"A Pain in the Mist: Navigating Operation DreamJob’s arsenal" published by OrangeCyberdefense. #DreamJob, #MISTPEN, #UNC2970, #DPRK, #CTI https://www.orangecyberdefense.com/global/blog/cert-news/a-pain-in-the-mist-navigating-operation-dreamjobs-arsenal

The keynote from @dmitri.silverado.org was both a heartfelt apology but also basically this xkcd.com/927/ haha

This is a pretty wild evolution. Both the integration of cyber and kinetic and the fact IRGC and that MOIS might actually be working effectively together.

It was a pleasure to be a part of this event along with quite the cast of characters, including some folks who I’ve worked with over the years. Thank you to the organizers and their truly amazing promotional themes! See folks tomorrow at @cyberwarcon.bsky.social

Bsides Pyongyang starts in 15 minutes if the Cloudflare gods cooperate. youtube.com/@bsidespyong... m.twitch.tv/bsidespyongy...

At the end of the day in incident response, you may get accolades if you catch the attacker, but you will have the most impact if you have met the victim's needs. #infosec #dfir

I really enjoy when my research on unusual suspected state sponsored hacking groups is useful. *monkey paw curls*

Over the course of my career I’ve found and accomplished some pretty wild stuff. Next week I will be talking, for the first time, about one of the wildest things I ever found. The talk will be geared to analysts and practitioners but pretty sure this will be fascinating for everyone.

Something is broken in YARA for VirusTotal right now, signatures matching on things for no apparent reason.🫡 to any folks who have to clean up

I know dunking on this is fun and all but if you watch the clip Christo is laughing and mocking this conspiracy theory he heard from Russian intel. I’ve heard stories about the terrible quality of Russian intel but this is bad.

New Iran drop from me tracking an attribution nightmare - UNK_SmudgedSerpent! A little Charming, a little Muddy, and a lot C5. Targeting policy experts with benign conversation starters, health-themed infra, OnlyOffice spoofs, and RMMs. Check out the full story www.proofpoint.com/us/blog/thre...

You need a very special personality type to be a great ft reverser and most people can’t. It’s why they can write their own ticket.

This will be my third time speaking at Bsides but it’s already the most hilarious

I was recently talking to someone who worked on tracking Chinese botnets. We talked about ways to impact them and settled on “fixing the IoT ecosystem”. Then we had a good laugh and changed the subject because obviously that’s never going to happen.

Get tickets before they run out! (This is a free online event that will not run out) www.eventbrite.com/e/bsides-pyo...

a useful correction on the timescale and process in that story here! (it does not, however, make the meme any better.)

If you’ve been laid off from a cyber threat intel position, and you want a ticket to CYBERWARCON, please reach out.

Sep 25: "North Korea is expanding its military drone program" www.38north.org/2025/09/curr... Mid-October:

Hell yeah check out that lineup

We saw Earth Estries, an advanced #APT intrusion set, sharing its access to Earth Naga (Flax Typhoon). We introduce the term "Premier Pass" to describe this behavior, and propose a four-tier classification framework for collaboration types among advanced groups www.trendmicro.com/en_us/resear...

Thanks to @xorhex for an interesting discussion that is worth sharing here. I knew I read this somewhere but here's a fun thing you can do in YARA-X: 2 of ($a*, $b*, 3 of ($c*)) This is documented but not widely known: virustotal.github.io/yara-x/docs/...

TI / IR / Threat Hunting / Forensics / Vuln Mgmt staff since BRICKSTORM, and especially since yesterday:

On the one hand, it is very tempting to join in with everyone dunking on F5 for this but on the other hand I forget what I was going to say here

Update on this. @austinlarsen.me says the figure is likely 100+ www.reuters.com/sustainabili...

LFG @bsidespyongyang.bsky.social

Announcing this year's CYBERWARCON speaker lineup and agenda! We've got some fantastic talks this year, and more will be announced soon. Don't miss your chance to register now! Thank you everyone who submitted to the CFP. The selection was a truly grueling process!

So, next week I'm presenting this concept on expanding Bluesky's limited form of certificate authority verification into a multi-root, multi-platform system. Still revising a final draft. I'd love it if everyone took a look and gave me comments.

Great piece from @strikereadylabs.com on a continuation of Operation Roundpress - both a great finding and walkthrough how to find, and analyze, these types of XSS phishes strikeready.com/blog/0day-ic...

A thread of great questions from @greg-l.bsky.social and fantastic answers (and nuance) by @invisig0th.bsky.social, about the legendary APT1 report and way more.

#ESETresearch has identified two campaigns targeting Android users in the 🇦🇪. The campaigns, which are still ongoing, distribute previously undocumented spyware impersonating #Signal and #ToTok via deceptive websites. www.welivesecurity.com/en/eset-rese... 1/6

I don’t think I’ve seen a vendor do this before. Just add YARA support. www.validin.com/blog/yara_hu...

CFP closes this Friday, September 26th at 11:59pm EST! If you'd like to speak at CYBERWARCON this year, get your talk submission in ASAP to be considered! Submit your talk here >> www.cyberwarcon.com/cfp2025 #CYBERWARCON #CFP

#ESETresearch has observed #Gamaredon exploiting CVE-2025-8088 (#WinRAR path traversal) in an ongoing spearphishing campaign. This vulnerability allows arbitrary file write via crafted RAR archives. 1/6

#ESETresearch has uncovered the North Korea-aligned threat actor, DeceptiveDevelopment, targeting freelance developers with trojanized coding challenges and fake job interviews. www.welivesecurity.com/en/eset-rese... 1/6

Hopefully nobody is using vSphere or ESXi for anything important.

Great thread on the SIM farm bust in NYC. Only note is that there are lots of incompetent spies and spy-adjacent folks out there but I don’t think any are incompetent in this specific way so completely agree with @tprophet.org analysis.

GitHub will require a FIDO-based two-factor authentication method to publish updates to npm packages. The company will also deprecate legacy long-lived npm tokens and roll out new ones that last only seven days. github.blog/security/sup...

North Korean espionage group Kimsuky used "sex offender notices" to lure victims into running its malware logpresso.com/ko/blog/2025...

It’s conference season and this is also kind of hilarious

Ian is a secret operative of big Availability.

#FTSCon Speaker Spotlight: Wesley Shields (@wxs.bsky.social) is presenting “COLDRIVER: NOROBOT/YESROBOT/MAYBEROBOT” in the HUNTER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

#FTSCon Speaker Spotlight: Michael Horka is presenting “Lilac Typhoon aboard the Indigo Train - The Current State of Chinese Obfuscation Networks” in the HUNTER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

#FTSCon Speaker Spotlight: Tom Lancaster (@tlansec.bsky.social) & Josh Duke are presenting “Mission Auth Possible: Passwordless Phishing” in the HUNTER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

This is absolute CTI bait, great job ESET www.welivesecurity.com/en/eset-rese...

As far as I can tell, Whittaker is the only tech executive in the entire world taking a principled and honest stand against the pervasive enshittification of technology by AI agents. I hope Signal can be a North Star for other software vendors. english.elpais.com/technology/2...

Hey I know that guy!

GitLab Threat Intelligence details BeaverTail & InvisibleFerret, distributed via malicious repositories & ClickFix by North Korean threat actors. Previously targeting developers, the focus has shifted towards marketing & trader roles in crypto & retail. gitlab-com.gitlab.io/gl-security/...

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-gl...