Danny Moore
@moore.bsky.social
Cyber-warfare | PhD from KCL | Author of 'Offensive Cyber Operations' | Security @ Meta
It is rare for the public to see such a large list of ICE’s technology capabilities in a single document. 404 Media has published the whole document, called “ICE Wide Analytical Tools," here: www.404media.co/leaked-docum... @josephcox.bsky.social reports:
No one is immune. As a side note the auth/trust model for most online services was already vulnerable to social engineering, and AI lowers the barrier to making compelling lures.
Courtney Milan@courtneymilan.com · 2mo agoI think I just barely escaped a shockingly savvy scammer trying to get my bank credentials. First, whoever it was had my actual phone number, my actual bank, and the last 4 digits of my account. They sent a "was this transaction you" message that looked almost identical to the ones my bank sends.
Even though I lived under constant rocket fire, I can't imagine what it must be like to live under the threat of scaled cheap drone warfare. Production scales up to millions-per-year now, this would've been pure fantasy a decade ago.
Ulrike Franke@rikefranke.bsky.social · 3mo agoUkraine, in the meantime, has been attacked by 6722 drones in the month of April alone.
Chatting about this with friends earlier, but I miss the mid 2010s when all of cyber sec was on a flawed but functional Twitter. What I loved most about it was that we intersectdd with journalists, academics, policy makers, lawyers, band anyone else who had skin in the game.
One of our biggest issues as a cybersecurity community and industry is that we inflicted dozens of partly overlapping cryptonyms on the world and just expect them to deal with it because we can't.
Danny Palmer@dannypalmer.bsky.social · last yr.A interesting read. Always felt a bit odd covering cyber attacks, then writing it was carried out by 'Vengeful Hamster' or 'Creeping Groundhog' or something ...then also having to use a paragraph to detail all the different names different companies call the same group. www.wsj.com/tech/cyber-s...
Still consistently the best cyber-related podcast out there
Catalin Cimpanu@campuscodi.risky.biz · last yr.-CoinMarketCap hacked via animated logo -White House rejects NSA & CyberCom nomination -FCC probes US Cyber Trust Mark program -Cyberattack disrupts Russian animal processing industry -Iran hacks Albania's capital Tirana Podcast: risky.biz/RBNEWS441/ Newsletter: news.risky.biz/risky-bullet...
Considering that one of Israel's overt goals for the war is to destabilize the Iranian government, a nation-wide shutdown of public internet access plays well into Israel's hands. And it may not even stop further attacks.
Lorenzo Franceschi-Bicchierai@lorenzofb.bsky.social · last yr.NEW: Iran's government has now admitted it took down the internet in the country, arguing it was to protect against Israeli cyberattacks. I spoke to two Iranians who live abroad and can't communicate with their loved ones back home. "I haven’t heard from them in two days," said @ammir.bsky.social.
Predatory Sparrow has dumped the Nobitex crytpo platform source code on Telegram They previously stole $90mil worth of assets in a hack yesterday t.me/gonjeshkdara...
My hot take is that it isn't a lack of strategy, Israel has many viable, ambitious strategies. It's a constant failure of political will, unity, and patience to enact a strategy.
Interesting! In my book, Offensive Cyber Operations, I talk a lot about the convergence of tactical offensive cyber and electronic warfare. The resources, approach and desired outcomes are deeply connected. The UK's move is in line with trends seen elsewhere. Will dive more into it all later.
The most interesting bit here is that the best Western gov cyber outfits overhauled their operational approach after the mid-10s to focus more on avoiding detection. The era of the "factory ops" was too risky with the rise of threat intel. Harder to reliably spot 2025's Regin, Careto, Flame, etc
Lorenzo Franceschi-Bicchierai@lorenzofb.bsky.social · last yr.NEW: More than a decade ago, Kaspersky discovered a mysterious "elite" hacking group it called Careto (aka “The Mask”), which then vanished and only resurfaced last year. We can now reveal that the researchers who investigated it were confident that the Spanish government was behind it.
"the technical team's analysis indicates that the attacker's methods and related technical proficiency were relatively low-level." Nothing in the article to explain what makes this "cyber warfare".
Catalin Cimpanu@campuscodi.risky.biz · last yr.A threat actor has allegedly breached and disrupted the backend systems of a sci-tech company based out of Guangzhou, China. Chinese officials claimed the hack had a "clear political background and [showed] distinct signs of cyber warfare." www.globaltimes.cn/page/202505/...
If you’ve been laid off from a cyber intel position, please reach out if you’d like to come to @sleuthcon.bsky.social.
NEW: Hundreds of victims are surfacing across the world from zero-day cyberattacks on SAP, in a campaign that one leading cyber expert is comparing to the vast Chinese government-linked Salt Typhoon and Volt Typhoon breaches. cyberscoop.com/sap-cyberatt...
