Nick Biasini

Head of Outreach at Cisco Talos. These are my views not my employers.

@[email protected]

[Cisco Talos Intelligence Group @TalosSecurity]

For this week's episode of Talos Takes, we got together a panel to discuss the major takeaways from #BHUSA and #DEFCON, including all the talk around #AI @nohackme @ImmortanJo3 @infosec_nick https://t.co/Pzqd9o66GK

[Cisco Security @CiscoSecure]

Next week at #BHUSA - Join @infosec_nick from @TalosSecurity for a threat briefing with insights and mitigation strategies related to identity attacks, zero-day exploits, #ransomware, and infostealer #malware ➡️ https://t.co/YyN4vEwIrg

📆 August 7
⏰ 2:35pm
📍 Mandalay Bay I

[Cisco Security @CiscoSecure]

🎙️ In @TalosSecurity's first episode of Talos Threat Perspective (TTP), @infosec_nick & James Nutland reveal new #ransomware trends & identity vulnerabilities.

See how Cisco's User Protection Suite protects against these threats in today's #security blog: https://t.co/WVHWzOxHit

[Nick Biasini @infosec_nick]

Latest from our team. #Turla targeting NGOs supporting Ukraine. Full details 👇

[Cisco Talos Intelligence Group @TalosSecurity]

The #Turla APT is back with a new backdoor, very similar to its previous "TinyTurla" tool. Read more about what this Russian state-sponsored actor is up to now https://t.co/5gADXtEIn8

[Nick Biasini @infosec_nick]

One of, if not the biggest issue, with the mercenary spyware / PSOA space is the lack of sharing of actionable intelligence and IOCs. Until we fix it, its not going to get any better. We need to shine a light on how this technology works.

[Jessica Lyons @JessicaHrdcstle]

"There is almost zero data being shared across the industry on this particular threat, and that is a massive problem," @TalosSecurity @infosec_nick said.

The #spyware business is booming despite government crackdowns https://t.co/erJsnsO628 via @theregister

[Cisco Talos Intelligence Group @TalosSecurity]

Our 2023 Year in Review report is live now! Check out our never-before-seen data on attacker trends, the most popular malware of the past year, and breakdowns on specific state-sponsored actors https://t.co/AQOIK0kZmA

[Nick Biasini @infosec_nick]

Great conversation, hope to be able to do it again soon. Thanks @ryanaraine, as always.

[Ryan Naraine @ryanaraine]

🔥NEW podcast advisory: @TalosSecurity researcher Nick Biasini on the cryptic world of threat actor attribution, the rise of PSOAs (private sector offensive actors) and why network edge devices are a happy hunting ground for attackers @infosec_nick

https://t.co/qMbsvjNga0

[Nick Biasini @infosec_nick]

Latest research from our team. Great work as always uncovering the network of dating apps that are seemingly related in addition to the overtly malicious apps we found. #AridViper

[Cisco Talos Intelligence Group @TalosSecurity]

We're releasing details of a threat actor called #AridViper targeting users in the #MiddleEast with #spyware. Although it is likely based out of Gaza, Talos has no evidence indicating or refuting this campaign is related in any way to the Israel-Hamas war. https://t.co/C0gGe08v6e

[Nick Biasini @infosec_nick]

Latest from our team on #YoroTrooper. Great work as always from @asheermalhotra and @_vventura

[Cisco Talos Intelligence Group @TalosSecurity]

Talos assesses with high confidence that the #YoroTrooper threat actor likely consists of individuals from Kazakhstan. But that hasn't stopped them from covering their tracks and disguising their origins. More on this threat actor in our latest blog https://t.co/K2xIhDkaWg

[Cisco Talos Intelligence Group @TalosSecurity]

An actor we're calling "ShroudedSnooper" is actively targeting telecommunications companies in the Middle East using a previously undiscovered #malware family. More details on this threat and how users can stay protected https://t.co/km18Gv3Jjx

[Nick Biasini @infosec_nick]

More great work from the team on recent #Lazarus activity. Check it out 👇

[Cisco Talos Intelligence Group @TalosSecurity]

#NorthKorea's Lazarus Group is back again, this time with two new remote access trojans. The attacker continues to use the same infrastructure, but is changing up their eventual payloads. More here: https://t.co/mlZ4UCphXI

[Nick Biasini @infosec_nick]

Another talk in the business hall at #BHUSA this year. Come say hi and learn about XDR.

[Cisco Security @CiscoSecure]

Planning your visit to #BHUSA? 🎩

📆 Don't miss our session on August 9 at 11:30am PT with VP, AJ Shipley and @TalosSecurity's @infosec_nick to learn more about how #XDR offers a solution that can provide an advantage!

💻 Register here: https://t.co/Pi3LxXhNyJ

@BlackHatEvents

[Decipher @DecipherSec]

"This decision shows the will and action by the Biden administration against those that have shown willingness to abuse these technologies." @infosec_nick

Security Industry Mulls Spyware ‘Whack-A-Mole’ Problem https://t.co/x3XIpk12QS #decipher #deciphersec

[Cisco Talos Intelligence Group @TalosSecurity]

We just published new research on an adversary conducting several campaigns against government entities, military organizations and civilian users in #Ukraine and #Poland. These campaigns primarily start with #spam emails and malicious Office attachments https://t.co/zlfMRpNmtj

[Nick Biasini @infosec_nick]

Latest from our team. Great research from @g0jirasan. Check out the follow up blog on additional malicious activity as well - https://t.co/A6ScSgKQt3

[Cisco Talos Intelligence Group @TalosSecurity]

We recently saw threat actors exploiting a #Windows policy loophole that allows the signing and loading of cross-signed kernel-mode drivers with older signature timestamps. #Microsoft just released an advisory on this activity, but more on our blog here: https://t.co/tNNzIlPQnc

[Nick Biasini @infosec_nick]

Latest blog I worked on with Talos Incident Response. Vendor and contractor account abuse is a pervasive form of supply chain attack that organizations need to account and prepare for, details and recommendations. 👇

[Cisco Talos Intelligence Group @TalosSecurity]

Adversaries are increasingly using compromised third-party accounts to infiltrate the software supply chain. We have more on this threat and the trends around vendor account compromise over on the Talos blog https://t.co/qr1jg1RoZB

[Cisco Talos Intelligence Group @TalosSecurity]

This week's episode of Talos Takes covers the #Predator spyware and the rise of "mercenary" groups. This is a quick overview of why spyware is so dangerous and what we recently learned about the Predator tool specifically https://t.co/8vrXioPq6l

[Cisco Talos Intelligence Group @TalosSecurity]

Talos researchers recently discovered a new #botnet called #Horabot that can completely take over targeted users' Outlook mailbox, even using the target's contact list to send more spam https://t.co/YHD8gOBzua

[Nick Biasini @infosec_nick]

I was out in the desert last week when this dropped. Great research from my team. A lot went into this and I'm super proud of the results. Mercenary spyware is a major problem, one we intend on covering more widely. One of the best technical analyses to date. Details 👇

[Cisco Talos Intelligence Group @TalosSecurity]

We have new details on a #spyware tool called #Predator that's actively being sold and used to unknowingly track targeted users. Here's the full technical breakdown of how this tool works and why the use of "mercenary" spyware is on the rise https://t.co/KTEeu0joqy