/
Navigation
C
Chronicles
Browse all articles
C
E
Explore
Semantic exploration
E
R
Research
Entity momentum
R
N
Nexus
Correlations & relationships
N
~
Story Arc
Topic evolution
S
Drift Map
Semantic trajectory animation
D
P
Posts
Analysis & commentary
P
Browse
@
Entities
Companies, people, products, technologies
Domains
Browse by publication source
Handles
Browse by social media handle
Detection
?
Concept Search
Semantic similarity search
!
High Impact Stories
Top coverage by position
+
Sentiment Analysis
Positive/negative coverage
*
Anomaly Detection
Unusual coverage patterns
Analysis
vs
Rivalry Report
Compare two entities head-to-head
/\
Semantic Pivots
Narrative discontinuities
!!
Crisis Response
Event recovery patterns
Connected
Nav: C E R N
Search: /
Command: ⌘K
Embeddings: large
VOICE ARCHIVE

Nick Carr

@itsreallynick
21 posts
2025-10-27
This seems odd
2025-10-27 View on X
PCMag

X prompts users to re-enroll their security keys for 2FA, and will lock accounts that are not updated by Nov. 10, allowing it to retire the Twitter.com domain

If you're using a hardware security key as your two-factor authentication (2FA) method on X, you'll need to re-enroll by Nov. 10 or your account will be locked.

2025-10-19
@cyb3rops Giant grain of 🧂 and if true, valid point espionage target (vs corporate intellectual property theft 😂) but I'm pretty certain China's national time center runs their network time protocol (NTP) and it's particularly vulnerable based on how isolated their infra is (Great
2025-10-19 View on X
Bloomberg

China says the NSA has been hacking its National Time Service Center, which provides high precision time services for the government and others, since 2023

China said it's uncovered “irrefutable evidence” of US government cyber attacks on the country's main agency responsible for timekeeping.

2023-12-30
“Since mid-November 2023, Microsoft Threat Intelligence has observed threat actors, including financially motivated actors like Storm-0569, Storm-1113, Sangria Tempest, and Storm-1674, utilizing the ms-appinstaller URI scheme (App Installer) to distribute malware.” this one has a fascinating operational timeline
2023-12-30 View on X
XDA Developers

Microsoft disables Windows App Installer's ms-appinstaller after the URI scheme was used to spread malware; Microsoft disabled and re-enabled the scheme in 2022

While I was there this was used to deliver malware and had no basic security thought put into it, so they disabled the feature.  —  After I left they reenabled it, it got misused f...

2023-12-15
Watching the drastic impacts in real-time as the servers came down 🤌 Read more: https://blogs.microsoft.com/ ... [image]
2023-12-15 View on X
Wired

How Microsoft's 10-year-old Digital Crime Unit uses unique legal tactics and the company's technical reach to disrupt global cybercrime and state-backed actors

Ten years in, Microsoft's DCU has honed its strategy of using both unique legal tactics and the company's technical reach …

Watching the drastic impacts in real-time as the servers came down 🤌 Read more: https://blogs.microsoft.com/ ... [image]
2023-12-15 View on X
CyberScoop

Microsoft seizes US-based infrastructure and websites used by cybercrime group Storm-1152 that created ~750M fraudulent Microsoft accounts, after a court order

2023-12-14
Watching the drastic impacts in real-time as the servers came down 🤌 Read more: https://blogs.microsoft.com/ ... [image]
2023-12-14 View on X
CyberScoop

Microsoft seizes US-based infrastructure and websites used by cybercrime group Storm-1152 that created ~750M fraudulent Microsoft accounts, after a court order

Relying on a court order, the tech giant seized websites belonging to a top purveyor of fraudulent Microsoft accounts.

2023-12-09
Phishing campaigns are just marketing campaigns with different outcomes [image]
2023-12-09 View on X
Wall Street Journal

The US and the UK accuse Russia's FSB of orchestrating a global hacking campaign since 2015 to interfere in UK elections and target US energy networks and spies

2023-12-08
Phishing campaigns are just marketing campaigns with different outcomes [image]
2023-12-08 View on X
Wall Street Journal

The US and the UK accuse Russia's FSB of orchestrating a global hacking campaign since 2015 to interfere in UK elections and target US energy networks and spies

The cyberattacks also allegedly took aim at U.S. energy networks and American spies  —  LONDON—The U.S. and U.K. governments …

2023-10-27
These red teamers are getting out-of-hand [image]
2023-10-27 View on X
BleepingComputer

Microsoft publishes a profile of Octo Tempest, a “dangerous” hacking group targeting organizations across tech, gaming, financial services, and other sectors

Microsoft has published a detailed profile of a native English-speaking threat actor with advanced social engineering capabilities …

Behind some of the most disruptive attacks of 2023, you will find recon, social engineering, and sometimes extortion - applied at all layers of the intrusion by Octo Tempest: https://aka.ms/... Rapidly innovative & highly-adaptive. They are watching defenders and learning. [image]
2023-10-27 View on X
BleepingComputer

Microsoft publishes a profile of Octo Tempest, a “dangerous” hacking group targeting organizations across tech, gaming, financial services, and other sectors

Microsoft has published a detailed profile of a native English-speaking threat actor with advanced social engineering capabilities …

2023-08-30
Qakbot operators built their threat model around their moms finding their secret files. 🤣 [image]
2023-08-30 View on X
BleepingComputer

The FBI led an effort to dismantle the Qakbot botnet, which ransomware gangs used as an infection vector for years, on August 25 after infiltrating its network

It was live on 700k endpoints (!) which should give you an idea of the scale of cybersecurity woes at many orgs (it's still really, really bad out there). X: Nick Carr / @itsreally...

payments.txt - seemed like a good idea at the time 😅 [image]
2023-08-30 View on X
BleepingComputer

The FBI led an effort to dismantle the Qakbot botnet, which ransomware gangs used as an infection vector for years, on August 25 after infiltrating its network

It was live on 700k endpoints (!) which should give you an idea of the scale of cybersecurity woes at many orgs (it's still really, really bad out there). X: Nick Carr / @itsreally...

