🚨 #Shai-Hulud: Major npm supply chain attack. 100+ packages weaponized with stolen GitHub tokens, stealing secrets, hijacking repos, and auto-propagating like a worm. Guidance + detections inside www.wiz.io/blog/shai-hu...

New from 404 Media: airlines are selling *5 billion* ticketing records to the government for warrantless searching, per new docs we obtained. ARC is a data broker owned by United, American, Delta, etc. Then sells peoples' travel info to ICE, Secret Service, FBI etc www.404media.co/airlines-sel...

A private individual with power to get public servants fired, put them at physical risk, get them investigated, threaten their post government careers, go after their families and defame them with fantasies is an enormous threat to our national security and public well being. This can't stand.

A fun investigation from the team here at @wizsecurity.bsky.social www.wiz.io/blog/wiz-dis... Showing how leaked/stolen AWS keys can be used to enable other financially motivated schemes. (s/o to our friends at Proofpoint who helped us get some context on the phishing emails)

Now up to 22 different Cinnamon Toast Crunch related products. The quest continues.

I can't speculate on Trump's health in this new press conference but he just ribbed Alabama Senator Tommy Tuberville over Bama losing badly on Saturday. Tuberville coached Auburn, Bama's big in-state conference rival.

TL;DR I am launching my #startup and we are going to change how to evaluate,cluster and reason about #malware, delivering accurate,contextual intelligence on samples. Say Hi to RationalEdge @rationaledge.bsky.social rationaledge.io #threatintel #threathunting #cti #reverseengineering #detection 1/9

The summer of 2025. What we were promised Vs What we got

On the left: Nate Cavanagh, a 28-year-old DOGE staffer and college dropout. On the right: Mohammad Halimi, a 53-year-old exiled Afghan scholar. This is the story of how DOGE targeted Halimi on social media. Then the Taliban took his family. 🧵

1/ We've just released a new report uncovering new infrastructure tied to multiple activity clusters linked to the Israeli spyware vendor #Candiru across several countries. Full report: www.recordedfuture.com/research/tra...

⚡Meet our Lightning Talk speakers at #BindingHookLive: @euben.bsky.social, @melissakgriffith.bsky.social, @benread.bsky.social, @disclosing.observer, Lena Riecke and Selena Larson! Request your invite: bindinghooklive.com

🍎 machofile 🍏 first official release is finally live: github.com/pstirparo/ma... It is a python module to parse #Mach-O binary files, with a focus on malware analysis and reverse engineering. machofile is self-contained. #macho #ios #reverseengineering #detection #threathunting #threatintel 1/3

This thread has somehow hit 20 different Cinnamon Toast Crunch-related products.

@volexity.com is looking to grow our Threat Intelligence team. New job posting for Senior Analyst role is up here: www.volexity.com/company/care... If you have any questions, don't hesitate to ask.

New from me: China has been ramping up its public attribution against Taiwan, likely in an attempt to shift the conversation on cyber intrusions and pressure the island and they're using their private sector cybersecurity companies to do it. Read the piece, but a few highlights, take aways in this 🧵

#PublicAttribution of cyber activities is #China’s latest technique for pressuring #Taiwan and shaping the international dialogue around #cybersecurity. @benread.bsky.social digs into the details on Binding Hook: bindinghook.com/articles-hoo...

New from the one and only pun-king @mkyo.bsky.social on the increased and ongoing Chinese targeting of semiconductor-related organisations in Taiwan. Edge device exploitation may be the TTP of the moment, but Chinese groups still go phishing when the chips are down www.proofpoint.com/us/blog/thre...

As part of @gmfus.bsky.social's Taiwan-EU-US policy fellowship, I wrote about the opportunity Europe has to build cyber defense links with Taiwan and how it would benefit both sides. Read that and the other 10 pieces from the other fellows here: www.gmfus.org/news/next-ge...

17th and 18th varieties discovered in upstate New York

some other highlights: - this cluster tried to re-establish relationships after we disabled their accounts by creating new, similarly named accounts. very persistent! - if you thought their device linking phase was over, think again! susp apt29 groups looove this & want to make it seem more legit

It’s time for a new hoodie. I’m joining @wizsecurity.bsky.social as the Director of Strategic Threat Intelligence. I’m super excited to join the team and help shape the future of cloud threat intel.

