Daniel Gordon

Every single word. Except when you post about video games, I tune right out lol

ScarCruft continues to evolve, introduces Bluetooth harvester After publishing our initial series of blogposts back in 2016, we have continued to track the ScarCruft threat actor. ScarCruft is a Korean-speaking and allegedly state-sponsored threat actor that usu...

Just @ me next time lol. Definitely a USB propagation mechanism in 2022. securelist.com/updated-mata...

Maybe this Bluetooth harvester in 2019.

securelist.com/scarcruft-co...

Just a reminder that in the absence of reliable information, you can just wait for more information before reacting. You can even touch grass while you’re waiting.

Statement from Dario Amodei on our discussions with the Department of War A statement from our CEO on national security uses of AI

This kinda sounds like Anthropic actually standing up for itself, I’m guessing for long term reasons.

www.anthropic.com/news/stateme...

The future is bright... I will never be unemployed as a cybersecurity reporter

New Cisco zero-day, this one one discovered by the ASD

sec.cloudapps.cisco.com/security/cen...

Google Threat Intelligence Group took down a massive, longterm intrusion campaign into global telcos and government. This PRC-nexus actor built a vast surveillance tool across 42 confirmed countries and another 20 suspected countries. 1/x

For offense, I used to think AI would be mostly abused for social engineering and that AI companies would put in effective guardrails in response to wider abuse. I no longer think that. Anthropic was used in a wide ranging compromise of the Mexican government. archive.md/Qlgtr

Google disrupts Chinese-linked hackers that attacked 53 groups globally Google disrupted a Chinese-linked hacking group that breached at least 53 organizations across 42 countries, the company said Wednesday.

Google disrupts Chinese-linked hackers that attacked 53 groups globally - www.reuters.com/sustainabili...

This is Contagious Interview and I’m not sure why Microsoft didn’t attribute in the blog. I have a couple guesses but that’s all they would be: guesses.

Microsoft’s naming convention is the worst, other than all the other ones lol. Moonstone is memorable for being a ransomware crew that makes ridiculous NFT-based tank video games though lol

I've been seeing Vshell in #opendirs for a few years. With the recent attention, it was time to do a proper write-up on it:
https://censys.com/blog/vshell/

North Korean Lazarus Group Now Working With Medusa Ransomware North Korean attackers continuing to mount extortion attacks against the U.S. healthcare sector despite indictment.

Moonstone Sleet using Medusa ransomware www.security.com/threat-intel...

Eating crackers (joking mostly)

#100DaysOfYARA - Day 15 (a little behind)

I used @REMnux 's MCP, to extract a payload from an (unknown to me) malware, I'm now tracking as AxolotlLoader. I used the MCP to build a YARA rule based off of the XOR decryption function.

Rule at end
1/5

GitLab Threat Intelligence Team reveals North Korean tradecraft Gain threat intelligence about North Korea’s Contagious Interview and fake IT worker campaigns and learn how GitLab disrupted their operations.

Without exaggeration, one of the most epic DPRK reports ever about.gitlab.com/blog/gitlab-...

About half of it is the world’s largest list of IOCs, which makes sense given how high volume this adversary is and how much GitLab could see. Definitely not a quick read though 😂

Oh I forgot HERE ARE THEIR PERFORMANCE REVIEWS LOL

Contagious Interview is famously bad at opsec but holy smokes I have never seen a threat actor so comprehensively put on blast since APT1.

We found a process for scraping images and creating synthetic images at scale. We found OPERATORS IN BEIJING AND MOSCOW and THIS IS THEIR ADDRESS LOL. res.cloudinary.com/about-gitlab...

Oh we noticed a COVERT COMM CHANNEL IN HTML CODE COMMENTS. res.cloudinary.com/about-gitlab...

Oh check out THIS SPREADSHEET OF THEIR FINANCES res.cloudinary.com/about-gitlab...

Here is THEIR ORG CHART res.cloudinary.com/about-gitlab...

They found a TARGET LIST.

GitLab Threat Intelligence Team reveals North Korean tradecraft Gain threat intelligence about North Korea’s Contagious Interview and fake IT worker campaigns and learn how GitLab disrupted their operations.

Without exaggeration, one of the most epic DPRK reports ever about.gitlab.com/blog/gitlab-...

SOS returns to Brussels on October 22, 2026!

As the geopolitical landscape rifts, hybrid threats continue to adapt & evolve. We provide a forum for observers of state-aligned sabotage, espionage, and more to share research with an action-oriented community.

Stay tuned for more announcements!

Password managers' promise that they can't see your vaults isn't always true Contrary to what password managers say, a server compromise can mean game over.

The makers of password managers like Bitwarden, 1Password, Dashlane and LastPass promise they can't see your password vault. But that's not always true. A server compromise can mean game over for you, say researchers who examined some of the top password managers on the market

UNC6201 Exploiting a Dell RecoverPoint for Virtual Machines Zero-Day | Google Cloud Blog UNC6201 utilizes a newly discovered zero-day in Dell RecoverPoint for Virtual Machines to deliver BRICKSTORM and subsequently backdoors.

0day -> webshell -> Brickstorm malware ☹️

cloud.google.com/blog/topics/...