Jack

Security researcher

[Jack @malwareforme]

Getting away from Twitter. You can find me on BlueSky while I rebuild followers and figure it out:

https://t.co/bAe4wKO5gU

[Nick Carr @ItsReallyNick]

Russian threat actor Midnight Blizzard is conducting widespread traffic manipulation attacks at hotels worldwide. Result: delivering malware or redirecting auth flows at their discretion, globally.

Since early May 2026, we saw this subcluster manipulate DNS and HTTP traffic from networks served by captive portals to redirect user traffic through actor-controlled infrastructure. We’re calling the campaign CaptiveCrunch.
“We have observed notable commonalities in the equipment and management systems used across multiple affected networks.”

We break down the malware & techniques, but the most important part is how dynamic all of it is: Midnight Blizzard is using AI to support a significant portion of these operations. They are moving and changing quickly.

Feedback welcome on the suggested mitigations: https://t.co/cVGbdQEpXQ
Help spread the word to VIPs in governments, diplomatic entities, non-governmental organizations (NGOs) in the US and Europe (probably also those traveling to Black Hat)

[Matt Zorich @reprise_99]

We are looking for some interns to join our team here at Microsoft. If you are currently studying cyber security, computer science, mathematics or anything similar and based in Ireland or Cheltenham then we would love to hear from you - https://t.co/N0ECP8eiGM

[Matt Zorich @reprise_99]

People often share full Kusto queries, which is awesome, but what about those handy one liners and tips you have picked up along the way? Here are some of my favourites, share yours below!

Extend an additional column for your local time, example +5 UTC:

| extend LocalTime = TimeGenerated +5h

Find events only on weekends, cast a variable to make it easy to read:

let Saturday = time(6.00:00:00);
let Sunday = time(0.00:00:00);
AuditLogs
| where dayofweek(TimeGenerated) in (Saturday, Sunday)

Find events during certain hours of the day:

| where hourofday(TimeGenerated) !between (4 .. 23)

Calculate the minutes (or hours or days etc) between two events:

| extend ['Minutes Between Events']=datetime_diff("minute",Timestamp1,Timestamp2)

Parse the details, including browser family and version etc of a user agent:

| extend UserAgentDetail = todynamic(parse_user_agent(UserAgent, "browser"))

Decode base64 encoded strings, useful for PowerShell:

| extend DecodedCommand = base64_decode_tostring(EncodedCommand)

Rename columns while using project:

| project LogTime=TimeGenerated, SigninLocation=Location, IP=IPAddress, Agent=UserAgent

[Matt Zorich @reprise_99]

If you're a guy in your early 20s, learn regex.

Go into debt if you have to

[Jack @malwareforme]

@SwiftOnSecurity Prisoners of Geography

[Josh Kamdjou @jkamdjou]

excited to announce @sublime_sec has raised a $60M Series B led by @IVP

@CNBC wrote about the news this morning: https://t.co/TQuFhwhkP2

@ianthiel and I are so grateful and humbled by the trust our customers and community have placed in us. we won't let you down

[William Metcalf @node5]

Enjoy punching phish? Experience writing detections for phish, using regex, Yara, etc., and looking to grow as a researcher within an experienced team? Join me and the rest of the Splunk Attack Analyzer Misfits of Detection Science. US only, fully remote https://t.co/Crr9enas1y

[الرقة تذبح بصمت @Raqqa_SL]

The great Syrian people overthrew the Assad regime.
Syria is Free
We are free

[Josh Kamdjou @jkamdjou]

🔊 Useful advice for the holiday dinner table

https://t.co/5NaMy2BhAT

[Threat Insight @threatinsight]

Proofpoint has tracked this technique since August 2024, and call it “brooxml”. Our researchers do not consider this a zero-day or vulnerability in general.

We’ve released Emerging Threats and YARA signatures at the end of this thread.

[Jack @malwareforme]

The absolute worst take ever. Just don’t end up in PCRE jail and it’s fine. Regex 4ever

[Microsoft On the Issues @MSFTIssues]

Microsoft’s Digital Crimes Unit has seized 240 fraudulent websites, disrupting a major “Phishing-as-a-Service” operation. These campaigns targeted sensitive industries like financial services, jeopardizing data, transactions, and even life savings. https://t.co/0wNWO09dP2

[Nick Carr @ItsReallyNick]

I'm told we are hiring in MSTIC: https://t.co/ltfZcQbg5n
Come for the data, stay for the data. Creative problem solvers have the most impact.
If we've worked together, I'm happy to refer you.

But...

[William Metcalf @node5]

I'll just leave this here... https://t.co/DTCblEsK7U

[Josh Kamdjou @jkamdjou]

you can deploy verifiable coverage for this with @sublime_sec (for free), here’s the detection that’s been out for over a year (h/t @zoomequipd @ajpc500): https://t.co/DeufOQqIP3

[IAM!ERICA @EricaZelic]

There is also this setting in https://t.co/VTZqU7OhTu

[Sublime Security @sublime_sec]

Announcing our latest NLU model update: BERT Large Language Model (LLM), which is better at understanding tone, intent, and context than ever before.

We’ve detailed our research in our latest blog and how it’s used to combat AI-generated attacks: https://t.co/M7vAv8uFTG

[Justin @br0k3ns0und]

We are now developing @elastic threat hunting queries, alongside our detection rules, and openly sharing these as well! 🎉🎉

Can visually explore these with https://t.co/DYH1CkmLYN! 🔥🔥

#ThreatHunting #DetectionEngineering

[Sublime Security @sublime_sec]

We're excited to announce the release of our new Public EML Analyzer: a free, unauthenticated tool for analyzing email messages.

Upload any EML and get Sublime's analysis results along with URL sandbox and attachment previews, insights, and more: https://t.co/LCU2LK988F