"The best netflow comes from asking friends for favors." -- @jags.bsky.social @craiu.bsky.social

[FR][EN]Our last report on Storm-1516, a russian information manipulation set (IMS) likely to affect the French and European debate. So proud of my team! Feel free to share and enjoy. #FIMI

🔥 NEW pod alert! Signalgate and Signal's ID management nightmares, who's the mysterious APT caught in Russia, the return of Lab Dookhtegan and coordinated hack-for-leak ops @craiu.bsky.social @jags.bsky.social Apple: bit.ly/3budprob YouTube: bit.ly/TBP-YT Spotify: bit.ly/3DH5wEO

This week, four buddies, no problems! Katie Moussouris is joining the show 🌺 Set your alarms ⏰ Spotify: bit.ly/3DH5wEO Apple: bit.ly/3budprob YouTube: bit.ly/TBP-YT @k8em0.bsky.social @craiu.bsky.social @jags.bsky.social

A brand-new pod for your weekend earholes. The show is available on all platforms @craiu.bsky.social @jags.bsky.social securityconversations.com/episode/a-ha...

🇨🇳🇺🇸🕵️ On the pod, we unpacked a new report on what China knows about NSA intrusions @jags.bsky.social @craiu.bsky.social www.linkedin.com/posts/ryanar...

Good news, there appear to be no need to cancel the results of the German elections!

Three Buddy Problem heads-up: The pod will be a day late this week because of travel schedules. Catch up on Spotify open.spotify.com/show/6dXbRag...

Tuned in to listen to a pretty nuanced take on Salt Typhoon, got jump scared by @jags.bsky.social mentioning my name lol

Three Buddy Problem Episode 28 - the first of 2025, is out! We discuss the US Treasury/BeyondTrust hack, APT group naming bad examples of bad examples, a new variant of the Xdr33 malware and exclusive new information on the Cyberhaven hack. securityconversations.com/episode/us-t...

“Today, more seasoned hackers are recruiting kids from the gaming world, said Allison Nixon, chief research officer at online investigations firm Unit 221B. ‘There’s a talent pool in those videogames that can be drawn from and fraud groups have realized this.’” www.wsj.com/tech/cyberse...

Proud and honored to see @viginum.bsky.social ’s investigation on the Portal Kombat disinformation network mentioned in @craiu.bsky.social’s top of the top 2024 research list. Thank you & Kudos to the DivOps team! @colingerard.bsky.social medium.com/@costin.raiu...

New pod alert! @craiu.bsky.social @jags.bsky.social podcasts.apple.com/us/podcast/s...

🎁🧐 NEW! Episode 26 is gift-wrapped and delivered with spicy hot takes on CISA's VPN advice, banning TP-Link, bombing ransomware hackers and Cellebrite/Android 0days @craiu.bsky.social @jags.bsky.social Enjoy wherever pods are found! securityconversations.com/episode/us-g...

On the YouTubes! @jags.bsky.social @craiu.bsky.social youtu.be/khT86zvLJXE?...

For Christmas, the Three Buddy Problem pod will be looking back at the best security research that was published in 2024. Special buddy cookies to those who were outstanding. Extra points for obscure ones! @craiu.bsky.social @jags.bsky.social Link: docs.google.com/forms/d/e/1F...

What is the link between the canceling of the presidential elections in Ro, foreign influence, Russia and TikTok? Episode 24 of the Three Buddy Problem podcast deep dives into the topic with local insights: securityconversations.com/episode/insi...

Help us choose the best security research of 2024:

Three Buddy Problem: Volexity's Steven Adair joins the show 🔥 @stevenadair.bsky.social @craiu.bsky.social @jags.bsky.social Enjoy securityconversations.com/episode/vole...

If you have not listened to the latest episode #ThreeBuddyProblem 🎙️then it is high time to catch up 😁 #PIVOTcon #PIVOTcon25 was mentioned 🙏🤟💪 Love it! cc: @ryanaraine.bsky.social @craiu.bsky.social @jags.bsky.social

A band new Three Buddy Problem episode for your weekend earholes! 🔥 with @craiu.bsky.social @jags.bsky.social We cover Volexity’s discovery of Russian APT Wi-Fi “nearest neighbor attacks,” the Chinese surveillance state, Salt Typhoon realities, and more... LISTEN open.spotify.com/episode/2Bop...

@hultquist.bsky.social kicks off this year's #CYBERWARCON.

