Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, compromising hospitality-related networks worldwide to steal credentials, access cloud environments, and deliver malware to travelers. msft.it/63328aBnhE

CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft | Microsoft Security Blog

Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals of hospitality-related organizations such as hotels since May 2026 in order to deliver malware to travelers and steal credentials in an operation we call CaptiveCrunch.

msft.it

State of Statecraft (SOS) is a new security and intelligence conference that brings together experts on espionage, sabotage, influence, and other unique forms of covert statecraft to share their work with a community hyper-focused on tackling state-sponsored operations.

APT28 🤝 war crimes

Extending the veneer of grassroots activism «by default» to an entire category of threat activity routinely orchestrated (if not carried out directly) by intelligence agencies is just flat out irresponsible at this point. I beg of you: stop using the label "hacktivism".

... maybe Teams isn't so bad

Mark Chadbourn@chadbourn.bsky.social · last yr.

The strike on the Revolutionary Guard HQ was during a crisis meeting of senior Iranian leaders.

Short thread (hopefully in plain English) on the nuclear deterrence dynamics in the India-Pakistan relationship and where this goes if escalation continues. <1>

Weekly summary is out.. ctoatncsc.substack.com/p/cto-at-ncs...

CTO at NCSC Summary: week ending May 4th

The age of advanced cryptography techniques edges ever closer..

ctoatncsc.substack.com

Fascinating to see reference to GRU unit 20728 from FR relative to Russia's offensive cyber program -- as far as I'm aware, a first from a Western service? www.diplomatie.gouv.fr/fr/dossiers-...

Russie – Attribution de cyberattaques contre la France au service de renseignement militaire russe (APT28) (29.04.25)

La France condamne avec la plus grande fermeté le recours par le service de renseignement militaire russe (GRU) au mode opératoire d'attaque APT28, (…)

diplomatie.gouv.fr

Credibility of claims aside, the slow creep toward direct mirroring of US public attribution has reached its final stop: www.reuters.com/technology/c...

China accuses US of launching 'advanced' cyberattacks, names alleged NSA agents

Chinese police in the northeastern city of Harbin have accused the United States National Security Agency (NSA) of launching "advanced" cyberattacks during the Asian Winter Games in February, targeting essential industries.

reuters.com

Incredibly important piece here, bravo @lhn.bsky.social and @agreenberg.bsky.social www.wired.com/story/signal...

SignalGate Isn’t About Signal

The Trump cabinet’s shocking leak of its plans to bomb Yemen raises myriad confidentiality and legal issues. The security of the encrypted messaging app Signal is not one of them.

wired.com

In order to help protect people from falling victim to sophisticated phishing attacks, Signal introduced new user flows and in-app warnings. This work has been completed for some time and is unrelated to any current events. 5/

The memo used the term ‘vulnerability’ in relation to Signal—but it had nothing to do with Signal’s core tech. It was warning against phishing scams targeting Signal users. 3/

One piece of misinfo we need to address is the claim that there are ‘vulnerabilities’ in Signal. This isn’t accurate. Reporting on a Pentagon advisory memo appears to be at the heart of the misunderstanding: npr.org/2025/03/25/n.... 2/

It's never a bad time to take a look at your online accounts and see if you spot a weird device or login. We have a comprehensive guide on how to check if your Gmail, Apple ID, Facebook, IG, WhatsApp, Telegram, Discord, etc have been hacked. techcrunch.com/2025/03/25/h...

How to tell if your online accounts have been hacked | TechCrunch

This is a guide on how to check whether someone compromised your online accounts.

techcrunch.com

Russia's intelligence services have spent time and resources to develop Signal-specific tradecraft because it is best-in-class for secure communications. It is Signal's lack of vulnerability that makes the app the high priority target that it is.

Kevin Collier @kevincollier.bsky.social · last yr.

It's really crucial to understand how badly framed this is. There is no Signal vulnerability. The Pentagon email did a bad job explaining a Google report from a month ago and NPR repeated it. This is like saying because you got a phishing email at your Gmail address, there's a Google vulnerability.

It's really crucial to understand how badly framed this is. There is no Signal vulnerability. The Pentagon email did a bad job explaining a Google report from a month ago and NPR repeated it. This is like saying because you got a phishing email at your Gmail address, there's a Google vulnerability.

