SLEUTHCON

At CYBERWARCON 2024, Zak Butler presented findings on how RT has evolved its tactics to continue spreading its narratives. Watch the full talk to see Zak Butler’s deeper investigation into these covert influence operations.

Watch here >> www.youtube.com/watch?v=ZPmL...

#cybersecurity #CYBERWARCON

Why are threat actors copying each other?

At #SLEUTHCON 2023, Joe Wise (Proofpoint) broke down how cybercriminals are ditching old tactics and copying what works, like HTML smuggling, to save time and stay effective.

More talks like this? Join us June 6 for #SLEUTHCON 2025!
🔗 sleuthcon.com

Sreekar Madabushi & Aleksandar Milenkoski joined us at SLEUTHCON 2025 to present their findings on how North Korean threat actors showed interest in Validin’s threat intel data.

Watch their full talk to learn more about what they found.

Full presentation >> www.youtube.com/watch?v=UxRQ...

At CYBERWARCON 2023, Kristin Del Rosso + Dakota Cary joined us to explain how China’s mandatory vulnerability reporting laws reshaped global cybersecurity.

Watch the full video here >>
www.youtube.com/watch?v=xbeR...

CYBERWARCON is returning Wed, November 19, 2025 in Arlington, VA + online.

The "Com" isn't simply a hacker group, it's an online phenomenon that has changed the cybercrime landscape in the past several years.

Allison Nixon shares more in this short clip from her SLEUTHCON 2025 talk with Ben Coon.

Watch the full talk here >> www.youtube.com/watch?v=TydZ...

🚨 Sponsorships are OPEN for CYBERWARCON 2025!

Spots are limited + interest is already high. Help us keep the event independent + accessible to the folks doing the work.

📍 Crystal City, VA
📅 Nov 19, 2025
📩 cyberwarcon.com

Let’s build something solid again this year.

CYBERWARCON is back! Save the date for Wednesday, November 19, 2025, in Arlington, VA + virtually.

Follow us to stay up to date for CFPs, volunteer opportunities + more!

Check out for more information + sponsorship opportunities >> www.cyberwarcon.com

Exciting news! Select SLEUTHCON 2025 talks are now live on our YouTube for you to watch!

Get a recap on some of your favorite talks from SLEUTHCON 2025, or watch the ones you missed!

Check them out here >> www.youtube.com/@sleuthcon

#SLEUTHCON #cybersecurity

What is Androxgh0st?

Alex Delamotte breaks it down in her SLEUTHCON talk from 2024. She also provides insights on how researchers can attribute tools in an open-source malware ecosystem

Check out this clip from her talk to learn more!

Full vid here > www.youtube.com/watch?v=iYTe...

A summer of security: empowering cyber defenders with AI Here’s what we’re announcing at cybersecurity conferences like Black Hat USA and DEF CON 33.

Google has just used AI and threat intel to foil a zeroday before it could launch. Working from artifacts gathered by GTIG, Big Sleep was used to identify a vuln before actors could ramp up exploitation. It doesn’t get much better than this in intel. blog.google/technology/s...

Legit remote admin tools are essential for IT teams, but cybercriminals are turning them into a serious threat.

Eric Loui explains how.

Check out this old #SLEUTHCON 2024 clip, and watch the full talk here >> www.youtube.com/watch?v=i0vP...

Crypters are the secret weapon cybercriminals use to hide their malware in plain sight. Bavi Sadayappan from Mandiant unpacks how these tools work & why they’re thriving in underground markets.

Check out this throwback from #SLEUTHCON 2024. View the full video here > www.youtube.com/watch?v=4pHe...

Four arrested by UK police over ransomware attacks on M&S, Co-op and Harrods Britain's National Crime Agency said police arrested one woman and three men suspected in ransomware attacks against major U.K. retailers.

Four UK arrests in Scattered Spider incidents. Suspects are 17 to 20 years old. therecord.media/uk-arrests-f...

At CYBERWARCON 2024, Matthieu Faou exposed Operation Texonto, a Russia-aligned information operation.

Watch his full talk here >> www.youtube.com/watch?v=X5lL...

Read the research here >> www.welivesecurity.com/en/eset-rese...

#CYBERWARCON #ThreatIntel #InformationOperations #Disinformation

A big thank you to all of our sponsors who made SLEUTHCON possible this year!

@vertexproject.bsky.social
@sentinelone.com
@domaintools.bsky.social
@crowdstrike.com
@teamcymrus2.bsky.social
@intel471.bsky.social
+ VMRay & Validin!

AT&T deploys new account lock feature to counter SIM swapping AT&T has launched a feature to help prevent SIM swapping and unauthorized account changes, offering added security for both individual and business wireless customers.