SAP cyberattack widens, drawing Salt Typhoon and Volt Typhoon comparisons
Hundreds of victims are surfacing across the world from zero-day cyberattacks on Europe’s biggest software manufacturer and company.
cyberscoop.com
Drama over at X/xAI. Whatever you ask Grok, it pivots to “white genocide” in South Africa. The last panel is what Grok claims was a “verbatim” system prompt that caused the behavior. Jury out. It’s now fixed but they haven’t yet bothered explaining. This, not those AGI fantastical scenarios.
New from 404 Media: the Signal clone the Trump administration uses was just hacked. TeleMessage makes a modified version of Signal that archives messages for government agencies, Waltz used it. A hacker got some users' messages, group chats. Hugely significant breach www.404media.co/the-signal-c...
The Signal Clone the Trump Admin Uses Was Hacked
TeleMessage, a company that makes a modified version of Signal that archives messages for government agencies, was hacked.
404media.co
The literal birth of my firstborn child was less anxiety inducing than a full week of driving and parking in Tel Aviv.
THREAD: When @thekrebscycle.bsky.social and his workplace, @sentinelone.com, were singled out by Donald Trump on Wednesday, I thought it was an opportunity to weigh the cybersecurity industry's rhetoric against their real world actions.
Cybersecurity is built on trust, I can only imagine how CISA staff must be feeling.
Kevin Collier @kevincollier.bsky.social · last yr.New: Current CISA employees — picture patriotic, hardworking nerds not used to the spotlight, often with narrow focuses like identifying how hackers break into the industrial control systems that run our water and electric facilities — are sick of Trump's cuts and the politicization of their work.
👀 China reportedly acknowledged to outgoing Biden officials in December that it was responsible for the Volt Typhoon critical infrastructure intrusions, linking them to "increasing U.S. policy support for Taiwan." www.wsj.com/politics/nat...
I was there. It was meant literally. “JD Work — now on the US NSC — shocked some by warning that the US would take lethal action against malicious actors in commercial cyber operations. Participants who heard [it said] they were unsure if it was meant literally or figuratively”
The Record@therecordmedia.bsky.social · last yr.The Pall Mall Process — a diplomatic initiative designed to reform the commercial spyware and hacking market — has added more nations as it confronts an industry that is more complex than ever. https://therecord.media/pall-mall-process-commercial-spyware-hacking-paris-diplomacy
The Swiss population doesn’t want to buy the F35 anymore, given everything that’s going on in Trump’s US. In 2020, a 50,1% majority had voted for the acquisition in a referendum. www.watson.ch/schweiz/wirt...
Why is the headline on all X outage stories about Musk blaming Ukraine for the DDoS? Why aren't media outlets putting the emphasis on the security lapse that allowed script kiddies (or whoever) to launch the attack against X as well as the lack of any evidence that the traffic came from Ukraine IPs?
DDoS attacks frequently use compromised or otherwise co-opted IP addresses. The global distribution helps avoid geofencing defenses. Public high-confidence attribution takes time and effort. So take any quickfire claims with healthy skepticism.
Kevin Collier @kevincollier.bsky.social · last yr.Updated with Musk's claim about the apparent DDoS: The IP addresses originated in "the Ukraine area." Besides the geographical ambiguity (isn't Russia in the Ukraine area?), this is also total nonsense. A big DDoS uses hacked devices from around the world. Says nothing about where the attacker is.
Great coverage by @kimzetter.bsky.social. In this ecosystem we need to be doubly suspicious of major claims even if published by reputable sources. Considering the denials it's hard to pin down the truth. That said if things continue we may still see a gradual derisking of Russia by the US.
Kim Zetter@kimzetter.bsky.social · last yr.Two stories published Friday reporting that Trump admin had ordered US Cyber Command and CISA to "stand down" on their work to detect/counter Russian cyber threats. But new info has come out to contradict them. I dug into what we know and don't know. www.zetter-zeroday.com/did-trump-ad...
That's genuinely lovely but if we are to establish soft power diplomatic momentum that isn't dependent on the US establishment maybe do it on a network that isn't Elon's X.
Yashar Ali 🐘@yasharali.bsky.social · last yr.In an extraordinary display of public support, heads of state, heads of government, and foreign ministers from all over Europe and Canada are posting in support of Ukraine in response to the Oval Office meeting with Trump, Zelenskyy, and Vance.
Madness
The Record@therecordmedia.bsky.social · last yr.The secretary of Defense has ordered U.S. Cyber Command to stand down from all planning against Russia, including offensive digital actions, sources tell Recorded Future News. https://therecord.media/hegseth-orders-cyber-command-stand-down-russia-planning
New from 404 Media: anyone can push updates to the Doge.gov site. Two sources independently found the issue, one made their own decision to deface the site. "THESE 'EXPERTS' LEFT THEIR DATABASE OPEN." www.404media.co/anyone-can-p...
I'm sorry but that's the most unhinged paragraph I ever read
