CYBERWARCON

Russia-affiliated Secret Blizzard conducting ongoing espionage against embassies in Moscow A new Microsoft report finds that the long-running threat group has gained positions on state-aligned ISPs and Russian telecoms, while tricking foreign embassy staff to download custom malware.

A new Microsoft report finds that the long-running threat group has gained positions on state-aligned ISPs and Russian telecoms, while tricking foreign embassy staff to download custom malware. via @mattkapko.com cyberscoop.com/russia-secre...

At CYBERWARCON 2024, Zak Butler presented findings on how RT has evolved its tactics to continue spreading its narratives. Watch the full talk to see Zak Butler’s deeper investigation into these covert influence operations.

Watch here >> www.youtube.com/watch?v=ZPmL...

#cybersecurity #CYBERWARCON

Sreekar Madabushi & Aleksandar Milenkoski joined us at SLEUTHCON 2025 to present their findings on how North Korean threat actors showed interest in Validin’s threat intel data.

Watch their full talk to learn more about what they found.

Full presentation >> www.youtube.com/watch?v=UxRQ...

CYBERWARCON is back! Save the date for Wednesday, November 19, 2025, in Arlington, VA + virtually.

Follow us to stay up to date for CFPs, volunteer opportunities + more!

Check out for more information + sponsorship opportunities >> www.cyberwarcon.com

UNC512 targeted a Ukrainian drone operator using a phishing doc + missed calls to trigger a custom malware chain. From Google Forms to GitHub, this was frontline cyber espionage.

Watch the full CYBERWARCON 2024 talk w/ Dan Black + Anton Prokopenkov
www.youtube.com/watch?v=0DMS...

At CYBERWARCON 2023, Kristin Del Rosso + Dakota Cary joined us to explain how China’s mandatory vulnerability reporting laws reshaped global cybersecurity.

Watch the full video here >>
www.youtube.com/watch?v=xbeR...

CYBERWARCON is returning Wed, November 19, 2025 in Arlington, VA + online.

The "Com" isn't simply a hacker group, it's an online phenomenon that has changed the cybercrime landscape in the past several years.

Allison Nixon shares more in this short clip from her SLEUTHCON 2025 talk with Ben Coon.

Watch the full talk here >> www.youtube.com/watch?v=TydZ...

🚨 Sponsorships are OPEN for CYBERWARCON 2025!

Spots are limited + interest is already high. Help us keep the event independent + accessible to the folks doing the work.

📍 Crystal City, VA
📅 Nov 19, 2025
📩 cyberwarcon.com

Let’s build something solid again this year.

CYBERWARCON is back! Save the date for Wednesday, November 19, 2025, in Arlington, VA + virtually.

Follow us to stay up to date for CFPs, volunteer opportunities + more!

Check out for more information + sponsorship opportunities >> www.cyberwarcon.com

Exciting news! Select SLEUTHCON 2025 talks are now live on our YouTube for you to watch!

Get a recap on some of your favorite talks from SLEUTHCON 2025, or watch the ones you missed!

Check them out here >> www.youtube.com/@sleuthcon

#SLEUTHCON #cybersecurity

@hultquist.bsky.social caught red handed at Coldplay with @thekrebscycle.bsky.social board...

Stay tuned to find out when you can get your own board this year.

Did you know there are over 50 #CYBERWARCON talks public on our YouTube, ready for you to watch RIGHT NOW?

Learn something new, or rewatch one of your favorites.

Check them out here: www.youtube.com/@cyberwarcon

Let us know what some of your favorite talks are below!

Legit remote admin tools are essential for IT teams, but cybercriminals are turning them into a serious threat.

Eric Loui explains how.

Check out this old #SLEUTHCON 2024 clip, and watch the full talk here >> www.youtube.com/watch?v=i0vP...

A summer of security: empowering cyber defenders with AI Here’s what we’re announcing at cybersecurity conferences like Black Hat USA and DEF CON 33.

Google has just used AI and threat intel to foil a zeroday before it could launch. Working from artifacts gathered by GTIG, Big Sleep was used to identify a vuln before actors could ramp up exploitation. It doesn’t get much better than this in intel. blog.google/technology/s...

We (@gabagool.ing - AKA gabbot) and I updated this with some more recent tomfoolery from this group.

They continued the ASP campaign with evidence they responded to our initial publication.

They were doing some sneaky calendar stuff that lead to adding a device to the target's O365 tenant.

At CYBERWARCON 2024, Matthieu Faou exposed Operation Texonto, a Russia-aligned information operation.

Watch his full talk here >> www.youtube.com/watch?v=X5lL...

Read the research here >> www.welivesecurity.com/en/eset-rese...

