If you've been laid off from a cyber threat intel position and would like to come to @SLEUTHCON this year, please reach out.

Google Threat Intelligence Group is dropping our latest AI Threat Tracker report today, which covers several threats we are watching through a variety of means. The report includes some details of the first 0day exploit we've found developed with AI. 1/x cloud.google.com/blog/topics/...

Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access | Google Cloud Blog

Explore GTIG's 2026 report on how adversaries leverage AI for zero-day exploits, autonomous malware, and industrial-scale cyber operations.

cloud.google.com

Google finds evidence a criminal hackers attempted a widespread campaign that relied on a 0day built by artificial intelligence. “It’s a taste of what’s to come,” @hultquist.bsky.social says. www.nytimes.com/2026/05/11/u...

Google Says Criminal Hackers Used A.I. to Find a Major Software Flaw

nytimes.com

Google disrupts hackers who used AI to identify a “zero day” vulnerability in popular online system administration tool (that it would not name). “It’s here,” said @hultquist.bsky.social “The era of AI-driven vulnerability and exploitation is already here.” apnews.com/article/goog...

Google disrupts hackers using AI to exploit an unknown weakness in a company's digital defense

Google said Monday that it had disrupted a criminal group’s attempt to use artificial intelligence to exploit another company’s previously unknown digital vulnerability, adding to heightened worries a...

apnews.com

The speaker lineup is here! 🐍 SLEUTHCON 2026 is six weeks away, and the lineup is stacked. Check it out and grab your tickets today! Happening June 5th, 2026, in Arlington, VA + virtually! www.sleuthcon.com #SLEUTHCON #CybersecurityEvents

Getting ready to read these @sleuthcon.bsky.social talk proposals! Last day sleuths! IT’S CRIME TIME!

a man in a purple and black jacket with a ravens logo on the front

ALT: a man in a purple and black jacket with a ravens logo on the front

media.tenor.com

The @SLEUTHCON CFP closes next week. Don’t waste valuable time doing your taxes. Submit! Submit! Submit!

SLEUTHCON@sleuthcon.bsky.social · 4mo ago

We want to hear from YOU 🫵 Got something you think would make a great talk at SLEUTHCON this year? We are looking for speakers to share their knowledge of cybercriminal threats with our in-person and virtual audience, as well as media who are present at the event.

The @SLEUTHCON CFP closes next week. Don’t waste valuable time doing your taxes. Submit! Submit! Submit!

SLEUTHCON@sleuthcon.bsky.social · 4mo ago

We want to hear from YOU 🫵 Got something you think would make a great talk at SLEUTHCON this year? We are looking for speakers to share their knowledge of cybercriminal threats with our in-person and virtual audience, as well as media who are present at the event.

We are still looking at the axios supply chain compromise, but we’ve attributed it to UNC1069, a suspected DPRK actor, who we covered in a blog this February. They are financially-motivated and historically DPRK uses these incidents to target crypto. cloud.google.com/blog/topics/...

UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering | Google Cloud Blog

North Korean threat actors target the cryptocurrency industry using AI-enabled social engineering such as deepfakes, and ClickFix.

cloud.google.com

Get your tickets (and CFPs) now! This conference is always a great time and you learn a lot.

SLEUTHCON@sleuthcon.bsky.social · 5mo ago

SLEUTHCON 2026 is coming! 🐍🐻🌲 Registration is open and our CFP is live! We're back on June 5th, in-person in Arlington, VA and virtually. CFP closes April 17th + tickets will sell out! sleuthcon.com #SLEUTHCON #SLEUTHCON2026 #Cybercrime

SLEUTHCON 2026 is coming! 🐍🐻🌲 Registration is open and our CFP is live! We're back on June 5th, in-person in Arlington, VA and virtually. CFP closes April 17th + tickets will sell out! sleuthcon.com #SLEUTHCON #SLEUTHCON2026 #Cybercrime

Today I went to RUSI and @hultquist.bsky.social told me his thoughts about what to expect from Iranian cyber operations in the near future... Essentially, while tactics won't suddenly change, he believes the attacks will have a much wider scope... www.infosecurity-magazine.com/news/iran-cy...

