adam_cyber @Adam_Cyber Twitter profile

Last Seen Profiles

@LBHSCheer

@LinkedFusion

@Miz_otrhk

@KadanNite

@CLinepannetier

@MaggitAva81394

@yupiiCDER

@OqMeta

@DrDebMuldrew

@AmmTowers

@SandersBob49

@Papuaviral1

@Mousse_Tique

@dineshbohrabmr

@alfie_gilchrist

@KPPkmeekjai

@EndFGM_NETFA

@elethereal

@bokeplokalmalam

@AJPcrosser

@TeamDLH

@Saraalawami92

@Arda20124413

@Superstar_Game

@YMWAP_Boston

@FMauguiere

@USNATO

@sin__cas

@farahmaster

@inmyselfishness

@Tapo152

@owkhey

@bokeplokalmalam

@Abrar_khawja

@veenadubal

@infopolitano

adam_cyber

@Adam_Cyber

11 months

There are a lot of hacktivist groups and known adversaries engaged in the cyber conflict around the #IsraelPalestineConflict . @CrowdStrike pulled together a graphic to highlight some of what we're seeing.

25

373

894

adam_cyber

@Adam_Cyber

2 years

New research from @CrowdStrike Intel on Scattered Spider Bringing their Own Vulnerable Device Driver to Windows:

SCATTERED SPIDER Attempts to Avoid Detection with Bring-Your-Own-Driver Tactic

Learn how CrowdStrike detected SCATTERED SPIDER's attempt to deploy a malicious driver through a vulnerability (CVE-2015-2291) in the Intel Ethernet diagnostics driver.

www.crowdstrike.com

3

93

243

adam_cyber

@Adam_Cyber

3 years

@CrowdStrike has identified exploitation of #log4j vulnerability by threat actors that more closely resembles targeted intrusion consistent with advanced attackers, such as deploying web shells and conducting lateral movement.

5

67

231

adam_cyber

@Adam_Cyber

3 years

Since everyone is talking about darkside at the moment - check out this @CrowdStrike Intel blog on how they target ESXi and their connection to Carbon Spider: #darkside #ColonialPipeline #Ransomware

New Ransomware Tactic: Adversaries Target ESXi Servers | CrowdStrike

By deploying ransomware on ESXi hosts, adversaries quickly increased the scope of affected systems, further pressuring victims to pay the ransom demands.

www.crowdstrike.com

0

97

195

adam_cyber

@Adam_Cyber

4 years

Awesome work by @CrowdStrike Intel team documenting #ransonware actors targeting of hypervisor

New Ransomware Tactic: Adversaries Target ESXi Servers | CrowdStrike

By deploying ransomware on ESXi hosts, adversaries quickly increased the scope of affected systems, further pressuring victims to pay the ransom demands.

www.crowdstrike.com

1

74

186

adam_cyber

@Adam_Cyber

3 years

Excellent work by @CrowdStrike intel team detailing what has been a whirlwind day! #log4j

Log4j2 Vulnerability: How to Mitigate CVE-2021-44228 | CrowdStrike

CrowdStrike Falcon® OverWatch analyzes CVE-2021-44228 (Log4Shell) and the ongoing attempts to exploit the Log4j2 vulnerability, and offers mitigation recommendations.

www.crowdstrike.com

0

48

144

adam_cyber

@Adam_Cyber

4 years

SUNSPOT the malware used to drop SUNBURST has been identified - excellent analysis by @Crowdstrike Intelligence:

SUNSPOT Malware: A Technical Analysis | CrowdStrike

In this blog, we offer a technical analysis of SUNSPOT, malware that was deployed into the build environment to inject this backdoor into the SolarWinds Orion platform.

www.crowdstrike.com

2

71

133

adam_cyber

@Adam_Cyber

1 year

I am very excited to publicly unveil our new @CrowdStrike Counter Adversary Operations! Consolidating our market leading Threat Intelligence and game changing OverWatch Threat Hunting teams into a new entity charged with raising the cost for adversaries!

