New report from Positive Technologies vivisects recent (2024-2025) APT31 attacks targeting Russian IT firms specifically government contractors and integrators ptsecurity.com/research/pt-...

“Providing tech services to supercharge ICE operations while blocking tools that support accountability of ICE officers is entirely backwards." - @kateruane.bsky.social www.404media.co/google-has-c...

Never assume your audience knows what acronyms stand for.

Remember NFTs? 😂😂😂😂😂😂😂

An interesting article talking about public attribution and the lack thereof in Indonesia and India on @bindinghook.bsky.social. bindinghook.com/india-and-in...

New Iran drop from me tracking an attribution nightmare - UNK_SmudgedSerpent! A little Charming, a little Muddy, and a lot C5. Targeting policy experts with benign conversation starters, health-themed infra, OnlyOffice spoofs, and RMMs. Check out the full story www.proofpoint.com/us/blog/thre...

It's a good night, but I'm a little concerned that New York is going to have a mayor that knows this song: youtu.be/WZzCHcMKyDc?... #NESCAC

I love kids. I have two of them. They’re amazing. However, kids are the absolute least self aware, clumsiest little puffins on the planet. Please don’t drive tonight unless you have to, and if you do drive, drive super slow and pay 100% attention at all times. Happy Halloween! 🎃 👻 💀 #PublicHealth

The romantic fables of peoplehood, of real “men with chests” (Fukuyama 2018) who make national histories… once you treat debates about liberalism in the Global South as reflecting the same common impulses that motivates illiberal politics everywhere else, you begin to see our common humanity /end

Follow this thread 👇 With the inaugural SOS just 18 days away, we'll be highlighting a few of the amazing talks you'll be hearing on October 28 in Brussels! stateofstatecraft.com/agenda Get a ticket while you still can! 🎟️🎟️🎟️

"What if, in the process of trying to ban AI products that quite actually encourage children to kill themselves, we wind up banning chatbots that help children cheat on their homework, diminish their propensity for critical thought, and lead to the development of other forms of AI psychosis?"

Berlin

“James Comey’s rights and liberties are not the only ones at risk today. So is your own right to participate in free and fair elections in order to render a verdict on Trump’s invasion of those rights and liberties.” From @davidfrum.bsky.social apple.news/AX8_ub4UHR0G...

🚨 #Shai-Hulud: Major npm supply chain attack. 100+ packages weaponized with stolen GitHub tokens, stealing secrets, hijacking repos, and auto-propagating like a worm. Guidance + detections inside www.wiz.io/blog/shai-hu...

New from 404 Media: airlines are selling *5 billion* ticketing records to the government for warrantless searching, per new docs we obtained. ARC is a data broker owned by United, American, Delta, etc. Then sells peoples' travel info to ICE, Secret Service, FBI etc www.404media.co/airlines-sel...

A private individual with power to get public servants fired, put them at physical risk, get them investigated, threaten their post government careers, go after their families and defame them with fantasies is an enormous threat to our national security and public well being. This can't stand.

A fun investigation from the team here at @wizsecurity.bsky.social www.wiz.io/blog/wiz-dis... Showing how leaked/stolen AWS keys can be used to enable other financially motivated schemes. (s/o to our friends at Proofpoint who helped us get some context on the phishing emails)

Now up to 22 different Cinnamon Toast Crunch related products. The quest continues.

I can't speculate on Trump's health in this new press conference but he just ribbed Alabama Senator Tommy Tuberville over Bama losing badly on Saturday. Tuberville coached Auburn, Bama's big in-state conference rival.

TL;DR I am launching my #startup and we are going to change how to evaluate,cluster and reason about #malware, delivering accurate,contextual intelligence on samples. Say Hi to RationalEdge @rationaledge.bsky.social rationaledge.io #threatintel #threathunting #cti #reverseengineering #detection 1/9

The summer of 2025. What we were promised Vs What we got

On the left: Nate Cavanagh, a 28-year-old DOGE staffer and college dropout. On the right: Mohammad Halimi, a 53-year-old exiled Afghan scholar. This is the story of how DOGE targeted Halimi on social media. Then the Taliban took his family. 🧵

1/ We've just released a new report uncovering new infrastructure tied to multiple activity clusters linked to the Israeli spyware vendor #Candiru across several countries. Full report: www.recordedfuture.com/research/tra...