David Folkenflik@davidfolkenflik.bsky.social · last yr.

News: NPR’s Tom Bowman reports of a Pentagon-wide warning about Signal’s security vulnerability - one week ago 👇🏼

We are looking for a motivated Research Analyst to join our cyber and tech team at @rusi.bsky.social. You need to be able to work in London. Full job spec below 👇 royalunitedservicesinstitute.peoplehr.net/Pages/JobBoa...

Research Analyst

This position sits in RUSI’s Cyber and Tech Research group, which seeks to shine a light on UK and international cyber and technology issues. We take what can sometimes be complex and technical subjec...

royalunitedservicesinstitute.peoplehr.net

Developing low visibility, low signature forms of compromise for signal accounts is a clear area of investment for Russia's services as well. Generally speaking if you use the app for sensitive comms: audit your linked devices. Do it now. cloud.google.com/blog/topics/...

Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger | Google Cloud Blog

Russia state-aligned threat actors target Signal Messenger accounts used by individuals of interest to Russia's intelligence services.

cloud.google.com

Yaroslav Trofimov@yarotrof.bsky.social · last yr.

Hold on, so Steve Witkoff was participating in the Signal group discussing war plans against Houthis while being physically in Moscow, perhaps even in the Kremlin? He met Putin late on March 13. Obviously the odds of Russia not compromising any device he would bring there are pretty slim.

Right now a single technical organization is being asked to defend (at least) one side in a major regional war, the political communications of the entire US administration, the communications of anyone opposed to that administration, big piles of NGOs, and millions of “ordinary” folks to boot.

For no reason at all, re-upping this blog from @danwblack.bsky.social, which shows the high interest that Russian APTs have in getting access to Signal messages. cloud.google.com/blog/topics/...

Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger | Google Cloud Blog

Russia state-aligned threat actors target Signal Messenger accounts used by individuals of interest to Russia's intelligence services.

cloud.google.com

🚨NEW REPORT: first forensic confirmation of #Paragon mercenary spyware infections in #Italy... Known targets: Activists & journalists. We also found deployments around the world. Including ... #Canada? And a lot more... Thread on our @citizenlab.ca investigation 1/ citizenlab.ca/2025/03/a-fi...

Gorbachev believed the Soviet Union had to reform or die. But his reforms were so incoherent and inconsistent, yet persistent, he wound up destroying the USSR-something practically no one when he started thought was a possible outcome.

One of things I miss the most now that I'm fully remote is the old in-office nerding out about what was in the news. This podcast has really helped to fill that void. Highly recommend.

Ryan Naraine@ryanaraine.bsky.social · last yr.

NEW POD ALERT: Revisiting the US/Russia cyber stand down order and the diplomatic optics. Plus, a dissection of ‘The Lamberts’ and connections to US intelligence agencies, attribution around ‘Operation Triangulation’, VMware 0days and i-Soon indictments securityconversations.com/episode/revi...

⚡️Russia launches largest drone attack since start of full-scale invasion. Ukraine’s air defense shot down 138 drones while 119 decoy drones were lost out of a total of 267 drones launched by Russia, the Ukrainian Air Force said.

Russia launches largest drone attack since start of full-scale invasion

Ukraine’s air defense shot down 138 drones while 119 decoy drones were lost.

kyivindependent.com

Ransom War: How Cyber Crime Became a Threat to National Security is officially out in Europe today! Thanks to everyone who helped make this possible. It has been a fascinating research journey. www.amazon.co.uk/Ransom-War-B...

Ransom War: How Cyber Crime Became a Threat to National Security

Buy Ransom War: How Cyber Crime Became a Threat to National Security by Smeets, Max (ISBN: 9781911723912) from Amazon's Book Store. Everyday low prices and free delivery on eligible orders.

amazon.co.uk

Regarding the anatomy of what is now a highly consequential disinformation narrative: has anyone sourced where the claim that Zelenskyy has four percent approval ratings originates from?

I feel like that point has maybe been underappreciated about this historic era we're living through. Governance not just by the historically wealthy, but by people consumed by mass, often shared delusions. People have always been wrong on some facts, but not sure it's ever been quite like this.