Adam

[Adam @digivector]

@danmccay @goodgood_golf @CallawayGolf lol

[Volexity @Volexity]

Don't miss @tlansec's talk at 12:00 BST tomorrow, Oct 5, at #VB2023 in London! He will share @Volexity's research + observations of a North Korean #apt using unique, persistent #socialengineering techniques to target victims. More here: https://t.co/kwj60Nch3K
#threatintel #dfir

[Shane Huntley @ShaneHuntley]

North Korea 🇰🇵 thinks it's easier to steal 0day from researchers than to find it themselves.

If you are doing security research or have privileged access you have to assume you could be targeted at some point by a nation state.

[Adam @digivector]

Check if you've communicated with Paul091_! Outside of the 0-day, they also pushed their github project, GetSymbol - meant to help researchers download symbols. But it contains an update channel that could allow them to run arbitrary exes on machines of interest!

[billy leonard @billyleonard]

🚨 DPRK 🇰🇵 campaign against security researchers - new from @Google TAGs @maddiestone @_clem1 @digivector on new 0day ITW and potential infection through a tool aimed at helping the research community. as wu said protect ya neck kids 🦇

https://t.co/i2LSWjRfe1

[Ilya Miskov @ilyamiskov]

This is peak UI design.

[Steven Adair @stevenadair]

@Volexity @Microsoft365 @Microsoft It turns out our investigation turned up nothing because there was nothing for us to find. The incident was invisible to us with the data at our disposal and this was due to the customer's M365 license level: E3. This is likely the most common license level for most orgs. 3/7

[Bernardo Quintero @bquintero]

3 vacantes abiertas en Google Malaga

Software Engineer, Backend, VirusTotal, Google Cloud
https://t.co/ZepgQtyhgC

Solutions Consultant, VirusTotal
https://t.co/O599caIz7U

Security Engineer, VirusTotal
https://t.co/j9d22Z3Ukj

[Antti Tikkanen @anttitikkanen]

Snap is hiring security engineers for D&R and threat intel roles in Switzerland (we have offices in Zurich and Yverdon-les-Bains): https://t.co/gp9oql7oVF & https://t.co/J9oI2wxXzq

Retweets for visibility are much appreciated!

[bk (Ben Koehl) @bkMSFT]

The legend of @moranned coming to present research at BlueHat Israel 🎉

[Intrusion Truth @intrusion_truth]

We are hurtling towards our finale. Join us to meet the character who helped us reach an assessment of Xiaoruizhi's APT affiliation. https://t.co/I4tstwpYJK

[Intrusion Truth @intrusion_truth]

Introducing our main character of this investigation... Wuhan Xiaoruizhi Science and Technology Company https://t.co/d36qGP4VBC

[Bernardo Quintero @bquintero]

Google Málaga += 2 vacantes

Software Engineer, Infrastructure Integrator, VirusTotal, Google Cloud
https://t.co/e1cwtr1IgN

Security Engineer, VirusTotal
https://t.co/zyk9zrEfE9

[Adam @digivector]

@notareverser I know the struggle! ♥️

[Brian Bartholomew @Mao_Ware]

Officially on the job market today. Anyone looking for an old TI guy with a "smidge" of years under his belt, let me know. Happy to have a chat.

[Pete Markowsky @PeteMarkowsky]

So finally feel like I can talk about this. Santa as in https://t.co/1T0hNmP7lt now supports file access authorization. This means that we can authorize if a binary should be able to open a file/path and leverage code signing for targeting/filtering.

[Shane Huntley @ShaneHuntley]

“Litigation was filed against several of CryptBot’s major distributors who we believe are based in Pakistan and operate a worldwide criminal enterprise.”

@pmbureau and the team taking on cybercrime on a number of fronts.

https://t.co/me0xTx1Jrd

[visi stark @invisig0th]

@vtxproject is looking for non-profit orgs with an intelligence use case that would benefit from having #synapse. We plan to select a few with compelling missions and donate #synapse enterprise licenses/support.

Reply, DM, or join slack https://t.co/lU0MpjB70M if you have ideas!

[billy leonard @billyleonard]

In a previous life, Alex found more APT campaigns in a day than most vendors did in a year. If you want to increase positive coverage of your flashy new widget, no better person to help you do it!

[John Hultquist @JohnHultquist]

The likely DPRK 3CX incident was part of a DOUBLE supply chain incident (access from one supply chain compromise was used to create another). Leapfrogging this way allows the actor to create a vicious cycle that expands their footholds exponentially. https://t.co/9SXK1MMbe4

[billy leonard @billyleonard]

🆕 Updates from @Google TAG on recent APT, IO and Crime from 🇷🇺🇧🇾 actors against 🇺🇦 and regionally. 🎣 and more from 🇷🇺GRU, 👻🖊️, 🇨🇺💰 looking like APT and IO from the once adored 👨‍🍳.

1/🧵

https://t.co/vKd8VCUUj2