). This mindset, popularized by a Taiwanese hacker Lin in the 1990s, spread from China's red hackers to CTF teams. Today, it powers China's cyber industry. New piece for @nattothoughts.bsky.social nattothoughts.substack.com/p/defense-th...

The Natto Team explores the development of China's vulnerability research and discovery skills, starting from the vocational college level. Thanks to @euben.bsky.social @dakotaindc.bsky.social Kristin Del Rosso for their previous research on the topic nattothoughts.substack.com/p/when-a-voc...

The Natto Team continues finding stories of Chinese hackers fascinating as they reveal the motivations behind cyber operations and the evolution of China's information security industry. nattothoughts.substack.com/p/stories-of...

In their latest for #BindingHook, Massimo Marotti, Matteo E. Bonfanti, and Giovanni Faleg of the Italian National Cybersecurity Agency reflect on the process of forming the new #G7CybersecurityWorkingGroup: bindinghook.com/articles-hoo...

Fascinating to see reference to GRU unit 20728 from FR relative to Russia's offensive cyber program -- as far as I'm aware, a first from a Western service? www.diplomatie.gouv.fr/fr/dossiers-...

Fellow @euben.bsky.social argues that EU member states should reduce strategic #technologicaldependencies on non-EU countries, particularly those deemed high-risk, and enhance proactive #cybersecurity capabilities. bindinghook.com/articles-bin...

In this piece with @nattothoughts.bsky.social's @meidanowski.bsky.social, we dug into China’s two naming-and-shaming campaigns over the past 30 days—targeting alleged Taiwanese and U.S. hackers amid escalating geopolitical tensions. nattothoughts.substack.com/p/wars-witho...

My question is did state media add mention of US universities in response to the paper @euben.bsky.social and I wrote last year which included circumstantial evidence of hacks by NWPU? www.sentinelone.com/labs/labscon...

It was a matter of time. Less than a month after outing alleged Taiwanese cyber operatives in an unprecedented move for both its tone and detail, China has done the same with alleged NSA operatives—for the first time. The language echoes that of Western reports, though less detailed.

What's happening to @thekrebscycle.bsky.social is disgusting He's one of the most hardworking, dedicated and smart people I'm lucky enough to know, and he showed a LOT of courage when he fought back against attempts to undermine the 2020 election result I hope Americans will stand behind him

We loved having you @weberv.bsky.social, Zoë van Doren, @euben.bsky.social & co! 🙏

It was a real pleasure to speak about #China as a risen cyber power at the @virtualroutes.bsky.social colloquium w Zoë van Doren yesterday. Thanks to thought-provoking comments from @euben.bsky.social and great chairing by Lena Riecke & @partomirzaei.bsky.social.

A case study of the i-SOON indictment and leaks reveals that source information may vary but it is important to compare and evaluate information for unique insights. nattothoughts.substack.com/p/indictment...

I wrote a piece on China’s evolution into a bigger, more sophisticated and more threatening cyber power over the past decade, and particularly in the last few years. I also look at the pivotal role played by China’s private sector ecosystem in that shift. www.economist.com/china/2025/0...

Chinese hacking is becoming bigger, better and stealthier @euben.bsky.social and I on the beat economist.com/china/2025/0...

Join us for the next session of the Colloquium series next week! 👇 ⏰ April 2, 16:00-17:00 CET 💡 @weberv.bsky.social, Zoë van Doren & @euben.bsky.social 💭 China’s Expanding Cyber Playbook: Espionage, Fear, and Influence in East Asia Read more & sign up: virtual-routes.org/event/chinas...

Glad to be part of this awesome crew :)

A recent research from Natto Thoughts about US-sanctioned, allegedly APT27-associated actor. #apt27 nattothoughts.substack.com/p/zhou-shuai...

Big day for Chinese threat intel MSS outs 4 alleged members of Taiwan's Information, Communications & Electronic Force Command, links them to cyber attacks QiAnXin & Antiy release 2 separate reports on Taiwan-linked APT-Q-20/APT-C-01/GreenSpot/PoisonVine 🧵w/ links & details

Putting some order in today's APT announcements: -APT27 charges: www.justice.gov/usao-dc/pr/c... -iSoon charges: www.justice.gov/usao-sdny/pr... -APT27 sanctions: home.treasury.gov/news/press-r... -iSoon reward: x.com/RFJ_USA/stat... -IC3 APT27 alert: www.ic3.gov/PSA/2025/PSA...

As the Natto Team was going to publish this piece, US Department of Justice unsealed an indictment charging eight i-SOON employees and highlighting the importance of companies like i-SOON in China's cyberthreat landscape. nattothoughts.substack.com/p/where-is-i...

Zhou Shuai (Coldface) joins the list of former members of China’s patriotic hacking group, the Green Army (see i-SOON and Integrity Tech’s leadership), who have been exposed as working for state cyber operations. He is undeniably one of China’s top legacy hackers. www.justice.gov/usao-dc/pr/c...

Select Committee on the Chinese Communist Party Holds Hearing — " End the Typhoons: How to Deter Beijing’s Cyber Actions and Enhance America’s Lackluster Cyber Defenses” selectcommitteeontheccp.house.gov/committee-ac...

Love seeing @euben.bsky.social and I in the same place. www.voachinese.com/a/deepseek-c...

“The #1 thing we need for the future is talent…so when [DistrictCon] asked me to come speak, I couldn’t say yes quick enough” - Gen. Nakasone

Amazing work on China's public opinion monitoring and manipulation by @dakotaindc.bsky.social, @alex.leetnoob.com & @milenkowski.bsky.social 🔥 www.sentinelone.com/labs/censors...

If you’re familiar with iOS jailbreaking, then you’ve likely heard of the Pangu Team. 1y after the i-SOON leaks, my latest for @nattothoughts.bsky.social examines Pangu’s ties to i-SOON and the links b/w elite vuln researchers and govt-contracted hackers nattothoughts.substack.com/p/the-pangu-...

The other shoe has finally dropped, but we still need more intrusion details to defend against the threats. #salttyphoon #apt nattothoughts.substack.com/p/salt-typho...

We're officially 1 month away from DistrictCon Year 0! Check out our agenda for talks, exploits, round tables, and more! www.districtcon.org/agenda

The stories you can uncover through research. This part made me giggle: "This was the first hacker attack in my life, and my teacher was my own hormones."

I recently spoke with @voiceofamerica.bsky.social, joined by my brilliant colleague @euben.bsky.social, about whether @bsky.app might become a hotspot for foreign disinformation campaigns. www.voanews.com/a/bluesky-co...

Great read with a mention of @nattothoughts.bsky.social’s recent piece on China’s Public Opinion Monitoring Tools nattothoughts.substack.com/p/bluesky-sh...

It would be helpful to attribute research more explicitly or add links to original sources in articles

"It is normal to strengthen technical exchanges and promote scientific and technological innovation"... "by harnessing hacking contest vulnerabilities for strategic use by security agencies*" There, fixed it for them. Analyses backing this up 👇 (1/6) (Source: www.newsweek.com/us-indicts-h...)

The decade of investments by Xi’s government into China’s enabling ecosystem is paying off. I summarize much of those efforts here: techcrunch.com/2021/11/12/c... But additional reports since that article demonstrate the point 1/

The Chinese govt has used public opinion analysis systems to influence discourse on US social media. Will Bluesky be included? Most likely. My new piece for @nattothoughts.bsky.social, building on recents posts by @stamos.org and @seanhaines.bsky.social 👇🏼 open.substack.com/pub/nattotho...