⚡Meet our Lightning Talk speakers at #BindingHookLive: @euben.bsky.social, @melissakgriffith.bsky.social, @benread.bsky.social, @disclosing.observer, Lena Riecke and Selena Larson! Request your invite: bindinghooklive.com

🍎 machofile 🍏 first official release is finally live: github.com/pstirparo/ma... It is a python module to parse #Mach-O binary files, with a focus on malware analysis and reverse engineering. machofile is self-contained. #macho #ios #reverseengineering #detection #threathunting #threatintel 1/3

This thread has somehow hit 20 different Cinnamon Toast Crunch-related products.

@volexity.com is looking to grow our Threat Intelligence team. New job posting for Senior Analyst role is up here: www.volexity.com/company/care... If you have any questions, don't hesitate to ask.

New from me: China has been ramping up its public attribution against Taiwan, likely in an attempt to shift the conversation on cyber intrusions and pressure the island and they're using their private sector cybersecurity companies to do it. Read the piece, but a few highlights, take aways in this 🧵

#PublicAttribution of cyber activities is #China’s latest technique for pressuring #Taiwan and shaping the international dialogue around #cybersecurity. @benread.bsky.social digs into the details on Binding Hook: bindinghook.com/articles-hoo...

New from the one and only pun-king @mkyo.bsky.social on the increased and ongoing Chinese targeting of semiconductor-related organisations in Taiwan. Edge device exploitation may be the TTP of the moment, but Chinese groups still go phishing when the chips are down www.proofpoint.com/us/blog/thre...

As part of @gmfus.bsky.social's Taiwan-EU-US policy fellowship, I wrote about the opportunity Europe has to build cyber defense links with Taiwan and how it would benefit both sides. Read that and the other 10 pieces from the other fellows here: www.gmfus.org/news/next-ge...

17th and 18th varieties discovered in upstate New York

some other highlights: - this cluster tried to re-establish relationships after we disabled their accounts by creating new, similarly named accounts. very persistent! - if you thought their device linking phase was over, think again! susp apt29 groups looove this & want to make it seem more legit

It’s time for a new hoodie. I’m joining @wizsecurity.bsky.social as the Director of Strategic Threat Intelligence. I’m super excited to join the team and help shape the future of cloud threat intel.

For those unfamiliar, Ellen Nakashima is also one of the best natsec/intelligence/cyber reporters in the world, and has been for decades, in no small part because of course she cultivates high level sources instead of relying on official agency press offices.

New DISCARDED podcast drop! Join @greg-l.bsky.social and me as we talk about our fave North Korean groups, DPRK as the neglected child, TA406 and the Russian connection, and finally, the dreaded but pervasive IT worker problem podcasts.apple.com/us/podcast/c... open.spotify.com/episode/01d1...

Some personal news….I’ve turned in the badge & laptop and am departing Google. After a decade at iSight/Mandiant/GTIG the time has come for a new adventure. I’m grateful to everyone I worked with and learned so much from. Will share my new role soon, but for now, I’m doing a little recharging.

In a time where the cybersecurity industry has opted for a safe neutral position on things like racism and fascism, I was pleased to see @bittner.hachyderm.io.ap.brid.gy and his team at the CyberWire do a special episode on Juneteenth thecyberwire.com/podcasts/spe...

There are currently two roles open at Insikt Group, one Senior Analyst focused on Iran and one Analyst focused on Rest of the World. Reach out if you have questions: job-boards.greenhouse.io/recordedfutu... job-boards.greenhouse.io/recordedfutu...

Double scoop : We got to talk to Brett Leatherman about his new role as head of the FBI's Cyber Division, and we broke the news of the latest Salt Typhoon victim to be identified, satellite comms company Viasat: www.bloomberg.com/news/article...

Has anyone used the term "Cyber Industrial Base" to describe the ecosystem of companies that support cyber operations? Thinking mostly about the PRC, but could apply lots of places.

This policy alone will do enough to slow PRC brain drain into the United States that China should remove Rubio from its sanctions list as a gesture of appreciation.

Really great research here and good work by the team to cut off a C2 channel.

16th different Cinnamon Toast Crunch related food I've found

New at the Post: The White House plans to ramp up cyber attacks on China but are cutting the main civilian cyber defense agency, #CISA. With hacks of U.S. infrastructure already surging, officials and experts told me the U.S. is wide open to retaliation. GIFT LINK, please share. wapo.st/45mUXlq

If you’ve been laid off from a cyber intel position, please reach out if you’d like to come to @sleuthcon.bsky.social.

I wrote some details on LOSTKEYS: malware which we directly attribute to COLDRIVER. They don't deploy it often, but we have seen it a few times and want to make people aware of it. cloud.google.com/blog/topics/...

"all of these tragedies would not happen" <alonzo_mourning.gif> via: blog.360totalsecurity.com/en/what-if-h...