Susannah Clark Matt

Writer, Editor @redcanary.

[Susannah Clark Matt @Susannigans]

For @nytimes, I wrote a Tiny Love Story about my dad. https://t.co/JkIgB4kNGo

[Susannah Clark Matt @Susannigans]

@sidhubaba 🎶 Oops(AI) did it again....

[Susannah Clark Matt @Susannigans]

@NtiAning omg everyone's earnestly hopeful faces in the first photo...😭

[Susannah Clark Matt @Susannigans]

The most fun I have (at work) all year!

[Red Canary, a Zscaler company @redcanary]

What do the Wu-Tang Clan and Barney have in common? 👐🦖

They’re both featured on this year’s Threat sounds playlist!

Every year, the Red Canary team collaborates to pair the top 10 threats and techniques from our Threat Detection Report with a specific track. Thanks to community suggestions, this year’s list is our most diverse yet—from hip-hop legends to childhood classics.

Whether you're hunting threats or just clearing your queue, we’ve got your soundtrack covered.

🎧 Listen to the full playlist and download the report here: https://t.co/TOBGl6OYZj

[Susannah Clark Matt @Susannigans]

📣 Filmed In Gaza is in 2nd place and so close to joining the #Webbys Winners Circle. RT + VOTE: https://t.co/2xp3Lkyz4y

[Red Canary, a Zscaler company @redcanary]

The 2026 Threat Detection Report is packed with brand-new sections on the AI trends we’re seeing in the wild. 🤖🛡

From AI-powered threats to AI infrastructure risks, these are the priorities every security leader needs to prioritize.

Our experts break down everything you’ll find in this year's report right here 👉 https://t.co/OiZf7Rm6EC

[Red Canary, a Zscaler company @redcanary]

Read our liner notes to see which threats, techniques, and trends these songs pair with! https://t.co/kQPtXn4Zyc

[Red Canary, a Zscaler company @redcanary]

If you’re waiting for a breach to learn how adversaries move, you’re already behind. 📉

We’ve crunched the numbers, analyzed the latest techniques, and built the ultimate guide to keeping your environment safe.

The 2026 Red Canary Threat Detection Report is dropping soon! https://t.co/2DqSEmS1rO

[Frank Matt @fxmatt4]

In June of 2025, @NBCNews published its investigation into Rwanda's secret war in the DRC. At the time of publication, Rwanda was at the table for US-backed peace negotiations for a conflict they had never admitted to taking part in.

Now, we're starting to see that admission🧵

[Red Canary, a Zscaler company @redcanary]

What a year 2025 has been! From relentless threat detection to excitedly joining the Zscaler family, it has been a busy year for the Red Canary team.

We're looking back at the most beloved and informative content we brought you, the cybersecurity community, throughout 2025 in this "best of" list.

Explore our top picks here ➡️ https://t.co/pvN21tC92Q

[Red Canary, a Zscaler company @redcanary]

The "Sticky Bandits" of cybercrime are out there waiting for an opportunity to wreak havoc. Your cloud security strategy needs a bit of Kevin McCallister's legendary proactive defense!

➡️ Click here before your cloud gets hit with a paint can: https://t.co/xx3Ia8uCRx

[Red Canary, a Zscaler company @redcanary]

The @CISAgov is strongly encouraging organizations to patch a critical-severity Windows Server Update Services (WSUS) vulnerability (CVE-2025-59287) after adding it to its catalog of Known Exploited Vulnerabilities (KEV Catalogue). On servers with WSUS Server Role enabled and ports open to 8530/8531, adversaries can leverage specially crafted requests to exploit a deserialization of untrusted data vulnerability that allows for remote code execution. This can lead to PowerShell and Windows Command Shell executing base64 encoded commands designed to enumerate users and network information on affected endpoints.

While Microsoft has issued guidance for mitigating this vulnerability, including releasing an out-of-band security update for impacted Windows Server versions, some organizations may not be able to patch immediately.

