Jason Damron

Co-Founder @Sensilla_Inc - your security team when you don’t have one | Former NSA | 30 years defending networks

[Mehmet Ergene @Cyb3rMonk]

This is big 🔥🔥 https://t.co/OOsaKt4PkG

[Jason Damron @JasonSDamron]

@ZackKorman @UK_Daniel_Card I’m trying to figure out why he was repeatedly clicking and rotating sites once he knew that the link was bad. Also, did he post the link for others to follow to dodgy sites?

[GitHub @github]

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.

[Dominic Alvieri @AlvieriD]

Trellix was breached by RansomHouse

@Trellix

[Jason Damron @JasonSDamron]

It was not a quiet Sunday morning at @Sensilla_Inc

[Florian Roth ⚡️ @cyb3rops]

Anyone else seeing Microsoft #Defender flagging #DigiCert root certificate registry keys as malware?

We’ve seen reports that Defender signature update from April 30 added a detection called:

Trojan:Win32/Cerdigent.A!dha

In some environments, Defender apparently detected DigiCert Root CA certificate registry entries and removed them from the trust store.

The affected cert hashes mentioned so far:

0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43
DDFB16CD4931C973A2037D3FC83A4D7D775D05E4

Example path:

HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43

There’s also a Reddit comment suggesting Microsoft has started restoring the certs and that admins can check this via Advanced Hunting in Defender:

DeviceRegistryEvents
| where RegistryKey contains "0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"
or RegistryKey contains "DDFB16CD4931C973A2037D3FC83A4D7D775D05E4"
| where ActionType == "RegistryKeyCreated"
| where Timestamp > datetime(2026-05-03T04:00:00)
| project Timestamp, DeviceName, ActionType, InitiatingProcessFileName
| order by Timestamp desc

On an affected device, this can also be checked with:

certutil -store AuthRoot | findstr -i "digicert"

Could become an annoying day for admins if this spreads

https://t.co/VflLyFgssp

[Jared DeMott @JaredDeMott]

Hit me up at LinkedIn if you’re hacking, using AI, and Love vulnerability management. I’ve got three amazing roles open!

[haroon meer @haroonmeer]

For decades(?) we laughed at the hacker-news commenters who felt they could build Dropbox in a weekend.

We knew that engineer was confusing the ability to write a POC with an actual enterprise-ready solution.

AI now lets everyone be that engineer.

[Florian Roth ⚡️ @cyb3rops]

Here’s how I currently see software development.

Imagine a farmer who grows cabbage.

He has one large field and several smaller ones. For years, a group of farm workers harvested the cabbage by hand. It took them a full week to clear the big field. They worked carefully. Sometimes a cabbage was damaged, but overall the quality was good.

Then the farmer discovers a machine.

The machine harvests the entire field in one hour and delivers all the cabbage to the barn.

It’s not perfect. Out of 1,000 cabbage heads, maybe 30 or 40 are damaged. The workers point this out immediately:
“When we do it by hand, only 10 get damaged. Our work is higher quality.”

They’re right.

But the farmer replies:
“You need a week for one field. The machine needs one hour.”

Now the machine can harvest:
the big field in the morning
the next field an hour later
then another
and another

Eight, ten, maybe twenty fields per day.

The farmer doesn’t ask the workers to compete with the machine anymore. He gives them a new job:
Stand in the barn. Pick up each cabbage. Check it quickly. Throw out the damaged ones.

That’s the new bottleneck.

And maybe, soon, the farmer buys another machine that does even that inspection automatically.

The workers are still correct: hand-harvested cabbage is often better.
But it no longer matters economically.

The speed difference overwhelms the quality difference.

This is where software development is heading.

Engineers are right when they say manual coding can be higher quality in many situations.
But it is orders of magnitude slower.

That gap is so large that even imperfect AI-generated code wins.
And the quality improves every month.
If it doesn’t improve, it gets cheaper.
If it doesn’t get cheaper, it gets smaller.
And once it’s small enough, it runs on your own hardware.