Expect Iran to Launch Cyber-Attacks Globally, Warns Google

John Hultquist suggests “aggressive” Iranian cyber attackers will target the US and its Gulf allies with plausibly deniable ransomware attacks, hacktivist campaigns and more

infosecurity-magazine.com

Google Threat Intelligence Group took down a massive, longterm intrusion campaign into global telcos and government. This PRC-nexus actor built a vast surveillance tool across 42 confirmed countries and another 20 suspected countries. 1/x

The conditions are absolutely ripe for cyberattacks on the Winter Games. In addition to historic precedent like Sandworm’s attempted disruption of the Pyeongchang opening ceremonies, Russian sabotage and cyberattack in Europe right now is reaching fever pitch. 1/x

Notepad++ compromised in supply chain attack from June to December 2025 by “likely Chinese state-sponsored actor”. notepad-plus-plus.org/news/hijacke...

"The actor Poland has identified is notable for a lengthy history of digging into global critical infrastructure while holding back on actual attacks," @hultquist.bsky.social says. "If they have finally pulled the trigger, that would be a major departure from over a decade of restraint."

Poland releases details on December’s cyberattack on their energy infrastructure, noting similarities to prior FSB activity. The wiper has been attributed by others to Sandworm (GRU). Attribution is definitely not super clear yet. 1/x cert.pl/uploads/docs...

Ready to put your analysis skills to the test? Join us on Nov 18 (pre-CYBERWARCON) for a Synapse challenge using a real-world scenario. There will be snacks and limited-edition challenge coins! vertex.link/events/cyber...

Meet our speaker: Kevin Hoganson! He leverages a broad skill set across cyber threat intelligence, digital forensics & incident response. His talk highlights commercial spyware actors' cleanup of forensic artifacts which prevents meaningful analysis of mobile device infections. www.cyberwarcon.com

Tickets are almost sold out. Nerds. www.cyberwarcon.com

Meet our speaker Dlshad Othman! He has fifteen+ years of experience in threat intelligence, and has built a career at the intersection of cybersecurity and geopolitics. He will be joining David Magnotti for their talk "Ping First, Boom Second", which will focus on Iranian cyber threat groups.

If you’ve been laid off from a cyber threat intel position, and you want a ticket to CYBERWARCON, please reach out.

An opinion piece I wrote for Cipher Brief on the next wave of AI threats. The speed and scale of this activity will change the nature of cybersecurity. In order to compete with adversary use of this technology we must adopt it wholeheartedly into defense. www.thecipherbrief.com/ai-cyberatta...

AI-Powered Adversaries Require AI-Driven Defenses

OPINION — The use of artificial intelligence by adversaries has been the subject of exhaustive speculation. No one doubts that the technology will be abused by criminals and state actors, but it can b...

thecipherbrief.com

Meet our speaker Caleb Marquis! His work played a central role in the landmark indictment of North Korean hacker Rim Jong Hyok. He has received the FBI Medal of Excellence and the Department of Justice Attorney General Award for Distinguished Service.

We're excited to have Eric Kerr join us at CYBERWARCON! His talk, "From Hacker to Help Desk: The Surprising Story of a North Korean Cyber Operator", will cover the activities of Andariel, a North Korean hacking group that steals military & nuclear technology from US & South Korean defense networks.

We're proud to announce Ruarigh Thornton is joining us this year at CYBERWARCON! Head of Research and Disruption at PGI, with experience in threats including counter espionage, hostile state information operations + more. He has led 100+ digital investigations. www.cyberwarcon.com

I won’t be at CYBERWARCON this year so I need someone to give @hultquist.bsky.social a hard time for me. I don’t yet know why he deserves this, but I’m sure a reason will present itself between now and then. The man never disappoints in the shenanigans and tomfoolery department.

Have you ever wanted to see two terminally online nerds really (and I mean *really*) get into the SVR deep lore while continuing the eternal goal of making 2016 last forever? Gosh does @cyberwarcon.bsky.social have a talk for you!

Oil Into The Fire — CYBERWARCON

cyberwarcon.com

CYBERWARCON is gooooooooo! This year’s agenda is live! Thank you submitters.

CYBERWARCON@cyberwarcon.bsky.social · 10mo ago

Announcing this year's CYBERWARCON speaker lineup and agenda! We've got some fantastic talks this year, and more will be announced soon. Don't miss your chance to register now! Thank you everyone who submitted to the CFP. The selection was a truly grueling process!