nate

Sysadmin turned CSIRT.

[nate @nate2x4]

Every time.

[nate @nate2x4]

@MazdaMX5Cup @GPSTPETE @MazdaMX5Cup where is the paddock with the posters? Not seeing anything on the event map.

[nate @nate2x4]

@UK_Daniel_Card I did a sort of Spotify wrapped after the first year I built it. I'll work on putting something together for last year!

[nate @nate2x4]

Facts. I built https://t.co/MRjL7hiKfZ so you could see not just the user and the source, but also the passwords they're using.

[mRr3b00t @UK_Daniel_Card]

Adventures of a honeypot!

Want to see some cyber reality? come check this out tweeps! This is literally how someone major incidents start.

https://t.co/p4vYFdJLYp

[nate @nate2x4]

@vxunderground @HCAdamSec @SecureAerospace In it to win it.

[nate @nate2x4]

Uh oh.

[Invictus Incident Response @InvictusIR]

One of the most insecure defaults is getting less insecure at the end of this month. Microsoft is limiting what permissions a user can consent to. This is very interesting for everyone doing #BEC investigations. Curious to see if this will impact malicious app usage.

More info (https://t.co/JGO1pFaVPz)

#stayInvictus #BEC #CloudIncidentResponse

[nate @nate2x4]

Just dropped off some NoLogsNoBreach stickers at the #GrrCON stickercon

[nate @nate2x4]

Sharing for awareness of the awareness.

[Andrew Kalat @Lerg]

It's cybersecurity awareness month! So, uh, be aware!
There, done.

[nate @nate2x4]

I can't wait until this tactic is used in a KnowBe4 simulation. Imagine failing this test 😭

[Matt Johansen @mattjay]

This BBC reporter was offered 25% of a ransom payout if he gave hackers access to the corporate network.

He played along, so we got a look inside their tactics here:

[Ismael Valenzuela @aboutsecurity]

🚫 These threat actors tried to hide their code behind the GPU. We caught them anyways.

🐺 Our @AWNetworks Labs team uncovered a threat actor abusing GitHub’s repository structure and Google Ads to redirect users to a malicious download, while a GPU-gated decryption routine kept the payload encrypted on systems without a GPU. We have named this new attack technique #GPUGate.

👉 Full research here: https://t.co/dJVfJ6LHVI

#CTI #ThreatResearch #ThreatIntel #ArcticWolf #SecOps #SOC

[nate @nate2x4]

@ThatCuberGuy99 If we meet, I've got Infosec stickers! See you at Grrcon.

[nate @nate2x4]

Woo! Big thank you to @InvictusIR !

[Invictus Incident Response @InvictusIR]

Thank you all for the love 💙 and the funny comments 😆

The winners of the giveaway are @nate2x4 & @Frank_Korving

[nate @nate2x4]

Say it louder for those in the back.

[Opener of the way @way_opener]

@techspence If you're not doing risk acceptance on purpose you're doing it by accident

[nate @nate2x4]

@InvictusIR I want access because Invictus always produces good stuff!

[%TEMP% @TEMP43487580]

I just started a new blog, and this is my first post. I took a bit of PTO, so this is a little record of some fun I had playing around with Intune during that time. It's about enrollment restriction bypass😄

https://t.co/o9CcXHN4b8

[Who said what? @g0njxa]

A Windows #Clickfix alternative seen in the wild on a mass-spreading malware campaign bypassing traditional Win+R shortcut restrictions

User is asked to open the Windows Power User menu (Win+X), open a Powershell terminal and paste and running a malicious Clickfix-style command

[nate @nate2x4]

First Microsoft introduces the ability to disable direct send after all the abuse, and now Salesforce is providing a method to stop the abuse exploited by ShinyHunters. Better late than never!

[𝕯𝖒𝖎𝖙𝖗𝖞 𝕾𝖒𝖎𝖑𝖞𝖆𝖓𝖊𝖙𝖘 @ddd1ms]

Behind the curtain: How Lumma affiliates operate.

https://t.co/wW2NbB5kwo

[nate @nate2x4]

You gotta do this. Something will probably break, but that's the name of the game.

[Black Hills Information Security @BHinfoSecurity]

**NEW** BHIS | Blog
Did you know your M365 tenant accepts unauthenticated email for your tenant domains by default?

Stop Spoofing Yourself! Disabling M365 Direct Send
by: @Securecake
Published: 8/20/2025
Learn more: https://t.co/4rqbE7ayTi