CrowdStrike Debuts Counter Adversary Ops Team | CrowdStrike

The launch of CrowdStrike Counter Adversary Operations unites Falcon OverWatch and CrowdStrike Intelligence to stop modern breaches. Learn more!

www.crowdstrike.com

1

31

126

adam_cyber

@Adam_Cyber

3 years

We added some additional information to the @CrowdStrike #log4js blog including additional countermeasures and adversary attempts to defeat them.

Log4j2 Vulnerability: How to Mitigate CVE-2021-44228 | CrowdStrike

CrowdStrike Falcon® OverWatch analyzes CVE-2021-44228 (Log4Shell) and the ongoing attempts to exploit the Log4j2 vulnerability, and offers mitigation recommendations.

www.crowdstrike.com

0

40

128

adam_cyber

@Adam_Cyber

3 years

@CrowdStrike has identified a malicious Java class file hosted on infra associated with a nation state adversary. The Java code is used to download known instances of adversary specific tooling and is likely to be used in conjunction with the recently disclosed #log4j issue.

2

36

120

adam_cyber

@Adam_Cyber

2 years

#threatintel in cars with @JohnHultquist - @CrowdStrike and @Mandiant carpooling and keeping that carbon footprint low

10

3

123

adam_cyber

@Adam_Cyber

1 year

Does Scattered Spider seem to be everywhere? The scope of their intrusions since March 2022 from a @CrowdStrike perspective is pretty broad. They use social engineering, living off the land, and RMM tools before deploying ransomware or conducting extortion.

3

40

118

adam_cyber

@Adam_Cyber

2 years

Crowdstrike intel blog on EMBER BEAR the adversary associated with #whispergate -

EMBER BEAR: Threat Actor Profile | CrowdStrike

EMBER BEAR is an adversary group aimed at creating public mistrust in targeted institutions and degrading government ability to counter Russian cyber operations.

www.crowdstrike.com

0

49

116

adam_cyber

@Adam_Cyber

2 years

Very excited to release the @CrowdStrike 2023 Global Threat Report today - get it here: See key insights into adversary behavior in 2022 and how the threat is evolving including data weaponization, cloud targeting, and more!

CrowdStrike 2024 Global Threat Report | CrowdStrike

Summarizing a year defined by adversarial stealth, the highly anticipated CrowdStrike 2024 Global Threat Report uncovers notable themes, trends, and events.

www.crowdstrike.com

0

29

103

adam_cyber

@Adam_Cyber

1 month

As we work with customers and partners to get systems fully restored, we are seeing threat actors try to take advantage of the situation. Here is intel on what we have seen related to the issues today:

Falcon Sensor Issue Likely Used to Target CrowdStrike Customers

A July 19, 2024, Falcon sensor content update issue is likely being used by threat actors to target CrowdStrike customers. Learn more.

www.crowdstrike.com

2

58

102

adam_cyber

@Adam_Cyber

2 years

Nice work by @CrowdStrike Services and Intel teams on a recent Exchange issue () Here is a useful tool to check logs for evidence of exploitation:

OWASSRF: CrowdStrike Identifies New Method for Bypassing ProxyNotShell Mitigations

Learn how CrowdStrike recently discovered a new exploit method using CVE-2022-41080 and CVE-2022-41082 to achieve remote code execution (RCE) through Outlook Web Access.

www.crowdstrike.com

0

48

101

adam_cyber

@Adam_Cyber

1 month

More intelligence on threat actors abusing the incident last week to distribute malware. This latest is a python infostealer.

Threat Actor Distributes Python-Based Info Stealer Using Fake Update

CrowdStrike Intelligence identified a malicious ZIP file containing a Python-based information stealer now tracked as Connecio. Learn more here.

www.crowdstrike.com

2

40

98

adam_cyber

@Adam_Cyber

3 years

Awesome work by @CrowdStrike Services and Intel teams breaking down how COZY BEAR conducts an operation and looks at their capabilities on linux too! #ThreatIntel #CyberSecurity

StellarParticle Campaign: Novel Tactics and Techniques | CrowdStrike

This blog discusses the StellarParticle campaign and the novel tactics and techniques used in supply chain attacks observed by CrowdStrike incident responders.

