Caitlyn L.

Cyber Threat Intel @ Google | Web3 Security | Probably has 75+ blockscanner tabs open | Views own.

[rootsecdev @rootsecdev]

Reminder connect to your cell phone hotspot as opposed to hotel wifi... if you have one. Connecting to a free hotel wifi hotspot should be a last resort.

[John Hultquist @JohnHultquist]

Our blog on the Axios NPM supply chain attacks. We are attributing the incident to a suspected North Korean threat actor we track as UNC1069. That actor is financially motivated and DPRK historically leveraged supply chain attacks to target crypto. https://t.co/F4dRfij58R

[Mandiant (part of Google Cloud) @Mandiant]

North Korean actor UNC1069 is targeting the crypto sector with AI-enabled social engineering, deepfakes, and 7 new malware families.

Get the details on their TTPs and tooling, as well as IOCs to detect and hunt for the activity detailed in our post 👇

https://t.co/t2qIB35stt

[Mandiant (part of Google Cloud) @Mandiant]

Google & partners disrupted IPIDEA, one of the world's largest residential proxy networks, reducing its device pool by millions.

This infrastructure was leveraged by over 550 distinct espionage and cybercrime groups.

Full report + IOCs here:

https://t.co/2GAnvawRwl

[Rich Luchette @richluchette]

Say what you will about Buffalo, NY, but the streets would have been cleared by Sunday evening if they got DC’s snowfall.

[InfoSecProf @_John_Doyle]

During our talk at @BSidesPyongyang two weeks ago on Cyber Juche, @crypt0ca1tlyn and I unveiled key feeder pipeline universities that the #RGB, #MSS, #MID, and #MND use to develop skills, experience, and ability to support various roles within their hacking units.

[rekdt @rekdt]

FYI: if you have an Oura ring, you're giving your health data to Palantir

[noid @__noided]

Announcing my rejected talk for @bsidespyongyang:

Is that "web3 enthusiast" follower with the anime PFP acting suspicious?

Find out if you have confirmed North Korean followers at https://t.co/sR2776PBF2.

[DL News @dlnews]

North Korean crypto infiltration is much worse than everyone thinks, says SEAL member

https://t.co/pa2djTmrE9

[BSides Pyongyang @BSidesPyongyang]

We are incredibly excited for this years agenda! #BSPY25 #BSidesPyongyang

Join us Tuesday 18 November 2025 on Twitch and YouTube

Register at https://t.co/7hHKvW3r2w

[Mandiant (part of Google Cloud) @Mandiant]

Google Threat Intelligence Group details the ways threat actors are misusing AI tools, including how they are generating and executing AI-enabled malware.

🔗 Read this latest report on our blog: https://t.co/VfvwpLFQXn

[Ossy Vincent @ossynoya]

Me finally reading the api documentation after trying it for the last two hours based on vibes.

[John Hultquist @JohnHultquist]

If you’ve been laid off from a cyber threat intel position, and you want a ticket to CYBERWARCON, please reach out.

[Mandiant (part of Google Cloud) @Mandiant]

North Korea threat actor UNC5342 is using EtherHiding, the first time we have observed a nation-state use this technique. 🚨

The TTP is being used in a social engineering campaign that leads to cryptocurrency heists and espionage.

Read the blog post: https://t.co/JGnXcAQfoQ

[The Hacker News @TheHackersNews]

⚡ North Korean hackers just used the blockchain to hide malware — the first time ever seen.

Google says they used EtherHiding to plant code inside smart contracts, making it nearly impossible to remove and easy to update for just $1.37 in gas fees.

Full story ↓ https://t.co/8fDp4eZscT

[Security Alliance @_SEAL_Org]

A deeper dive into the npm registry phisher's tactics, techniques, and procedures uncovers a history of persistent attempts at attacking cryptocurrency users.

https://t.co/JhvrKUwkse

[samczsun @samczsun]

my sincerest condolences to the person responsible for this, this was a generational fumble, the likes of which we will probably never see again

[Tay 💖 @tayvano_]

This is why DPRK IT Workers get hired.

Their resumes are fake but pristine and the perfect length.

They a/b test them 1000x more than you.

If you’ve been hiring for years you can search your archives for names/emails/handles and see 10 versions of one dude with your own eyes.

[Neil Renic @NC_Renic]

when you said you’d take care of it in September and it’s September