Red Canary has detected post exploitation activity related to this vulnerability through the following detection analytics:

𝐀𝐛𝐮𝐬𝐞 𝐨𝐟 𝐖𝐢𝐧𝐝𝐨𝐰𝐬 𝐜𝐨𝐦𝐦𝐚𝐧𝐝 𝐬𝐡𝐞𝐥𝐥 𝐟𝐨𝐫 𝐞𝐱𝐞𝐜𝐮𝐭𝐢𝐨𝐧

Security teams could detect this activity by looking for 𝙘𝙢𝙙.𝙚𝙭𝙚 being spawned from the Windows Server IIS worker process (𝙬3𝙬𝙥.𝙚𝙭𝙚) or the WSUS service binary (𝙬𝙨𝙪𝙨𝙨𝙚𝙧𝙫𝙞𝙘𝙚.𝙚𝙭𝙚), with a /𝙘 command that starts another 𝙘𝙢𝙙.𝙚𝙭𝙚 /𝙘 instance. https://t.co/4QxhnhfgmS

𝐀𝐛𝐮𝐬𝐞 𝐨𝐟 𝐏𝐨𝐰𝐞𝐫𝐒𝐡𝐞𝐥𝐥 𝐭𝐨 𝐨𝐛𝐟𝐮𝐬𝐜𝐚𝐭𝐞 𝐜𝐨𝐦𝐦𝐚𝐧𝐝𝐬

Another detection opportunity involves looking for the use of the shortened encodedCommand flag in 𝙋𝙤𝙬𝙚𝙧𝙎𝙝𝙚𝙡𝙡. Adversaries often try to obfuscate the use of malicious code on an endpoint, wrapping them up for PowerShell to execute. https://t.co/DQYc56Q0kC

[Red Canary, a Zscaler company @redcanary]

Based on all the Easter eggs, we were expecting Taylor's new album to be called "The Life of a SOC analyst." But we're excited for this new era nonetheless! ❤️‍🔥

👩‍💻 Revisit @Susannigans's blog on why Swifties should work in cybersecurity: https://t.co/LsYuxWqMWq

[Susannah Clark Matt @Susannigans]

@fxmatt4 won an Emmy and I couldn’t be prouder!

[The Emmys @TheEmmys]

The #NewsEmmys Award for Outstanding Research – News goes to The Hidden Autopilot Data That Reveals Why Teslas Crash (@WSJ).

[Red Canary, a Zscaler company @redcanary]

🐣 A new color bird threat has hatched!

Mocha Manakin employs paste and run with PowerShell to drop a custom NodeJS backdoor that could lead to ransomware.

☕ Read our breaking research for detection opportunities and more technical details on this Red Canary-named threat.
https://t.co/bAxFbBb0FV

[Frank Matt @fxmatt4]

Rwanda has never admitted to taking part in the conflict in the DRC that since 2021 has killed thousands and displaced millions. @NBCNews Digital Docs investigation discredits Rwanda's narrative of this conflict and lays bare their hidden invasion.

🧵 with links to watch & read

[NBC News @NBCNews]

NBC News analyzed leaked reports, satellite images and interviews to reveal the extent of Rwanda's carefully concealed and high-tech war in the Congo, as the U.S. tries to strike a deal for peace and access to the region's minerals. https://t.co/jdzC4cacbV

[Susannah Clark Matt @Susannigans]

Another year, another Emmy nomination for @fxmatt4! Watch his piece on Tesla crashes here: https://t.co/07Sd0N0Z57

[The Emmys @TheEmmys]

#NewsEmmys Nominees for Research – News:
- Apes (@natgeo)
- Breakdown in Maine @PBS)
- The Cap Arcona | @60Minutes (@CBS)
- Documenting Police Use of Force (@PBS)
- The Hidden Autopilot Data ... (@WSJ)
- K File Investigation in NC Governor's Race (@CNN)
- Starving Gaza (@AJENews)

[Susannah Clark Matt @Susannigans]

@ReichlinMelnick @immcouncil Well done, Aaron!

[Susannah Clark Matt @Susannigans]

I found a way to mash up up my love of music with my career in infosec. Check out Threat Sounds vol. 5! https://t.co/qVL9ZJBNAr

[Red Canary, a Zscaler company @redcanary]

🎸 Did you know our annual report has a soundtrack? Read our liner notes to find out which threats and techniques we paired with songs by Taylor Swift, Beyoncé, Phish, and more. https://t.co/Zbl4vDNpht

🎥 Full behind the scenes video here: https://t.co/9chFFo1LTn

[Susannah Clark Matt @Susannigans]

This is the fifth Threat Detection Report I've worked on, and I'm so proud of the way it has evolved into an evergreen resource that people refer to as they run into cyber threats throughout the year. Don't try to take it in all once! https://t.co/GKjk1SKqlG

[Red Canary, a Zscaler company @redcanary]

The Threat Detection Report is both a timely read and an evergreen resource that practitioners refer to throughout the year. 🌲

Here's what's new in the 2025 edition: https://t.co/nI3FkbBwM6