#CYBERWARCON #ThreatIntel #InformationOperations #Disinformation

PRC hacker in custody. The USG has been trying to make this happen for a very long time. This won't break Chinese cyberespionage but it might damage their talent pipeline. 1/x

A big thank you to all of our sponsors who made SLEUTHCON possible this year!

@vertexproject.bsky.social
@sentinelone.com
@domaintools.bsky.social
@crowdstrike.com
@teamcymrus2.bsky.social
@intel471.bsky.social
+ VMRay & Validin!

We don’t have an exact date yet, but will be announcing soon!

Make sure you stay connected with us so that you don't miss any announcements or updates!

Website: www.cyberwarcon.com
YouTube: youtube.com/@cyberwarcon...
Twitter: x.com/CYBERWARCON
Linkedin: www.linkedin.com/company/cybe...

#CYBERWARCON #cybersecurity

Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets This report uncovers a set of related threat clusters linked to PurpleHaze and ShadowPad operators targeting organizations, including cybersecurity vendors.

At CYBERWARCON 2023, Aleksandar Milenkoski & Tom Hegel shared DPRK threat actor insights.

They back with new research, tracking a China-nexus cyberespionage campaign hitting global orgs (PurpleHaze & ShadowPad clusters).

www.sentinelone.com/labs/follow-...

#APT #cyberespionage #cybersecurity

The People's Liberation Army Cyberspace Force Established in 2024, the People's Liberation Army Cyberspace Force merges cyber and electronic warfare to disrupt, deter, and dominate in future conflicts.

Good backgrounder on the PLA Cyberspace Force, the successor to the Strategic Support Force (which succeeded 3PLA). greydynamics.com/the-peoples-...

In 3 days a slick new UK edition of Sandworm comes out with a new cover and new foreword: www.amazon.co.uk/Operation-Sa...

The publisher has tweaked the title to "Operation Sandworm" for UK reasons I don't entirely understand, but it's the same book, and hopefully will now reach a new audience.

In light of the cooling situation in the Middle East, a reminder that critical infrastructure is already under attack, and the threat actors have not gone away. We are still responding to Scattered Spider activity.

Operation Texonto: Information operation targeting Ukrainian speakers in the context of the war ESET Research discovers Operation Texonto, a disinformation/psychological operations (PSYOPs) campaign that uses spam emails to demoralize Ukrainian citizens with disinformation messages about war-rel...

ESET’s Matthieu Faou exposed “Operation Texonto”, a pro-Russian disinformation operation aimed at Ukrainian speakers. He shared the full breakdown at #CYBERWARCON.

Watch his talk >> www.youtube.com/watch?v=X5lL...

Read the research >> www.welivesecurity.com/en/eset-rese...

#IO #Cybersecurity

Table ronde Ransomware : regards croisés sur un écosystème inédit (en anglais) Lors de cette table ronde animée par Valéry Rieß-Marchive, les experts Jon DiMaggio, d'Analyst1, et Allan Liska, de Recorded Future, partagent leurs analyses sur les importants bouleversements survenu...

At SLEUTHCON, Allan Liska & Jon DiMaggio hosted the only gameshow where we ask: Is it ransomware? From CL0P to Pay2Key, they broke it all down.

They recently joined LeMagIT to discuss how the ransomware ecosystem keeps evolving. You can watch it here:
www.brighttalk.com/webcast/1953...

YouTube video by CYBERWARCON Adversarial Targeting of Critical Infrastructure Linchpins - Intent, Motivation, and Effects

At CWC24, Kyle O'Meara + Casey Brooks shared info on CyberAv3ngers and more groups that attack critical infrastructure. Andy Greenberg dives deeper into this group in his article from April.

Watch here: www.youtube.com/watch?v=h15i...

Read the article here: www.wired.com/story/cybera...

There are gonna be a lot of hot takes in the next couple of weeks suggesting extraordinary Iranian cyber capability. For a grounded, contemporary view of their capability and limitations check out this report on activity in Israel following Oct 7. 1/x blog.google/technology/s...

YouTube video by CYBERWARCON Domain of Deception: How China's GLASSBRIDGE Campaign Manipulates the Web

Vanessa Molter shared a talk on GLASSBRIDGE, a group of 4 companies that push pro-PRC narratives by operating networks of inauthentic news sites & newswire services.

Talk here >>> www.youtube.com/watch?v=Pl9w...

Here research here >>> cloud.google.com/blog/topics/...

Select talks from past SLEUTHCONs are up and ready for you to watch on our YouTube channel.

Check them out + subscribe so you're one of the first to know when talks from this year are available. 🐍

www.youtube.com/@sleuthcon

#cybersecurity #cybercrime #SLEUTHCON