Proud to share new research by Amazon Threat Intelligence detailing recent activity by Sandworm/APT44 🇷🇺 targeting US and European energy, critical infrastructure, and managed security provider networks via vulnerable and misconfigured network edge devices. #threatintel aws.amazon.com/blogs/securi...

Trend Micro tracks SHADOW-VOID-042 spear-phishing (Nov 2025) using Trend Micro-themed lures and a decoy site mimicking Trend’s corporate style, targeting defence, energy, chemicals, cybersecurity and ICT sectors. www.trendmicro.com/en_us/resear...

Oh good another Cloudflare outage, hopefully it’s the half of the internet I’m not using right now

Welp aws.amazon.com/blogs/securi...

Discussion came up that public TI reporting is marketing. 100% true. My team also factors in that adversaries read these too, which heavily influences content/topics we blog.

French NGO Reporters Without Borders targeted by Calisto in recent campaign | Calisto is a Russia-nexus intrusion set attributed by the USA, the UK, New Zealand and Australia to the Russian intelligence service FSB | December 3, 2025, Sekoia.io blog.sekoia.io/ngo-reporter...

A perfect CVSS 10 🧑🏻‍🍳💋 CVE-2025-55182: Unauthenticated remote code execution vulnerability in React Server Components The vuln is in versions 19.0, 19.1.0, 19.1.1, and 19.2.0: react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack Upgrade immediately!

ESET Research reports new MuddyWater activity against organisations in Israel and one in Egypt. The Iran-aligned group uses previously undocumented tools, including a custom Fooder loader, to run MuddyViper, a new C/C++ backdoor for stealth & persistence. www.welivesecurity.com/en/eset-rese...

Give your team a secure way to do things or they’ll do them insecurely. Make the secure way straightforward, efficient, documented, and then actually respond to questions, and folks will switch…people mostly want to do the right thing, we just make it hard sometimes

FINAL DAY!! Every one of my courses is 25% off until midnight 🚀✨ It's the only sitewide sale we do all year, and the cheapest you'll see these courses. This discount is for all y'all, so use the code ALLYALL at checkout. View my courses here: networkdefense.io/

Contagious Interview is the Cheesecake Factory of APTs. Just calm the F down and be good at something instead of trying to do 500 mediocre things at once. opensourcemalware.com/blog/contagi...

Gonna assume the answer is “lol” but is anyone using configuration change of an IP address as a trigger to retire it as an IOC? I feel like there’s a business opportunity. Will it make money? No. Can we pretend it uses AI to get VC money? Maybe.

Me trying to study while North Korean hackers register new domains

I was trying to figure out a way to stretch my brain a little over break and guess what happened!

LIFTOFF! All my courses on networkdefense.io are 25% off until Tuesday, 12/2, at midnight ET 🚀 This is the only sitewide sale we do all year, and the cheapest you'll see these courses. This event is for all y'all, so to get the discount, use code ALLYALL at checkout.

For software developers: there's currently a highly sophisticated hacking group targeting developers with backdoored coding skills tests. They typically take the form of large source codes specific to your skillset. Please email any suspicious code to me on: [email protected] 1/2

"A Pain in the Mist: Navigating Operation DreamJob’s arsenal" published by OrangeCyberdefense. #DreamJob, #MISTPEN, #UNC2970, #DPRK, #CTI https://www.orangecyberdefense.com/global/blog/cert-news/a-pain-in-the-mist-navigating-operation-dreamjobs-arsenal

The keynote from @dmitri.silverado.org was both a heartfelt apology but also basically this xkcd.com/927/ haha

This is a pretty wild evolution. Both the integration of cyber and kinetic and the fact IRGC and that MOIS might actually be working effectively together.

It was a pleasure to be a part of this event along with quite the cast of characters, including some folks who I’ve worked with over the years. Thank you to the organizers and their truly amazing promotional themes! See folks tomorrow at @cyberwarcon.bsky.social

Bsides Pyongyang starts in 15 minutes if the Cloudflare gods cooperate. youtube.com/@bsidespyong... m.twitch.tv/bsidespyongy...

