Daniel Gordon

25% off all courses, promo code ALLYALL and sale ends at midnight ET on 12/2

LIFTOFF! All my courses on networkdefense.io are 25% off until Tuesday, 12/2, at midnight ET 🚀

This is the only sitewide sale we do all year, and the cheapest you'll see these courses.

This event is for all y'all, so to get the discount, use code ALLYALL at checkout.

For software developers: there's currently a highly sophisticated hacking group targeting developers with backdoored coding skills tests. They typically take the form of large source codes specific to your skillset. Please email any suspicious code to me on: suspicious-skill-tests@protonmail.com
1/2

On the plus side, if you had to decided to go into law or politics this would have just been a normal Tuesday.

Honestly just being able to summarize the scale and current state of the issue in 25 minutes is a pretty significant achievement.

"A Pain in the Mist: Navigating Operation DreamJob’s arsenal" published by OrangeCyberdefense. #DreamJob, #MISTPEN, #UNC2970, #DPRK, #CTI https://www.orangecyberdefense.com/global/blog/cert-news/a-pain-in-the-mist-navigating-operation-dreamjobs-arsenal

Even ignoring all the practical challenges: marketing, researchers, customers/defenders and policy makers use threat group names differently. Standardization can’t really account for these different use cases very well.

Standards

The keynote from @dmitri.silverado.org was both a heartfelt apology but also basically this xkcd.com/927/ haha

This is a pretty wild evolution. Both the integration of cyber and kinetic and the fact IRGC and that MOIS might actually be working effectively together.

It was a pleasure to be a part of this event along with quite the cast of characters, including some folks who I’ve worked with over the years. Thank you to the organizers and their truly amazing promotional themes! See folks tomorrow at @cyberwarcon.bsky.social

BSides Pyongyang 🇰🇵 #BSidesPyongyang2025 :A free community cyber conference on Nov 18 2025 (Missile Industry Day) @ Lazarus HQ Pyongyang Roblox | 30th anniversary 🎂

Bsides Pyongyang starts in 15 minutes if the Cloudflare gods cooperate.
youtube.com/@bsidespyong...
m.twitch.tv/bsidespyongy...

At the end of the day in incident response, you may get accolades if you catch the attacker, but you will have the most impact if you have met the victim's needs. #infosec #dfir

I really enjoy when my research on unusual suspected state sponsored hacking groups is useful. *monkey paw curls*

Tax dollars?

Over the course of my career I’ve found and accomplished some pretty wild stuff. Next week I will be talking, for the first time, about one of the wildest things I ever found. The talk will be geared to analysts and practitioners but pretty sure this will be fascinating for everyone.

They dropped this in August which was better than I expected from an AI company. www.anthropic.com/news/detecti...

They’ve hired some established names in CTI.

I honestly don’t consider this recent report to be that extraordinary given the number of people trying to figure how to AI everything.

They’re sharper and more careful than I am though maybe I’m a low bar to clear

Lots of orgs redact IOCs, which I hate, but when you have only one method of detection, you don’t broadcast it for the adversary.

I believe you know security folks but you don’t know the CTI team or you wouldn’t be posting.

Why would they call a 3rd party about platform abuse? Also Bishop Fox wtf?

Cannot believe I’m defending an AI company but no 1,4,5 are not legit. Like not even slightly legit.

An org chart with R at the top, I’s and B’s at the second level and G’s and B’s on the third.

AI will do it for us!

Fixed 🙂

Something is broken in YARA for VirusTotal right now, signatures matching on things for no apparent reason.🫡 to any folks who have to clean up

Doesn’t look like DPRK to me, should probably give them your social security number

I don’t know. Not a lot of public info on that. In the current environment, I suspect they write a love letter, do a photo op, and build a hotel and get him back for free but 🤷‍♂️

If you defect, your family goes to a prison camp or worse.

*Screams incoherently at five different things about this that make no sense*

bsky.app/profile/vali...

A lot of “infrastructure geolocates to X, therefore state sponsored by X”. A lot of “major ransomware attack was to distract from an [unrelated] major espionage intrusion” and a lot of “I heard about something a couple times therefore growing trend”.

With that said I’ve certainly seen this kind of thing from western intel folks as well and spent way more time than I would like debunking grand conspiracy theories and wild unsupported attribution statements.

I know dunking on this is fun and all but if you watch the clip Christo is laughing and mocking this conspiracy theory he heard from Russian intel. I’ve heard stories about the terrible quality of Russian intel but this is bad.

Also I should note Christo is relaying Russian intel RUMINT rather than things he actually believes.