Pinned Tweet
New Blog: Sponsored by Russian military intelligence, APT44 is a dynamic and operationally mature threat actor that is actively engaged in the full spectrum of espionage, attack, and influence operations. cloud.google.com/blog/topics…
Tyler McLellan retweeted
⚠️ Attention SecOps - AOMEI Backupper Supply Chain
If your organization use AOMEI Backupper between April and July 2026?
Use our analyst shared SIGMA rules and review EDR history to check whether you are compromised or not.
AOMEI said Server are fixed, but it don't remove malware already delivered.
manageengine.com/threat-anal…
Some investigations are stronger because a second team can validate the findings from a different vantage point.
Our ManageEngine Threat Analysis Lab (METAL) identified malicious activity in AOMEI Backupper’s promotional channel through Endpoint Central EDR telemetry. We shared our findings with @Google Threat Intelligence Group and @Mandiant, who confirmed the threat and captured it from their side.
If AOMEI Backupper is running in your environment, start with our report. Run the Sigma rules, check the Indicators of Compromise (IoC) list against your endpoints, and take the right steps to stay protected.
Read more: zurl.co/juwRs
Tyler McLellan retweeted
Security research is a team sport.
Huge thanks to @tylabs and Charles Carmakal from @Mandiant for collaborating with our @manageengine METAL(ManageEngine Threat Analysis Lab) team on the AOMEI supply chain investigation.
manageengine.com/threat-anal…
New from GTIG & Mandiant: UNC7017 tampered with AOMEI's update servers in 5–10 minute bursts, then reverted the files. Check the URL later and it looks clean.
We break down the CROSSROAD → SHINYROAD chain, plus IOCs & YARA: cloud.google.com/blog/topics…
New from GTIG & Mandiant: UNC7017 tampered with AOMEI's update servers in 5–10 minute bursts, then reverted the files. Check the URL later and it looks clean.
We break down the CROSSROAD → SHINYROAD chain, plus IOCs & YARA: cloud.google.com/blog/topics…
Tyler McLellan retweeted
Fresh @Mandiant and GTIG blog detailing zero day exploitation of CVE-2026-102764 in BeyondTrust Remote Support by 🇨🇳 nexus espionage actor ARMORY CASTLE (fka UNC5221).
cloud.google.com/blog/topics…
Tyler McLellan retweeted
Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of ShinyHunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world.
The Dutch High-Tech Crime Unit arrested the suspect under Dutch law. That's exactly how the "best athlete" model in the new FBI Cyber Strategy is meant to work: the partner with the strongest authority and access leads.
The @FBI is grateful to everyone who has assisted us in the ShinyHunters investigation, especially the Dutch National Police and the industry partners who shared information with us.
Mandiant Consulting and Google Threat Intelligence Group (GTIG) identified active, in-the-wild exploitation of a zero-day vulnerability (CVE-2026-88772) affecting Citrix NetScaler ADC and NetScaler Gateway appliances. cloud.google.com/blog/topics…
Tyler McLellan retweeted
‼️ BREAKING: Google says ShinyHunters is mass-exploiting an Oracle PeopleSoft flaw, using a trick that slips past the firewall rules companies relied on instead of patching, and has planted web shells on dozens of systems worldwide.
The campaign has spread from universities to healthcare, government, tech and transportation, and some servers got a new backdoor called SIDEEYE, hidden inside a booby-trapped media player installer signed with a valid certificate.
Google has published IOCs, file hashes and a fix-it guide for CVE-2026-35273, and warns victims to prepare for extortion.
Shinyhunters exploitation of PeopleSoft update from Mandiant. Orgs using this software must patch, recent spike in waf mitigation bypasses: cloud.google.com/blog/topics…
Tyler McLellan retweeted
TeamPCP pulled off the worst-ever software supply chain hacking spree and breached thousands of companies. Now Google’s threat intelligence group has revealed it had a mole inside the hackers’ inner circle. wired.com/story/an-undercove…
Tyler McLellan retweeted
UNC6671 has secretly diversified extortion operations across multiple brands, aggressively targeting financial services, private equity, and law firms with tailored vishing and AiTM tactics.
Check out the breakdown below ⬇️
Read the full report: goo.gle/3RB9Mg3
Tyler McLellan retweeted
BREAKING: Google warns of a massive ransomware campaign targeting Wall Street firms including Blackstone, Apollo, CME Group & more.
Tyler McLellan retweeted
Blackfile (UNC6671) is still at it and has been operating under a series of rebrands. They are currently hitting the financial sector hard with vishing attacks. New blog on their ops with remediation and hardening guidance. cloud.google.com/blog/topics…
Tyler McLellan retweeted
Hedge fund cyberattacks tied to BlackFile-linked UNC6671 extortion group
bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
One threat group, many faces. By mapping shared phishing templates and root domains, we've connected the dots between BlackFile, REDACT, PINK, HELIX, and FALCON. Dive into our infrastructure analysis: cloud.google.com/blog/topics…
Tyler McLellan retweeted
Today Mandiant announced that they're a bunch of soft blooded cowards and need to make names more catchy, or something.
They're abandoning their APT naming convention (i.e. APT29) and replacing it with codenames, like SANDWORM RELIC
Weak bro
cloud.google.com/blog/topics…
Great article covering some of the stranger details of unc3753’s recent targeting of US law firms.
Link: "When cybercriminals hire burglars: Inside an alleged Russian effort to infiltrate multibillion-dollar US law firms" (4/4) cnn.com/2026/06/27/politics/…
Peoplesoft orgs should follow our mitigation advice here cloud.google.com/blog/topics…
🚨 The Council of Europe has allegedly been breached. Over 297 GB of HR and payroll data, more than 429,000 files, has been compromised.
It marks the second major hit on European institutions this year. In March, the EU Commission, ENISA, and the Directorate-General for Digital Services were breached.
Shinyhunters exploited Oracle PeopleSoft zero day: cloud.google.com/blog/topics…
ShinyHunters "Oracle PeopleSoft servers are being targeted in ongoing data theft attacks by the ShinyHunters extortion gang, which claims to have stolen data from over 100 organizations." bleepingcomputer.com/news/se…