www.crowdstrike.com

1

45

91

adam_cyber

@Adam_Cyber

3 years

In addition to the blog we published () here is a timeline graphic we hope will be helpful in illustrating the years of offensive #cyber operations against #Ukraine by #VoodooBear

3

45

93

adam_cyber

@Adam_Cyber

3 years

@CrowdStrike Intelligence published a blog and code to decrypt files that may have been encrypted by ransomware called #partyticket in #ukraine

How to Decrypt the PartyTicket Ransomware Targeting Ukraine | CrowdStrike

We explain how PartyTicket ransomware used in Ukraine attacks only superficially encrypts files, and outline how it's possible to recover the encrypted files.

www.crowdstrike.com

0

54

95

adam_cyber

@Adam_Cyber

4 years

Excellent work by the @CrowdStrike eCrime team - Wizard Spider (Trickbot) back to business:

Wizard Spider Modifies and Expands Toolset [Adversary Update]

The CrowdStrike Intelligence team shares its analysis of key observations from WIZARD SPIDER's BazarLoader, Conti and Ryuk operations over recent months.

www.crowdstrike.com

1

43

78

adam_cyber

@Adam_Cyber

26 days

Excited to announce the launch of the @CrowdStrike 2024 Threat Hunting Report - it contains insights from the last year by our Overwatch team. Details the increase in targeting of Healthcare by ecriminals, exposes Famous Chollima, and more!

0

20

73

adam_cyber

@Adam_Cyber

2 years

Some nice analysis by @CrowdStrike Intelligence in Prophet Spider an access broker who sells to big game hunters-

PROPHET SPIDER Exploits Citrix ShareFile | CrowdStrike

Read our blog post to learn how PROPHET SPIDER continues to evolve their tradecraft while continuing to exploit known web-server vulnerabilities.

www.crowdstrike.com

0

23

69

adam_cyber

@Adam_Cyber

19 days

If you haven’t had a chance to read the @CrowdStrike Threat Hunting Report yet, I've got you covered! I will be providing a quick overview of the report along with a deep dive into an insider threat you may not have heard of we call famous chollima.

CrowdStrike 2024 Threat Hunting Report Briefing | CrowdCast

Join CrowdStrike for an exclusive threat briefing on the latest adversary trends and key findings from the CrowdStrike 2024 Threat Hunting Report.

www.crowdstrike.com

0

10

61

adam_cyber

@Adam_Cyber

5 months

The CSRB findings from the summer 2023 breach of Microsoft are both alarming and confirm many of the concerns I've voiced about the risk of overreliance on their products. @Microsoft is a national security threat and it's time to take it seriously! 🧵

1

22

61

adam_cyber

@Adam_Cyber

24 days

Detailed blog regarding kernel access and security architecture, hopefully this helps dispel some common misinterpretations about kernel access, specifically regarding the architecture of the Falcon sensor:

Tech Analysis: CrowdStrike's Kernel Access and Security Architecture

Learn about the CrowdStrike Falcon sensor architecture on the Windows operating system, including user benefits and common misconceptions.

www.crowdstrike.com

1

13

59

adam_cyber

@Adam_Cyber

5 years

Awesome work by @CrowdStrike intel team illustrating the latest entrant to the big game hunting a/k/a enterprise ransomware scene:

PINCHY SPIDER Adopts “Big Game Hunting” to Distribute GandCrab

New tactics from PINCHY SPIDER affiliates indicate a shift toward GandCrab ransomware in targeted, low-volume/high-return “big game hunting” attacks.

www.crowdstrike.com

1

28

57

adam_cyber

@Adam_Cyber

10 years

Overlap in Silent Chollima (DPRK) malware with spelling error #Secruity http://t.co/BHHZOGeiMR

6

62

51

adam_cyber

@Adam_Cyber

8 years

On the left is the legitimate д-30 app mentioned in @CrowdStrike report, on the right is the one manipulated by fancy bear.

3

48

52

adam_cyber

@Adam_Cyber

3 years

Great work by @Crowdstrike Intel team assessing the reaction to recent #ransomware incidents by criminal groups and forums.

