Foreign actors have been compromising domestic routers for years because they’re unpatched and/or end of life, so they ban foreign routers. By summer, after years of foreign actors compromising domestic telcos also because of poor cyber hygiene, they will ban foreign telcos.

follow malware and you get malware authors and malware payloads. follow the infrastructure and you don't know where the fuck it's gonna take you.

First repeatable attribution framework for threat intel teams since the Diamond Model as far as I know…

First VoidLink, now HONESTCUE. Fair to assume AI generated malware frameworks are only going to exponentially grow… cloud.google.com/blog/topics/...

“The uncomfortable lesson of Salt Typhoon is not that Beijing has futuristic capabilities. It’s that Washington often treats major intrusions as proof of overwhelming adversary sophistication, when in reality, basic, preventable weaknesses still account for much of the vulnerability.” 🎯

Something not many are saying or those involved are considering, everyone involved will almost certainly be investigated by the next administration, whether it be for criminal or civil lawsuits against the officers involved, or the administration officials obstructing the investigation.

Germany’s foreign intelligence agency (BND) intercepted phone conversations of former President Barack Obama while he was aboard Air Force One over several years. The interceptions exploited vulnerabilities in the aircraft’s encryption and known frequencies. www.zeit.de/politik/ausl...

T-Mobile users like, “There’s no way coverage is that good.”

Scoop: The lone employee behind CISA's Pre-Ransomware Notification Initiative resigned on Friday rather than take a forced reassignment to FEMA. CISA says PRNI will continue, but sources said David Stern's loss will be a major setback for it. My story: www.cybersecuritydive.com/news/cisa-ra...

Success in AI won’t just be because of chips and algorithms, but just as, if not more, importantly, data centers and power generation. www.nytimes.com/2025/12/22/c...

In order: data security and management, cloud security, identity management. Goes without saying, protections should follow data - but what does that mean in a world of AI? How are you ensuring only those authorized to see or know certain things, are? www.cybersecuritydive.com/news/ai-secu...

Where is the closest rooftop? There is something I would like to shout. “AI is currently a force multiplier on existing attacker tradecraft, not a source of fundamentally new TTPs.” www.recordedfuture.com/blog/ai-malw...

Straight up, I developed and taught — and @kikta.net now teaches — an entire course at the @alperovitch.institute that boils down to “you can shape adversary cyber activity but you can’t deter it because that’s how intelligence operations work”. Being mad at China for playing the game is ridiculous.

I explained to my class week that despite all the panic about state actor capabilities: -The biggest threat to electricity is squirrels -Minecraft skids have the best DDoS capabilities -No amount of disruption could ever beat misconfiguration, with DNS at the top of the list

EXCLUSIVE: President Donald Trump has decided not to nominate Army Lt. Gen. William Hartman to be the next leader of U.S. Cyber Command and the National Security Agency. On @therecordmedia.bsky.social therecord.media/william-hart...

Data center security being the Achilles heel of AI has been the topic of concern for the last year or two. I think the biggest takeaway from this piece is the need for a business continuity plan - being ready to go back to manual processes where AI has taken over. www.scworld.com/perspective/...

Peter Kyle raised eyebrows last year when he said he was made, just hours into office, “very very aware that there was a cybersecurity challenge that our country faced that I simply wasn’t aware of before.” We report a secret briefing by intel chiefs was responsible: therecord.media/cyberattack-...

Microsoft: Multiple subsea fiber cuts in the Red Sea impacting global communications azure.status.microsoft/en-us/status

Interesting attack vector. Essentially the AI equivalent of domain squatting, except with AI model names. www.securityweek.com/ai-supply-ch...

🚨New research drop: Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms It was a pleasure collaborating with Sreekar Madabushi and @kennethkinion.bsky.social from Validin! Read our blog post: s1.ai/nk-ops

Legislation to renew two federal cybersecurity laws has finally begun moving through Congress, but it’s unclear if lawmakers will be able to pass both bills before an end-of-the-month deadline. On @therecordmedia.bsky.social therecord.media/house-homela...

