By Stimson's postulate, I'm no gentleman. 🐇
Orange Pill & Hodl St
Joined January 2017
- Tweets75
- Following624
- Followers2K
- Likes901
Pinned Tweet
🚨 ALERT: @Mandiant's #AdvancedPractices team has recently received a video message from a State nexus actor. Sharing this for general visibility. Be safe out there.
cc:@ryankaz42 🚨
cameo.com/recipient/664ed553…
nick retweeted
Fresh @Mandiant and GTIG blog detailing zero day exploitation of CVE-2026-102764 in BeyondTrust Remote Support by 🇨🇳 nexus espionage actor ARMORY CASTLE (fka UNC5221).
cloud.google.com/blog/topics…
If your security team is only scanning static code repos, you're missing ephemeral supply chain attacks that trigger exclusively inside short-lived CI/CD runners.
Insightful intelligence 👇
cloud.google.com/blog/topics…
New from GTIG & Mandiant: UNC7017 tampered with AOMEI's update servers in 5–10 minute bursts, then reverted the files. Check the URL later and it looks clean.
We break down the CROSSROAD → SHINYROAD chain, plus IOCs & YARA: cloud.google.com/blog/topics…
nick retweeted
One threat group, many faces. By mapping shared phishing templates and root domains, we've connected the dots between BlackFile, REDACT, PINK, HELIX, and FALCON. Dive into our infrastructure analysis: cloud.google.com/blog/topics…
🚨 UNC6692 is targeting enterprise environments with a sophisticated "SNOW" malware suite.
Posing as IT helpdesk staff, the actor uses high-pressure social engineering to deploy custom backdoors like SNOWBASIN and SNOWGLAZE.
Breakdown and IOCs: cloud.google.com/blog/topics…
🚨 SECURITY ALERT 🚨
The popular NPM package axios (>100M weekly downloads) was hit by a DPRK-nexus supply chain attack.
The attack deploys a cross-platform RAT (WAVESHAPER.V2).
Full IoCs & breakdown from @GoogleCloud:cloud.google.com/blog/topics… #CyberSecurity #NPM #Axios
nick retweeted
We're lucky to have @JumpforJoyce on team @Google and on the side of the open and secure web
wsj.com/video/googles-approa…
nick retweeted
“I didn’t know limewire was still a thing” the latest on Shiny Hunters cloud.google.com/blog/topics…
nick retweeted
UNC6040 uses vishing to steal data from Salesforce environments and move laterally into Okta and M365.
Defend against their tactics with our guide that covers identity, SaaS application hardening, and detection.
Read now: bit.ly/4gRdqKH
ALT UNC6040 Proactive Hardening Recommendations
nick retweeted
🚨🚨🚨🇨🇳 Actors leveraging BRICKSTORM🚨🚨🚨
cloud.google.com/blog/topics…
nick retweeted
CORNFLAKE.V3 malware spotted in an access-as-a-service operation using the ClickFix technique. 🥣
UNC5518 uses fake CAPTCHA pages for access, which UNC5774 then leverages to deploy the CORNFLAKE.V3.
Learn more: bit.ly/4mZ64a3
ALT Analyzing the CORNFLAKE.V3 Backdoor
nick retweeted
🚨 Final reminder that RooCon25 CFP closes August 22, 2025!
🎟️ Details on guest registration is coming next week so stay tuned for updates! 🦘
🔗 Submit Your RooCon25 Talk at:
rsvp.withgoogle.com/events/r…
nick retweeted
Watch out for #UNC6293 🚨
By impersonating the U.S. DoS, this Russia-backed threat group is building a rapport with its targets before convincing them to set up ASPs.
Uncover their motives and learn how to defend yourself in our blog post 👉 bit.ly/3JfwghX
nick retweeted
🚨Widespread Exploitation observed🚨 of on-prem Sharepoint vulnerabilities. Just another reminder to patch and verify your environment!
Google Threat Intel is tracking widespread exploitation of on-prem SharePoint vulns: CVE-2025-53770 & CVE-2025-53771.
This is a severe threat. We recommend patching, threat hunting and rotating keys.
Learn more, incl. how to detect this threat in Google SecOps: security.googlecloudcommunit… @GoogleCloudSec @Mandiant
nick retweeted
Google Threat Intel is tracking widespread exploitation of on-prem SharePoint vulns: CVE-2025-53770 & CVE-2025-53771.
This is a severe threat. We recommend patching, threat hunting and rotating keys.
Learn more, incl. how to detect this threat in Google SecOps: security.googlecloudcommunit… @GoogleCloudSec @Mandiant
Get RooCon CFP in today!! You'll be able pick up some legit Chicken Salt after your talk.
🦘 RooCon25 Call for Papers is open! 🦘
This is your chance to share your latest insights and help us make RooCon25 the most successful edition to date! We’re waiting for submissions until 22nd of August.
Find the CFP submission link and the guidelines at rsvp.withgoogle.com/events/r…
Organizations, are you prepared for voice phishing?📱
UNC6040 is a financially-motivated threat cluster that specializes in using voice phishing (vishing) to compromise organizations' Salesforce instances, leading to large-scale data theft.
Learn more: bit.ly/3FxJwx1
