Ready to put your analysis skills to the test? Join us on Nov 18 (pre-CYBERWARCON) for a Synapse challenge using a real-world scenario. There will be snacks and limited-edition challenge coins! vertex.link/events/cyber...

Meet our speaker: Kevin Hoganson! He leverages a broad skill set across cyber threat intelligence, digital forensics & incident response. His talk highlights commercial spyware actors' cleanup of forensic artifacts which prevents meaningful analysis of mobile device infections. www.cyberwarcon.com

Tickets are almost sold out. Nerds. www.cyberwarcon.com

Meet our speaker Dlshad Othman! He has fifteen+ years of experience in threat intelligence, and has built a career at the intersection of cybersecurity and geopolitics. He will be joining David Magnotti for their talk "Ping First, Boom Second", which will focus on Iranian cyber threat groups.

If you’ve been laid off from a cyber threat intel position, and you want a ticket to CYBERWARCON, please reach out.

An opinion piece I wrote for Cipher Brief on the next wave of AI threats. The speed and scale of this activity will change the nature of cybersecurity. In order to compete with adversary use of this technology we must adopt it wholeheartedly into defense. www.thecipherbrief.com/ai-cyberatta...

Meet our speaker Caleb Marquis! His work played a central role in the landmark indictment of North Korean hacker Rim Jong Hyok. He has received the FBI Medal of Excellence and the Department of Justice Attorney General Award for Distinguished Service.

We're excited to have Eric Kerr join us at CYBERWARCON! His talk, "From Hacker to Help Desk: The Surprising Story of a North Korean Cyber Operator", will cover the activities of Andariel, a North Korean hacking group that steals military & nuclear technology from US & South Korean defense networks.

We're proud to announce Ruarigh Thornton is joining us this year at CYBERWARCON! Head of Research and Disruption at PGI, with experience in threats including counter espionage, hostile state information operations + more. He has led 100+ digital investigations. www.cyberwarcon.com

I won’t be at CYBERWARCON this year so I need someone to give @hultquist.bsky.social a hard time for me. I don’t yet know why he deserves this, but I’m sure a reason will present itself between now and then. The man never disappoints in the shenanigans and tomfoolery department.

Have you ever wanted to see two terminally online nerds really (and I mean *really*) get into the SVR deep lore while continuing the eternal goal of making 2016 last forever? Gosh does @cyberwarcon.bsky.social have a talk for you!

CYBERWARCON is gooooooooo! This year’s agenda is live! Thank you submitters.

Announcing this year's CYBERWARCON speaker lineup and agenda! We've got some fantastic talks this year, and more will be announced soon. Don't miss your chance to register now! Thank you everyone who submitted to the CFP. The selection was a truly grueling process!

What's that? www.cyberwarcon.com/oil-into-the...

🚨🚨🚨 Google released a report on "Brickstorm" this morning — a next-level, suspected China-linked campaign targeting U.S. firms. Ultra-stealthy, 400+ day dwell times, focus on stealing IP, finding zero-days, and focused on long-term cyberespionage. cyberscoop.com/chinese-cybe...

We are expecting several organizations who use this tool and actively hunt for this threat will find that this actor has been active in their networks for some time.

We are releasing details on BRICKSTORM malware activity, a China-based threat hitting US tech to potentially target downstream customers and hunt for data on vulnerabilities in products. This actor is stealthy, and we've provided a tool to hunt for them. cloud.google.com/blog/topics/...

This is unironically one of the wildest photos ever taken.

Last week to get your @CYBERWARCON submissions in! Don’t miss out!

We've got some good submissions flowing into the @CYBERWARCON CFP, but there's still time for more. If you have good content, and you're worried the honorarium won't cover your travel, please submit, and we'll work it out. We do this because we believe this research matters.

Finland is so small that I once visited and Mikko found me in a bookstore.