Russian spies—likely Russia's GRU intelligence agency—used a new trick to hack a victim in Washington, DC: They remotely infected another network in a building across the street, hijacked a laptop there, then breached the target organization via its Wifi. www.wired.com/story/russia...

Here's a job opening for PaloAlto Unit 42 (Sr. Principal Threat Researcher) that mentions #synapse experience would be a plus! 🎉💚 jobs.smartrecruiters.com/PaloAltoNetw...

🔥 TPB Episode 21 is live on all platforms! The future of CISA is a recurring theme of an episode filled major gov-level hacking attacks from Iran, China... securityconversations.com/episode/what...

if plugx is your game, open dir with live payloads 103.43.18[.]71:88 #apt #malware files archived here for homegamers github.com/StrikeReady-...

The Three Buddies Problem podcast episode 21 is now live! Together with @ryanaraine.bsky.social and @jags.bsky.social we talk geography, cyber magic walls, Aria Sepehr Ayandehsazan aka Emennet Pasargad, Predatory Sparrow and of course, magic money #bitcoin: securityconversations.com/episode/what...

France's former domestic spy chief on trial for allegedly collecting classified info for Luis Vuitton owner Bernard Arnault. Bernard Squarcini allegedly spied on a former journalist and current MP who made a documentary critical of Arnault and on Hermès, a competitor of Arnault. (archive.ph/VAocp)

Look who finally showed up!

here's what today's russian apt phish campaign looked like, targeting ukraine tuyt8erti867i.synergize[.]co -> jkbfgkjdffghh.linkpc[.]net 44935484933a13fb6632e8db92229cf1c5777333fa5a3c0a374b37428add69fb

Blog when? 🥰

CISA+FBI want you to stop coding in C/C++. Agree?

The Three Buddy Problem Episode 20 podcast is now live! We revisit the ‘hack-back’ debate, hot nuggets in Clem's Hexacon talk, Apple’s new iOS update rebooting iPhones in LEA custody, the mysterious GoblinRAT backdoor and more! LISTEN: securityconversations.com/episode/myst...

As more folks migrate away from a certain crowded, corrupted social media hellscape and arrive here, a couple lists below of accounts to follow in the cybersecurity community and my fellow WIRED reporters and editors:

There’s a cyber starter pack here: go.bsky.app/JvFS98y And we have wired journalists too go.bsky.app/Acr6kiY

🚩Hash: 823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962 🎯Malware name: Pygmy Goat 🔹Comment: Pygmy Goat is a native x86-32 ELF shared object that was discovered on Sophos XG firewall devices, providing backdoor access to the device. t.co/6zF2He5nHE

I'm new to BlueSky. Whom should I follow for interesting CTI posts?

The Three Buddies Problem episode 18 is now on YouTube - watch us discuss the Sophos kernel mode implant, the Pope's telemetry gathering efforts and CIA success stories in Venezuela: www.youtube.com/watch?v=wn8n...

The Three Buddy Problem podcast Episode 19 just published! We explore Ivan Kwiatkowski’s essay on the limits of threat intel, Sophos using kernel implants to surveil Chinese hackers, the concept of ‘hack-back’, geopolitical layers of cyber espionage&more: securityconversations.com/episode/the-...

Sophos detailed to me its 5-year cat-and-mouse game with Chinese hackers repeatedly exploiting its firewalls. The company resorted to installing spy "implants" on devices the hackers were testing on—tracing them to a university and contractor in Chengdu. www.wired.com/story/sophos...

Sophos engineers preparing their revenge against the Chengdu hackers #PacificRim

Listen to the Three Buddy Problem podcast – Ep. 18! Cast: Juan Andres Guerrero-Saade (SentinelLabs), Costin Raiu (me! @craiu.bsky.social / Art of Noh) and Ryan Naraine (SecurityWeek). securityconversations.com/episode/fort...

Perfect conference location #pivotcon

Yara rules too slow? Not finding the needle in the APT haystack? Too many warnings or too many false positives? Turkey in the oven, got spare time? Join @trompi and myself tomorrow for cool yara tips and tricks, #Thanksgiving edition! www.brighttalk.com/webcast/1828...

Russia's Sandworm hackers breached Ukraine's power grid again to trigger a blackout for the third time. In this case, it coincided with missile strikes, the first such combination of digital and physical attack of this kind. https://www.wired.com/story/sandworm-ukraine-third-blackout-cyberattack/

Belts are not the ultimate goal but rather a reflection of one's commitment to the art. Thank you master Goci, for having spent so many evenings, patiently, teaching us, always pushing for more, encouraging to overcome our limits and become not just faster and stronger but also more resilient.