Mathew retweeted
Fresh @Mandiant and GTIG blog detailing zero day exploitation of CVE-2026-102764 in BeyondTrust Remote Support by 🇨🇳 nexus espionage actor ARMORY CASTLE (fka UNC5221).
cloud.google.com/blog/topics…
Mathew retweeted
🚨 SET YOUR ALARMS: #RooCon26 guest registrations open TOMORROW (1 Sep) @ 9:00 am AEST! ⏰
Join us 18–19 Nov at Google Sydney for deep technical threat intel, attribution, & adversary tradecraft.
🔗 Register Here Tomorrow:
rsvp.withgoogle.com/events/r…
Mathew retweeted
🚨 Only TWO weeks left to submit to the #RooCon26 CFP! 🚨
Got interesting research on threat intel, attribution, or adversary tradecraft? Share it in our high-trust, closed-door forum at Google Sydney (Nov 18-19).
👉 Submit: rsvp.withgoogle.com/events/r…
Mathew retweeted
🚨 The Call for Proposals for RooCon26 is officially OPEN! 🚨
We want your best talks on threat intel & attribution for Nov 18-19 at Google Sydney.
🔒 Strict closed-door policy (no recordings/streams)
📅 Closes: Aug 31
Submit now:
🔗 rsvp.withgoogle.com/events/r…
🚨🦘 @RooCon_AU is back for 2026! get those submissions ready!
Mathew retweeted
🦘RooCon is back! The 4th edition of RooCon26 is coming to Google Sydney on Nov 18-19!
RooCon is a free conference focused on cyber threat intelligence & attribution.
🔒 To encourage candid sharing, we are continuing our policy of no recording or streaming of talks.
Old technique, new zero-day
CVE-2026-5426 in KnowledgeDeliver is related to hardcoded machine keys enabling ViewState deserialization attacks. If you're a defender in APJ, but especially Japan, this may be relevant to you:
EN:
cloud.google.com/blog/topics…
JP:
cloud.google.com/blog/ja/top…
Mathew retweeted
🚨🚨🚨🇨🇳 Actors leveraging BRICKSTORM🚨🚨🚨
cloud.google.com/blog/topics…
Mathew retweeted
Our team at @Mandiant just published urgent research on an espionage campaign by China-nexus actors using the BRICKSTORM backdoor. They’ve been in victim networks undetected for over a year, targeting tech & legal sectors for IP theft and intel on US trade and national security.
Get your last minute submissions in!
🚨 Final reminder that RooCon25 CFP closes August 22, 2025!
🎟️ Details on guest registration is coming next week so stay tuned for updates! 🦘
🔗 Submit Your RooCon25 Talk at:
rsvp.withgoogle.com/events/r…
Mathew retweeted
🚨 Final reminder that RooCon25 CFP closes August 22, 2025!
🎟️ Details on guest registration is coming next week so stay tuned for updates! 🦘
🔗 Submit Your RooCon25 Talk at:
rsvp.withgoogle.com/events/r…
Mathew retweeted
🦘 RooCon25 Call for Papers is open! 🦘
This is your chance to share your latest insights and help us make RooCon25 the most successful edition to date! We’re waiting for submissions until 22nd of August.
Find the CFP submission link and the guidelines at rsvp.withgoogle.com/events/r…
Mathew retweeted
"GTIG assesses that UNC5221 will continue pursuing zero-day exploitation of edge devices based on their consistent history of success and aggressive operational tempo."
If you're not paying attention to this TA then I don't know what to tell you 🤷♂️
cloud.google.com/blog/topics…
Mathew retweeted
Fresh off the press today is a new blog detailing our observations from in the wild exploitation of CVE-2025-22457 by UNC5221 that includes two newly observed malware families tracked as BRUSHFIRE and TRAILBLAZE.
cloud.google.com/blog/topics…
Is there a ghost in your router? Our new blog outlines how #UNC3886 continues to deploy custom malware ecosystems for long-term access, this time targeting Juniper Networks’ Junos OS routers. 👻👻
@googlecloud cloud.google.com/blog/topics…