ian

threat research @BlackLotusLabs

[ian @adversarialy]

Isn’t this just a sort of nimbyism ? I understand why someone wouldn’t want a factory, power plant, or Walmart in their backyard—but that doesn’t mean we should ban all factories, power plants, and Walmarts. Opposing data centers might be good politics but it doesn’t seem like good policy

[ian @adversarialy]

@j2k3k

[ian @adversarialy]

@SimoKohonen @DefusedCyber let’s go

[ian @adversarialy]

Porchfest! @PPorchfest

[ian @adversarialy]

@SimoKohonen @techspence I’ve been meaning to test out Galah, which caches responses so you’re not constantly generating new ones for identical requests. You can also set up Suricata rules so only certain requests are directed to the AI

[ian @adversarialy]

@AlisonPHorn @oucmecalling311 @Janeese4DC I’m pretty sure all the major candidates have plans for dealing with rats, and they’re mostly in agreement about what should be done

[780th Military Intelligence Brigade (Cyber) @780thC]

Leaked Documents Reveal Russian ‘Cognitive Strikes’ Against the West — Including Islamophobic ‘Pig Head’ Attacks in Paris
OCCRP | Organized Crime and Corruption Reporting Project
https://t.co/loSJ9O66Q0
@OCCRP

[ian @adversarialy]

@jamieantisocial @gleeda to be fair using minimized might actually bypass this @cyb3rops Sigma rule 😂

[BleepingComputer @BleepinComputer]

Chinese hackers target telcos with new Linux, Windows malware
https://t.co/2xrKLSHrQw

https://t.co/2xrKLSHrQw

[ian @adversarialy]

Looks like “shadowcore” was just a renamed version of AdaptixC2

[ian @adversarialy]

We found multiple Cisco Catalyst SD-WAN devices beaconing to a C2 server at 194.163.175[.]135. If anybody has intel about "𝐬𝐡𝐚𝐝𝐨𝐰𝐜𝐨𝐫𝐞" C2, please let me know!

https://t.co/bYDrJonRbD

[ian @adversarialy]

@HackingLZ @JohnHultquist infosec to concepts that have been around for decades (zero trust, assume breach, defense in depth, etc.)

[Will @BushidoToken]

For those tracking Warlock Ransomware, I’ve added two profiles for their Tools & Exploits. Thanks to TrendAI, Sophos, Microsoft, Reliaquest, and Lumen Black Lotus Labs for sharing their research.

Tools: https://t.co/mtNdx01KP2

Exploits: https://t.co/bbDpHkhwMt

[ian @adversarialy]

@UK_Daniel_Card @DefusedCyber Interesting that 205.237.106[.]117 is using @HackingLZ 's favorite AI pentest tool, PentAGI.

That same actor also targeted @sysdig Langflow honeypots in March:
https://t.co/CMGVmurM7W

[CISA Cyber @CISACyber]

Chinese government-linked cyber threat actors are using covert networks built from compromised SOHO routers, IoT, & smart devices to carry out malicious activity. We urge all orgs to review our advisory for TTPs, IOCs, & mitigations against this threat. 🔗 https://t.co/VvBpThfINq

[ian @adversarialy]

@UK_Daniel_Card @DefusedCyber The payload here looks consistent with the PoC published by @zerozenxlabs, which is incorrectly attributed to CVE-2026-20127. It actually exploits three other vulnerabilities Cisco recently disclosed in SD-WAN Manager. More info in this @VulnCheckAI blog: https://t.co/3muCCKvDXa

[Simo @SimoKohonen]

source https://t.co/e9R3o8mMOZ

thanks @adversarialy

[ian @adversarialy]

@DefusedCyber It’s because this was just added to ExploitDB yesterday https://t.co/brffamoxUL

[Co11ateral @co11ateral]

FortiWeb 8.0.2 – Remote Code Execution

This came out today. Make sure you’re patched

https://t.co/bgD1VHPrOt

#blueteam #redteam

[780th Military Intelligence Brigade (Cyber) @780thC]

In FrostArmada, Lumen observed Forest Blizzard using that technique to feed targeted logins into Attacker-in-the-Middle (AitM) infrastructure, scaling from limited activity to thousands of victims worldwide.
https://t.co/FT1OIreAiy
@lumentechco

[Eric Geller @ericgeller]

Hours after Microsoft reveals that Russian hackers have been breaking into poorly secured routers & hijacking DNS requests (sometimes to collect Outlook data) https://t.co/BwG1UpvNpr DOJ says it has kicked those Russians out of the US routers they hacked: https://t.co/mEfYcJ2Ngf

[ian @adversarialy]

@lukOlejnik And not just in the UK
https://t.co/lAlYlbYzTi

[ian @adversarialy]

We estimate this campaign impacted about 18,000 victims (IPs with at least 10 interactions with the GRU's rogue DNS servers) from at least 120 countries. These victims included government agencies in certain North African, Central American, and Southeast Asian countries.