Ismael Valenzuela

VP Labs, Threat Research & Intel @AWNetworks ▪️ SANS Author & Senior Instructor #GSE 132 ▪️ #SEC530 #ThinkRedActBlue @TheMondayBrief

[Ismael Valenzuela @aboutsecurity]

🔥 Amazing day at the @SANSInstitute #AISummit 2026.

I had the chance to join the SANS360 lightning talks. 10 practitioners, 6 minutes each. No fluff.

My message was simple: #AI is collapsing prevention time, but time-based security still holds. Speed doesn’t make these attacks smarter. In fact, it often makes them more fragile.

To show how #AllAroundDefenders can flip the script, today we introduced #Decipio, our latest community project from the @AWNetworks Labs team.

#Decipio injects controlled “lies” into the environment to expose credential theft the moment it begins. It also applies automation and AI-assisted workflows defensively, creating a home-field advantage for defenders.

To protect the #cyberdefense community, we decided to release Decipio as a gated, community-driven release.

👉 You can start requesting access today through our website, and learn more about it in our latest blog:
🔹 https://t.co/IkiXWyiwbE
🔹 https://t.co/ADXE2L9MQU

#CyberDefense #AI #ThinkRedActBlue

[The Monday Brief @TheMondayBrief]

No, we don’t think AI is going to kill us all.

Plugin4Shell and OpenAI’s latest reports give us plenty to talk about: code that doesn’t match the approved commit, unauthorized credential use, and instructions to conceal mistakes.

Also in this week’s @TheMondayBrief: Cisco ISE under active exploitation, and why FamousSparrow’s targeting of Latin American governments should have you looking at geopolitics when setting your intelligence priorities.

@aboutsecurity and @fulmetalpackets get into all of it below👇

https://t.co/UZVL0s5jjD

#Cybersecurity #AgenticAI #ThinkRedActBlue

[Arctic Wolf @AWNetworks]

Arctic Wolf Labs is tracking an active widescale Russian-origin ClickFix campaign that uses a Ukrainian-language fake Cloudflare CAPTCHA to deliver an infostealer that collects browser credentials, wallet data, and supports persistent remote tasking: https://t.co/l3dCs7COhB

[Arctic Wolf @AWNetworks]

AW Labs discovered a procurement-themed phishing campaign targeting organizations in Europe using a layered delivery chain featuring HTA, PowerShell, JavaScript, and Lua-based execution to evade detection and deploy an in-memory infostealer: https://t.co/aeIPMr3IK7

[The Hacker News @TheHackersNews]

⚡ Billions of tokens. Millions of requests.

U.S. agencies accuse China-based AI firms of using industrial-scale distillation to extract capabilities from Claude, GPT, Gemini, and Grok.

How the campaigns hid their access: https://t.co/dcT7tBejq5

[Ismael Valenzuela @aboutsecurity]

I have to admit that I had a lot of fun with my latest @SANSInstitute webcast. I even built a couple of cinematic demos showing an attacker hijacking an AI agent’s intent and turning its legitimate access against you.

The Agentic SOC: Defending With, and Against, Autonomous AI.
Slides + recording 👇
https://t.co/UNoLbiR1QB

#AgenticAI #ThinkRedActBlue #ZeroTrust

[SANS Institute, EMEA @SANSEMEA]

⏳ Don't miss The Agentic SOC: Defending With, and Against, Autonomous AI today at 3 PM GST.

Join SANS Senior Instructor @aboutsecurity to explore how adversaries are weaponising autonomous agents and how defenders can secure agentic AI.

Register free 👉 https://t.co/DPp5hLDwJN

[The Monday Brief @TheMondayBrief]

“Hi, this is IT.”

Sometimes that’s all it takes to get handed the keyboard.

This week: fake IT support on Teams, a hijacked Terraform registry, PostgreSQL privilege abuse and targeted spyware. What happened, why it matters, and what to do, by @aboutsecurity & @fulmetalpackets

https://t.co/NRNTF7mfKG

#Cybersecurity #TheMondayBrief #ThreatIntelligence #ThinkRedActBlue

[Arctic Wolf @AWNetworks]

Today's Pack Alert: Arctic Wolf observed a large-scale Fortinet VPN credential access campaign targeting hundreds of organizations, using organization-specific identities and infrastructure linked to confirmed malicious access.

Learn more: https://t.co/KfThylfbgb

[The Monday Brief @TheMondayBrief]

New Monday Brief, by @aboutsecurity and @fulmetalpackets

1⃣@OpenAI postmortem on the @huggingface intrusion.
2⃣The @FBI seizure that left QScan and QTRouter inoperable.
3⃣Two more factory implants in white-label ZBT routers.
4⃣The TeamPCP arrests.

Four incidents where the facts were available long before the conclusion was 👇

https://t.co/MAMJCLA5aA

[Arctic Wolf @AWNetworks]

🐺 Introducing Pack Alert: our newest way to share timely threat research. AW Labs researchers recently observed malicious GitHub repositories that use redirects to fingerprint a visitor's device before delivering a payload built for that platform: https://t.co/eNymF1Urcs

[Ismael Valenzuela @aboutsecurity]

Dark Caracal is back in LatAm with new tricks.

@AWNetworks Labs uncovered GoCaracal: a modular Go framework with a lightweight foothold implant + a 34-handler RAT. Ethereum smart contract as C2 fallback (yes, it's called "BulletproofC2"). Deployed alongside an updated Bandook built to burn old signatures.

249 samples. 23 of 24 C2s on AEZA.

Full analysis, YARA + IOCs:
https://t.co/SWI8us7K5w

#ThreatIntel #DarkCaracal #ThinkRedActBlue

[SANS Institute, EMEA @SANSEMEA]

🤖 AI agents are changing the SOC, but greater autonomy brings new security challenges.