How Ransomware Adversaries Reacted to the DarkSide Attack

Learn how the notorious ransomware operators have responded to the DarkSide pipeline attack and the effect it's had on the ransomware-as-a-service landscape.

www.crowdstrike.com

0

23

50

adam_cyber

@Adam_Cyber

2 years

In light of todays announcement - I’ll reshare this tweet @JohnHultquist

adam_cyber

@Adam_Cyber

6 years

This week on #threatintelincars @CrowdStrike @FireEye discuss attribution

3

1

28

1

4

49

adam_cyber

@Adam_Cyber

7 months

@vxunderground @CrowdStrike Scattered Spider, Aquatic Panda, Nemesis Kitten, and Labyrinth Chollima

1

48

adam_cyber

@Adam_Cyber

3 years

Another awesome research blog by @CrowdStrike intel - this one on the Plotus ATM malware used for cashing out:

Automated Deobfuscation of Ploutus ATM Malware | CrowdStrike

Ploutus malware protects its code with a commercial obfuscator named .NET Reactor. We demonstrate how to build a deobfuscator to combat this technique.

www.crowdstrike.com

2

25

48

adam_cyber

@Adam_Cyber

1 month

Continuing to see threat actors leveraging @CrowdStrike to target systems - here’s the latest activity we have observed:

Threat Actor Uses Fake Recovery Manual to Deliver Unidentified Stealer

Learn more about a Word document CrowdStrike Intelligence identified containing macros that download an unidentified stealer now tracked as Daolpu.

www.crowdstrike.com

0

16

47

adam_cyber

@Adam_Cyber

6 years

@CrowdStrike and @FireEye lowering our carbon footprint by car pooling!

8

3

46

adam_cyber

@Adam_Cyber

3 years

I never thought I could dislike Java more than I did in college… But here I am 20 years later, up for multiple nights… cramming

2

1

42

adam_cyber

@Adam_Cyber

8 years

On the left are strings from FANCY BEAR linux implant, on the right are strings from the Android implant used against Ukraine military

6

43

42

adam_cyber

@Adam_Cyber

3 years

What happens if your malware gets added to OFAC list? Get new malware... #ransomware Excellent analysis by @CrowdStrike Intel team!

INDRIK SPIDER: WastedLocker Superseded by Hades Ransomware

CrowdStrike Intelligence has identified Hades ransomware as INDRIK SPIDER’s successor to WastedLocker. Discover how the team identified this adversary evolution.

www.crowdstrike.com

0

12

41

adam_cyber

@Adam_Cyber

1 month

We identified a likely eCrime actor using todays issue to deploy RemCos:

Likely eCrime Actor Capitalizing on Falcon Sensor Issues | CrowdStrike

A likely eCrime actor is targeting LATAM-based CrowdStrike Customers with July 19, 2024 Falcon sensor issue using filenames. Learn more.

www.crowdstrike.com

0

27

41

adam_cyber

@Adam_Cyber

6 years

If you are a researcher looking for a challenging and fun environment to fight bad guys @CrowdStrike Intelligence has a few positions open: #ThreatIntel #Cybersecurity

0

24

37

adam_cyber

@Adam_Cyber

6 years

Awesome work by the @CrowdStrike Intel team analyzing GRIM SPIDER a/k/a Ryuk -

What is Ryuk Ransomware? The Complete Breakdown

Since August 2018, Ryuk Ransomware has been used to target enterprise environments. Threat actors operating it have netted over $3,701,893.98 USD to date.

www.crowdstrike.com

1

24

40

adam_cyber

@Adam_Cyber

8 years

FAQ slide from @CrowdStrike presentation on FANCY BEAR X-Agent for Android that @DAlperovitch and I just wrapped up

4

34

35

adam_cyber

@Adam_Cyber

1 month

An update on the analysis of the falcon crash reporter we previously published a blog on, looks like targeted intrusion activity:

Malicious Inauthentic Falcon Crash Reporter Installer Delivers Malware Named Ciro

A threat actor distributed a malicious installer named Ciro posing as an inauthentic Falcon Crash Reporter Installer. Learn more.

www.crowdstrike.com

0

19

38

adam_cyber

@Adam_Cyber

2 years

Newly identified supply chain attack:

CrowdStrike Falcon® Platform Identifies Supply Chain Attack via a Trojanized Comm100 Chat Installer...

