Former Threat Researcher at Proofpoint. ✿ Exclaimer of meeps. ✿ Parent to servers. ✿ Drinker of tea, Earl Grey, Hot. ✿ Former @FBI ✿
My opinions are my own.
At #LABScon23, Proofpoint's Greg Lesnewich will take a close look at similarities in macOS components used in North Korean crypto heists @greglesnewich
https://t.co/d6KJBcd5Lu
7️⃣ @greglesnewich | Greg Lesnewich
A senior threat researcher at @proofpoint, Greg is working on tracking malicious activity linked to the DPRK (North Korea). He has a background in threat intelligence, incident response, and managed detection, and previously built a threat intelligence program for a Fortune 50 financial organization.
I’ve been laid off! I’d be a great fit for the following roles:
🔥CTI Analyst
🔥Hunt
🔥CTI Manager
8 GIAC Certs + MBA IT Management + DSc Cybersecurity
5 + years of CTI/Hunt experience
Thank you!
Without amplifying initial content TA499 & #DisinfoOps rely on organic engagement by prominent accounts in the landscape to amplify narratives. Credit to @Twitter for adding disinfo tags with source context & comment details. @Zydecaa continues to do great research on these guys
Recent email addresses and domains observed used by this actor are p@poroshenko2019[.]com and ayermak@zelenskyy[.]team with subject lines "President Poroshenko – [Target]. Request” or similar.
Proofpoint's threat research on Russia-aligned TA499 has been featured in @barronsonline, @guardian, @TheRegister and more.
So what is TA499 and why is this activity note-worthy? @Zydecaa, sr. threat researcher, joins DISCARDED to dish on the details.
🎧 https://t.co/kEMjakZLAA
Prank or propaganda? This week, @proofpoint published research on Russia-aligned threat actor TA499.
@threatinsight expert @Zydecaa joined our DISCARDED #podcast to provide additional insight and share what makes tracking this threat actor so unique.
🎧: https://t.co/6ym2t8ILvu
My podcast interview on the 🏆AWARD🏆 winning DISCARDED is now live and goes even more in depth on TA499!
https://t.co/jc0eagguH6
https://t.co/hr2ccyhp6e
Podcast hosts, you know 'em and love 'em: @selenalarson and #cristaneedsatwitter
A new report dropped this morning from one of my wonderful peers @Zydecaa and the Threat Research Team.
#TA499 (#RU - #Russia - #APT), a State-Encouraged Actor, has been targeting North American and European government officials as well as CEOs with video calls 🧵👇
Check out the blog! This blog details the last two years of observed impersonated emails in relation to world events at large.
https://t.co/LPHQsIU6z8
https://t.co/2fetLtn5N8
2/4: Throughout 2021 and 2022, email lures emphasized urgency and timeliness. In the lead-up to the war, TA499’s email lures shifted from a focus on Russian opposition to the arming of Ukraine and Ukraine's NATO status.
🌏TA499🌎, publicly known as Vovan and Lexus, has utilized nuclear sensitivities, a war that has caused global destabilization, and the empathy of those supporting refugees and democracy internationally as email lures while purporting to be numerous international officials.
🇷🇺 intelligence attempted to procure data from Ukraine's international partners via email from a fake account alleging to be foreign affairs advisor of 🇺🇦 PM Shmyhal
Olena Kotlyarova, who is his only foreign affairs advisor, reported this on FB
https://t.co/xh5X7yRgDC
This is really incredible research by @Axel_F5 and @threatinsight. Seeing members of my team take a complex attribution situation and expand on previous research that our APT team has put out is one of the biggest gifts of working with the brightest!
https://t.co/XT9cZCHUSS
From Oct. 2022 to Jan. 2023, @proofpoint observed tens of thousands of email messages targeting organizations in the U.S. 🇺🇸 and Germany 🇩🇪.
We associate this activity with highly organized and financially motivated threat actor, #TA866.
Full report: https://t.co/J8wGi0Ny34
Today, @NCSC@NCSCgov published an advisory raising awareness about the threat of spear phishing from #TA446 (#Seaborgium) & #TA453 (#CharmingKitten).
These state-aligned actors use phishing to collect info from academia, defense, governments, NGOs, think-tanks, and journalists.