Cyber threat intelligence | Palo Alto Unit 42 | SANS FOR578 instructor | Arcane Trickster | Ex-Mandiant | Ex-CIA | Posts represent my personal views

Joined June 2018
Some of you may have seen my LinkedIn posting or the official Mandiant blog where moments ago we released the Mandiant CTI Analyst Core Competencies Framework. For those who didn't, TL;DR the framework enumerates higher level topical subjects and underlying core skills as
1
3
23
InfoSecProf retweeted
LAST DAY TO SUBMIT TO THE @CYBERWARCON CFP! Some things I’d love to see submissions on: 💣 Destructive and disruptive cyber attackers. Especially those active in European sabotage and the Middle Eastern conflict. What’s going on with Volt Typhoon? 💣 Third parties roped into state cybershenanigans like criminals. 💣 Hack and leakers like COLD RIVER and CALANQUE ION. 💣 The state of info ops. What’s working? 💣 Targeting of IP cameras and other cyber espionage and surveillance efforts tied to physical targeting. 💣 Real case studies on the use of AI in state actor intrusions. Especially when those intrusions lead to disruptive and destructive scenarios. We are looking for real world case studies that will illuminate the future of the threat. There is still time, but don’t dally!
1
10
24
1,930
Wait wait wait does this mean next year's @VansWarpedTour sponsor will be @Wendys ?
98
InfoSecProf retweeted
Beyond Lazarus: Organization of DPRK Cyber Capabilities The old #Lazarus umbrella has been decomposed into six distinct clusters (TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet, Famous Chollima) that mix espionage with crypto theft, ransomware, and bank heists. kudelskisecurity.com/researc…
2
68
5
262
36,374
InfoSecProf retweeted
Great resource here from the folks at @CSIS compiling OSINT data on the nationwide cyberattacks on water systems that U.S. officials privately believe is the handiwork of Iran-linked hackers. csis.org/analysis/mapping-ir…
2
32
1
58
4,836
InfoSecProf retweeted
So…anyone seen details on this?
On Mythos, from @MarkWarner in this morning's Senate Banking hearing: "the head of the NSA and Cyber Command came and said this tool broke into almost all of our classified systems, not in weeks, but in hours"; I had not seen that mentioned elsewhere?
1
282
InfoSecProf retweeted
Please look into this @virginmedia you’re blocking legitimate security researchers:
We’re not malicious @virginmedia 🥺 ctrlaltintel[.]com is for sharing intel, we’re only a threat to cybercriminals 🙏
1
7
23
8,956
This is how you de-escalate
50
49
17
520
77,623
Only Siths deal in absolutes
1
1
116
Friday morning work vibes
96
We've got a new logo for our 2026 conference! The BSides Boulder CFP is still open for two weeks. Submit your conference talk on Sessionize: sessionize.com/bsides-boulde…
3
7
230
I don't usually air dirty laundry, but for anyone in #Connecticut I strongly recommend against ever working with #slagermadryllc. As you can see from the email reply from one of their partners, the firm has no ethical standards and is willing to go so far as to taunt, in writing,
1
225
a prospective client the day of their mother's funeral. What a disgraceful showing.
145
InfoSecProf retweeted
Extremely proud to represent @Unit42_Intel today at the United Nations in NYC as my colleague Evan discusses our team’s work to combat DPRK IT Workers. Let’s goooo
6
3
83
3,735