The CrowdStrike threat teams have confirmed a recent supply chain attack delivering malware via a trojanized installer for the Comm100 Live Chat application.

www.crowdstrike.com

0

20

38

adam_cyber

@Adam_Cyber

1 month

More intelligence on threat actors using current events to try to gain visibility:

Hacktivist Entity USDoD Claims to Have Leaked CrowdStrike’s Threat Actor List

Adversaries exploit current events for attention and gain. We remain committed to sharing data with the community.

www.crowdstrike.com

1

21

36

adam_cyber

@Adam_Cyber

3 years

With tensions rising in Ukraine - @CrowdStrike intel sheds some light on what #ThreatIntelligence folks can expect in terms of offensive #cyber operations -

Past Cyber Operations Against Ukraine and What May Be Next

This blog evaluates past cyber operations of adversaries related to Russia against Ukrainian interests, and forecasts future operations within the region.

www.crowdstrike.com

0

9

36

adam_cyber

@Adam_Cyber

25 days

Setting the record straight regarding alleged vulnerabilities related to the channel file issue, bottom line: there is no mechanism to write to arbitrary memory addresses or control program execution, and we use cert pinning to mitigate MitM

Tech Analysis: Addressing Claims About Falcon Sensor Vulnerability | CrowdStrike

Our analysis outlines why the Channel File 291 incident is not exploitable in a way that achieves privilege escalation or remote code execution and we detail how we secure the Falcon sensor’s channel...

www.crowdstrike.com

0

13

36

adam_cyber

@Adam_Cyber

1 year

The disruption of Snake malware, which CrowdStrike attributes to Russia-nexus adversary VENOMOUS BEAR, is a huge win for the U.S. & NATO against FSB’s Center 16. Operation MEDUSA highlights the importance of public/private collaboration to take down sophisticated adversaries.

0

7

36

adam_cyber

@Adam_Cyber

3 years

@CrowdStrike Intel team weighs in with analysis of the malicious bootloader from #whispergate

Technical Analysis of the WhisperGate Malicious Bootloader | CrowdStrike

A set of malware dubbed "WhisperGate" was recently reported to have been deployed against Ukrainian targets. This blog breaks down how the malicious bootloader works.

www.crowdstrike.com

0

18

35

adam_cyber

@Adam_Cyber

7 years

Awesome work to decode NotPetya/Petya MFT's -

How to Decrypt NotPetya & Petya After an Attack - CrowdStrike

CrowdStrike offers tools and step-by-step instructions for recovering your Master File Table (MFT) after a NotPetya or Petya attack. With the aid of the supplied tools, almost all of the Master File...

www.crowdstrike.com

0

30

33

adam_cyber

@Adam_Cyber

6 years

Awesome work by the @crowdstrike Intelligence eCrime Team! #ransomware

0

21

29

adam_cyber

@Adam_Cyber

10 months

In addition to the @CrowdStrike blog post today on Imperial Kitten - we have released a podcast detailing Iranian cyber operations going back over a decade - or where ever you enjoy podcasts. #CyberSecurity #threatintelligence

Iran’s Rise from Nascent Threat Actor to Global Adversary | Adversary...

“Iran’s digital presence is something we don’t want to underestimate.” Though its cyber activity has been making headlines during a dynamic past few weeks, Iran’s history as a major player in the...

crowdstrike.podbean.com

0

19

32

adam_cyber

@Adam_Cyber

7 years

This keynote by Cliff Stoll from @CrowdStrike Fal.Con was truly entertaining -

0

11

30

adam_cyber

@Adam_Cyber

1 month

Additional intelligence on targeting using @CrowdStrike as a theme for spear phishing:

Malicious Inauthentic Falcon Crash Reporter Installer Distributed to German Entity

A malicious inauthentic Falcon Crash Reporter installer was distributed to a German entity via a spearphishing website. Learn more.

www.crowdstrike.com

2

13

30

adam_cyber

@Adam_Cyber

2 years

For some threat hunting queries - @amunchbach dropped some knowledge on Reddit - #ThreatIntel

From the crowdstrike community on Reddit: 2023-01-10 | SCATTERED SPIDER Targeting Falcon and Other...

