404 Media is suing ICE for documents relating to its $2 million contract with Paragon Solutions. These are the journalists you should be supporting with your subscription money because they are meeting the moment. www.404media.co/were-suing-i...

The critical RCE Vulnerability in Microsoft #SharePoint was disclosed at #Pwn2Own in May. Because of Trend @thezdi.bsky.social, our customers have been protected since May. Stay up to date on the latest with this vulnerability here: https//www.trendmi...

Iran's APT42 (Charming Kitten) hacker team is now conducting targeted spearphishing attacks on high-profile Israeli national security journalists and cybersecurity researchers, according to Check Point. blog.checkpoint.com/security/edu...

Supposed experts and mainstream media have spent the past few days hyperventilating over reports of a colossal data breach that exposed more than 16 billion credentials. There’s just one inconvenient detail: evidence to support its sensational claim is lacking. cyberscoop.com/colossal-dat...

Iran has demonstrated its capability/intent to keep up cyber operations amid Israeli strikes. On Friday, an IRGC-linked group targeted Albania's capital in retaliation for the country hosting ~3k Iranian dissidents. The intrusion could disrupt services/expose data: www.politico.eu/article/iran...

News: The Washington Post has suffered a cyber intrusion that compromised the emails of at least several reporters at the paper, including those on the national security and economic policy teams, according to people familiar with the matter.

Google's @hultquist.bsky.social‬ says his threat intel team expects Iranian hackers to "rededicate themselves to attacks against Israeli targets" following Israel's bombing operation, though he says 🇮🇷-on🇮🇱 hacking "is already persistent and aggressive." US infrastructure could face more hacks too.

The cybercriminal group FIN6 (Skeleton Spider) is phishing recruiters by posing as job seekers on LinkedIn/Indeed and luring them to fake resume sites that deliver the "more_eggs" backdoor via AWS-hosted, CAPTCHA-protected pages. More from DomainTools: dti.domaintools.com/Skeleton-Spi...

"This research underscores the persistent threat Chinese cyberespionage actors pose to global industries and public sector organizations, while also highlighting a rarely discussed target they pursue: cybersecurity vendors." www.sentinelone.com/labs/follow-...

🥤& #threat-intel: CISA added Langflow Code Injection CVE-2025-3248 to the KEV on May 5. Recently, it has garnered considerable attention, with South Korea leading the pack. This vuln enables unauthenticated attackers to execute arbitrary code via /api/v1/validate/code viz.greynoise.io/tag...

@npr.org EXCLUSIVE: The Department of Agriculture is demanding states hand over personal data of food assistance recipients — including Social Security numbers, addresses and, in at least one state, citizenship status, according to emails shared with NPR.

Deploying realistic honeypots at scale is hard—DECEIVE makes it simple. Join David Bianco at #Honeynet2025 in Prague as he presents an AI-assisted SSH honeypot that enables high-fidelity deception with minimal effort. 📅 June 2–4, 2025 🔗 prague2025.honeynet.org #honeypots #llm #ai

In December, leading EdTech company PowerSchool was hacked, exposing the private information of tens of millions of American kids. PowerSchool paid the ransom to keep the data private. That apparently didn't work: somebody started using that data today to extort public schools in North Carolina.

🔥 Dispatch Debrief: April 2025 is live 🔥 Explore star sign-inspired hunting techniques, organizing your hunt squad, and the value of finding "nothing." Discover this month's insights from @thorcollective.bsky.social Dispatch - dispatch.thorcollective.com/p/april-debr...

Hm! He argues the CSRB has to evolve + be fully separated from CISA (it was dismantled at start of Trump 2.0), noting that, during the board's Salt Typhoon probe, some telcos got nervous and said they will not share information with the agency b/c CSRB is tied to the DHS office.

Initial probe into cause of power outages in Spain & Portugal today suggests fault rather than cyberattack, according to the European Union Agency for Cybersecurity (ENISA). “For the moment the investigation seems to point out to a technical/cable issue,” a spokesperson for the agency tells me.

When incidents hit, how you communicate shapes the outcome. This week’s @thorcollective.bsky.social Dispatch features @audrastreetman.bsky.social, former journalist turned cyber intel analyst. dispatch.thorcollective.com/p/how-commun...

News: @thekrebscycle.bsky.social, a target of Trump's wrath last week, is resigning from SentinelOne to focus fully on fighting back against against the White House's campaign to punish dissent. www.wsj.com/politics/pol...

If this contract ends, the damage will be immense. To be clear, that's immense damage to the US' ability to protect its computer systems, both in the commercial and in the public sectors. And yes, this includes critical infrastructure such as power, water, and transportation.

BREAKING. From a reliable source. MITRE support for the CVE program is due to expire tomorrow. The attached letter was sent out to CVE Board Members.

Infosec must not remain silent while Trump goes after Chris Krebs: www.eff.org/deeplinks/20...

THREAD: When @thekrebscycle.bsky.social and his workplace, @sentinelone.com, were singled out by Donald Trump on Wednesday, I thought it was an opportunity to weigh the cybersecurity industry's rhetoric against their real world actions.

“When you see important societal actors — be it university presidents, media outlets, C.E.O.s, mayors, governors — changing their behavior in order to avoid the wrath of the government, that’s a sign that we’ve crossed the line into some form of authoritarianism..” www.nytimes.com/2025/03/06/u...

Big Law has failed to stand up to Trump and now infosec is following suit.

