I know it's that time of year we all set out with lofty goals to achieve great things, but if there's anyone out there looking for a good cause to support whilst doing so.. let me suggest @reunite_ICAC 1/4

Room is packed to the rafters here at #CyberThreat23 and @SANSInstitute @jameslyne & @NCSC are kicking us off with a pretty cool light show & promises of some amazing speakers. They never disappoint on that front!

The UK's @NCSC has launched Protective DNS for Schools. The service will be completely free, and the phased rollout will start now and will progress into next year. Together we can protect the most vulnerable at scale 💪 ncsc.gov.uk/blog-post/introd…

🎅 It always pays to have Santa in your corner. Subscribe to be notified when Holiday Hack Challenge 2023 opens for play and your odds of making the “Nice List” are sure to skyrocket. 🚀 sans.org/u/1se2 #HolidayHack #Cybersecurity

Join us at SANS Cyber #ComplianceCountdown on November 2, when @Nebulator will discuss the SEC and #NIS2 mandates and what they mean for your cyber incident management plans and reporting. ➡️ View the Full Agenda & Register for Free: sans.org/u/1sCo #CyberCompliance

Throwback to when the awesome folks at SANS Institute saw fit to dub me "The Most Lethal Forensicator We Know,” complete with a custom-made plaque and a Darth Vader helmet signed by none other than David Prowse, the man in the suit. It brings me great joy to be part of the amazing community at SANS, and I’m very proud of the work we do and the positive impact we have on the world. I couldn’t choose a better second family, even if I tried. Eternally grateful. Indeed, the DFIR side of the force is strong with this one ✊ #DFIR #digital forensics #cybersecurity

I've got some really cool stuff to share! - Smaller Log Retention (while still hitting compliance!) - Network Micro Segmentation - Application Allow Lists - Asset Inventory

Nice guide from NCSC. I wrote a guide for instagram recovery this morning so I’ve added a link to this as well. Will publish when I’m slept. 🫡🤗🇬🇧

Next up, the brilliant @4enzikat0r reminding us that our tools often lie to is and is really important to check and validate everything. Never blindly trust tool output. #DFIREurope23 #DFIREurope #DFIRSummit #forensics #infosec #CyberSecurity @SANSEMEA

Start of the #DFIREurope summit here in Prague. @j3ssgarcia opening to a packed room of keen forensics and IR practitioners. Awesome start to a great @SANSEMEA event. #dfir #dfirsummit #infosec #cybersecurity

Bart Vanautgaerden, from Google Cloud, sharing the details of an intrusion by Chinese Threat ActorUNC4841 explotiting a Barracuda zero-day @sansforensics @SANSEMEA #DFIReurope23

Speakers and venue are ready in Prague for our biggest SANS DFIR Summit EMEA ever!! sans.org/cyber-security-trai… @sansforensics @SANSEMEA

It’s great to be back in Prague again for another amazing SANS DFIR Summit EMEA (the first after the pandemic)!! Honored to be Chairing it again, with such amazing speakers and content. Can’t wait to meet old & new friends!! sans.org/cyber-security-trai… @sansforensics @SANSEMEA

Just 2 days left to submit nominations for the #SANSDMA Awards.  Help us acknowledge the unsung heroes in #Cybersecurity! We are accepting nominations until Friday, Sept 29 at 5pm EDT Nominate Now: sans.org/u/1neV

Catch me on this Tuesday, September 26th, on the latest episode of Wait Just an Infosec where some special guests will be joining me to discuss how we can recognize those contributing to the advancement of cybersecurity 🫡 Also dropping by is TrustedSec Founder and CEO David Kennedy (@HackingDave), for a discussion on how AI will influence offensive cyber capabilities in the coming years. You won’t want to miss this one! More info below 👇 YouTube link to live stream: tinyurl.com/mrhtkzeu Wait Just an Infosec: sans.org/wjai SANS Difference Maker Awards: sans.org/u/1sFM #WJAI #WaitJustanInfosec @SANSInstitute linkedin.com/events/cybersec…

