State of Statecraft (SOS) is a new security and intelligence conference that brings together experts on espionage, sabotage, influence, and other unique forms of covert statecraft to share their work with a community hyper-focused on tackling state-sponsored operations.

APT28 🤝 war crimes

Extending the veneer of grassroots activism «by default» to an entire category of threat activity routinely orchestrated (if not carried out directly) by intelligence agencies is just flat out irresponsible at this point. I beg of you: stop using the label "hacktivism".

... maybe Teams isn't so bad

Short thread (hopefully in plain English) on the nuclear deterrence dynamics in the India-Pakistan relationship and where this goes if escalation continues. <1>

Weekly summary is out.. ctoatncsc.substack.com/p/cto-at-ncs...

Fascinating to see reference to GRU unit 20728 from FR relative to Russia's offensive cyber program -- as far as I'm aware, a first from a Western service? www.diplomatie.gouv.fr/fr/dossiers-...

Credibility of claims aside, the slow creep toward direct mirroring of US public attribution has reached its final stop: www.reuters.com/technology/c...

This is very cool. "Sensational stories of flying saucers dominated U.S. newspaper headlines from June to July 1947. Could they have been purposely planted as part of a U.S. strategic deception operation, aimed at breaking the Soviet Diplomatic Code?" www.tandfonline.com/doi/abs/10.1...

Incredibly important piece here, bravo @lhn.bsky.social and @agreenberg.bsky.social www.wired.com/story/signal...

In order to help protect people from falling victim to sophisticated phishing attacks, Signal introduced new user flows and in-app warnings. This work has been completed for some time and is unrelated to any current events. 5/

The memo used the term ‘vulnerability’ in relation to Signal—but it had nothing to do with Signal’s core tech. It was warning against phishing scams targeting Signal users. 3/

One piece of misinfo we need to address is the claim that there are ‘vulnerabilities’ in Signal. This isn’t accurate. Reporting on a Pentagon advisory memo appears to be at the heart of the misunderstanding: npr.org/2025/03/25/n.... 2/

It's never a bad time to take a look at your online accounts and see if you spot a weird device or login. We have a comprehensive guide on how to check if your Gmail, Apple ID, Facebook, IG, WhatsApp, Telegram, Discord, etc have been hacked. techcrunch.com/2025/03/25/h...

Russia's intelligence services have spent time and resources to develop Signal-specific tradecraft because it is best-in-class for secure communications. It is Signal's lack of vulnerability that makes the app the high priority target that it is.

It's really crucial to understand how badly framed this is. There is no Signal vulnerability. The Pentagon email did a bad job explaining a Google report from a month ago and NPR repeated it. This is like saying because you got a phishing email at your Gmail address, there's a Google vulnerability.

We are looking for a motivated Research Analyst to join our cyber and tech team at @rusi.bsky.social. You need to be able to work in London. Full job spec below 👇 royalunitedservicesinstitute.peoplehr.net/Pages/JobBoa...

Developing low visibility, low signature forms of compromise for signal accounts is a clear area of investment for Russia's services as well. Generally speaking if you use the app for sensitive comms: audit your linked devices. Do it now. cloud.google.com/blog/topics/...

Right now a single technical organization is being asked to defend (at least) one side in a major regional war, the political communications of the entire US administration, the communications of anyone opposed to that administration, big piles of NGOs, and millions of “ordinary” folks to boot.

For no reason at all, re-upping this blog from @danwblack.bsky.social, which shows the high interest that Russian APTs have in getting access to Signal messages. cloud.google.com/blog/topics/...

🚨NEW REPORT: first forensic confirmation of #Paragon mercenary spyware infections in #Italy... Known targets: Activists & journalists. We also found deployments around the world. Including ... #Canada? And a lot more... Thread on our @citizenlab.ca investigation 1/ citizenlab.ca/2025/03/a-fi...

Gorbachev believed the Soviet Union had to reform or die. But his reforms were so incoherent and inconsistent, yet persistent, he wound up destroying the USSR-something practically no one when he started thought was a possible outcome.

One of things I miss the most now that I'm fully remote is the old in-office nerding out about what was in the news. This podcast has really helped to fill that void. Highly recommend.

