Pinned Tweet
Getting away from Twitter. You can find me on BlueSky while I rebuild followers and figure it out:
malwareforme.bsky.social
Jack retweeted
Russian threat actor Midnight Blizzard is conducting widespread traffic manipulation attacks at hotels worldwide. Result: delivering malware or redirecting auth flows at their discretion, globally.
Since early May 2026, we saw this subcluster manipulate DNS and HTTP traffic from networks served by captive portals to redirect user traffic through actor-controlled infrastructure. We’re calling the campaign CaptiveCrunch.
“We have observed notable commonalities in the equipment and management systems used across multiple affected networks.”
We break down the malware & techniques, but the most important part is how dynamic all of it is: Midnight Blizzard is using AI to support a significant portion of these operations. They are moving and changing quickly.
Feedback welcome on the suggested mitigations: microsoft.com/en-us/security…
Help spread the word to VIPs in governments, diplomatic entities, non-governmental organizations (NGOs) in the US and Europe (probably also those traveling to Black Hat)
Jack retweeted
We are looking for some interns to join our team here at Microsoft. If you are currently studying cyber security, computer science, mathematics or anything similar and based in Ireland or Cheltenham then we would love to hear from you - aka.ms/ghostjobs
Jack retweeted
People often share full Kusto queries, which is awesome, but what about those handy one liners and tips you have picked up along the way? Here are some of my favourites, share yours below!
Extend an additional column for your local time, example +5 UTC:
| extend LocalTime = TimeGenerated +5h
Find events only on weekends, cast a variable to make it easy to read:
let Saturday = time(6.00:00:00);
let Sunday = time(0.00:00:00);
AuditLogs
| where dayofweek(TimeGenerated) in (Saturday, Sunday)
Find events during certain hours of the day:
| where hourofday(TimeGenerated) !between (4 .. 23)
Calculate the minutes (or hours or days etc) between two events:
| extend ['Minutes Between Events']=datetime_diff("minute",Timestamp1,Timestamp2)
Parse the details, including browser family and version etc of a user agent:
| extend UserAgentDetail = todynamic(parse_user_agent(UserAgent, "browser"))
Decode base64 encoded strings, useful for PowerShell:
| extend DecodedCommand = base64_decode_tostring(EncodedCommand)
Rename columns while using project:
| project LogTime=TimeGenerated, SigninLocation=Location, IP=IPAddress, Agent=UserAgent
Jack retweeted
excited to announce @sublime_sec has raised a $60M Series B led by @IVP
@CNBC wrote about the news this morning: cnbc.com/2024/12/12/email-se…
@ianthiel and I are so grateful and humbled by the trust our customers and community have placed in us. we won't let you down
Jack retweeted
Enjoy punching phish? Experience writing detections for phish, using regex, Yara, etc., and looking to grow as a researcher within an experienced team? Join me and the rest of the Splunk Attack Analyzer Misfits of Detection Science. US only, fully remote splunk.com/en_us/careers/job…
Jack retweeted
Proofpoint has tracked this technique since August 2024, and call it “brooxml”. Our researchers do not consider this a zero-day or vulnerability in general.
We’ve released Emerging Threats and YARA signatures at the end of this thread.
🚨ALERT: Potential ZERO-DAY, Attackers Use Corrupted Files to Evade Detection 🧵 (1/3)
⚠️ The ongoing attack evades #antivirus software, prevents uploads to sandboxes, and bypasses Outlook's spam filters, allowing the malicious emails to reach your inbox
The #ANYRUN team discovered that as part of this #zeroday attack, threat actors attempt to conceal the file type by deliberately corrupting it, making it difficult for certain security tools to detect
📌 Our sandbox solves this problem thanks to interactivity. It launches these broken files in their corresponding programs, which allows it to identify #malicious behavior
See example:
app.any.run/tasks/6839e806-5…
🚫 Although these files operate successfully within the OS, they remain undetected by most security solutions due to the failure to apply proper procedures for their file types
They were uploaded to VirusTotal, but all antivirus solutions returned "clean" or “Item Not Found” as they couldn't analyze the file properly
Jack retweeted
Microsoft’s Digital Crimes Unit has seized 240 fraudulent websites, disrupting a major “Phishing-as-a-Service” operation. These campaigns targeted sensitive industries like financial services, jeopardizing data, transactions, and even life savings. aka.ms/DCU-disruption-ONNX
Jack retweeted
I'm told we are hiring in MSTIC: aka.ms/msticjobs
Come for the data, stay for the data. Creative problem solvers have the most impact.
If we've worked together, I'm happy to refer you.
But...
i’m legit amped about aligning with all of the “tip of the spear” teams under the CISO
this part of the public “secure futures” update is a pretty nice acknowledgment of threat intel impact
let’s go! come join us:
aka.ms/msticjobs 🕵️
aka.ms/ghostjobs 👻
Jack retweeted
I'll just leave this here... github.com/wmetcalf/rdp_holi…
Jack retweeted
you can deploy verifiable coverage for this with @sublime_sec (for free), here’s the detection that’s been out for over a year (h/t @zoomequipd @ajpc500): sublime.security/feeds/core/…
🚨We’re seeing reports of a large-scale #spearphishing campaign targeting multiple sectors, including government and IT. A foreign threat actor is sending phishing emails with malicious RDP files to gain network access. Take proactive measures. More info: bit.ly/4fp9aQB
Jack retweeted
There is also this setting in admin.microsoft.com
I'm not 100% sure if this will help thwart the current initial access attacks through Teams, but here are some things I would do:
1. Go admin.teams.microsoft.com/co… and ensure the following box is unchecked:
learn.microsoft.com/en-us/mi…
Jack retweeted
Announcing our latest NLU model update: BERT Large Language Model (LLM), which is better at understanding tone, intent, and context than ever before.
We’ve detailed our research in our latest blog and how it’s used to combat AI-generated attacks: sublime.security/blog/combat…
Jack retweeted
We are now developing @elastic threat hunting queries, alongside our detection rules, and openly sharing these as well! 🎉🎉
Can visually explore these with rulexplorer.io/! 🔥🔥
#ThreatHunting #DetectionEngineering
Threat hunting just got easier! This new repo of detection rules is crafted by our veteran detection engineers and powered by different Elastic query languages. Get the details of what’s included and see the future of this repo here: go.es.io/4h2JsTX
#ElasticSecurityLabs
Jack retweeted
We're excited to announce the release of our new Public EML Analyzer: a free, unauthenticated tool for analyzing email messages.
Upload any EML and get Sublime's analysis results along with URL sandbox and attachment previews, insights, and more: analyzer.sublime.security
Jack retweeted
Microsoft has been running massive deception campaigns that flood new phishing sites with bogus credentials for bogus companies on MS tenants. When attackers log in, they deliver a torrent of fresh threat intelligence that can be used to defend: #infosec youtube.com/watch?v=78qnM_Zz…