Ben Read
@benread.bsky.social
CTI @wizsecurity.bsky.social Adjuct at @jhu.edu - SAIS Nonresident Fellow at @atlanticcouncil.bsky.social - Cyber Statecraft Previously NSC44, Mandiant, Google Go Mammoths
New supply chain operation compromising keyv and cacheable. Some similarities to TeamPCP, but we're still investigating: www.wiz.io/blog/keyv-an...
keyv and cacheable npm Package Hijacked in Supply Chain Attack | Wiz Blog
Wiz Research is actively investigating an ongoing software supply chain attack affecting multiple keyv/cacheable npm packages.
wiz.io
Great new feature in the latest Signal app. If you enable disappearing messages the meta data of calls and missed calls gets deleted as well. I know this was a long standing goal for them, but the engineering behind it took time. #Privacy @signalapp
Most exciting @threatinsight.proofpoint.com drop yet - in collaboration with NSA - and the product of @greg-l.bsky.social's blood, sweat, and tears. Research into two Russian actors throwing half-click exploits against mailservers. Part 1 on TA488 / Void Blizzard www.proofpoint.com/us/blog/thre...
TA488 Targets Zimbra Mailservers with Half-Click Exploits | Proofpoint US
Proofpoint is releasing this report in coordination with NSA and FBI’s JSAC reporting about TA488/Void Blizzard, which can be found here. This is part 1 of a 2-part blog series Proofpoint is
proofpoint.com
Mullin just parroted an Iranian disinformation operation from 2020.
omg this Brian Krebs story: krebsonsecurity.com/2026/07/felo...
Felons, Fraudsters Flog Offensive Cybersecurity Startup
A cybersecurity startup dangling millions of dollars to acquire zero-day security vulnerabilities in popular software is run by a pair of far-right conspiracy theorists and convicted felons whose most...
krebsonsecurity.com
Great story here by my former colleague @bobmcmillan.bsky.social on built-in backdoors in consumer devices that allow nation-state hackers to create huge residential proxy networks. Bob spent months talking my ear off about this. This story is worth your time. www.wsj.com/tech/cyberse...
Exclusive | How Hackers Found a Back Door Into the American Living Room
Nation-state cyberattackers are increasingly using residential proxy networks to mask their traffic, turning everyday electronics into a massive global threat.
wsj.com
New from me and the @wizsecurity.bsky.social CIRT team. A novel suspected DPRK crypto targeting cluster. Their tactics are familiar (compromise via supply chain, job interviews) but their malware and infrastructure is different. www.wiz.io/blog/threat-...
Threat Actor Targets Crypto Organizations | Wiz Blog | Wiz Blog
Threat actor, JINX-0164, uses LinkedIn social engineering, custom macOS malware, and CI/CD hijacking to target crypto organizations.
wiz.io
This is nothing short of a bombshell. One of the most trusted media groups in Indonesia has released a report on Russian and Chinese influence operations in Indonesian social media, which blamed local protests on deliberate U.S. meddling. 🧵 1/
Yenni Kwok@yennikwok.bsky.social · 2mo agoThe English version of the investigative report: interaktif.tempo.co/proyek/opera...
Russia and China consider new steps to expand their digital cooperation including on software development and satellite Internet and declare adherence to cyber norms. In this post, I review the relevant sections of the recent joint statement from Beijing fromcyberia.substack.com/p/putin-and-...
Putin and Xi Plan for Co(de)dependence
Russia and China consider expanding their digital cooperation per the joint statement following recent talks in Beijing.
fromcyberia.substack.com
After this week's Github breach, we checked in on hacker group TeamPCP's victim count: their supply chain attacks have tainted more than 500 pieces of software (a thousand-plus different version) and breached hundreds of companies. This is out of control. www.wired.com/story/teampc...