Explore this post and more from the crowdstrike community

www.reddit.com

0

11

30

adam_cyber

@Adam_Cyber

6 years

This week on #threatintelincars @CrowdStrike @FireEye discuss attribution

3

1

28

adam_cyber

@Adam_Cyber

11 years

Interesting code injection technique using a window handle: http://t.co/vUwgvSIlRu by @CrowdStrike Intel's Chris Dietrich

1

36

28

adam_cyber

@Adam_Cyber

7 years

I'm releasing some quick code I threw together to interact with @HybridAnalysis API #malware

GitHub - adamcrowdstrike/HybridAPI: Quick tool for using Hybrid Analysis API on command line..

Quick tool for using Hybrid Analysis API on command line.. - adamcrowdstrike/HybridAPI

github.com

0

10

28

adam_cyber

@Adam_Cyber

1 year

Awesome work from Nicolas Zilio, Ken Balint , and Marco Ortisi! Discovering and Blocking a Zero-Day Exploit with @CrowdStrike Falcon Complete: The Case of CVE-2023-36874

Falcon Complete: Zero-Day Exploit Case Study | CrowdStrike

The Falcon Complete MDR team discovered and blocked a zero-day exploit (CVE-2023-36874) affecting Windows Error Reporting. Learn more about the discovery and response!

www.crowdstrike.com

0

8

27

adam_cyber

@Adam_Cyber

2 years

@CrowdStrike has a blog detailing yet another threat to global telecoms - this covers justforfun a/k/a bpfdoor similar to lightbasin this is tracked as DecisiveArchitect

How to Hunt for DecisiveArchitect and Its JustForFun Implant | CrowdStrike

CrowdStrike outlines the best methods to hunt for the JustForFun implant used by DecisiveArchitect to target global telecommunications companies.

www.crowdstrike.com

0

8

26

adam_cyber

@Adam_Cyber

4 years

If you want to get a sense of how vulnerabilities are hunted and exploited on embedded linux, check out this @CrowdStrike Intel blog #pwn2own

Pwn2Own: A Tale of a Bug Found and Lost Again | CrowdStrike

In this blog, we describe our journey of identifying and exploiting a stack-based buffer overflow vulnerability on the Western Digital My Cloud Pro Series PR4100 NAS.

www.crowdstrike.com

0

14

26

adam_cyber

@Adam_Cyber

9 years

http://t.co/sWtEfAfPmB - Great reversing by Chris Dietrich & nice comments on challenges faced by analysts balancing between intel and RE

0

17

25

adam_cyber

@Adam_Cyber

7 years

Awesome stuff in the @CrowdStrike casebook - breakdown of most common vectors is pretty cool

CrowdStrike Services 2021 Cyber Front Lines Report | CrowdStrike

The 2021 Cyber Front Lines Report brings together the insights & observations of CrowdStrike's Services team. Download the report today!

www.crowdstrike.com

0

15

25

adam_cyber

@Adam_Cyber

6 years

@CrowdStrike Intelligence analysis following the interesting posts by @intrusion_truth on STONE PANDA -

0

18

23

adam_cyber

@Adam_Cyber

6 years

Best conference swag ever!

3

5

23

adam_cyber

@Adam_Cyber

9 months

While I am always happy to speak on what @CrowdStrike is seeing with regards to DPRK offensive cyber activity - this appears to be Velvet Chollima targeting folks. Stay safe out there!

1

4

23

adam_cyber

@Adam_Cyber

7 years

Very cool to have the opportunity to work with @38NorthNK on DPRK cyber operations

North Korean Cyber Operations: Weapons of Mass Disruption - 38 North: Informed Analysis of North...