Hey folks! Make a huge difference by nominating someone that was a difference maker to you. Last year I won influencer of the year and honestly was one of the most memorable and humbling experiences. Early in my career, I always (and still do) looked up to the folks at SANS as being some of the highest quality training that was ever created and continues to forge the next generation of cybersecurity pros and hackers. I personally have several SANS certs, and believe deeply in this organization and it's mission. I remember the first whitepaper I ever wrote was for the GSEC Gold - I was so damn proud of that when I passed. First, thank you to @SANSInstitute for doing this and second - so many great folks were there and all deserved to win. I have agreed to be on the review board this year and take time to contribute back because it is such a meaningful award. If you have a few moments, nominate someone that has made a huge difference or impact in your career, the industry, or in the world. To receive a award like this is a once in a lifetime opportunity! #SANS

Your last chance to make a Difference… 📣 Nominations for the @SANSInstitute Difference Makers Awards (DMAs) are closing very soon! Know an inspiring cybersecurity professional that you want to celebrate? A book or podcast that had an impact on the industry? Or maybe a cybersec mentor who left a mark on your life and influenced your career? Time’s running out. Nominate your worthiest candidates, and help us honor them for their work and contributions to the InfoSec field. ⚠️ Make sure you nominate your choice by Friday, September 29th, 5 pm EDT. ⚠️ 🚨 SUBMIT YOUR NOMINATIONS HERE: tinyurl.com/27rf4p5u 🚨 📅 Mark your calendars 📅 Winners will be announced on December 13th, at the Difference Makers Awards hosted at the Washington Hilton. 💼 If you are looking to sponsor the event, reach out to: dma@sans.org. 💼 👉 For more info: sans.org/about/awards/differ… 👈 🔁 I would appreciate it if you could please take the time to RETWEET this post, and feel free to tag anyone who would want to nominate or vote for a candidate 🔁

Here's a thread of resources where you can get up to speed on SCATTERED SPIDER, UNC3944, Oktapus, and Muddled Libra. (which we KNOW are not exact overlaps, but we're doing the best we can, okay??!?) Starting with @CrowdStrike, good one from @realparisi crowdstrike.com/blog/analysi…

We finally have more info about how exactly Microsoft was hacked by Chinese threat actors. It’s a doozy, so strap in. Back in June, hacking group Storm-0558 accessed the cloud-based Outlook email systems for 25 organizations, including at least two US government agencies. We finally know how they managed to pull it off. The hackers got their hands on a Microsoft account consumer signing key, all the way back in 2021. This cryptographic key is used to generate authentication ‘tokens’ that prove a user’s identity before they’re allowed to access data and services. This is usually stored in a highly isolated and restricted ‘production environment.’ However, during an April 2021 consumer signing system crash, the signing key made its way out of this secure environment and into a crash dump, which should not happen under normal circumstances. A race condition allowed the key to be present in the crash dump, which Microsoft did not know at the time, and this mass of data was subsequently moved from the isolated production network into the company’s debugging environment on the internet-connected corporate network. At some point after this, Storm-0558 successfully compromised a Microsoft engineer’s corporate account, which had access to the debugging environment containing the crash dump, and subsequently the signing key. @Microsoft’s explanation covers this whole controversy, and the company has since patched the accumulation of errors and issues that led to this, but the one missing link is how the threat actors got their hands on this engineer’s account. As my good friend Jacob Williams put it in the article below, “All the best hacks are deaths by 1,000 paper cuts, not something where you exploit a single vulnerability and then get all the goods.” Indeed, the best threat actors are cunning, patient and perseverent - so much so that they can infiltrate global corporations. Here’s the news story: wired.com/story/china-backed… Microsoft’s post-mortem report on the attack: msrc.microsoft.com/blog/2023…

RT @BushidoToken: 🆕 Pleased to share my latest blog for SANS FOR589: Cybercrime Intelligence 👾 We reviewed the latest cybercrime intrusion…