2022-04-28
“Starting just before the invasion, we have seen at least six separate Russia-aligned nation-state actors launch more than 237 operations against Ukraine - including destructive attacks that are ongoing and threaten civilian welfare” 🇺🇦📰 Special Report: https://blogs.microsoft.com/ ...
2022-04-28 View on X
Microsoft On the Issues

Microsoft says at least six Russia-aligned actors launched 237+ cyberattacks against Ukraine from Feb. 23 to Apr. 8, including ~40 threatening civilian welfare

Tom Burt / Microsoft On the Issues :

2022-04-08
The dualities of U.S.-Ukraine relations through the lens of cyber crime: “There is some irony, that the nation you were plundering is now leading an international effort to protect your country, your people, your family” - Judge sentencing a #FIN7 operator https://www.justice.gov/... https://twitter.com/...
2022-04-08 View on X
CyberScoop

US judge sentences Denys Iarmak, a Ukrainian and member of the FIN7 hacking group, to five years in prison; FIN7 has stolen 20M+ credit card numbers since 2015

Denys Iarmak, a high-level member of the criminal hacking group FIN7, was sentenced to five years in prison today by a U.S. judge.

2022-01-17
When our awesome #MSTIC Russia team discovered this event unfolding in real-time 🤯, here was our crime triage on how DEV-0586's destructive malware differs from 𝘵𝘺𝘱𝘪 𝘤𝘢𝘭 human-operated ransomware. “Ransom” note in the blog: https://www.microsoft.com/... - anything we missed? https://twitter.com/... https://twitter.com/...
2022-01-17 View on X
Microsoft Security Blog

Microsoft identifies a destructive malware operation targeting Ukrainian organizations; the malware looks like ransomware but lacks a ransom recovery mechanism

European Union simulated a cyber attack on a fictitious Finnish power company Vilius Petkauskas / cybernews.com : Belarus state hackers suspected behind Ukraine cyberattack Grugq /...

2021-10-30
12 suspects interrogated & assets seized in an 8 country @Europol operation. Threat actors were running Cobalt Strike / Empire C2 - deploying LockerGoga, MegaCortex, and Dharma ransomware deployment - and mixing/laundering cryptocurrency. https://twitter.com/...
2021-10-30 View on X
The Record

Europol says it has detained 12 suspects for orchestrating ransomware attacks that hit 1,800+ victims across 71 countries since 2019

Catalin Cimpanu / The Record :

2021-10-29
12 suspects interrogated & assets seized in an 8 country @Europol operation. Threat actors were running Cobalt Strike / Empire C2 - deploying LockerGoga, MegaCortex, and Dharma ransomware deployment - and mixing/laundering cryptocurrency. https://twitter.com/...
2021-10-29 View on X
The Record

Europol says it has detained 12 suspects that were orchestrating ransomware attacks that hit 1,800+ victims across 71 countries since 2019

Europol said it detained 12 suspects this week it believes were part of a professional criminal group that orchestrated a long string of ransomware attacks … Source: Europol .

2021-01-20
🪙 On #GoldenSAML remediation: • Rotate the token-signing AD FS certificate in rapid succession twice 👉If only rotated once, a copy of the previous [compromised?] certificate will still be resident in Azure AD, and can still be used to forge SAML tokens https://www.fireeye.com/... https://twitter.com/...
2021-01-20 View on X
ZDNet

FireEye releases a free tool that audits networks to determine whether certain techniques, known to be employed by SolarWinds hackers, were used

Focusing on UNC2452 TTPs Lily Hay Newman / Wired : The SolarWinds Hackers Used Tactics Other Groups Will Copy Zeljka Zorz / Help Net Security : Malwarebytes was breached by the Sol...

2020-10-13
Two-part approach: • court order • technical action with ISPs Result: “We have now cut off key infrastructure so those operating Trickbot will no longer be able to initiate new infections or activate ransomware already dropped into computer systems.” https://blogs.microsoft.com/ ...
2020-10-13 View on X
ZDNet

Microsoft, Symantec, ESET, and other tech companies orchestrated an attempt to take down the TrickBot malware botnet, which had infected 1M+ computers

FS-ISAC, ESET, Lumen's Black Lotus Labs, NTT, Symantec, and the Microsoft Defender team participated in the takedown.

2020-10-12
Two-part approach: • court order • technical action with ISPs Result: “We have now cut off key infrastructure so those operating Trickbot will no longer be able to initiate new infections or activate ransomware already dropped into computer systems.” https://blogs.microsoft.com/ ...
2020-10-12 View on X
ZDNet

A coalition of tech companies, including Microsoft and Symantec, orchestrated a takedown of the TrickBot malware botnet, which had infected 1M+ computers

FS-ISAC, ESET, Lumen's Black Lotus Labs, NTT, Symantec, and the Microsoft Defender team participated in the takedown.