Zydeca

Former Threat Researcher at Proofpoint. ✿ Exclaimer of meeps. ✿ Parent to servers. ✿ Drinker of tea, Earl Grey, Hot. ✿ Former @FBI ✿

My opinions are my own.

[horse dentist @equine__dentist]

incredible video by the national gallery of art

[LABScon 2026 @labscon_io]

At #LABScon23, Proofpoint's Greg Lesnewich will take a close look at similarities in macOS components used in North Korean crypto heists @greglesnewich

https://t.co/d6KJBcd5Lu

[Greg Otto @gregotto]

I am so glad the internet willed this into existence https://t.co/HTLqI20fK2

[SentinelOne @SentinelOne]

7️⃣ @greglesnewich | Greg Lesnewich

A senior threat researcher at @proofpoint, Greg is working on tracking malicious activity linked to the DPRK (North Korea). He has a background in threat intelligence, incident response, and managed detection, and previously built a threat intelligence program for a Fortune 50 financial organization.

[Dr. Ch33r10 @Ch33r10]

I’ve been laid off! I’d be a great fit for the following roles:
🔥CTI Analyst
🔥Hunt
🔥CTI Manager

8 GIAC Certs + MBA IT Management + DSc Cybersecurity

5 + years of CTI/Hunt experience

Thank you!

[Brian Bartholomew @Mao_Ware]

Officially on the job market today. Anyone looking for an old TI guy with a "smidge" of years under his belt, let me know. Happy to have a chat.

[Digital_Monet @aRtAGGI]

Without amplifying initial content TA499 & #DisinfoOps rely on organic engagement by prominent accounts in the landscape to amplify narratives. Credit to @Twitter for adding disinfo tags with source context & comment details. @Zydecaa continues to do great research on these guys

[Threat Insight @threatinsight]

Recent email addresses and domains observed used by this actor are p@poroshenko2019[.]com and ayermak@zelenskyy[.]team with subject lines "President Poroshenko – [Target]. Request” or similar.

[Threat Insight @threatinsight]

Proofpoint's threat research on Russia-aligned TA499 has been featured in @barronsonline, @guardian, @TheRegister and more.

So what is TA499 and why is this activity note-worthy? @Zydecaa, sr. threat researcher, joins DISCARDED to dish on the details.

🎧 https://t.co/kEMjakZLAA

[Threat Insight @threatinsight]

Prank or propaganda? This week, @proofpoint published research on Russia-aligned threat actor TA499.

@threatinsight expert @Zydecaa joined our DISCARDED #podcast to provide additional insight and share what makes tracking this threat actor so unique.

🎧: https://t.co/6ym2t8ILvu

[Zydeca @Zydecaa]

My podcast interview on the 🏆AWARD🏆 winning DISCARDED is now live and goes even more in depth on TA499!

https://t.co/jc0eagguH6

https://t.co/hr2ccyhp6e

Podcast hosts, you know 'em and love 'em: @selenalarson and #cristaneedsatwitter

[Zydeca @Zydecaa]

Read this amazing thread summarizing my research because when I do it I sound like an egg

[Andrew Northern 𓅓 @ex_raritas]

A new report dropped this morning from one of my wonderful peers @Zydecaa and the Threat Research Team.

#TA499 (#RU - #Russia - #APT), a State-Encouraged Actor, has been targeting North American and European government officials as well as CEOs with video calls 🧵👇

[Zydeca @Zydecaa]

@ex_raritas omg why can you hype me so much better than I can hype me

[Zydeca @Zydecaa]

Check out the blog! This blog details the last two years of observed impersonated emails in relation to world events at large.
https://t.co/LPHQsIU6z8

https://t.co/2fetLtn5N8

[Threat Insight @threatinsight]

2/4: Throughout 2021 and 2022, email lures emphasized urgency and timeliness. In the lead-up to the war, TA499’s email lures shifted from a focus on Russian opposition to the arming of Ukraine and Ukraine's NATO status.

[Zydeca @Zydecaa]

🌏TA499🌎, publicly known as Vovan and Lexus, has utilized nuclear sensitivities, a war that has caused global destabilization, and the empathy of those supporting refugees and democracy internationally as email lures while purporting to be numerous international officials.

[Zydeca @Zydecaa]

🔎Additional unattributed sighting of TA499 ITW 🔍
https://t.co/lCW7PBDkhU

[Euromaidan Press @EuromaidanPress]

🇷🇺 intelligence attempted to procure data from Ukraine's international partners via email from a fake account alleging to be foreign affairs advisor of 🇺🇦 PM Shmyhal

Olena Kotlyarova, who is his only foreign affairs advisor, reported this on FB
https://t.co/xh5X7yRgDC

[Zydeca @Zydecaa]

@ex_raritas

[Digital_Monet @aRtAGGI]

This is really incredible research by @Axel_F5 and @threatinsight. Seeing members of my team take a complex attribution situation and expand on previous research that our APT team has put out is one of the biggest gifts of working with the brightest!
https://t.co/XT9cZCHUSS

[Threat Insight @threatinsight]

From Oct. 2022 to Jan. 2023, @proofpoint observed tens of thousands of email messages targeting organizations in the U.S. 🇺🇸 and Germany 🇩🇪.

We associate this activity with highly organized and financially motivated threat actor, #TA866.

Full report: https://t.co/J8wGi0Ny34

[Threat Insight @threatinsight]

Today, @NCSC @NCSCgov published an advisory raising awareness about the threat of spear phishing from #TA446 (#Seaborgium) & #TA453 (#CharmingKitten).

These state-aligned actors use phishing to collect info from academia, defense, governments, NGOs, think-tanks, and journalists.