Tyler McLellan

Intrusion aficionado. @Google/@Mandiant GTIG Advanced Practices

[Tyler McLellan @tylabs]

New Blog: Sponsored by Russian military intelligence, APT44 is a dynamic and operationally mature threat actor that is actively engaged in the full spectrum of espionage, attack, and influence operations. https://t.co/fEBboG3Zmu

[Tyler McLellan @tylabs]

new GTIG blog unc3753/luna moth/silent ransom: https://t.co/BTbIz47RHU

[Tyler McLellan @tylabs]

UNC6671 has targeted dozens of orgs across using a distinct subdomain-based infrastructure model (.enrollms[.]com), new GTIG blog digs into their TTPs: https://t.co/TRbOXmdhow

[Buffalo Sabres @BuffaloSabres]

That's how we do it in Buffalo. ❤️🤍

[Tyler McLellan @tylabs]

JSFuck obfuscation eww

[Haifei Li @HaifeiLi]

So, this is what I was busy working on.. A really interesting (and sophisticated) Adobe Reader PDF "fingerprinting" exploit involving zero-day and allowing to launch additional maybe RCE/SBX exploitation!

https://t.co/k3Rmy8k4rS

[Austin Larsen @AustinLarsen_]

The #axios maintainer just confirmed #UNC1069 🇰🇵 used the same playbook we documented in February.

Cloned a founder's identity. Built a convincing Slack workspace. Scheduled a call. Fake "update" deployed WAVESHAPER.V2. npm creds stolen. Trojanized axios update pushed.

[Tyler McLellan @tylabs]

Shout out to Mandiant Threat Defense and all the teams in GTIG that quickly neutralized this at dozens of clients overnight: North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack https://t.co/nRB5kylmyC

[Leonid Volkov @leonidvolkov]

I received a suspicious email with a weird link yesterday.

My first thought was this is yet another phishing attempt, albeit well-tailored.
I was wrong: researchers with whom I shared this email told me I was targeted by a very recent DarkSword attack used by the GRU.

If I were to click the link in that email, my phone would be compromised — without entering any passwords or doing anything else.

Fun fact: the attack would be launched only if I would access the link using an iPhone registered in Lithuania (which is indeed my case). Luckily, I didn’t click.

Beware!

Technical details about this exploit and how to stay protected: https://t.co/6m2ewFRk0d

[Tyler McLellan @tylabs]

Getting Gemini to book my calendar items like a big list of school sport events is a massive time saver.

[Tyler McLellan @tylabs]

“I didn’t know limewire was still a thing” the latest on Shiny Hunters https://t.co/BKHin75jS9

[Tyler McLellan @tylabs]

@borealissaves I’m skeptical of that report because it conflates "intrusion attempts" with actual intrusions. 2.6M "attempts" a day usually means automated pings and port scans, not millions of unique breaches.

[Tyler McLellan @tylabs]

Merry Cyber Christmas!

[Mandiant (part of Google Cloud) @Mandiant]

UPDATE: New guidance due to the recent Salesforce advisory regarding Gainsight applications.

Get hardening, logging, and detection recommendations for programmatic credentials.

https://t.co/26ncbjyba3

[Tyler McLellan @tylabs]

We can all agree onions do not belong on a burger, or anything really.

[Sundar Pichai @sundarpichai]

iykyk

[Tyler McLellan @tylabs]

Nooooo

[Toronto Blue Jays @BlueJays]

After 32 years...

🇨🇦 O Canada at the #WorldSeries

[Tyler McLellan @tylabs]

Showing the kids how it’s done.

[Tyler McLellan @tylabs]

What do we call the teenage stage where they drink two gallons of milk over two days?

[Ryan Naraine @ryanaraine]

Mandiant: "In many cases, the average dwell time of 393 days exceeded log retention periods and the artifacts of the initial intrusion were no longer available."

[FBI @FBI]

The FBI has released a FLASH alert on the targeting of Salesforce platforms by the cybercriminal groups UNC6040 and UNC6395, which are responsible for a surge in data theft and extortion attempts. Click for indicators of compromise (IOCs) and protect your organization: https://t.co/CNCBWbMzMj