There is no visible ceiling yet.

So the role changes.

From writing code
to reviewing code
to supervising systems that write and review code.

Like the farm workers in the barn.

Not because their work was bad.
But because the machine changed the economics.

[spencer @techspence]

Far too many orgs are relying far too much on EDR. If (I mean when) attackers are able to avoid detection from that, they usually won’t be detected until it’s too late.

[Byron Wan @Byron_Wan]

In mid-Sep 2025, Anthropic detected suspicious activity that later investigation determined to be a highly sophisticated espionage campaign conducted by a threat actor assessed with high confidence to be a 🇨🇳 state-sponsored group. The attackers used AI’s “agentic” capabilities to an unprecedented degree — using AI not just as an advisor, but to execute the cyberattacks themselves.

The threat actor manipulated Anthropic’s Claude Code tool into attempting infiltration into roughly 30 global targets and succeeded in a small number of cases. The operation targeted large tech companies, financial institutions, chemical manufacturing companies, and government agencies. This is believed to be the first documented case of a large-scale cyberattack executed without substantial human intervention.

https://t.co/eFkzAfNxZs

https://t.co/SJhbUP8vJj

https://t.co/DwpuZm86hy

[Florian Roth ⚡️ @cyb3rops]

People on here act like someone decides not to patch.
Like there’s a guy who knows the service is vulnerable, knows it runs in prod, and just shrugs.
That’s maybe 1% of the cases.

The rest is messier:
- No idea the service exists (no inventory)
- No idea it’s vulnerable (no vuln reporting)
- Afraid to break stuff (downtime, legacy crap)
- No one owns it (silos, shadow IT)
- No time (small team, constant firefighting)
- Bad processes (manual patching, approvals, etc)
- Patching tools suck (yep, that too)

It’s rarely negligence.
It’s usually chaos.

[Tim MalcomVetter @malcomvetter]

‼️ It's getting to the point where we no longer care if a login used MFA (unless FIDO2 Passkeys). We care more about where, how, timing, user agent, what happened afterwards, etc.

If you're "in the trenches" working suspicious logins in the Microsoft world, you'll feel this one!

[spencer @techspence]

- Don’t trust EDR alone to protect your organization
- Enforce MFA everywhere
- Audit AD regularly with PingCastle, ScriptSentry, Locksmith, and ADeleginator
- Perform external & internal pentesting annually
- Find an MDR vendor you trust and pay them to help you monitor your environment
- Security starts and ends with people and exists to protect the business

[Rob Joyce @RGB_Lights]

One truth I've always stood by: attackers win by knowing your infrastructure better than you do. AI-enabled coding will bring amazing productivity, but the undiscovered cracks and seams built by vibe coding will be a massive attack surface for a while...

[Steven Adair @stevenadair]

Our team at @Volexity has identified a new 0day exploited in the wild. This time we caught a threat actor using an unauthenticated RCE in Palo Alto Networks GlobalProtect. It has been assigned CVE-2024-3400 and is covered in this @PaloAltoNtwks advisory https://t.co/JZIOPnavnX

[Gerald Auger, Ph.D. @Gerald_Auger]

BSides Charleston 2023 on sale now!!!
💙

Also fun fact I’ve heard the keynote is really cool 😎

(being silly, it’s me, and I’m wicked excited and super pumped to deliver a great talk to kickoff the event!)

Get your tickets now👇

https://t.co/EFxqRTE7rx

[vx-underground @vxunderground]

All ALPHV ransomware group did to compromise MGM Resorts was hop on LinkedIn, find an employee, then call the Help Desk.

A company valued at $33,900,000,000 was defeated by a 10-minute conversation.

[Jason Damron @JasonSDamron]

@HackingLZ @cyb3rops Agree with this. But would include that the user reporting of junk/spam to the IT/helpdesk can increase dramatically. More negatives than positives generally.