PAPERS PLEASE! #BSidesPyongyang2025 🇰🇵 Submit your CFP now: https://forms.gle/y6QRMeYuJPYXZi1k9

Tech startup idea: instead of starting your car with your key, you get in, turn on the display panel, enter your password, get your phone out, open the authenticator app, enter your pin, enter the timed passcode, then open the start menu, then helpdesk, then "request engine start", then submit a tic

Yo! #CYBERWARCON CFP & Reg is LIVE! You know what to do. AI can't do it for you...or wear these socks. @hultquist.bsky.social @cyberwarcon.bsky.social

Major Update: We now believe this incident impacts other Salesloft Drift integrations, not just Salesforce. We’re advising Salesloft Drift customers to treat any and all authentication tokens stored in or connected to the Drift platform as potentially compromised.

Wait til they see the socks!

NEW: Google's Threat Intelligence Group has found the Salesloft issue impacting Salesforce actually impacts *all* Salesloft integrations, including those with Google Workspace. @mattkapko.com has it all (and will have more as this is developing) cyberscoop.com/salesloft-dr...

it's that time!!! @cyberwarcon.bsky.social tickets are on sale!! Get one before they sell out!! www.cyberwarcon.com/registration #CYBERWARCON #sockarmy

CYBERWARCON is coming!!! Registration and CFP are now open for this year's #CYBERWARCON! This year's keynote speaker will be @dmitri.silverado.org!! We are back in Arlington, VA this year on November 19th. www.cyberwarcon.com

An actor we are tracking as UNC6395 is targeting Salesforce customer instances through compromised OAuth tokens associated with the Salesloft Drift third-party application. This is ongoing and widespread. cloud.google.com/blog/topics/...

For anyone that is on their way to Vegas for Black Hat — if you have respiratory problems, prepare. Wildfires in Santa Barbara have smoke moving through the city. Here is a picture from a hotel room, I could see the mountains clearly yesterday. You see any 🏔️ in this pic?

Hot wasps have good jeans.

Just now: Sean Cairncross confirmed to be national cyber director in a 59-35 vote.

when they close it all up, I do believe this will go down as the funniest video on the internet

#PublicAttribution of cyber activities is #China’s latest technique for pressuring #Taiwan and shaping the international dialogue around #cybersecurity. @benread.bsky.social digs into the details on Binding Hook: bindinghook.com/articles-hoo...

CYBERWARCON is back! Save the date for Wednesday, November 19, 2025, in Arlington, VA + virtually. Follow us to stay up to date for CFPs, volunteer opportunities + more! Check out for more information + sponsorship opportunities >> www.cyberwarcon.com

Hilarious feedback on this from the Three Buddy Problem podcast. This was a win from Big Sleep and intel, and as much as we’d love to offer the full details, sources and methods concerns preclude it. We just couldn’t sit on it. Trust me @juanandres_gs, this is a whole new era. 1/x

sean learned the term ‘maillard reaction’ and now when we watch cooking shows he likes to very confidently say ‘that’s a solid maillard reaction’ or ‘nice maillard reaction on that’

What are the chances that Coldplay guy considered claiming deepfake?

While I do believe that deep fake vishing is happening, I’m skeptical of some of these incidents. In many cases the only evidence we have is the word of the person who was just deceived and who has the greatest incentive to lean on this explanation. Proceed with caution.

Hacked Elmo Account Posts Antisemitic Messages theonion.com/hacked-...

Google has just used AI and threat intel to foil a zeroday before it could launch. Working from artifacts gathered by GTIG, Big Sleep was used to identify a vuln before actors could ramp up exploitation. It doesn’t get much better than this in intel. blog.google/technology/s...

Four UK arrests in Scattered Spider incidents. Suspects are 17 to 20 years old. therecord.media/uk-arrests-f...

PRC hacker in custody. The USG has been trying to make this happen for a very long time. This won't break Chinese cyberespionage but it might damage their talent pipeline. 1/x

A Chinese cyberespionage actor was arrested in Italy over the holiday and faces extradition to the US. The crew he's connected to is pretty serious. www.reuters.com/world/china/...

Great feature rolled out by AT&T. SIM swapping is consistently used by Scattered Spider and other actors to defeat MFA. cyberscoop.com/att-wireless...

Mis-read the start ("Beat Boxing"). Went to find a gif, forgot what I was looking for, so now you get this. ☀️🖤