Good recent reads: CN: intrusiontruth.wordpress.com/2026/07/27/d... intrusiontruth.wordpress.com/2026/07/28/t... RU: www.proofpoint.com/us/blog/thre... www.microsoft.com/en-us/securi... Triangular: www.gendigital.com/blog/insight... medium.com/@billmarczak...

Dear Diary, Today I found a Ghost in the Network

Dear Diary, Today I found a Ghost in the Network A hidden seller Guangdong Chanming. If you were looking for them, you’d be disappointed. No public website, no storefront, and certainly no obvious …

intrusiontruth.wordpress.com

NP++ breach is a great general reminder that "power utilities" favored by IT pros are highly targeted for both supply chain and malvertising/seo poisoning. Just because you are a tech pro doesn't make you immune from attack, it makes you highly targeted. Cyber pros missed it, watch your back

Matt Kelly@breakersall.bsky.social · 6mo ago

NP++ June-december 2025 supply chain, rumors turned out to be true. notepad-plus-plus.org/news/hijacke... www.bleepingcomputer.com/news/securit... cyberplace.social/@GossiTheDog...

NP++ June-december 2025 supply chain, rumors turned out to be true. notepad-plus-plus.org/news/hijacke... www.bleepingcomputer.com/news/securit... cyberplace.social/@GossiTheDog...

globalnews.ca/news/1162087...

Read the full transcript of Carney’s speech to World Economic Forum - National | Globalnews.ca

Prime Minister Mark Carney gave a forceful speech in Davos, Switzerland, on the 'new world order' and how middle powers like Canada can benefit by working together.

globalnews.ca

Recommended Reading arxiv.org/abs/2601.04566

The Com, criminal hacking ethics, and off-ramps, this talk from Allison is compelling and excellent. Take a watch.

Allison Nixon@nixonnixoff.bsky.social · last yr.

My BSidesLV keynote is here. It touches on several difficult topics in our industry. Topics best discussed in person. As our industry spends this week in Vegas, please share this talk with your peers and discuss in person. www.youtube.com/watch?v=4CD9...

🚨 Another Internet blackout in Iran has begun at 12:50 UTC (4:20pm local). 🚨 Numerous Iranian service providers now offline in new national Internet blackout.

Predatory Sparrow are "hacktivists" that happens to be skilled at cyber war. www.wired.com/story/predat...

John Hultquist@hultquist.bsky.social · last yr.

Predatory Sparrow, or Gonjeshke Darande, is taking credit for cyberattacks on Iranian banks. Despite appearances this actor is not all bluster.

iranian offensive cyber capacities are not resilient or coherent enough to engage in meaningful effects-delivery against hardened targets while their country is actively being blown to shit. also: despite a few minor successes, iran has never matched china or russia in scale of access to USCIKR.

"Over four months, LLM users consistently underperformed at neural, linguistic, and behavioral levels. These results raise concerns about the long-term educational implications of LLM reliance and underscore the need for deeper inquiry into AI's role in learning."

Cathy Davidson@cathyndavidson.bsky.social · last yr.

More research on the cognitive deficit of relying only on AI... you can't even remember the information you called up. That's how learning works! arxiv.org/abs/2506.08872

Cubs, Royals, and Brewers held Pride Nights today. Notable in Chicago was a community group called “Play Catch with a Dad” that serves members of the LGBTQ+ community who have been disenfranchised by their families.

Michelle Frost@michellefrost.bsky.social · last yr.

Angels and Astros celebrated Pride this evening. And btw Astros closer Josh Hader is now an ally as confirmed by @booksandbows.bsky.social Change happens 🙏

Joe Slowik@pylos.co · last yr.

Thoughts concerning "what (really) is 'Salt Typhoon'" and the danger of "TA A, also known as TA B" statements without detail, explaination, or background: pylos.co/2025/06/11/a...

SMB to RCE via Kerberos coercion, nasty vuln and great research. Get patching.

RedTeam Pentesting@redteam-pentesting.de · last yr.

🚨 Our new blog post about Windows CVE-2025-33073 which we discovered is live: 🪞The Reflective Kerberos Relay Attack - Remote privilege escalation from low-priv user to SYSTEM with RCE by applying a long forgotten NTLM relay technique to Kerberos: blog.redteam-pentesting.de/2025/reflect...

"Don't look for breaches, so we don't have to disclose them" Is the new "no logs, no breach" www.nextgov.com/cybersecurit...

PR teams: just add "with Agentic AI" to end, then full send

Is the era of the “named actor” done? As the OG adversary sets diverge, get promoted, or move on actors dispersing across the kill chain based on specialized skills increases (ORBs, criminal underground) AND the CTI models maturing… APTs ⬇️⬇️ UNCs ⬆️⬆️

Friday vibes

I made SonicWall’s hall of fame for this one. Patch your firewalls (again), folks! bishopfox.com/blog/sonicwa...

SonicWall Sonicos Versions 7.1.x and 8.0.x

Blog describes how Bishop Fox staff identified a vulnerability in SonicWall SonicOS 7.1.x and 8.0.x in the SSL VPN service and solutions for customers.

bishopfox.com

Dwell time back? While Verizon DBIR measured dwell time is still falling, Mandiant MTrends noticed it acutally increased for the first time in years, despite record investment in Cyber and increased sophistication in it's most important countermeasure, effectiveness of detection & response teams. 🧵

For fans of root cause of catastrophic (often bureaucratic) failure, such as reports from CISA's Cyber Safety Review Board reports, recommend Challenger, by the same author of Incident Response required reading Midnight in Chernobyl. #RecommendedReading www.simonandschuster.com/books/Challe...

Challenger

Winner of the 2024 Kirkus Nonfiction Prize • Shortlisted for the 2025 Andrew Carnegie Medal for Excellence in Nonfiction • A New York Times Notable...

simonandschuster.com

Seeing blue skies, even though it is grey here in Chicago.