@digivector

Analyst @ Google TAG

 USA
Joined November 2011
  • Tweets2.4K
  • Following275
  • Followers826
13Media
Don't miss @tlansec's talk at 12:00 BST tomorrow, Oct 5, at #VB2023 in London! He will share @Volexity's research + observations of a North Korean #apt using unique, persistent #socialengineering techniques to target victims. More here: virusbulletin.com/conference… #threatintel #dfir
10
17
2,850
North Korea 🇰🇵 thinks it's easier to steal 0day from researchers than to find it themselves. If you are doing security research or have privileged access you have to assume you could be targeted at some point by a nation state.
Maddie Stone@maddiestone7 Sep 2023
North Korean actors 🇰🇵 are targeting security researchers again including use of at least one 0-day. IOCs in the blog ⬇️ If you've been in contact, please reach out blog.google/threat-analysis-…
Screenshot of top of blog. It says "Active North Korean campaign targeting security researchers"

ALT Screenshot of top of blog. It says "Active North Korean campaign targeting security researchers"

21
1
54
8,380
Check if you've communicated with Paul091_! Outside of the 0-day, they also pushed their github project, GetSymbol - meant to help researchers download symbols. But it contains an update channel that could allow them to run arbitrary exes on machines of interest!
billy leonard@billyleonard7 Sep 2023
🚨 DPRK 🇰🇵 campaign against security researchers - new from @Google TAGs @maddiestone @_clem1 @digivector on new 0day ITW and potential infection through a tool aimed at helping the research community. as wu said protect ya neck kids 🦇 blog.google/threat-analysis-…

Active North Korean campaign targeting security researchers

Threat Analysis Group shares findings on a new campaign by North Korean actors targeting security researchers.

blog.google
21
1
39
14,464
This is peak UI design.
834
7,209
802
55,735
3,640,310
Replying to @stevenadair @Volexity @Microsoft365 @Microsoft
It turns out our investigation turned up nothing because there was nothing for us to find. The incident was invisible to us with the data at our disposal and this was due to the customer's M365 license level: E3. This is likely the most common license level for most orgs. 3/7
2
13
4
51
17,894
3 vacantes abiertas en Google Malaga Software Engineer, Backend, VirusTotal, Google Cloud google.com/about/careers/app… Solutions Consultant, VirusTotal google.com/about/careers/app… Security Engineer, VirusTotal google.com/about/careers/app…
7
103
10
159
49,127
Snap is hiring security engineers for D&R and threat intel roles in Switzerland (we have offices in Zurich and Yverdon-les-Bains): wd1.myworkdaysite.com/recrui… & wd1.myworkdaysite.com/recrui… Retweets for visibility are much appreciated!
1
17
35
12,262
The legend of @moranned coming to present research at BlueHat Israel 🎉
BlueHat IL@BlueHatIL1 Jun 2023
It's on! BlueHat IL Nights is returning on June 22nd. Join us for the ultimate security bash with renowned Microsoft researcher Ned Moran, as he unveils the untold secrets of Iranian cyber operators like never before. Register now! microsoftrnd.co.il/bluehatil…
1
5
14
2,311
We are hurtling towards our finale. Join us to meet the character who helped us reach an assessment of Xiaoruizhi's APT affiliation. intrusiontruth.wordpress.com…

Introducing Cheng Feng 

You might be wondering why we have picked on Cheng Feng. Just a hard-working cyber security professional, right? Well, wrong, as it turns out. Cheng Feng helped us deduce what APT Wuhan Xiaoruizhi …

intrusiontruth.wordpress.com
1
17
1
53
16,965
Introducing our main character of this investigation... Wuhan Xiaoruizhi Science and Technology Company intrusiontruth.wordpress.com…

All roads lead back to Wuhan… Xiaoruizhi Science and Technology Company

As our readers know from our investigation into Hainan Xiandun Technology Development Company, the Intrusion Truth team have become quite adept at spotting a fishy front company when we see one.&nb…

intrusiontruth.wordpress.com
2
50
6
121
38,650
Google Málaga += 2 vacantes Software Engineer, Infrastructure Integrator, VirusTotal, Google Cloud careers.google.com/jobs/resu… Security Engineer, VirusTotal careers.google.com/jobs/resu…
4
49
4
89
24,579
Officially on the job market today. Anyone looking for an old TI guy with a "smidge" of years under his belt, let me know. Happy to have a chat.
5
47
5
88
43,250
So finally feel like I can talk about this. Santa as in github.com/google/santa now supports file access authorization. This means that we can authorize if a binary should be able to open a file/path and leverage code signing for targeting/filtering.

GitHub - google/santa: A binary authorization and monitoring system for macOS

A binary authorization and monitoring system for macOS - google/santa

github.com
8
88
10
309
71,371
“Litigation was filed against several of CryptBot’s major distributors who we believe are based in Pakistan and operate a worldwide criminal enterprise.” @pmbureau and the team taking on cybercrime on a number of fronts. blog.google/technology/safet…

Continuing our work to hold cybercriminal ecosystems accountable

Google shares details on its most recent actions to hold cybercriminals accountable.

blog.google
9
1
33
5,214
Replying to @vtxproject
@vtxproject is looking for non-profit orgs with an intelligence use case that would benefit from having #synapse. We plan to select a few with compelling missions and donate #synapse enterprise licenses/support. Reply, DM, or join slack v.vtx.lk/slack if you have ideas!
7
18
3
34
10,078
In a previous life, Alex found more APT campaigns in a day than most vendors did in a year. If you want to increase positive coverage of your flashy new widget, no better person to help you do it!
This quoted post is unavailable.
Try viewing anyway · View on X
5
22
5,322
The likely DPRK 3CX incident was part of a DOUBLE supply chain incident (access from one supply chain compromise was used to create another). Leapfrogging this way allows the actor to create a vicious cycle that expands their footholds exponentially. mandiant.com/resources/blog/…

Mandiant Cybersecurity Consulting

Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.

cloud.google.com
4
58
9
113
42,974
🆕 Updates from @Google TAG on recent APT, IO and Crime from 🇷🇺🇧🇾 actors against 🇺🇦 and regionally. 🎣 and more from 🇷🇺GRU, 👻🖊️, 🇨🇺💰 looking like APT and IO from the once adored 👨‍🍳. 1/🧵 blog.google/threat-analysis-…

Ukraine remains Russia’s biggest cyber focus in 2023

Google's Threat Analysis Group shares first quarter cyber updates on the threat landscape from the war in Ukraine.

blog.google
2
60
5
111
31,474
7 Apr: iOS/Mac 0day in the wild patched support.apple.com/en-us/HT21… 14 Apr: Chrome 0day in the wild patched chromereleases.googleblog.co… Both found by @_clem1 (TAG). Two different surveillance vendors. Great finds! Great fast patching! 👍 Wish these weren't so common though. 😔
33
3
125
45,014
"To maximize the performance of Chrome on high-end devices, we are now targeting them with a version of Chrome that uses compiler flags tuned for speed rather than binary size." Up to 30% faster on the Speedometer 2.1 benchmark! 🏎 blog.chromium.org/2023/04/mo…

More ways we’re making Chrome faster

From the beginning of Chrome, one of our 4 founding principles has been speed, and it remains a core principle that guides our work. Today’...

blog.chromium.org
6
28
197
66,539
Load more