At the end of the day in incident response, you may get accolades if you catch the attacker, but you will have the most impact if you have met the victim's needs. #infosec #dfir

I really enjoy when my research on unusual suspected state sponsored hacking groups is useful. *monkey paw curls*

Over the course of my career I’ve found and accomplished some pretty wild stuff. Next week I will be talking, for the first time, about one of the wildest things I ever found. The talk will be geared to analysts and practitioners but pretty sure this will be fascinating for everyone.

Something is broken in YARA for VirusTotal right now, signatures matching on things for no apparent reason.🫡 to any folks who have to clean up

I know dunking on this is fun and all but if you watch the clip Christo is laughing and mocking this conspiracy theory he heard from Russian intel. I’ve heard stories about the terrible quality of Russian intel but this is bad.

New Iran drop from me tracking an attribution nightmare - UNK_SmudgedSerpent! A little Charming, a little Muddy, and a lot C5. Targeting policy experts with benign conversation starters, health-themed infra, OnlyOffice spoofs, and RMMs. Check out the full story www.proofpoint.com/us/blog/thre...

You need a very special personality type to be a great ft reverser and most people can’t. It’s why they can write their own ticket.

This will be my third time speaking at Bsides but it’s already the most hilarious

I was recently talking to someone who worked on tracking Chinese botnets. We talked about ways to impact them and settled on “fixing the IoT ecosystem”. Then we had a good laugh and changed the subject because obviously that’s never going to happen.

Get tickets before they run out! (This is a free online event that will not run out) www.eventbrite.com/e/bsides-pyo...

a useful correction on the timescale and process in that story here! (it does not, however, make the meme any better.)

If you’ve been laid off from a cyber threat intel position, and you want a ticket to CYBERWARCON, please reach out.

Sep 25: "North Korea is expanding its military drone program" www.38north.org/2025/09/curr... Mid-October:

Hell yeah check out that lineup

We saw Earth Estries, an advanced #APT intrusion set, sharing its access to Earth Naga (Flax Typhoon). We introduce the term "Premier Pass" to describe this behavior, and propose a four-tier classification framework for collaboration types among advanced groups www.trendmicro.com/en_us/resear...

Thanks to @xorhex for an interesting discussion that is worth sharing here. I knew I read this somewhere but here's a fun thing you can do in YARA-X: 2 of ($a*, $b*, 3 of ($c*)) This is documented but not widely known: virustotal.github.io/yara-x/docs/...

TI / IR / Threat Hunting / Forensics / Vuln Mgmt staff since BRICKSTORM, and especially since yesterday:

On the one hand, it is very tempting to join in with everyone dunking on F5 for this but on the other hand I forget what I was going to say here

Update on this. @austinlarsen.me says the figure is likely 100+ www.reuters.com/sustainabili...

LFG @bsidespyongyang.bsky.social

Announcing this year's CYBERWARCON speaker lineup and agenda! We've got some fantastic talks this year, and more will be announced soon. Don't miss your chance to register now! Thank you everyone who submitted to the CFP. The selection was a truly grueling process!

So, next week I'm presenting this concept on expanding Bluesky's limited form of certificate authority verification into a multi-root, multi-platform system. Still revising a final draft. I'd love it if everyone took a look and gave me comments.

Great piece from @strikereadylabs.com on a continuation of Operation Roundpress - both a great finding and walkthrough how to find, and analyze, these types of XSS phishes strikeready.com/blog/0day-ic...

A thread of great questions from @greg-l.bsky.social and fantastic answers (and nuance) by @invisig0th.bsky.social, about the legendary APT1 report and way more.

#ESETresearch has identified two campaigns targeting Android users in the 🇦🇪. The campaigns, which are still ongoing, distribute previously undocumented spyware impersonating #Signal and #ToTok via deceptive websites. www.welivesecurity.com/en/eset-rese... 1/6

I don’t think I’ve seen a vendor do this before. Just add YARA support. www.validin.com/blog/yara_hu...

CFP closes this Friday, September 26th at 11:59pm EST! If you'd like to speak at CYBERWARCON this year, get your talk submission in ASAP to be considered! Submit your talk here >> www.cyberwarcon.com/cfp2025 #CYBERWARCON #CFP