“Reuters contacted 33 of the largest U.S. cybersecurity companies… for comment on Trump's action against SentinelOne. Only one offered comment on Trump's action. The rest declined, did not respond or did not answer questions.” www.reuters.com/world/us/cyb...

"The Chinese official’s remarks at the December meeting were indirect and somewhat ambiguous, but most of the American delegation in the room interpreted it as a tacit admission and a warning to the U.S. about Taiwan, a former U.S. official familiar with the meeting said" www.wsj.com/politics/nat...

So I stuck up for Sean Plankey as future CISA, now time to stick up for Chris Krebs, past CISA - this shit is bonkers and should give pause to anyone even considering federal employment if this kind of shit is what you get for doing your job: www.whitehouse.gov/fact-sheets/...

The Trump administration is now going after its first cybersecurity company, stripping @sentinelone.com of "any active security clearance." Will the infosec industry do any better than the legal industry in showing solidarity? www.whitehouse.gov/fact-sheets/...

New from WSJ: North Korea commands 8,000+ hackers who "can wait months or years to exploit a single slip in a company’s digital security." Over the past decade, regime has stolen more than $6 billion in cryptocurrency: www.wsj.com/world/asia/n...

The actor behind the alleged Oracle breach shared a class action complaint filed yesterday that claims #Oracle became aware of a ransomware attack on or around Jan. 22 and failed to report the data breach to customers as outlined in its privacy policies. www.pacermonitor.com/public/filin...

Sekoia found DPRK targeting of job seekers in the cryptocurrency sector has evolved to include the "ClickFix" tactic of displaying a fake error message in a browser to deceive users into executing malicious PowerShell to deploy the GolangGhost backdoor on Windows/macOS blog.sekoia.io/clickfix-tac...

The Cisco Talos 2024 Year in Review found that #ransomware actors are less likely to fully rebound from a law enforcement takedown if decryption tools are made publicly available. Compares the impact of the ALPHV takedown (key provided) vs LockBit (no key). blog.talosintelligence.com/content/file...

The Multi-State Information & Analysis Center contacted member states Wed night to share which services it can keep providing (Albert, MDBR, EDR, NCSR, & SOC) and which it can't (IR, CTI, member engagement, VDP) after its host organization lost federal funding. www.documentcloud.org/documents/25...

“The Lazarus Group’s campaign targeted applications used in cryptocurrency and authentication systems, embedding malware into trusted software packages. Developers unknowingly included these compromised packages in their projects...” securityscorecard.com/blog/operati...

Registration is open for the SANS New2Cyber Summit on March 13! The free virtual event is for anyone new to cybersecurity or looking to level up their skills. I'm presenting at 4:25pm ET about my career change from local TV news to cyber threat intelligence: www.sans.org/cyber-securi...

DHS has terminated the memberships of everyone on its advisory committees. This includes several cyber committees, like CISA's advisory panel and the Cyber Safety Review Board, which was investigating Salt Typhoon. That review is "dead," person familiar says. www.documentcloud.org/documents/25...

Congratulations @letswastetime.bsky.social, @davidjbianco.bsky.social, and Dr. Ryan Fetterman for being named the community winners in the “Innovation of the Year” category at the SANS Difference Makers Awards! So proud to work with you and see the impact of the PEAK Threat Hunting framework.

New on @darkreading.bsky.social: "The consequences of large-scale incidents, such as Log4j ..., have had lasting impacts on the cybersecurity world. However, cybersecurity defenders can learn from these experiences." By Audra Streetman @audrastreetman.bsky.social www.darkreading.com/vulnerabilit...

One of Romania's most important energy services companies has announced it is currently tackling an ongoing cyberattack. Electrica Group, which is listed on the Bucharest and London stock exchanges, published a note to investors on Monday warning of a “cyber attack in progress.”

In new commentary for Dark Reading, I explain how the lessons learned from large-scale incidents, like Log4j and the MOVEit breach, can help inform vulnerability prioritization: www.darkreading.com/vulnerabilit... #cybersecurity #infosec

Until CTI improves threat actor naming conventions and information sharing about attribution decisions, we should stop saying "aka" for all reports and instead say "overlaps with" because details do matter in the long run, despite those who don't care about attribution for their individual roles.

The pivoting from one telecommunications company to another, as described by T-Mobile's CSO, sounds similar to CrowdStrike's description of Liminal Panda exploiting eDNS servers in the GPRS network to compromise at least 13 telecoms globally since at least 2019... www.crowdstrike.com/en-us/blog/a...

I interviewed @t-mobileus.bsky.social CSO Jeff Simon about the recent Salt Typhoon attacks against US telecoms: "the technique that was used to go from one telecommunications infrastructure to another is not something that I've seen in my 15-plus-year career in cyber security."

NEWS: Top White House official Anne Neuberger says Chinese "Salt Typhoon" hackers have impacted dozens of countries in their massive espionage campaign and compromised at least eight U.S. telecommunications firms www.wsj.com/politics/nat...

The White House just held a press call to discuss the latest on China's "Salt Typhoon" hacking campaign against telecommunications companies. New detail: "At least eight" U.S. telcos have been hacked, deputy national security adviser for cyber Anne Neuberger said.

Senior CISA and FBI officials just held a background call to brief reporters on the status of their investigation into Chinese hacking of U.S. and foreign telecom companies. It sounds like telecoms are a long way from being able to evict the Chinese hackers from their networks.

"CISA and Partners Release Joint Guidance on PRC-Affiliated Threat Actor Compromising Networks of Global Telecommunications Providers" www.cisa.gov/news-events/...