Over the past 10 years, the escapades of various nation-state actors in the cyber realm have ...

www.38north.org

0

9

23

adam_cyber

@Adam_Cyber

3 years

Nice post on hunting #HermeticWiper what @CrowdStrike calls DriveSlayer -

From the crowdstrike community on Reddit

Explore this post and more from the crowdstrike community

www.reddit.com

1

3

22

adam_cyber

@Adam_Cyber

5 years

Katie From @CrowdStrike Intel briefing on Chollima actors at #CYBERWARCON

0

5

22

adam_cyber

@Adam_Cyber

2 years

This is what keeps me up at night:

Suspected Chinese hackers tampered with widely used customer chat program, researchers say

Suspected Chinese hackers tampered with widely used software distributed by a small Canadian customer service company, another example of a "supply chain compromise" made infamous by the hack on U.S....

www.reuters.com

0

9

18

adam_cyber

@Adam_Cyber

8 years

@WifeBuey @CrowdStrike fun fact fancy bear named because sofacy malware name reminded analyst of iggy azalea song

3

15

17

adam_cyber

@Adam_Cyber

2 years

@JohnHultquist things escalated quickly

2

1

19

adam_cyber

@Adam_Cyber

5 years

Fantastic work by @_k0zy from @CrowdStrike Intelligence team! Join us at our Fal.con Unite conference to hear more!

Cybersecurity Blog | CrowdStrike

The #1 blog in cybersecurity. Industry news, insights from cybersecurity experts, and new product, feature, and company announcements.

www.crowdstrike.com

0

6

18

adam_cyber

@Adam_Cyber

2 years

@JohnHultquist and I have the #threatintel uniform dialed in!

4

2

17

adam_cyber

@Adam_Cyber

8 years

Announcing a new defense oriented conference - - limited space, cfp now open!

0

7

16

adam_cyber

@Adam_Cyber

1 year

New @crowdstrike blog on Vanguard Panda - a/k/a volt typhoon

Falcon Complete MDR Thwarts VANGUARD PANDA Tradecraft

Read this blog post to learn how Falcon Complete detected and thwarted VANGUARD PANDA (Volt Typhoon) tradecraft.

www.crowdstrike.com

0

9

15

adam_cyber

@Adam_Cyber

3 years

Just gonna leave this here:

1

0

16

adam_cyber

@Adam_Cyber

8 years

So disappointed in the infosec community and capacity for original thought... Smh

2

3

16

adam_cyber

@Adam_Cyber

7 years

@msuiche fascinating deep dive on ethereum issues #falconUNITE17 looks interesting

GitHub - msuiche/porosity: *UNMAINTAINED* Decompiler and Security Analysis tool for Blockchain-ba...

*UNMAINTAINED* Decompiler and Security Analysis tool for Blockchain-based Ethereum Smart-Contracts - msuiche/porosity

github.com

0

7

14

adam_cyber

@Adam_Cyber

2 years

@RidT Mila - Contagio Malware Dump

2

0

15

adam_cyber

@Adam_Cyber

5 months

"The Board concludes that Microsoft’s security culture was inadequate." This is a pattern - SunBurst (2020), Lap$us(2022), Storm-0558 (2023), and Cozy Bear (2024) - Microsoft is a national security risk, security is a team sport, when are we putting them on the bench?

0

3

15

adam_cyber

@Adam_Cyber

6 years

More awesome stuff from @CrowdStrike Intelligence on #ecrime

"Sin”-ful SPIDERS: WIZARD SPIDER and LUNAR SPIDER Sharing the Same Web

A new campaign in which BokBot is distributing a custom variant of a TrickBot module signals a more intimate relationship between the two adversaries, WIZARD SPIDER and LUNAR SPIDER. A historical...

www.crowdstrike.com

0

7

15

adam_cyber

@Adam_Cyber

5 months

"Microsoft acquired a company called Affirmed Networks" ... "Microsoft believes that prior to the acquisition, Storm-0558 targeted an engineer and compromised their device" - Onboarding risk is a huge issue - M&A needs to incorporate compromise assessments as part of DD

1

3

15

adam_cyber

@Adam_Cyber

1 year

Very excited to announce the Adversary Universe Podcast is coming! Preview here:

