Azi Vaziri

Herder of cybercats at @google Threat Intelligence Group / TAG. Views are my own.

[Azi Vaziri @az_matazz]

Spyware is used against high-risk users: journalists, human rights defenders, dissidents and political opponents. I'm particularly proud of our latest work, shedding light on Commercial Surveillance Vendors who make $$$ exploiting vulnerable systems and users. 🧵

[Shane Huntley @ShaneHuntley]

Announcing the latest report from Threat Analysis Group documents the rise of commercial surveillance vendors and the industry that threatens free speech, the free press and the open internet

https://t.co/6y7gkrwS6A

Some highlights below. 🧵

[Josh Stroschein | The Cyber Yeti @jstrosch]

🎙️ You may have heard of the Glupteba botnet, but did you know @Google didn't just disrupt it—they sued the operators?

In a wild twist, the Russian operators didn't stay in the shadows. They hired a US attorney and showed up in a New York court to fight back.

In the latest episode of Behind the Binary, @pmbureau discusses the wild tale of the technical and legal takedown!

🎧 Listen here: https://t.co/5MlNJa37ov

[NetBlocks @netblocks]

⚠️ Update: It has now been 24 hours since #Iran implemented a nationwide internet shutdown, with connectivity flatlining at 1% of ordinary levels. The ongoing digital blackout violates the fundamental rights and liberties of Iranians while masking regime violence ⏱

[Azi Vaziri @az_matazz]

@itsme_urstruly Lumbergh

[Azi Vaziri @az_matazz]

Earlier last year, we (Threat Analysis Group) published a comprehensive paper on the rise of CSVs + entire industry that threatens free speech/press/open internet: https://t.co/8OdV0YoFeX We must continue to focus on new international norms/frameworks to limit this misuse.

[Azi Vaziri @az_matazz]

Still Spying: even after getting hit with U.S. sanctions, spyware vendor Intellexa (Predator) is still dodging restrictions, exploiting 0days and selling digital weapons to the highest bidder. @google 🧵 #zerodayexploit #spyware https://t.co/LJKlOsBd73

[Azi Vaziri @az_matazz]

Also see this great research published by our friends at Amnesty: https://t.co/LGaOmZZMnw

[Azi Vaziri @az_matazz]

Toujours un grand plaisir d'échanger tech & cybersécurité avec @Guglielminetti à ~29:17min sur l'émergence d'outils qui modifient leur propre comportement en temps réel pour éviter la détection: https://t.co/jjfUdQHDKW
📄 Rapport complet: https://t.co/TqUexPVTki

[Jigsaw @Jigsaw]

For years, public opinion research has required trade-offs: depth or breadth; stories or statistics. ⚖️

Today, we’re sharing how Jigsaw and the Napolitan Institute bridged those gaps during our We the People pilot. 🇺🇸

[Azi Vaziri @az_matazz]

Of course, multiple @google teams work actively on disruption, disabling accounts/assets, and insights gained are used to strengthen safety guardrails and classifiers of our models for better resilience.

[Azi Vaziri @az_matazz]

In Jan'25, we published analysis of APTs attempting to use gen AI, specifically Gemini: no novel capabilities, just common usage, largely ineffective. Check out today's update on advances in threat actor usage of #AI tools: https://t.co/qDJQNdBeUt 🧵

[Azi Vaziri @az_matazz]

🔁Augmentation of full attack lifecycle: PRC, IR, NK continue to leverage AI to enhance all stages of operations (i.e. recon, creation of phishing lures, C2 dev, data exfiltration, etc.)

[Azi Vaziri @az_matazz]

It's @realJGoldblum 's birthday y'all 🎉

[John Scott-Railton @jsrailton]

6/ Some offensive providers quietly lobby for a world where they grow fast & unfettered, paid with your tax dollars.

Nimble & filling gaps.

But if you play out the scenario from past evidence?

Expect a massive transfer of taxpayer-funded tech & talent to foreign governments.

[Azi Vaziri @az_matazz]

Constantly iterating delivery mechanisms to evade detection, alternating between simple/complex methods (ex splitting crypto keys) as a persistent effort to maintain its core mission: intel collection against high-value targets like NGOs & policy advisors.

[Azi Vaziri @az_matazz]

New Malware Attributed to RU State-Sponsored COLDRIVER (🧵) https://t.co/Ee9xz1VWz9 ✍️ @wxs

[Azi Vaziri @az_matazz]

New infection chain uses a "ClickFix" lure (disguised as CAPTCHA) to trick users into running a downloader called NOROBOT, which 1st deploys a Python backdoor (YESROBOT) before settling on a more flexible/extensible PowerShell backdoor (MAYBEROBOT).