@leonchangtw

Threat Researcher @TRENDMICRORSRCH

 Taiwan
Joined January 2019
  • Tweets133
  • Following477
  • Followers126
We first introduced the term “Premier Pass” during my talk at @pivot_con — describing a trend of advanced collaboration among China-aligned APT groups like Earth Estries & Earth Naga. Today, we published a blog post that explores the concept in depth. trendmicro.com/en_us/researc…

The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns | TrendAI (US)

Trend™ Research examines the complex collaborative relationship between China-aligned APT groups via the new “Premier Pass-as-a-Service” model, exemplified by the recent activities of Earth Estries...

trendaisecurity.com
11
28
2,436
❗️ IP intelligence company Spur pushed a PR containing comments from their AI saying they'd copied competitor Synthient's CLI. Spur raised $200 million this year. Synthient is just one guy named Ben.
20
50
13
798
71,152
Today, the @FBI and @TheJusticeDept announced the disruption of a global botnet used by Chinese state-sponsored group known as QTFY to target U.S. critical infrastructure. Our investigation attributes QTFY to the Nanjing Xinjiuwei Network Technology Company, which sells stolen data and hacking services to Chinese military and intelligence agencies. Their services include a scanning platform that scours the internet for vulnerable smart devices—like home routers and security cameras—infects thousands of them, and feeds them into a botnet, or a network of machines secretly controlled by the adversary. These platforms hide the origin of PRC-linked cyberattacks. Thanks to the work of @FBISanDiego, FBI Cyber Division, and partners at DOJ—we shut those platforms down 🔗justice.gov/opa/pr/justice-d…
153
632
61
2,376
144,236
Today we are releasing a pair of reports: First: a joint release with NSA, FBI, and the allies, on TA488 (Void Blizzard, Laundry Bear) using half-click XSS exploits
3
36
7
153
39,968
Leon Chang retweeted
Sam Altman
@samaJul 21
we had a significant security incident during evaluation of our models. we are sharing what we have learned so far. thanks to @huggingface for the partnership on this. openai.com/index/hugging-fac…

OpenAI and Hugging Face partner to address security incident during model evaluation

OpenAI and Hugging Face share early findings from a security incident during AI model evaluation, highlighting advanced cyber capabilities and lessons for defenders.

openai.com
2,121
2,064
2,215
17,353
10,367,129
Leon Chang retweeted
Analysis Center@jpcert_acJul 17
#JSAC2027 を2027年1月19日から1月22日の4日間にわたり開催いたします。また、本日より講演とワークショップのCFP・CFWの募集を開始しております。 みなさまのご応募お待ちしております。^AS jsac.jpcert.or.jp/

JSAC2027 – Tokyo, January 19-22, 2027

JSAC is an annual event for security analysts held by JPCERT/CC.

jsac.jpcert.or.jp
22
1
54
6,146
#ESETresearch has discovered a supply-chain attack targeting stock investors in 🇻🇳Vietnam, distributing SPECTRALVIPER through the update mechanism of the FireAnt Metakit stock investment platform. welivesecurity.com/en/eset-r… 1/4
3
31
1
112
9,135

Malware Reverse Engineering is no longer a human problem!

Article · @fr0gger_
36
249
24
1,100
245,748
‼️At the end of last year, there was a series of coordinated attacks in Polish cyberspace. 📌Today, our team is publishing a report describing the technical analysis of these events. We show the scheme of operation and the tools used by the attackers. ➡️cert.pl/uploads/docs/CERT_Po…
12
146
19
300
75,439
#JSAC2026 の全てのプログラムを公開しました。詳しくはタイムテーブルをご覧ください。 ^AS jsac.jpcert.or.jp/timetable.…

JSAC2027 – Tokyo, January 19-22, 2027

JSAC is an annual event for security analysts held by JPCERT/CC.