A Hacker Group Is Poisoning Open Source Code at an Unprecedented Scale
GitHub is just the latest victim of TeamPCP, a gang that has carried out a spree of software supply chain attacks that has impacted hundreds of organizations.
wired.com
Why do some states routinely target civilian systems and commit operational errors, risking escalation, while others pursue highly restrained and carefully calibrated cyber operations, investing enormous amounts of time and resource? www.tandfonline.com/doi/full/10....
Fear of the (Un)known: How to Think About Risk and Threat Cultures in Cyber Conflict
The question of how states make operational decisions in cyber conflict is under-theorised. Much of existing scholarship has answered it within general frameworks of materialist and rationalist the...
tandfonline.com
New TeamPCP operation targeting Durable Task SDK for Python via PyPl. www.wiz.io/blog/durable...
durabletask: TeamPCP's Latest PyPi Compromise | Wiz Blog
Discover the latest on malicious versions of the pypi package durabletask, matching TeamPCP tactics.
wiz.io
Shame on the government of Zambia for buckling under Chinese government pressure over Taiwan and canceling this year’s @rightscon.org. www.rightscon.org/rc26-stateme...
A statement to our community about why RightsCon 2026 will not take place in Zambia
Our official statement to the digital rights community about why RightsCon 2026 will not take place in Zambia
rightscon.org
I laundered my Amherst College contribution through the only 5-college team on the list (UMASS), but I had to do my part. #GoMammoths @edsbs.bsky.social @newap-georgia.bsky.social @hollyanderson.bsky.social
Lotus Wiper was likely used to attack PDVSA One important thing that the Kaspersky report omits is that pdvsa[.]com is hardcoded into OhSyncNow.bat, a file that triggers the wiping operation (HT @benread.bsky.social). This is used to limit the attack to the specified domain 1/11
Oleg Shakirov@shakirov2036.bsky.social · 4mo agoKaspersky discovered a new wiper uploaded from Venezuela in mid-December. The campaign likely targeted utilities and energy sector Evidence suggests it was months in the making There are no explicit links to previously reported incidents in Venezuela securelist.com/tr/lotus-wip...
Congratulations, Virginia! Republicans are trying to tilt the midterm elections in their favor, but they haven’t done it yet. Thanks for showing us what it looks like to stand up for our democracy and fight back.
Awful to see Jorgenson crash like that. Gutted for him, I hope it's not as bad as it looked. #AGR26
This paper represents a small but deeply impressive and genuinely important achievement by the much maligned British state in what is probably the most important global issue of our era. Hear me out ( 🧵) 1/ www.aisi.gov.uk/blog/our-eva...
Our evaluation of Claude Mythos Preview’s cyber capabilities | AISI Work
We conducted cyber evaluations of Anthropic’s Claude Mythos Preview and found continued improvement in capture-the-flag (CTF) challenges and significant improvement on multi-step cyber-attack simulati...
aisi.gov.uk
I'm live with the @huntress.com folks for Tradecraft Tuesday on axios and DPRK if you want to hang out: events.zoom.us/ejl/AnrTlSR3...
All-in-one virtual event platform | Zoom Webinars & Events
events.zoom.us
🚨 500+ malicious PRs. One campaign. Wiz Research traced 6 waves of prt-scan starting 3 weeks earlier. AI-powered, automated attacks exploiting pull_request_target. Low success rate—but real npm + cloud creds hit. Full story: www.wiz.io/blog/six-acc...
prt-scan: AI-Powered GitHub Actions Supply Chain Attack | Wiz Blog
Wiz Research traces six waves of pull_request_target exploitation to one actor, starting three weeks before public disclosure. 500+ malicious PRs, 10% success.
wiz.io
North Korea is good at supply-chain attacks: www.cnn.com/2026/03/31/p...
North Korean hackers bug software used by thousands of US companies in potential crypto heist attempt | CNN Politics
Suspected North Korean hackers have bugged a software package that has been used by thousands of US companies in a major supply-chain attack that could take months to recover from, security experts sa...
cnn.com