Join SANS Senior Instructor @aboutsecurity for our webcast exploring how to defend with, and against, autonomous AI.

📅 8 September
⏰ 3 PM GST

Register free 👉 https://t.co/DPp5hLDwJN

[Dmitry Melikov @DmitriyMelikov]

Huge thanks to @dimitribest for the chance to present together at #BlackHatUSA 2026! Your experience, expertise, and support made this whole thing possible.

Massive shout-out to the organizers #BlackHatUSA for picking our topic. The conference was held at the highest level.
@vkamluk , thank you for your patience and all the hard work you put into coaching us. Your energy and help really came through in the presentation.

Big thanks to @aboutsecurity and Jamie Butler for jumping in and helping us.

And of course, Arctic Wolf Labs (@AWNetworks) — thank you for the support and help.

[Ismael Valenzuela @aboutsecurity]

Thanks to @Bloomberg for covering our latest @AWNetworks #LightSpy research: a Chinese-built #spyware platform operating in more than 13 countries, with 117 servers, router implants across Europe and Africa, pricing tiers, billing infrastructure, even a demo environment for prospective buyers. Surveillance sold as a product, complete with customer service.

The best detail: an operator used the platform's own billing infrastructure to order KFC, leaving his real name and office address behind. Even nation-state operators get hungry. This one's OPSEC was finger lickin' bad 🍗

Full story: https://t.co/aK3hFW4E5T

#ThreatIntelligence #LightSpy #Spyware #BlackHat2026 #ArcticWolf

[The Monday Brief @TheMondayBrief]

25+ years in this field and the findings have not changed: weak passwords, no network isolation, exposed services nobody inventoried.

What changed this week is who found them. Anthropic's own AI models breached three real companies from a test sandbox. A vishing crew went from a Teams call to ransomware in 17 hours. Someone edited water PLC safety logic in seven states with the vendors' own engineering tools.

None of them needed an exploit, because the basics were already broken.

Think Red by @fulmetalpackets. Act Blue by @aboutsecurity.

https://t.co/4fgXCksthD

#CyberSecurity #ThreatIntelligence #OTSecurity #BlueTeam #InfoSec #SOC #Ransomware

[The Monday Brief @TheMondayBrief]

Everyone covered the #OpenAI sandbox escape last week. Two stories got almost no attention.

1/ Sixteen countries signed a joint advisory on a Russian campaign against Zimbra webmail. Laundry Bear. Targets across NATO states, Ukraine and the US, including nuclear installations. Opening the message is enough. The part nobody covered: the payload issues itself an app-specific password and turns IMAP on. Reset every password in the tenant and the adversary is still reading mail. Patch to 10.1.20. Then go audit those credentials.

2/ An operator already inside Thailand's Ministry of Finance ran an open source agent unattended to handle privilege escalation checks and enumeration. Nothing exotic. The approval prompt meant to prevent it is one toggle. If isolating a host in your environment needs a human signature, their clock is faster than yours.

@spovolny of @exabeam joins @fulmetalpackets and @aboutsecurity on all three signals this week 👇

https://t.co/NqqNJc8tcX

#ThinkRedActBlue #ThreatIntelligence #ZeroTrust #AgenticAI

[Ismael Valenzuela @aboutsecurity]

The AI "escaped the sandbox and gained internet access" is a fancy way of saying nobody enforced default deny outbound across the environment. Once again, this frontier AI lab story is less about a "superintelligent breakout" and more about a lack of cyberdefense fundamentals: a flat network with an egress path nobody was watching.

And yes, I know, a zero-day was involved. But zero-days get you code execution. A defensible security architecture decides what code execution gets you.

#DefensibleSecurityArchitecture #ZeroTrust #AllAroundDefender #SEC530

[International Cyber Digest @IntCyberDigest]

‼️ BREAKING: OpenAI says two of its own models, GPT-5.6 Sol and an unnamed pre-release system tested with cyber safeguards off, broke out of a sandbox last week, chained zero-days and stolen(!) credentials to reach the open internet, and hacked Hugging Face to cheat on a benchmark, in what OpenAI calls an unprecedented cyber incident.

[Jesse D'Aguanno @0x30n]

Why is it every time big AI labs talk about cyber capabilities it feels like they’ve never seen hacking before?

[Selección Española Masculina de Fútbol @SEFutbol]

⭐️⭐️ ¡¡𝗦𝗢𝗠𝗢𝗦 𝗕𝗜𝗖𝗔𝗠𝗣𝗘𝗢𝗡𝗘𝗦 𝗗𝗘𝗟 𝗠𝗨𝗡𝗗𝗢!!

#VamosEspaña | #CopaMundialFIFA

[Ismael Valenzuela @aboutsecurity]

Great conversations do not need a script. Just two friends who happen to think about adversaries for a living.

I joined my good friend and @TheMondayBrief co-host @fulmetalpackets at The War Room of Hackticks & Telemetry, to talk about the #ThinkRedActBlue strategy, @SANSDefense #SEC530, agentic AI threats, mitigations, and threat modeling, among other interesting things, including the World Cup, and the lessons learned of @MalagaCF promoting to 1st division with a bunch of kids, the importance of hard work and staying humble! ⚽ 🇪🇸

My segment starts around the 25 minute mark, but the whole conversation is worth your time 👇

https://t.co/wWXi0x9eDr

Thanks @fulmetalpackets and @rapid7 for having me on the show!

#ThreatIntelligence #Cybersecurity #TheMondayBrief #ThinkRedActBlue #InfoSec #CyberDefense #Malaga @SANSInstitute