jsac.jpcert.or.jp
24
6
46
21,131
Leon Chang retweeted
PIVOTcon@pivot_con18 Dec 2025
You asked for our traditional #CfP meme-guideline for #PIVOTcon26 - here it is 🥳🎉 Reminder: - one track,30m - no recording/streaming/tweeting. - No TLP:WHITE - Original content only #CTI #ThreatIntel #ThreatResearch 1/7
1
11
2
17
4,144
Leon Chang retweeted
PIVOTcon@pivot_con27 Nov 2025
#PIVOTcon26 #CfP is open and you can submit your proposals till 6 FEB 2026 CfP rules and submissions here: pretalx.com/pivotcon26/cfp #ThreatIntel #ThreatResearch #CTI
13
1
16
3,611
🔎Our CERT is releasing a new technical report on 🇰🇵Operation #DreamJob, focusing on recent evolution in its tooling. Following an IR engagement at a large manufacturing client based in 🇪🇺, we investigated artefacts we attribute to #UNC2970. ➡️Full blog: ow.ly/V4mr50Xug1l
1
50
2
187
23,709
#ESETresearch discovered and analyzed a previously undocumented malicious tool for network devices that we have named #EdgeStepper, enabling China-aligned #PlushDaemon APT to perform adversary-in-the-middle to hijack updates to deliver malware. @0xfmz welivesecurity.com/en/eset-r… 1/5

PlushDaemon compromises network devices for adversary-in-the-middle attacks

ESET researchers have discovered a network implant used by the China-aligned PlushDaemon APT group to perform adversary-in-the-middle attacks.

welivesecurity.com
4
29
2
73
11,702
Leon Chang retweeted
Dan Perez
@MrDanPerez20 Nov 2025
🚨 #APT24 Leveraging #BADAUDIO🚨 New blog post describing 🇨🇳 actor APT24 targeting 🇹🇼 via multiple vectors to include #phishing, #strategicwebcomp #supplychain compromises 👀👀👀 cloud.google.com/blog/topics…

APT24's Pivot to Multi-Vector Attacks | Google Cloud Blog

PRC-nexus APT24 uses BADAUDIO malware in a persistent, multi-vector espionage campaign targeting Taiwan.

cloud.google.com
20
1
59
17,334
Leon Chang retweeted
PIVOTcon@pivot_con13 Nov 2025
#PIVOTcon26 registration is now OPEN 🤟📷 #ThreatResearch #ThreatIntel 📷pivotcon.org Please read carefully the whole 🧵 for the rules about invite -> registration (1/6)🌐
1
13
1
16
2,510
We disrupted a highly sophisticated AI-led espionage campaign. The attack targeted large tech companies, financial institutions, chemical manufacturing companies, and government agencies. We assess with high confidence that the threat actor was a Chinese state-sponsored group.
993
3,190
1,777
20,796
7,541,906
知道創宇(Knownsec)データ漏洩事件 - 中国国家支援サイバースパイ活動の全容解明 qiita.com/n_hiraoka/items/ab… #Qiita @onokoro48より

知道創宇(Knownsec)データ漏洩事件 - 中国国家支援サイバースパイ活動の全容解明 - Qiita

作成日: 2025年11月 分析対象: 中国サイバーセキュリティ企業・知道創宇の大規模データ漏洩事件 📋 目次 エグゼクティブサマリー 事件の概要 知道創宇について 漏洩データの詳細分析 グローバル標的リスト「関基目標庫」 中国政府・公安部との関係 グローバルな影響と...

qiita.com
1
8
1
28
7,602
Awesome new threat report from Google Threat Intel Group documenting how threat actors are leveraging Gemini. A lot of information and actionable avalable in the report! Great work 👌 services.google.com/fh/files…
4
135
6
513
43,937
Leon Chang retweeted
Costin Raiu
@craiu16 Oct 2025
Some additional details emerge about the F5 breach: the hackers were in the company's network for at least 12 months, according to people familiar with the investigation. F5 sent customers on Wednesday a threat hunting guide for Brickstorm, which is leveraged by the UNC5221 Chinese APT group. BTW, 12 months is just a bit short of the 393 days that is the average dwell time for UNC5221. Story by Patrick Howell O'Neill and colleagues: bloomberg.com/news/articles/…

Potentially ‘Catastrophic’ Breach of Cyber Firm Blamed on China

A potentially “catastrophic” breach of a major US-based cybersecurity provider has been blamed on state-backed hackers from China, according to people familiar with the matter.

bloomberg.com
8
111
12
312
49,657
Load more