Magnus Jacobsen

Computer aficionado

[Michael 🆘 @matonis]

ICYMI: the State of Statecraft conference (@what_is_sos) returns to Brussels for Volume II on October 22, 2026. Registration is open & the CFP runs until Aug. 14

SOS is an event focused on state-sponsored operations: https://t.co/dPROolOxy9

🧵👇

[Ryan Naraine @ryanaraine]

WATCH on YouTube https://t.co/KM9e8uGHYr

[Magnus Jacobsen @m4gjac]

@ryanaraine An episode focused on the lost stories of the Equation Group sounds like a fantastic idea. Alternatively, an episode on adversary archaeology from you guys would likewise be a treat.

[Ryan Naraine @ryanaraine]

🔥 Volexity founder Steven Adair joins the problem to discuss memory analysis and the technical challenges associated with memory dumping and forensics, Volexity’s “nearest neighbor” Wi-Fi hack discovery, gaps in EDR detection and telemetry, and some real-talk on the Volt Typhoon intrusions.

Also, a Firefox zero-day exploited on the Tor browser, the professionalization of ransomware, ESET's discovery of a Linux bootkit (we have a scoop on the origins of this!), Binarly research on connections to LogoFAIL, and major visibility gaps in the firmware ecosystem. @juanandres_gs @stevenadair @craiu

[Steven Adair @stevenadair]

Just gave a talk about the Nearest Neighbor Attack at #CYBERWARCON and had a great time detailing our findings. This was a lot of great work by our @Volexity team and special thanks to @5ck and @tlansec for the long hours working on it! Def. one of our wildest #DFIR engagements!

[Magnus Jacobsen @m4gjac]

@ryanaraine It is a great podcast. Excellent discussions and content. Really enjoying it.

[Magnus Jacobsen @m4gjac]

@foxit https://t.co/COETRK0zt4 and https://t.co/LRfi7tgJAY look to be variants of a POC for CVE-2024-21762 (based on Assetsnote's writeup). The IP also hosted some likely Rekoobe backdoor variants, among other things. Thanks @Huntio
https://t.co/vr4huLA2oa
https://t.co/61CX7X4GRV

[JD Work @HostileSpectrum]

Why would a .cn state champion cyber firm have incentives to exaggerate issues when making public their root cause analysis of a major outage triggered by an EDR that has consistently been at the first line of defeating & attributing PANDA / BRONZE / TYPHOON intrusion sets, across the most popular enterprise deployed OS? Why indeed?

[Eugenio Benincasa @eubenincasa]

🧵In China, where the military-civilian divide is blurred, hacking contests and bug bounty programs help assess the strength and robustness of its offensive cyber ecosystem

This graph I've compiled shows my understanding based on my research (yellow) and other sources

Insights:

[Squiblydoo @SquiblydooBlog]

Infostealers are often bloated and signed.

Debloat removes the certificate by default since the cert becomes invalid in most cases.

With 1.5.6, you can now preserve the cert. (Refer to the original valid cert in your reports.)
https://t.co/Q10T7Ja25t
https://t.co/c396xd6jy7

[Squiblydoo @SquiblydooBlog]

It is common for malware to be signed with code signing certificates.

How is this possible? Impostors receive the cert directly and sign malware.

In this blog-post, we look at 100 certs used by #Solarmarker malware to learn more.

https://t.co/TzxQyzOUEG

[Dan Black @DanWBlack]

New report from @Mandiant detailing APT29's expansion of interest beyond diplomatic missions.

We judge this to be an early warning signal to other political parties and civil society groups across Europe/the West that they are also in the SVR's sights.

https://t.co/OitiYTjMs3

[John Hultquist @JohnHultquist]

APT29 (Midnight Blizzard/Cozy Bear) is targeting German political parties. The SVR has been on a tear lately and their mission of keeping Putin up to date on the West's thinking is especially important at this critical moment in the war. 1/2 https://t.co/KXLKOfuXyb

[Magnus Jacobsen @m4gjac]

Some good ones with different perspectives:

Attribution of Advanced Persistent Threats: How to Identify the Actors Behind Cyber-Espionage
https://t.co/eodfmYuIwy

The Hacker and the State: Cyber Attacks and the New Normal of Geopolitics
https://t.co/Wkxl9PT1Cy

A classic:

Network Attacks and Exploitation: A Framework
https://t.co/r2uARlj8sb

A lot of research since, but a good read:

Cyber War Will Not Take Place
https://t.co/BAse1XbZAT

[Dan Black @DanWBlack]

Great work here from our @ESET colleagues on a hybrid espionage/influence cluster we track as UNC5101.

Think tanks and other non-profits working on policy, defense, or security issues pertaining to the Russian Federation are primary targets for this actor's espionage activity.

[Malcat dev @malcat4ever]

#Malcat version 0.9.5 is out!
You can now unpack & disassemble #InnoSetup installers, download samples from threat intel providers and enjoy an improved user interface.
Last but not least: Debian 12 package!

More info there:
https://t.co/5jIe3gfDhs

[Pasquale Stirparo 🌻🇺🇦 @pstirparo]

EarlyBird tickets are gone,and tickets are going fast (definitely faster than our vetting :) ). If you have not done it yet,request an invite at https://t.co/42RPCyfUu4
Many exciting news coming starting from next week, don't miss your chance ;) #CTI #ThreatIntel #PIVOTcon24 #CfP

[Volexity @Volexity]

.@Volexity detected an incident where it discovered a threat actor chained 2 #0days in Ivanti Connect Secure, CVE-2023-46805/CVE-2024-21887, to achieve RCE, modifying components of the software to backdoor the device.

https://t.co/RibC5G0aOp

#dfir #threatintel #memoryforensics

[Pasquale Stirparo 🌻🇺🇦 @pstirparo]

The response we got since we announced #PIVOTcon24 last week has been insane, beyond our optimistic expectations. THANK YOU ALL.
We are so excited about how the program and the whole event are shaping. Join us by requesting an invite #GetItWhileItsStillHot #ThreatIntel #CTI #CfP

[Dan Black @DanWBlack]

Kyivstar's pushback on Solntsepek claims is notable, as personas used by the GRU to publicly claim responsibility for wiper attacks are notorious for embellishing the impact of their operations.

Exaggerating success is intentional and a core element of the playbook.