Andrea (she/her)

Researcher & linguist focused on biological & computer security issues
Interests: Russia, E. Asia, Artificial Intelligence, Language 🇺🇦

[Andrea (she/her) @justaddnotes]

PSA to all my friends and colleagues here on this app: you can find me on BlueSky as well at @justaddnotes.bsky.social 🦋🫶

[Unit 42 @Unit42_Intel]

Unit 42 has observed #StatelyTaurus (aka #MustangPanda) used the following domains in various campaigns to enable its globally spanning espionage operations in the last 90 days: https://t.co/vFtuwuyPyj

[Greg Lesnewich @greglesnewich]

When @unpacker publishes, you gotta read it

Excellent work as always!

[Tom Hegel @TomHegel]

New research from @milenkowski and @ValidinLLC

🇰🇵 Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms

Research: https://t.co/WknGevy514

Reuters story: https://t.co/hTP4qLb3PS

[Silent Push @silentpush]

Here's a quick hunting query you can use to find #Clickfix fake booking sites with a tiny bit of regex in our Community Edition.

Shoutout to @JAMESWT_WT for sharing the initial domains 🔥

[Lawrence_Sec @Lawrence_Sec]

A significant amount of #CastleLoader C2 infrastructure identified by @JulianVoeg and @_whoisnt in their latest report was tied to #ThreatActivityEnabler 🇬🇧 FEMO IT SOLUTIONS #AS214351 utilising 🇩🇪 aurologic GmbH #AS30823 as their sole upstream provider. One to watch out for!

[Brian Liston @brianjliston]

⚡️ New report out today from our team at @RecordedFuture: “Russian Influence Assets Converge on Moldovan Elections”

Ahead of the upcoming parliamentary elections, we touch on multiple Russia-based/linked influence operations we assess are attempting to destabilize Moldova, including:

🪆 Matryoshka (Operation Overload),
✂️ Operation Undercut,
🌩️ Foundation to Battle Injustice (CopyCop/Storm-1516),
📺 Ilan Shor-sponsored Moldova24 television network and covertly sponsored Facebook pages, and finally
🤺 Portal Kombat’s “Pravda Moldova”

https://t.co/AdLAFzq6T1

[Calwarez @calwarez]

This report on Stark Industries is a fantastic case study in the cat-and-mouse game between hosting providers and law enforcement. The new "Threat Activity Enabler" (TAE) terminology is spot-on and highlights the critical role these providers play in the cybercrime ecosystem.

[Will @BushidoToken]

First we saw APT28 using an LLM to generate commands in their malware and now, a ransomware is using an LLM to start file system encryption 👀

[Eric Geller @ericgeller]

Anthropic says a hacker used its Claude chatbot "to an unprecedented degree": Claude identified vulnerable companies, wrote infostealer malware, analyzed stolen files for extortion purposes, calculated extortion amounts, and wrote extortion messages. https://t.co/gVyu3b7YG0

[Calwarez @calwarez]

Highly recommend this report on TAG-144. It breaks down the group's operations into five distinct clusters and reveals some serious tradecraft! From using compromised government emails to hiding payloads in JPGs. A deep dive into a very sophisticated threat.

[Julian-Ferdinand @JulianVoeg]

Great deep dive into Stark Industries by my colleagues @Lawrence_Sec and @_whoisnt, covering its role as a TAE, how it preempted and evaded EU sanctions, and broader issues with the hosting ecosystem. Definitely underreported topic and highly recommended read.

[Brian Liston @brianjliston]

This is Overload/Storm-1679/Matryoshka ops

[urlscan.io @urlscanio]

We recently announced the GA launch of our urlscan Observe feature. With urlscan Observe you can set up hunting rules for new domains and websites, trigger notifications and additional monitoring. Observe now allows you to control the monitoring process: https://t.co/hNmk63URfA

[Eric Geller @ericgeller]

Former @CISAgov director Jen Easterly helped put together a site that matches laid-off CISA employees with companies that want to hire them. https://t.co/YHlXWko0lW

[Silent Push @silentpush]

🚨New Research Blog 🚨Sensitive VPN Information Discovered in #Lazarus Group Infrastructure

Silent Push analysts have conducted in-depth research into the latest #bybit Crypto Heist by the Lazarus #APT group.

Read on for our findings below 👇

https://t.co/IafUBCkjmY

[Andrea (she/her) @justaddnotes]

@ArmandDoma This is *beyond* evil. In addition to being cruel, it breaks a solemn promise we made to people who risked their lives for us and it ultimately undermines our standing with allies.

[Will @BushidoToken]

🧵Thread of reports on 🇷🇺/🇺🇦 cyber activity in January 2025:

1. FANCY BEAR targets Central Asia with HATVIBE and CHERRYSPY malware (https://t.co/b6uwcCxAva)

2. Star Blizzard impersonates a US government officials in WhatsApp account takeover phish (https://t.co/vvqHoyHm07)

[Pierluigi Paganini - Security Affairs @securityaffairs]

Pro-Russia hackers #NoName057 targets #Italy again after #Zelensky's visit to the country ,,,
https://t.co/YgYZQegm4v
#securityaffairs #hacking #Russia

[StrikeReady Labs @StrikeReadyLabs]

"info.pdf" #russia #apt #phishing 53142380d75e3f54490f2896b58f308e6b91bec841d09b4e88985cb5b7812031
-> linkcuts[.]com/gumcrr51 -> doads[.]org/gumcrr51 -> run.mocky[.]io/v3/22a2a2d8-84b9-4619-b8ba-359beb386cf9 -> jkbfgkjdffghh.linkpc[.]net

[Virus Bulletin @virusbtn]

Symantec's Threat Hunter Team look into an espionage campaign, linked to China-based APT groups, targeting high-profile organizations in Southeast Asia. https://t.co/VrZEhFtFIJ