VP Labs, Threat Research & Intel @AWNetworks ▪️ SANS Author & Senior Instructor #GSE 132 ▪️ #SEC530 #ThinkRedActBlue @TheMondayBrief
Malaga, Spain 🛫 NYC-NJ, USA🗽
Joined June 2009
- Tweets7.1K
- Following9.2K
- Followers18.3K
- Likes15.2K
Pinned Tweet
🔥 Amazing day at the @SANSInstitute #AISummit 2026.
I had the chance to join the SANS360 lightning talks. 10 practitioners, 6 minutes each. No fluff.
My message was simple: #AI is collapsing prevention time, but time-based security still holds. Speed doesn’t make these attacks smarter. In fact, it often makes them more fragile.
To show how #AllAroundDefenders can flip the script, today we introduced #Decipio, our latest community project from the @AWNetworks Labs team.
#Decipio injects controlled “lies” into the environment to expose credential theft the moment it begins. It also applies automation and AI-assisted workflows defensively, creating a home-field advantage for defenders.
To protect the #cyberdefense community, we decided to release Decipio as a gated, community-driven release.
👉 You can start requesting access today through our website, and learn more about it in our latest blog:
🔹 arcticwolf.com/decipio/
🔹 arcticwolf.com/resources/blo…
#CyberDefense #AI #ThinkRedActBlue
Ismael Valenzuela retweeted
$600,000 in tokens over three weeks, from an agent that handed over its own API key. The METR incident is a visibility problem first. @aboutsecurity, walks through the METR incident and three visibility challenges for AI agents, in @TheHackersNews: thehackernews.com/2026/09/ze…
ALT A digital banner with a blue abstract background. The text reads: "The Hacker News: Zero Trust for AI Agents Starts With Fixing Zero Visibility by Ismael Valenzuela, SANS Senior Instructor." The SANS logo is displayed in the lower right corner.
The answer to life, the universe, and cybersecurity this week is 4 🧛♂️
Best sticker at @unpromptedconf
[un]prompted II kicking off at The Hibernia in SF with @gadievron
Who else is around at @unpromptedconf this week?
w/ @SANSInstitute @AWNetworks
Ismael Valenzuela retweeted
What starts as a seemingly legitimate judicial notice can quickly turn into full remote access. Check out the technical details in our new Arctic Wolf Pack Alert: bit.ly/4zNpZPA
#PHP2Shell has a working public exploit, but it's tailored to PHP 8.4.26 on Alpine Linux with a specific server setup.
As we've said all week: working RCE != reliable mass exploitation.
As every Monday morning, @fulmetalpackets & I discuss it in the latest issue of @TheMondayBrief:
themondaybrief.substack.com/…
#ThreatResearch #CyberSecurity #ThinkRedActBlue
🤖 Made with AI
Ismael Valenzuela retweeted
No, we don’t think AI is going to kill us all.
Plugin4Shell and OpenAI’s latest reports give us plenty to talk about: code that doesn’t match the approved commit, unauthorized credential use, and instructions to conceal mistakes.
Also in this week’s @TheMondayBrief: Cisco ISE under active exploitation, and why FamousSparrow’s targeting of Latin American governments should have you looking at geopolitics when setting your intelligence priorities.
@aboutsecurity and @fulmetalpackets get into all of it below👇
themondaybrief.substack.com/…
#Cybersecurity #AgenticAI #ThinkRedActBlue
Ismael Valenzuela retweeted
Arctic Wolf Labs is tracking an active widescale Russian-origin ClickFix campaign that uses a Ukrainian-language fake Cloudflare CAPTCHA to deliver an infostealer that collects browser credentials, wallet data, and supports persistent remote tasking: bit.ly/4iuItiq
Ismael Valenzuela retweeted
AW Labs discovered a procurement-themed phishing campaign targeting organizations in Europe using a layered delivery chain featuring HTA, PowerShell, JavaScript, and Lua-based execution to evade detection and deploy an in-memory infostealer: bit.ly/4AkkQQb
Ismael Valenzuela retweeted
⚡ Billions of tokens. Millions of requests.
U.S. agencies accuse China-based AI firms of using industrial-scale distillation to extract capabilities from Claude, GPT, Gemini, and Grok.
How the campaigns hid their access: thehackernews.com/2026/09/us…
I have to admit that I had a lot of fun with my latest @SANSInstitute webcast. I even built a couple of cinematic demos showing an attacker hijacking an AI agent’s intent and turning its legitimate access against you.
The Agentic SOC: Defending With, and Against, Autonomous AI.
