Nart Villeneuve

@nartv.bsky.social

[Nart Villeneuve @nartv]

@TLP_R3D The indirect linkage is likely because of the use of a common Bullet Proof hosting service in this case.

[Nart Villeneuve @nartv]

@ImposeCost https://t.co/f2fUuMQGgH

[profdeibert @RonDeibert]

NEW @citizenlab report -- extensive analysis of censored search results in 8 #China accessible search platforms.

#MicrosoftBing's "political censorship rules" found to be "broader and affected more search results than Baidu."

Authors: Jeffrey Knockel, Ken Kato & @emiledirks

[Nart Villeneuve @nartv]

On vacation and look what randomly flew by me #stoptoxictwitter

[Mastodon (@[email protected]) @joinmastodon]

Over 1 million people have joined Mastodon since October 27. Between that and those who returned to their old accounts, the number of active users has risen to over 1.6 million today, which, for context, is over 3 times what it was just about two weeks ago!

[Nart Villeneuve @nartv]

@Catspaw I think you were right :)

[Jim Stanford @JimboStanford]

It must've seemed like a clever PR idea. But Loblaws' "price freeze" on no-name products has turned out to be an own goal. My take for @TorontoStar @StarBusiness today: https://t.co/3EFmKLSL3R. Plus: the surge in corporate profits amidst inflation is a an economy-wide problem. /2

[Requiem @Requiem_fr]

1st paper from my friend and @mandiant colleague @fumik0_ ! 🥰
From RM3 to LDR4: URSNIF Leaves Banking Fraud Behind. 👇
https://t.co/eJJPPpv5R1
#malware

[Nart Villeneuve @nartv]

While exploits get a lot of attention, widely distributed malware -- the stuff that I believe accounts for a sizable % of the "initial entry vector was valid creds" seen in IR reports -- is often underestimated.

[Nart Villeneuve @nartv]

Two interesting tweets in my feed that intersect today: https://t.co/muApOwuW2Y and https://t.co/Mu9SgQZTHU.

[Blake @bmcder02]

My first blog with @MicrosoftDART!
This is a post incident report, talking about some of the TTPs we saw in a recent ransomware incident. This really emphasizes the importance of doing a post ransomware IR.
https://t.co/NXPOqR5EST

[Nart Villeneuve @nartv]

In this excellent #CTIS2022 presentation @xme quoted https://t.co/VxYL5Pa2f6 , ~50% of ransomware cases they analyzed began with use of valid RDP/VPN creds, but ~27% came from maldocs (#QAKBOT etc.). They also had one case of #RACCOON. The valid credentials come from somewhere!

[Nart Villeneuve @nartv]

But IR teams often run into issues trying to determine the initial access vector as @bmcder02 noted -- data retention limits and re-imaging compromised hosts etc. (https://t.co/pKhheLYIGV).

[Nart Villeneuve @nartv]

@wesdrone @pmelson Some interpret the industry or geographical impact from their telemetry data (which is often skewed by the distribution of the company’s customer base) as evidence of “targeting”.

[Nart Villeneuve @nartv]

@wesdrone @pmelson Some interpret automated personalization, or replyto threads as “targeted”, others take things like language of the lure, or geofencing as indicating “targeting”.

[Wes Drone @wesdrone]

I'm incredibly proud of @selenalarson and @dansomware's report on COVID social engineering. Telling threat stories over long periods of time is not our strength, they tackled this with grace and integrity. https://t.co/ZJucpm3xVA

[profdeibert @RonDeibert]

@PJ47596176 They forgot "Ghostnet" -- the OG threat actor name, and conceived by a non-industry group :)

[Nart Villeneuve @nartv]

@k8em0 @zeroday I still use this adapter when travelling, best swag I’ve got.

[Mike Schreiner @MikeSchreiner]

As we begin the new legislative session at Queen’s Park, I have one question for Doug Ford: What does ‘getting it done’ mean to you?

This was your commitment to Ontarians during the spring campaign. But if this summer is an example, ppl are in for a hard 4 years. 1/ #onpoli

[Kaylin Trychon @KaylinTrychon]

Great to see @ShaneHuntley testify before @HouseIntel today. I'm really proud of the work @Google TAG has been doing to combat spyware & speak out against the industry.

Adaptation of Shane's remarks here:https://t.co/mIxhtonFKh