Brad Slaybaugh

DFIR @Mandiant

[Steve YARA Synapse Miller @stvemillertime]

My @FireEye friends @DavidPany and @deeemdee4 put out a badass blog on tunneled RDP. What is it? How is it used? What can you do to find it? Read more here: https://t.co/N4sbqLHDfA

[David Pany @DavidPany]

Check out our blog on identifying abuse of RDP by attackers! Lots of actionable prevention recommendations too! https://t.co/X2BVHu4hco

[Nick Carr @ItsReallyNick]

@Mandiant BUGJUICE == REDLEAVES
HAYMAKER == CHCHES
SNUGRIDE == https://t.co/xovYDkIjdN

[Matthew Dunwoody @matthewdunwoody]

#APT29 part 2: I wrote up my favorite backdoor, POSHSPY, which I first discussed during our #noeasybreach talk. https://t.co/F5GcjfAzQv

[Nick Carr @ItsReallyNick]

We released the @Mandiant #MTrends 2017 report today, including details on Russian APT email harvesting techniques https://t.co/NqBSIPm1Bb