Slides + recording 👇
ismaelvalenzuela.com/talks/a…
#AgenticAI #ThinkRedActBlue #ZeroTrust
Ismael Valenzuela retweeted
⏳ Don't miss The Agentic SOC: Defending With, and Against, Autonomous AI today at 3 PM GST.
Join SANS Senior Instructor @aboutsecurity to explore how adversaries are weaponising autonomous agents and how defenders can secure agentic AI.
Register free 👉 go.sans.org/LTbBqd
Ismael Valenzuela retweeted
“Hi, this is IT.”
Sometimes that’s all it takes to get handed the keyboard.
This week: fake IT support on Teams, a hijacked Terraform registry, PostgreSQL privilege abuse and targeted spyware. What happened, why it matters, and what to do, by @aboutsecurity & @fulmetalpackets
themondaybrief.substack.com/…
#Cybersecurity #TheMondayBrief #ThreatIntelligence #ThinkRedActBlue
🤖 Made with AI
Ismael Valenzuela retweeted
Today's Pack Alert: Arctic Wolf observed a large-scale Fortinet VPN credential access campaign targeting hundreds of organizations, using organization-specific identities and infrastructure linked to confirmed malicious access.
Learn more: bit.ly/4gzLDQx
Ismael Valenzuela retweeted
New Monday Brief, by @aboutsecurity and @fulmetalpackets
1⃣@OpenAI postmortem on the @huggingface intrusion.
2⃣The @FBI seizure that left QScan and QTRouter inoperable.
3⃣Two more factory implants in white-label ZBT routers.
4⃣The TeamPCP arrests.
Four incidents where the facts were available long before the conclusion was 👇
themondaybrief.substack.com/…
Ismael Valenzuela retweeted
🐺 Introducing Pack Alert: our newest way to share timely threat research. AW Labs researchers recently observed malicious GitHub repositories that use redirects to fingerprint a visitor's device before delivering a payload built for that platform: bit.ly/4wVNsMD
Dark Caracal is back in LatAm with new tricks.
@AWNetworks Labs uncovered GoCaracal: a modular Go framework with a lightweight foothold implant + a 34-handler RAT. Ethereum smart contract as C2 fallback (yes, it's called "BulletproofC2"). Deployed alongside an updated Bandook built to burn old signatures.
249 samples. 23 of 24 C2s on AEZA.
Full analysis, YARA + IOCs:
arcticwolf.com/resources/blo…
#ThreatIntel #DarkCaracal #ThinkRedActBlue
Ismael Valenzuela retweeted
🤖 AI agents are changing the SOC, but greater autonomy brings new security challenges.
Join SANS Senior Instructor @aboutsecurity for our webcast exploring how to defend with, and against, autonomous AI.
📅 8 September
⏰ 3 PM GST
Register free 👉 go.sans.org/LTbBqd
Ismael Valenzuela retweeted
Huge thanks to @dimitribest for the chance to present together at #BlackHatUSA 2026! Your experience, expertise, and support made this whole thing possible.
Massive shout-out to the organizers #BlackHatUSA for picking our topic. The conference was held at the highest level.
@vkamluk , thank you for your patience and all the hard work you put into coaching us. Your energy and help really came through in the presentation.
Big thanks to @aboutsecurity and Jamie Butler for jumping in and helping us.
And of course, Arctic Wolf Labs (@AWNetworks) — thank you for the support and help.
Thanks to @Bloomberg for covering our latest @AWNetworks #LightSpy research: a Chinese-built #spyware platform operating in more than 13 countries, with 117 servers, router implants across Europe and Africa, pricing tiers, billing infrastructure, even a demo environment for prospective buyers. Surveillance sold as a product, complete with customer service.
The best detail: an operator used the platform's own billing infrastructure to order KFC, leaving his real name and office address behind. Even nation-state operators get hungry. This one's OPSEC was finger lickin' bad 🍗
Full story: bloomberg.com/news/articles/…
#ThreatIntelligence #LightSpy #Spyware #BlackHat2026 #ArcticWolf
Ismael Valenzuela retweeted
25+ years in this field and the findings have not changed: weak passwords, no network isolation, exposed services nobody inventoried.
What changed this week is who found them. Anthropic's own AI models breached three real companies from a test sandbox. A vishing crew went from a Teams call to ransomware in 17 hours. Someone edited water PLC safety logic in seven states with the vendors' own engineering tools.
None of them needed an exploit, because the basics were already broken.
Think Red by @fulmetalpackets. Act Blue by @aboutsecurity.
themondaybrief.substack.com/…
#CyberSecurity #ThreatIntelligence #OTSecurity #BlueTeam #InfoSec #SOC #Ransomware
🤖 Made with AI
