@7ufail

Typos in tweets should be expected. Tweets and opinions are my own. Threat Analyst @Mandiant @Google Cloud Advanced Practices 🦅

 Infosec Land
Joined May 2010
  • Tweets419
  • Following522
  • Followers571
26Media
🚨 NEW Blog from @mandiant 🚨  Suspected Chinese Threat Actor (#UNC3886) involved in Espionage Operations. mandiant.com/resources/blog/… 🧵

Mandiant Cybersecurity Consulting

Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.

cloud.google.com
1
88
8
164
36,960
Tufail Ahmed retweeted
Mohamed Salah
@MoSalah9 Aug 2025
Can you tell us how he died, where, and why?
UEFA
@UEFA8 Aug 2025
Farewell to Suleiman al-Obeid, the 'Palestinian Pelé'. A talent who gave hope to countless children, even in the darkest of times.
27,140
371,166
25,701
1,472,160
140,802,700
Tufail Ahmed retweeted
John@Big_Bad_W0lf_9 Jan 2025
🔥new blog detailing 0day exploitation of Ivanti appliances as well as newly observed malware families tracked as PHASEJAM and DRYHOOK. We also detail activity related to the previously observed SPAWN malware ecosystem tied to China nexus cluster UNC5337. cloud.google.com/blog/topics…

Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation | Google Cloud Blog

Zero-day exploitation of Ivanti Connect Secure VPN vulnerabilities since as far back as December 2024.

cloud.google.com
4
56
1
94
9,972
Tufail Ahmed retweeted
nick@3dRailForensics9 Jan 2025
This is Frontline Intel Operations in action #FIO
Mandiant (part of Google Cloud)
@Mandiant9 Jan 2025
🚨 #IvantiConnectSecure VPN Zero-Day (CVE-2025-0282) actively exploited since Dec. 2024! Learn about our initial investigations: bit.ly/4gOYzja #Cybersecurity #ZeroDay #ThreatIntel
4
14
1,315
#NewProfilePic
1
83
Tufail Ahmed retweeted
Will@BushidoToken25 Nov 2024
Is 2024 the year of the takedown? Volt Typhoon’s & Fancy Bear’s botnets, BlackCat, LockBit, BreachForums, Endgame, the Snowflake hacker, Scattered Spider members… the list goes on The feds have been on a roll lately 🫡
3
12
82
6,986
We are generally way too overconfident in understanding adversary intent in cyberspace. Activity is straightforward, attribution is tricky and intent is often opaque and relies on organizational politics and bureacracy inside organizations.
6
11
80
6,618
Bluesky 💙
62
Tufail Ahmed retweeted
Royal Hansen@royalhansen1 Nov 2024
"We believe this is the first public example of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software." googleprojectzero.blogspot.c…

From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code

Posted by the Big Sleep team Introduction In our previous post, Project Naptime: Evaluating Offe...

projectzero.google
6
18
3,549
Mandiant has been tracking #GOOTLOADER, an obfuscated #JavaScript downloader, since 2021. Explore its infection chain and detection strategies in our latest blog post. Stay informed! 👉 bit.ly/3YyRzPB #Malware #Cybersecurity
1
26
1
79
6,300
Tufail Ahmed retweeted
Andy Morales@Andy2002a31 Oct 2024
Check out my new blog breaking down #GOOTLOADER malware and how it has evolved this year. #GoogleCloud #Mandiant #Malware googlecloudcommunity.com/gc/…
2
8
303
Tufail Ahmed retweeted
RooCon@RooCon_AU26 Jul 2024
G'day everyone. The RooCon crew is very excited to make a RooCon24 keynote announcement! We will have @stvemillertime deliver a keynote about the state of the cyber and why it's not all bad news. He'll also discuss the evolution of threat actors' tradecraft over last 10 years.
2
11
2
30
8,517
🌶️ Active Fortinet Zero-Day Exploitation ITW 🌶️ cloud.google.com/blog/topics… #zeroday #fortinet #inthewild

Investigating FortiManager Zero-Day Exploitation (CVE-2024-47575) | Google Cloud Blog

Mandiant collaborated with Fortinet to investigate mass zero-day exploitation of FortiManager appliances.

cloud.google.com
1
20
3
47
10,897
Tufail Ahmed retweeted
Cooper
@justcuuper23 Oct 2024
Go ahead, MAGA. Spin it. Why are 23 Nobel Prize winning Economists wrong and you’re right?
11,525
12,368
1,169
79,370
5,499,069
🔥🔥🔥
Moritz@m_r_tz26 Sep 2024
Great technical post on LummaC2 obfuscation and how to deobfuscate samples through symbolic backward slicing: cloud.google.com/blog/topics… 🫸🫷 @cPeterr and Nino!
2
75
🔥🔥🔥
Joe@jinx_soda23 Sep 2024
DPRK's UNC5267 operations have expanded greatly over the past few years. It is essential to be proactive and detect them in your environment. These operations directly fund North Korea by diverting the paychecks they obtain back to the regime. cloud.google.com/blog/topics…

Staying a Step Ahead: Mitigating the DPRK IT Worker Threat | Google Cloud Blog

North Korea's IT workforce presents a persistent and escalating cyber threat.

cloud.google.com
83
“Malware distribution groups are tricky to look at as a collective, so let’s narrow it down to some of my *least* favorites…” See ya next week, @mWISEConference 🫶🏼 #mWISE2024
Mandiant (part of Google Cloud)
@Mandiant12 Sep 2024
🔔 1 week to go until the @mWISEConference in Denver! Security pros, gear up for advanced strategies, threat intel, and expert insights. Don’t miss out—register now! 👉 bit.ly/3Xl0kMD #mWISE2024
7
1
14
2,548
🆕🚨 analysis from @Google on APT42 activity against 🇺🇸 and 🇮🇱. A ton of work from folks over the past few months dedicated to protecting users disrupting campaigns, and making life hard for the actors. More to come! blog.google/threat-analysis-…

Iranian backed group steps up phishing campaigns against Israel, U.S.

Google’s Threat Analysis Group shares insights on APT42, an Iranian government-backed threat actor.

blog.google
2
69
9
141
49,188
🚀 Dive into our latest blog to see how Gemini 1.5 Flash is changing malware analysis! Tested with 1,000 files from @virustotal, it processes each in just 12 seconds. Get fast, accurate reports! ⚡️ Read more: bit.ly/3SsOLRC #MalwareAnalysis #Gemini #AI
4
4
1,155
🔥🔥🔥
Josh++@josh_murchie29 Jul 2024
Happy to get this out the door: cloud.google.com/blog/topics… Big thanks to @onfvp @jinx_soda @nicastronaut and the other named and unnamed authors. A few highlights ⬇️

UNC4393 Goes Gently into the SILENTNIGHT | Google Cloud Blog

We detail the evolution of UNC4393's operational tactics and malware usage throughout its active lifespan.

cloud.google.com
1
95
Great progress from the @googlechrome team imposing cost on infostealers. With the recent #UNC5537 campaign targeting Snowflake customers, this is a timely addition to Chrome. Enhanced protection and detection will likely force infostealer devs to rewrite their malware.
Will Harris@parityzero30 Jul 2024
With Chrome 127 on Windows, we're introducing enhanced encryption to protect sensitive data, starting with your cookies🍪! This helps protect your personal information and keeps your online accounts secure from hackers. Read more about this protection: security.googleblog.com/2024…
2
15
1,374

No more items