For those unfamiliar, Ellen Nakashima is also one of the best natsec/intelligence/cyber reporters in the world, and has been for decades, in no small part because of course she cultivates high level sources instead of relying on official agency press offices.

New DISCARDED podcast drop! Join @greg-l.bsky.social and me as we talk about our fave North Korean groups, DPRK as the neglected child, TA406 and the Russian connection, and finally, the dreaded but pervasive IT worker problem podcasts.apple.com/us/podcast/c... open.spotify.com/episode/01d1...

Some personal news….I’ve turned in the badge & laptop and am departing Google. After a decade at iSight/Mandiant/GTIG the time has come for a new adventure. I’m grateful to everyone I worked with and learned so much from. Will share my new role soon, but for now, I’m doing a little recharging.

In a time where the cybersecurity industry has opted for a safe neutral position on things like racism and fascism, I was pleased to see @bittner.hachyderm.io.ap.brid.gy and his team at the CyberWire do a special episode on Juneteenth thecyberwire.com/podcasts/spe...

There are currently two roles open at Insikt Group, one Senior Analyst focused on Iran and one Analyst focused on Rest of the World. Reach out if you have questions: job-boards.greenhouse.io/recordedfutu... job-boards.greenhouse.io/recordedfutu...

Double scoop : We got to talk to Brett Leatherman about his new role as head of the FBI's Cyber Division, and we broke the news of the latest Salt Typhoon victim to be identified, satellite comms company Viasat: www.bloomberg.com/news/article...

Has anyone used the term "Cyber Industrial Base" to describe the ecosystem of companies that support cyber operations? Thinking mostly about the PRC, but could apply lots of places.

This policy alone will do enough to slow PRC brain drain into the United States that China should remove Rubio from its sanctions list as a gesture of appreciation.

Really great research here and good work by the team to cut off a C2 channel.

16th different Cinnamon Toast Crunch related food I've found

New at the Post: The White House plans to ramp up cyber attacks on China but are cutting the main civilian cyber defense agency, #CISA. With hacks of U.S. infrastructure already surging, officials and experts told me the U.S. is wide open to retaliation. GIFT LINK, please share. wapo.st/45mUXlq

If you’ve been laid off from a cyber intel position, please reach out if you’d like to come to @sleuthcon.bsky.social.

I wrote some details on LOSTKEYS: malware which we directly attribute to COLDRIVER. They don't deploy it often, but we have seen it a few times and want to make people aware of it. cloud.google.com/blog/topics/...

"all of these tragedies would not happen" <alonzo_mourning.gif> via: blog.360totalsecurity.com/en/what-if-h...

Look who finally joined Bluesky

"all of these tragedies would not happen" <alonzo_mourning.gif> via: blog.360totalsecurity.com/en/what-if-h...

As a society we need to put a time limit on what can be an "Emerging Threat" if something has been around for 60 years, it can no longer be categorized that way. The CTI industry is guilty of this, but it's not just us. What time limit do people think is reasonable? 5 years?

Go Mammoths (Cross Country is Football) @edsbs.bsky.social @newap-georgia.bsky.social @shutdownfullcast.bsky.social

MDaaS?

My first blog with Proofpoint is live! And we love a good crossover. State-sponsored actors try their hand at ClickFix - the hottest thing in cybercrime. Meet the North Koreans, Iranians, and Russians who are upping their social engineering game www.proofpoint.com/us/blog/thre...

Infosec must not remain silent while Trump goes after Chris Krebs: www.eff.org/deeplinks/20...

The answer, my friends, is no. www.reuters.com/world/us/cyb...

The executive order targeting Chris Krebs and S1 is absurd and puts petty, misplaced vindictiveness over national security.

It’s a bid to transition the United States into a reactionary hegemon (culturally, economically, etc.). They do intend to keep the hegemony bit, but they’re fundamentally mistaken that it is possible without the liberal scaffolding.

Excellent breakdown of the “Rogue RDP” TTP we’ve seen susp Russian APT UNC5837 using in their campaigns written by my colleague Rohit (@IzySec over on X)