Adversary Universe Podcast - CrowdStrike

Join CrowdStrike experts and business leaders across industries to discuss the most pressing cybersecurity issues facing enterprises and how to stay ahead.

www.crowdstrike.com

1

3

13

adam_cyber

@Adam_Cyber

2 years

@CrowdStrike is excited to be part of JCDC’s new ICS initiative to help empower security teams with actionable knowledge and insights to detect and deter cyberattacks across their operational technology

0

2

14

adam_cyber

@Adam_Cyber

1 month

We’ve published another intelligence alert on threat actors using the disruption last week, this time attempting to deploy lumma stealer:

Malware Distributed Using Falcon Sensor Update Phishing Lure | CrowdStrike

Lumma Stealer packed with CyberIt is being distributed using a CrowdStrike Falcon Sensor Update phishing lure. Learn more.

www.crowdstrike.com

0

10

14

adam_cyber

@Adam_Cyber

3 years

The @CrowdStrike 2022 global threat report is out! Read about the 82% increase in #ransomwareattack related data leaks we observed in 2021:

0

4

13

adam_cyber

@Adam_Cyber

3 years

Blog from @CrowdStrike engineering on how falcon fights wiper:

CrowdStrike Protects from Wiper Malware Used in Ukraine Attacks

The CrowdStrike Falcon® platform provides continuous protection from the wiper-style malware used to target Ukraine by offering real-time visibility across workloads.

www.crowdstrike.com

0

5

13

adam_cyber

@Adam_Cyber

6 years

Just gonna leave this here -

Cybersecurity Blog | CrowdStrike

The #1 blog in cybersecurity. Industry news, insights from cybersecurity experts, and new product, feature, and company announcements.

www.crowdstrike.com

1

6

13

adam_cyber

@Adam_Cyber

8 years

GReAT teeshirts guys @Mao_Ware #fancybear #BlackHat2016

2

12

adam_cyber

@Adam_Cyber

4 years

Ways to spot information ops on twitter: 1) look at tweet rate 2) look at account age 3) look at likes/retweets 4) look at description versus beliefs 5) look at operating times - if they say they are a retired cop and they resigned that day might be info op

0

3

12

adam_cyber

@Adam_Cyber

8 years

Come see some new research I've been doing to track down adversaries using natural language tools: #rsac

2

6

11

adam_cyber

@Adam_Cyber

6 months

Looking forward to this!!!

SLEUTHCON

@SLEUTHCON

6 months

SLEUTHCON is coming!!! Registration and CFP are now open for this year's SLEUTHCON! This year's keynote will be given by Bryan Vorndran, FBI's Assistant Director Cyber Division. We are virtual and in-person in Arlington, VA on May 24th! 1/x

4

53

109

1

2

12

adam_cyber

@Adam_Cyber

1 year

@silascutler @CrowdStrike @DAlperovitch @George_Kurtz Thanks for the heads up @silascutler - I’ll look into this…

0

11

adam_cyber

@Adam_Cyber

10 years

Amy Adams just gave first class seat to a US Army Sergeant - classy move!!

0

5

10

adam_cyber

@Adam_Cyber

5 years

My every day...

Little Bobby

@_LittleBobby_

5 years

Threat Intelligence Mileage May Vary |

2

43

117

2

1

11

adam_cyber

@Adam_Cyber

10 months

@CrowdStrike Counter Adversary Operations details some recent Imperial Kitten activity:

IMPERIAL KITTEN Deploys Novel Malware Families

CrowdStrike Counter Adversary Operations has been investigating cyberattacks targeting organizations in the transportation, logistics & technology sectors.

www.crowdstrike.com

0

4

11

adam_cyber

@Adam_Cyber

8 years

@CrowdStrike has been monitoring cyber skirmish between RU and Turkish hackers - looks like someone just escalated:

Turkey is investigating leak of 50 million citizens’ data

Join our daily and weekly newsletters for the latest updates and exclusive content on industry-leading AI coverage. Learn More Reuters (Can Sezer) — Turkey is investigating how hackers have posted...

venturebeat.com

1

12

11

adam_cyber

@Adam_Cyber

7 years

@JohnHultquist working hard on a tweet - standby