If I did one of those Ancestry DNA tests right now, a significantly high proportion would come back as Stilton Cheese

Details of the cyber attack at Harrods (as they are with Co-op & M&S) are still low and we shouldn’t rule out that the three incidents impacting the retailers are simply coincidence. .... 1/2

Why is @microsoft.com "Teams" plural, when "Word" is not? Surely a singular Team feels more homely... maybe. Conversely, a singular "Word", feels like about as much effort as I put in my school coursework.

Do phishing simulations on April Fools' Day still count? 🤷‍♂️

Cooking top tip: quarter-pounders are not the same size as quarter-kilo’ers #ImadeBigBurgers

New blog post from @darktrace.com, looking at the detection of an Insider Threat in a SaaS application, with the customer supported by our amazing Analyst SOC

In my first Executive Order, I will be renaming France as "Cheese-land" #GulfOfMexico

A cautionary tale: not everything suspicious is malicious. (although, I'd argue everything malicious was indeed suspicious at one point)

A new blog post from analysts at @darktrace.com: The use of phishing kits as part of an AitM attack, increasing an attackers ability and proficiency in stealing legitimate credentials. ... and then simply just logging on.

Ok Brain Trust: Prove me wrong. There is no application of cyber attack, where the intended outcome can't be achieved by non-cyber means.

One of my 2025 resolutions is to write more, including reinvigorating my cyber security focussed blog, which took a bit of a hiatus in the latter half of 2024. I've got a few ideas lined up already, but what would you like to see me write about?

Interesting OpSec aspect with regards to the BeyondTrust compromise. (H/T to @GossiTheDog.cyberplace.social.ap.brid.gy for first spotting this) Having a search for some of the IOCs from the BeyondTrust blog, reveals that they appear in a file uploaded to VirusTotal on the 19th December

US Treasury announce network breach by “Chinese Actors” via cybersecurity vendor BeyondTrust. BeyondTrust specialise in Privileged Access Management. In other words, they have the power to access or generate one-time-use Admin credentials for their customer networks.

New blog post by analysts from @darktrace.com: Detecting the exploitation of internet-facing File Transfer Servers, exploiting CVE-2024-50623

New blog post by analysts from @darktrace.com - a review of recent exploit campaigns against Palo Alto firewalls which are then used as a launch point into customer networks.

New blog post by analysts @darktrace.bsky.social - detecting the use of AiTM Phishing Kits, including MFA bypass, by attackers.

I can only read this in the voice of the guy who reads out the Football results.

‘Tis the season to… … be constantly picking up dropped pine needles off the floor

OSINT challenge - Easy Edition #lionesses

New blog post by analysts at @darktrace.bsky.social - detecting SaaS account compromise including the use of multiple VPN access points by threat actors.

Nuances become lost when arguments are oversimplified. In this case, both attribution and motivation are reduced into its simplest form. With attribution, it’s worth considering we’re talking about threats from multiple groups originating, or in support of, Russia’s objectives.

Only those of a certain age/persuasion will know what this means: FCKGW-RHQQ2-YXRKT-8TG6W-2B7Q8

A list of the most popular names for the daughters of drummers: 3. Anna One 2. Anna Two 1. Anna One Two Three Four

Sure, a snowy back garden sounds like fun, but for any dog owners out there, you now have your own dog 💩 minefield. One step and it could be catastrophe.

As we're in this rapid growth of @bsky.app, not only are we going to see accnts impersonating high profile individuals, but critically, impersonating high reputation news sources. All it would take is some imaginative "Breaking News" to hit public confidence. Can the real BBC News please stand up?

With reports of "fake" bsky accnts impersonating UK MPs, its important to note that accnt verification (akin to the pre-Musk Twitter "Blue tick") is left to the user, not @bsky.app. This is done using a method similar to how email spoofing is mitigated, with a special DNS record:

New to @bsky.app? We’ve got some etiquette just for you! Turn on the little feature that reminds you to post alt text with your images. Alt text allows blind and partially sighted people to understand what's in your images using screen readers. Without alt text, it just says "image".

…Also shows if your account has been blocked by anyone. I’ve been on this app for less than a week and I’ve already been blocked by someone?!

A friend asked if I had any pre-prepared content on phishing. I was feeling particularly lazy, so got ChatGPT to give it a go. I actually quite like the simplicity of its response.

Is it…. Not speeding?

#whoami - Global Head of Threat Analysis at Darktrace: Cyber Security, AI in Cyber Security, Threat Landscape - Ex-NCSC & UK Government: Current affairs, Geopolitics & Nat. Security - Other things: Diversity and Inclusivity, Compassionate Leadership, Social Mobility, Mentoring & Coaching

Hello World