New by me - Citrix have forgot to tell you a zero day was under exploitation earlier this year to successfully backdoor devices at "critical" organisations, and no vendor released technical details. More to come, including on CVE-2025-7775 too. doublepulsar.com/citrix-forgo...

The timing of this announcement on the same day that the US and its allies called out Chinese technology companies for hacking is nothing short of ironic…

While its expiration isn’t ideal, it isn’t the end of the world. Not all of gov use it, nor do all private orgs want to share under them due to their requirements. It makes it easier on those that don’t want to do the legwork, but it is certainly not the only solution. cyberscoop.com/cisa-2015-ex...

Cyber Command has the talent. Now it needs the tools, speed, and innovation to match.

“Agentic AI is really AI that can take action on your behalf, right? That will become the next insider threat, because, as organizations have these agentic AI deployed, they don’t have built-in guardrails to stop somebody from abusing it”

“True deterrence requires the capacity to continuously undermine an adversary’s capabilities and prepare to impose unacceptable costs.” Great op-ed presenting the state of play and how the US may be able to course correct its approach to cyber policy. www.foreignaffairs.com/china/china-...

Great example of how cybersecurity is a community.

Remember: Data poisoning doesn’t stop with model training data in RAG environments. www.scworld.com/feature/llm-...

While I give the ProPublica team accolades for their digital escorts article, this one lacks direct evidence/connections. Lack of substantive proof leads to analytical leaps, as seen here. Friendly reminder, correlation doesn’t equal causation. www.propublica.org/article/micr...

Given the number of government officials who have repeatedly stated the intentions of Volt for the last 2 years, either they were all wrong, or this one is not yet up to speed and may need to be briefed… cyberscoop.com/feds-still-t...

Lost in this strategy are the security implications this will have. Where threat actors may have had to gain access to multiple agencies and databases to develop insights on intelligence targets, now they will only need to gain access to the models. www.defenseone.com/policy/2025/...

Similar to something I commented recently on regarding the use of cyber in Russia/Ukraine - that conflict, and underscored by Israel/Iran - showed how cyber is only a means to an end, or a “combined arm” in military parlance, but not the end itself, and should not be viewed that way.

Sad to see the next generation of military leaders losing the opportunity to learn from the last generation of leaders because of the present generation of leaders.

Glad to see MN taking advantage of NG CPTs. I don’t think governors leverage their Title 32 authorities in this space as often as they could or should. (I think if we saw them employ DSCA it would definitely cause some concern from a “what aren’t they telling us” aspect.) kstp.com/kstp-news/to...

“Currently, a lot of cybersecurity defenses rely on human operators and I am not sure how well that will scale up to machine-timescale defenses,” www.cybersecuritydive.com/news/researc...

UNC3886 continues to gather more attention since CSA’s public comments... www.trendmicro.com/en_us/resear...

Probably one of the more comprehensive detection blogs I’ve seen for the SharePoint activity. Also states what some forget: IIS modules can persist even after SharePoint patches are applied, so orgs need to go back and see if they were hit and didn’t know if. www.splunk.com/en_us/blog/s...

The assumption that the US isn’t doing anything offensive in cyberspace and should be doing more is both inaccurate and not helpful to the “deterrence” cause. Doing more and not saying anything about it due to sensitivities doesn’t achieve the intended outcome either. cyberscoop.com/us-offensive...

Officially a zero day - new CVE, no patch. msrc.microsoft.com/blog/2025/07...

For those of you with SharePoint exposed to the internet, you may want to go look at those logs: research.eye.security/sharepoint-u...

PRC targeting of law firms has been going on for over a decade. From IP theft to policy disputes and human rights cases - there are a myriad of reasons for them to be targeted.

For those unfamiliar, Ellen Nakashima is also one of the best natsec/intelligence/cyber reporters in the world, and has been for decades, in no small part because of course she cultivates high level sources instead of relying on official agency press offices.