Ned Moran

Professor. Consultant. Analyst. Technologist. Security Geek. Privacy Advocate. Runner. Couch Potato.

[Ned Moran @moranned]

@billyleonard @12thMan the 12th man reference is deep ...

[Ned Moran @moranned]

@fstenv of course @fstenv . youre always welcome to hit me up

[Ned Moran @moranned]

@ChicagoCyber also important to note that Muddy as a unitary actor != Muddy as a supporting org that enables other ops. This is an easy thing to miss.

[Ned Moran @moranned]

@ChicagoCyber this is correct. from my view, there were multiple actors in at least one of the thanos victims so difficult to pin it solely on Muddy.

[Ned Moran @moranned]

@wxs @mjr_irl @billyleonard shots fired. men down. why so mean @wxs ?

[Ned Moran @moranned]

@ChicagoCyber Otrio! Cant wait for my kids to be old enough to play this

[Ned Moran @moranned]

@wxs @notareverser @Mao_Ware @simandsec gimme a break @wxs. I just learned how to thread tweets

[Ned Moran @moranned]

@Mao_Ware @simandsec https://t.co/Gbs2I9gbQq

[Ned Moran @moranned]

@Dragonkin37 @BojackTrojan @OhadMZ @Dragonkin37 is correct. At Cyberwarcon I noted that the only links between 33 and DEADWOOD were timing and targeting - which in and of themselves are low-confidence. We track DEADWOOD separately from 33.

[Ned Moran @moranned]

@bkMSFT @cglyer @cglyer has yet to complete my on demand twitter training.

[Ned Moran @moranned]

This. 100 times, this.

[Ben Buchanan @BuchananBen]

I’m hesitant to do this because everyone says how the SolarWinds hack confirms all their priors, but here goes.

My PhD and first book argues the blurred lines between espionage and preparations to attack in cyber make interpretation hard. A short thread on what that means here.

[Saher Naumaan @saffronsec]

While MuddyWater's link to ransomware remains tenuous and unproven, the group is heavily invested in custom tool development. From PowerShell to .NET to C++ malware, Muddy is fast approaching other groups' capabilities. @snlyngaas reports w/ lines from me https://t.co/Zr2Sn4ZVyp

[bk (Ben Koehl) @bkMSFT]

It's almost as if there are companies providing/selling capabilities whether its Implants, Exploits, or all of the above and what you may see here are downstream customers. @moranned and I covered this a little bit in https://t.co/O1Unl2tMtr from 2015.

[bk (Ben Koehl) @bkMSFT]

There are a number of these kinds of examples where this kind of sharing can be inferred too in the infrastructure side of things, but.. this is Twitter and they probably also read the same tweets the defenders do.

[Оlga Belogolova 🌻 @olgs7]

Thanks for your patience, class! Took a little hiatus for a month. But we're back! In week 5 of “Lies & Disinformation” @Georgetown, we pivoted from Russian influence activities to Chinese and Iranian IO state actors.

[Ned Moran @moranned]

@PJ47596176 @RonDeibert @LenMaschmeyer @jonrlindsay this is true, but also much easier said than done for a variety of reasons.

[Ned Moran @moranned]

@9bplus @Mao_Ware @TheCollierJam Im still traumatized by years of 2k erg tests in college, but I will throw down on intervals (500m w/ 1min rest * 8) or a straight 5k.

[Ned Moran @moranned]

@RidT @BuchananBen i think its important that you measure effects across intrusion sets - even those that arent targeted via doxxing, indictments, etc. others can watch and learn and not repeat the mistakes their peers may have made.

[Ned Moran @moranned]

@RidT @daveaitel @BuchananBen cc @bkMSFT