Threat Intelligence Research Lead for NETSCOUT's ASERT Research Team
Joined April 2013
- Tweets566
- Following541
- Followers1.2K
- Likes244
We scored ~30 frontier AI companies' external security posture. 12 of 28 with visible scores got a D or F; scores ranged 48 to 98. The companies building AI are part of your supply chain too. @security_score #AISecurity #TPRM securityscorecard.com/blog/a…
If your threat hunting still leans on IP blocklists and geo filters, CanOworms was built to beat you. 633 servers, one "kickass" TLS cert, and a fingerprint that survives IP churn. Our 31-min webinar is on demand. @security_score #STRIKE brighttalk.com/webcast/19566…
Asos says attackers got into a third-party platform holding customer contact data, then used the company's own app to push the extortion note to shoppers. Vendor risk isn't just data loss, it's your brand's voice. #TPRM #DataBreach techcrunch.com/2026/10/08/as…
Takedowns used to cost attackers weeks. Now one IP can host 10,000 domains, leased for as little as 3 hours. Gilad Maizles and I broke down how @security_score STRIKE unmasked CanOworms and what defenders should do now. #ThreatIntel securityscorecard.com/blog/c…
One self-signed TLS cert with "kickass" in it unraveled 633 proxy servers. That's CanOworms, the proxy-for-rent network @security_score STRIKE exposed. Here's what it means for third-party risk teams 🧵
That's why IP, geography and ASN reputation keep failing. One IP can host 10,000 domains, leased for as little as 3 hours. Blocklists go stale before they ship.
What to do: treat vendors, routers and IoT as entry points, assume supply chain exposure, and hunt past the listed IOCs. Full research: securityscorecard.com/blog/i… #ThreatIntel #TPRM
The question is no longer "Am I secure?" It's "Are all of my vendors secure?" Attackers exploit vendor ecosystems faster than assessment cycles can react. My take on why humans alone can't keep pace. 🎥 @security_score #TPRM securitysenses.com/videos/we…
The FBI says its jobs-site breach came from a platform managed by a third party, after a contractor missed a patch Oracle had already issued. Patch SLAs in vendor contracts mean nothing if nobody verifies them. #TPRM #ThreatIntel nextgov.com/cybersecurity/20…
Poisoned litellm 1.107.0 sat on PyPI for ~2 hours on Oct 21, built from a lookalike repo and stealing credentials. If your AI stack auto-pulls unpinned packages, that's a fourth party you never assessed. Pin, verify, rotate. #SupplyChain #AI docs.litellm.ai/blog/securit…
One stolen vendor app identity, 2,250+ Microsoft 365 tenants targeted at up to 2,900 sign-ins/min. MFA never came into play: the ConnectWise backup app already had the keys. Your vendor's OAuth grants are your attack surface. #TPRM #SupplyChain microsoft.com/en-us/security…
Your PHP2Shell exposure doesn't stop at your servers. Ask your hosting providers and MSPs today: Which PHP versions do you run? When do you patch? Which of our services share infrastructure with other customers? @security_score #TPRM securityscorecard.com/blog/s…
The retailer owns the food. A refrigeration contractor often installed the controller and holds the remote access. That's why the cold-chain attacks are a third-party inventory problem, not just a firewall finding. Our analysis w/ @ayampolskiy #TPRM securityscorecard.com/blog/h…
French reports say supermarket defrost settings were pushed to 50°C, at ~700 stores per France's Finance Minister. We used Driftnet to map 5,282 exposed Danfoss StoreView interfaces on 4,642 IPs. Exposure isn't compromise, but it's homework. #OT securityscorecard.com/blog/h…
#PHP2Shell by the numbers: Driftnet saw 7.67M IPs tagged PHP in 30 days. 2.7M advertised a version below the fix, but only 3,674 showed a fixed build. Patch the runtime, restart the workers, then verify. @security_score #ThreatIntel securityscorecard.com/blog/p…
Richard Hummel retweeted
Why every company needs a DDoS response plan - helpnetsecurity.com/2024/07/… - @NETSCOUT @MalwareAnalyzer #DDoS #Attacks #Strategy #Government #Cybercriminals #ThreatIntelligence #CyberSecurity #netsec #security #InfoSecurity #CISO #ITsecurity #CyberSecurityNews #SecurityNews
7M+ DDoS attacks were launched in the last 6 months of '23—and a number of them are politically motivated.
In this Global Data episode, three cybersecurity experts discuss concerns around the protection of voter data in the upcoming UK elections. spoti.fi/3LS6yhF
Venezuela's elections sparked protests after the president declared victory and the opposition disputed. ASERT identified a 10x increase in DDoS attacks on July 29, showing how political unrest can extend into the digital realm. netscout.link/6004YEVJ2 @NETSCOUT
After arresting 3 linked to NoName057(16), the group declared a "holy war" on Spain, rallying pro-Russian hackers. @NETSCOUT has seen a rise in attacks on Spanish websites, but daily DDoS attacks remain normal for Spanish network operators. netscout.link/6009cHbt1