Great feature rolled out by AT&T. SIM swapping is consistently used by Scattered Spider and other actors to defeat MFA. cyberscoop.com/att-wireless...

Stay connected with us! You can find our other socials below.

Website: sleuthcon.com
YouTube: youtube.com/@sleuthcon
Twitter: x.com/SLEUTHCON
Linkedin: linkedin.com/company/sleu... pic.x.com/gyQfZ2MGj9

Table ronde Ransomware : regards croisés sur un écosystème inédit (en anglais) Lors de cette table ronde animée par Valéry Rieß-Marchive, les experts Jon DiMaggio, d'Analyst1, et Allan Liska, de Recorded Future, partagent leurs analyses sur les importants bouleversements survenu...

At SLEUTHCON, Allan Liska & Jon DiMaggio hosted the only gameshow where we ask: Is it ransomware? From CL0P to Pay2Key, they broke it all down.

They recently joined LeMagIT to discuss how the ransomware ecosystem keeps evolving. You can watch it here:
www.brighttalk.com/webcast/1953...

AkiraBot | AI-Powered Bot Bypasses CAPTCHAs, Spams Websites At Scale AkiraBot uses OpenAI to generate custom outreach messages to spam chat widgets and website contact forms at scale.

This year at #SLEUTHCON, Alex Delamotte + Jim Walter joined us to share details on AkiraBot, a Python framework used to promote a low-quality SEO service by spamming website chats and contact forms.

Read their full report from @sentinellabs.bsky.social here www.sentinelone.com/labs/akirabo...

YouTube video by SLEUTHCON How eCrime Adversaries Use Legitimate Remote Management Tools | SLEUTHCON 2024

Google TAG warns of attacks on U.S. insurance firms resembling Scattered Spider tactics.

“The insurance industry should be on high alert.” — @hultquist.bsky.social, founder of SLEUTHCON + CYBERWARCON

Check out Eric Loui’s 2024 talk that covers Scattered Spider activity: youtu.be/i0vPoKc9jG0

Google's @hultquist.bsky.social says in an emailed statement that the company is seeing "multiple intrusions in the US" that bear the hallmarks of Scattered Spider activity and "now seeing incidents in the insurance industry." Google spox. confirmed there's more than one U.S.-based insurance victim.

Select talks from past SLEUTHCONs are up and ready for you to watch on our YouTube channel.

Check them out + subscribe so you're one of the first to know when talks from this year are available. 🐍

www.youtube.com/@sleuthcon

#cybersecurity #cybercrime #SLEUTHCON

SLEUTHCON 2025 was another great year!!

If you want to stay up to date with us and content from the conference, make sure you follow us here 🐍

We're also on LinkedIn, Twitter, and YouTube!

LinkedIn >> t.co/d4QhWZ5HZJ
Twitter >> x.com/SLEUTHCON
YouTube >> t.co/0c9YpKw6ED

The talk from @nixonnixoff.bsky.social last Friday that is covered here is the one that scared the shit out of me as a parent.

Internet infamy drives The Com's crime sprees Unit 221B’s Allison Nixon said crackdowns have effectively shown the group that their actions carry real consequences.

Recent press highlights from SLEUTHCON:

Covering Allison Nixon's talk on "The Com":
cyberscoop.com/the-com-subc...

Highlights from Thibault Seret's talk:
www.wired.com/story/cyberc...

#Cybercrime #Cybercriminals #cybersecurity #SLEUTHCON

We appreciate you!

We're so glad you had a good time!! Thanks so much for coming and hanging out :)

Thank you to our sponsors!
@vertexproject.bsky.social @sentinelone.com @domaintools.bsky.social @crowdstrike.com @teamcymrus2.bsky.social @intel471.bsky.social

Mapping Hidden Alliances in Russian-Affiliated Ransomware - DomainTools Investigations | DTI Explore the hidden web of Russian-affiliated ransomware groups through a visual map revealing human overlaps, shared infrastructure, and evolving cybercriminal alliances in the post-Conti era

ICYMI, y'day my boss/CISO Daniel Schwalbe co-spoke with Jon DiMaggio at SLEUTHCON on the human realities of the RU-affiliated ransomware landscape & how it should evolve our investigative and disruption efforts.

#infosec #cybersecurity #threatintel #ransomware

dti.domaintools.com/mapping-hidd...

Internet infamy drives The Com's crime sprees Unit 221B’s Allison Nixon said crackdowns have effectively shown the group that their actions carry real consequences.

The Com’s chaotic, sprawling network, composed of mostly teenagers and young adults, are committing their crimes primarily for notoriety amongst their peers on the internet,
@nixonnixoff.bsky.social said during a presentation @sleuthcon.bsky.social. cyberscoop.com/the-com-subc...