Our new leader. The @economist.com has always been staunchly Transatlanticist. We don't say this lightly: "Europe must prepare to be abandoned or extorted. Not to prepare for that could leave Europe vulnerable to Russia and to an increasingly hostile America" www.economist.com/leaders/2025...

⚡️Russia launches largest drone attack since start of full-scale invasion. Ukraine’s air defense shot down 138 drones while 119 decoy drones were lost out of a total of 267 drones launched by Russia, the Ukrainian Air Force said.

Ransom War: How Cyber Crime Became a Threat to National Security is officially out in Europe today! Thanks to everyone who helped make this possible. It has been a fascinating research journey. www.amazon.co.uk/Ransom-War-B...

“A key finding is that tactical drones are inflicting roughly two-thirds of Russian losses…twice as effective as every other weapon in the Ukr arsenal put together…remarkable…for weapons which did not officially exist in the Ukr mil at start of the war” www.forbes.com/sites/davidh...

Regarding the anatomy of what is now a highly consequential disinformation narrative: has anyone sourced where the claim that Zelenskyy has four percent approval ratings originates from?

I feel like that point has maybe been underappreciated about this historic era we're living through. Governance not just by the historically wealthy, but by people consumed by mass, often shared delusions. People have always been wrong on some facts, but not sure it's ever been quite like this.

Really important to point out that part of the reason Russia is gunning for Signal in such an ass-backwards way is that all the normal ways they have to break into communications haven't worked on Signal.

"This activity is yet another example of the lengths threat actors will go through to find novel methods to compromise sensitive, encrypted communications." - @danwblack.bsky.social Update your Signal app folks cloud.google.com/blog/topics/...

Today, Google Threat Intelligence is alerting the community to increasing efforts from several Russia state-aligned threat actors (GRU, FSB, etc.) to compromise Signal Messenger accounts. cloud.google.com/blog/topics/...

Intelligence from the US and close allies shows that Putin still wants to control all of Ukraine, according to four Western intelligence officials and two US congressional officials. “We have zero intelligence that Putin is interested in a real peace deal right now" www.nbcnews.com/politics/nat...

A deeply disturbing third bullet point there

"An offer of Nato membership conditional on a Russian ceasefire breach has been promoted by some US senators and now has the backing of senior European leaders, including Alexander Stubb, the Finnish president" www.theguardian.com/world/2025/f...

Upcoming discussions in Riyadh will almost certainly upend a lot of immediate collection priorities across Europe. Ripple effects likely to be seen in the mobile threat landscape with long-term proliferation consequences.

Not a great idea to do this individually - force sensing & prudent planning should be done through NATO.

www.wsj.com/world/europe... "The SSD has brought together various elements of Russia’s intelligence services. It has taken over some powers from the FSB, the country’s largest intelligence service, and absorbed Unit 29155"

Sharing the project I've been working on for the last month. Here's GTIG's paper on the severe threat to national security posed by cyber crime.

Fantastic work here from the MSTIC folks re: 74455. So many threads to pull. www.microsoft.com/en-us/securi...

Explosive-Laden Goggles Sent To Russian FPV Drone Operators www.twz.com/news-feature...

We created the Ransomware Countermeasures Tracker: virtual-routes.org/ransomware-c...

With Trump in the White House "it is now clear that the starting assumption for economic and defence decisions in the future can no longer be that the U.S. will always be there for Canada. We must stand on our own." Today's @theglobeandmail.com editorial... www.theglobeandmail.com/opinion/edit...

Exhibit B: united24media.com/latest-news/...

"Ruptures of undersea cables that have rattled European security officials in recent months were likely the result of maritime accidents rather than Russian sabotage, according to several U.S. and European intelligence officials." www.washingtonpost.com/world/2025/0...

While the exact number is likely classified, the head of the US government’s dedicated counterintelligence organization said that by now “nearly 100” nations have purchased advanced spyware designed to crack into cellphones, “and they’re using it.” breakingdefense.com/2025/01/near...

"Some Chinese RedNote users have also posted reminders for their American counterparts on navigating the censorship system. For example, some have openly called on the newbies to accept China’s sovereignty over Taiwan" edition.cnn.com/2025/01/16/t...

In the spirit of not just dunking, I think the most educational book about China I’ve read in the past couple of years is Ian Johnson’s Sparks, which is kind of a modern history of the country through the window of dissident historians & artists www.cfr.org/book/sparks