Principal Adversary Hunter @Dragosinc | Husband | Father | Zelda nerd | Frequently goes on the dark web to look at pictures of skeletons
Australia
Joined February 2018
- Tweets71
- Following642
- Followers90
- Likes186
Josh Hanrahan retweeted
INDUSTRY ALERT: Discover how VOLTZITE threat group (overlaps with Volt Typhoon) is targeting U.S. critical infrastructure. Download for exclusive insights → hubs.la/Q02nXPmz0 #ICSsecurity #OTsecurity #DragosIntel #VOLTZITE
Josh Hanrahan retweeted
So the #ScreenConnect vuln is pretty f'ing trivial - however, skids and shitheads that can't do vuln research didn't know that. Not disclosing POC quickly still affords end-users time to assess, test, and patch before the donkey show begins. #infosec
Josh Hanrahan retweeted
JUST RELEASED! Dragos's 2023 OT Cybersecurity Year in Review is now available! Discover the highlights from this year's report and download your free copy for the complete analysis! hubs.la/Q02lysYr0 #2023yearinreview #DragosIntel #ICSsecurity #OTsecurity
Big news in the cyber world: The world’s most prolific ransomware group has been disrupted because of an international investigation involving law enforcement agencies from 10 countries, including the @AusFedPolice.
38
Josh Hanrahan retweeted
I have a high level of confidence that the RAT they are talking about in the iSoon leak is #ShadowPad, the successor of PlugX, which is used by APT41 (leak: github.com/I-S00N/I-S00N/blo…)
C2: 118.31.3[.]116
References:
github.com/SentineLabs/Shado… malpedia.caad.fkie.fraunhofe…
Josh Hanrahan retweeted
The Chinese APT contractor leak contained a few interesting files; namely:
- CDRs (Call Detail Records)
- LBS (Location Based Services) db records
Threat actors compromise telcos with the aim to obtain subscriber metadata to support IC objectives.
Some background: (1/5)🧵
Josh Hanrahan retweeted
Interesting Thread on a massive dump from a Chinese 🇨🇳 Ministry of Public Security (MPS) private industry contractor called iSoon (aka Anxun)
Leak contains:
- Spyware
- Espionage Ops
- “Twitter Monitoring Platform”
- And a lot more 🔥
This is a crazy NTC Vulkan-level leak ⚠️
#threatintel
someone just leaked a bunch of internal Chinese government documents on GitHub
github.com/I-S00N/I-S00N/
Josh Hanrahan retweeted
📅 Next week, Dragos CEO @RobertMLee and @SANSICS host an Executive Briefing covering the most important OT cybersecurity events and lessons learned from 2023. Save your seat → hubs.la/Q02lbq8B0 #ICSsecurity #OTsecurity #2023yearinreview #industrialcybersecurity
What in the deep fried fuck is this shit?
Last year, CrowdStrike showed how the most infamous breach in history could have been stopped.
This year, step into the future and see how our unstoppable mix of generative AI and human expertise keeps us ahead of even the most relentless adversaries.
crwdstr.ke/6010VTIEk
63
Short blog post over on nocht.org about CTI program maturity tips. I originally presented this at BSides Brisbane 2022, and thought it was about time I put a high level overview of the talk up.
nocht.org/10-tips-to-transit…
59
Verifying myself: I am cyberbubbl3z on Keybase.io. OT1UJN17H1plSsOmHbd6aifHWSI0n0orsDMq / keybase.io/cyberbubbl3z/sigs…
56
Josh Hanrahan retweeted
Recommended for CTI Researchers analyzing the last year of cyber operations surrounding #Ukraine 🇺🇦
🔎 With the Help of Curated Intel member @SimulationKYLE, our curated Ukraine Cyber Operations repo has been updated with all pertinent threat reports!
github.com/curated-intel/Ukr…
Josh Hanrahan retweeted
SANS Difference Maker award nominations are up and out to a community vote. Some amazing folks and teams on here but selfishly go vote @hacks4pancakes and the @DragosInc intel team (or others honestly so many good folks)! survey.sans.org/jfe/form/SV_…
Josh Hanrahan retweeted
In cyber threat intel, group names are definitions. They are unique definitions on at least some unique telemetry - definitions and telemetry that are not shared publicly and rarely privately. Noting a link or overlap between groups is important. Pretending 1:1 mapping is off
Had a blast presenting at @Bsides_BNE. So great to see a big turnout of CTI focused talks. Big shoutouts to @forensicdave for being an A/V grandmaster, @beLarge for making sure everything ran smoothly, and @bman013 for putting in a mammoth effort to ensure the event was epic
Josh aka @cyberbubblez from @dragos - got everyone thinking about their crown jewels - at #bsidesbrisbane / @Bsides_BNE
4
Josh Hanrahan retweeted
Last chance to register! Learn the full scope of industrial cyber threats targeting ONG infrastructure in this exclusive webinar with @ISMG_News: buff.ly/3MDmZwU #oilandgasindustry #ICSsecurity #OTsecurity
