New from me and the @wizsecurity.bsky.social CIRT team. A novel suspected DPRK crypto targeting cluster. Their tactics are familiar (compromise via supply chain, job interviews) but their malware and infrastructure is different. www.wiz.io/blog/threat-...

This is nothing short of a bombshell. One of the most trusted media groups in Indonesia has released a report on Russian and Chinese influence operations in Indonesian social media, which blamed local protests on deliberate U.S. meddling. 🧵 1/

Russia and China consider new steps to expand their digital cooperation including on software development and satellite Internet and declare adherence to cyber norms. In this post, I review the relevant sections of the recent joint statement from Beijing fromcyberia.substack.com/p/putin-and-...

After this week's Github breach, we checked in on hacker group TeamPCP's victim count: their supply chain attacks have tainted more than 500 pieces of software (a thousand-plus different version) and breached hundreds of companies. This is out of control. www.wired.com/story/teampc...

Why do some states routinely target civilian systems and commit operational errors, risking escalation, while others pursue highly restrained and carefully calibrated cyber operations, investing enormous amounts of time and resource? www.tandfonline.com/doi/full/10....

New TeamPCP operation targeting Durable Task SDK for Python via PyPl. www.wiz.io/blog/durable...

Shame on the government of Zambia for buckling under Chinese government pressure over Taiwan and canceling this year’s @rightscon.org. www.rightscon.org/rc26-stateme...

Amherst/Weslyan/Williams

I laundered my Amherst College contribution through the only 5-college team on the list (UMASS), but I had to do my part. #GoMammoths @edsbs.bsky.social @newap-georgia.bsky.social @hollyanderson.bsky.social

Lotus Wiper was likely used to attack PDVSA One important thing that the Kaspersky report omits is that pdvsa[.]com is hardcoded into OhSyncNow.bat, a file that triggers the wiping operation (HT @benread.bsky.social). This is used to limit the attack to the specified domain 1/11

Congratulations, Virginia! Republicans are trying to tilt the midterm elections in their favor, but they haven’t done it yet. Thanks for showing us what it looks like to stand up for our democracy and fight back.

Awful to see Jorgenson crash like that. Gutted for him, I hope it's not as bad as it looked. #AGR26

This paper represents a small but deeply impressive and genuinely important achievement by the much maligned British state in what is probably the most important global issue of our era. Hear me out ( 🧵) 1/ www.aisi.gov.uk/blog/our-eva...

I'm live with the @huntress.com folks for Tradecraft Tuesday on axios and DPRK if you want to hang out: events.zoom.us/ejl/AnrTlSR3...

WOUT!!

Ok on a serious note, it cannot be exaggerated how bad formalized Iranian control of the Strait is for the world. The entire global economy rests on an American guarantee of free commercial shipping. That guarantee is gone. We don’t know exactly what will happen but none of it will be good.

🚨 500+ malicious PRs. One campaign. Wiz Research traced 6 waves of prt-scan starting 3 weeks earlier. AI-powered, automated attacks exploiting pull_request_target. Low success rate—but real npm + cloud creds hit. Full story: www.wiz.io/blog/six-acc...

North Korea is good at supply-chain attacks: www.cnn.com/2026/03/31/p...

Do you like these pictures I took

🐺🐺🐺

Let’s go Huskies.

U.S. foreign policy has been captured by dorks obsessed with the movie 300 and the only way to fix it is to put in power dorks obsessed with the movie Master and Commander.

Our write-up of the LiteLLM supply chain compromise earlier today. Tactics remain the same (with a new exfil domain), but they keep coming.

Another One: KICS GitHub Action compromised by TeamPCP A few new TTPs here, will have more updates later today: www.wiz.io/blog/teampcp...

I keep seeing this framing like Bremmer's. It is wrong. Instead: 1. Iran was developing an ICBM when Khamenei imposed a 2,000-km range limit. 3. The programs shifted to space launch. 4. Khamenei lifted the restriction in October 2025 after the June attacks. 5. Now he's dead, and here we are.

💣Supply Chain attack affecting the Trivy scanner. 💣 Last night a malicious version (0.69.4) was published. This version steals credentials, cryptocurrency and keys from affected machines and installs a small python script for persistence. www.wiz.io/blog/trivy-c...

I’ve been critical of Iran’s pre-war deterrence practices, but this seems like a reasonable intra-war deterrence success.

Get your tickets (and CFPs) now! This conference is always a great time and you learn a lot.

Me in slack:

Pretty funny to work for an entity that can be abbreviated as BOFA and badly fall for a blatantly obvious trick

Kaspersky recently produced a podcast on Operation Triangulation, basically a story of the investigation Things that I haven't seen mentioned elsewhere: — Triangulation malware existed for >10 years — Some technical details similar to the Equation Group www.youtube.com/watch?v=j4pC...

A 1999 assessment by DoD OGC briefly mentions a draft treaty on information warfare that circulated on the Internet in 1995. Does anyone have any idea what it was or where on the Internet it could have been circulated? (Source: nsarchive.gwu.edu/document/214...)

reading "Bombing to Win" on the subway and shaking my head to show everyone I'm against bombing to win

I also have two affiliations with US universities in a similar situation, but it is somehow with the US Department of Defense.

While some cyber attacks from Iran might increase, keep in mind that many Iranian hackers face Internet shutdowns, instability caused by U.S./Israeli strikes, etc. So they won't be very active Note this from a recent F6 report on Persian ransomware www.f6.ru/blog/c77l-ra...

It's interesting how we keep seeing major publications getting reporting on successful high-stakes CIA operations and intelligence soon after they happen.

My take on Learning Resources v. Trump: the elephant in the room in Chadha and the legislative veto. fivepoints.mattglassman.net/p/the-court-...

You know who else posted a misleading video to "Enter Sandman"... www.justice.gov/archives/opa...

/remembers a LetsRun post that was similar /finds LetsRun post (www.letsrun.com/forum/flat_r...) /letsrun post was 21 years ago /crumbles into dust

I've been name checking Bombing to Win when we cover CNA in my Cyber Operations class for years, but now thanks to @sodrock.bsky.social , I can do it with a meme I don't fully understand.

SOS returns to Brussels on October 22, 2026! As the geopolitical landscape rifts, hybrid threats continue to adapt & evolve. We provide a forum for observers of state-aligned sabotage, espionage, and more to share research with an action-oriented community. Stay tuned for more announcements!

23 different Cinnamon Toast Crunch products in the thread now.

The US focused class of my and @hultquist.bsky.social "Global Cyber Operations" is on April 9, will we have a new cyber strategy to discuss by then? The race is on.

“We need not lose faith in the administrative state itself; we would do better to view it as having functioned with its hands tied tighter and tighter. But we are now starting, particularly in the climate and energy space, to hit real limits.” At @scientistsorg.bsky.social fas.org/publication/...

We have access to the data (could cross-check authenticity with a different leak we were able to obtain) and ran analysis on views counts to find out when the campaign seems to be effective (according to their own metrics) www.zdfheute.de/politik/russ...

New, by @lorenzofb.bsky.social: Google sent personal and financial data about a student and journalist, who attended a pro-Palestine protest in 2024, to ICE agents in response to an "administrative subpoena," which had not been approved by a judge.

A site tracking recent purges in the PLA vs purges at the Trump-Hegseth Pentagon purge-comparison.vercel.app