/
Navigation
C
Chronicles
Browse all articles
C
E
Explore
Semantic exploration
E
R
Research
Entity momentum
R
N
Nexus
Correlations & relationships
N
~
Story Arc
Topic evolution
S
Drift Map
Semantic trajectory animation
D
P
Posts
Analysis & commentary
P
Browse
@
Entities
Companies, people, products, technologies
Domains
Browse by publication source
Handles
Browse by social media handle
Detection
?
Concept Search
Semantic similarity search
!
High Impact Stories
Top coverage by position
+
Sentiment Analysis
Positive/negative coverage
*
Anomaly Detection
Unusual coverage patterns
Analysis
vs
Rivalry Report
Compare two entities head-to-head
/\
Semantic Pivots
Narrative discontinuities
!!
Crisis Response
Event recovery patterns
Connected
Nav: C E R N
Search: /
Command: ⌘K
Embeddings: large
VOICE ARCHIVE

Thaddeus E. Grugq

@thegrugq
130 posts
2025-06-18
What is the air speed of an unladen Predatory Sparrow?
2025-06-18 View on X
CyberScoop

A cyberattack claimed by pro-Israel hacktivist group Predatory Sparrow has reportedly disrupted services at Iran's state-owned Bank Sepah, including its website

The attack introduces a clear cyber element with immediate consequences for the country's critical infrastructure amid a growing conflict between Israel and Iran.

2025-03-25
Signal's encryption is irrelevant to the discussion. The real problem with sharing Top Secret data over Signal is not the security of the app, it's the security of the phone. And mobile phones are not secure against state level threat actors.
2025-03-25 View on X
The Atlantic

Trump officials accidentally added The Atlantic's EIC to a Signal group chat about the US' Houthi war plans; Signal is not approved for sharing classified info

U.S. national-security leaders included me in a group chat about upcoming military strikes in Yemen.  I didn't think it could be real.

2025-03-21
Even Lazarus are losing their jobs to AI!
2025-03-21 View on X
TechCrunch

Report: North Korea is launching Research Center 227, a cybersecurity research unit focused on AI-based hacking for stealing information and digital assets

The North Korean government is reportedly establishing a new hacking group within the intelligence agency Reconnaissance General Bureau (RGB). Bluesky: @myromanempire and @mnadeau ...

2024-11-29
“First”
2024-11-29 View on X
BleepingComputer

ESET researchers find the first UEFI bootkit designed specifically to target Linux systems, marking a shift in bootkits that previously focused on Windows

Article then proceeds to describe a toy GRUB wrapper bootkit that has nothing to do with UEFI firmware (other than running on UEFI systems like any other UEFI bootloader), does not...

2024-10-16
It's weird but... I believe the only people who will benefit from cryptologic attacks on WeChat are NSA. - China has direct access. - China uses it for managing intelligence assets. If NSA can monitor it via cryptologic attack; then —> good for USA bad for China. ¯\_(ツ)_/¯
2024-10-16 View on X
The Citizen Lab

An analysis of WeChat's network protocol MMTLS finds that it is a modified version of TLS 1.3 and WeChat developers' changes to its cryptography add weaknesses

Key contributions  — We performed the first public analysis of the security and privacy properties of MMTLS … X: @citizenlab , @thegrugq , @jsrailton , and @citizenlab X: @citizenl...

2024-09-13
Whats funny is that this is true on multiple levels. By keeping third parties out of the kernel there won't be another major security vendor like clownstrike
2024-09-13 View on X
The Verge

Microsoft plans to make changes to Windows that will help CrowdStrike, Broadcom, Sophos, Trend Micro, and other security vendors operate outside of the kernel

Microsoft is announcing plans to make changes to Windows that will help CrowdStrike and other security vendors operate outside of the Windows kernel.

2024-07-21
Not even a deci-Morris Worm!
2024-07-21 View on X
The Official Microsoft Blog

Microsoft estimates that CrowdStrike's update affected 8.5M Windows devices, or less than 1% of all Windows machines

On July 18, CrowdStrike, an independent cybersecurity company, released a software update that began impacting IT systems globally.  Although this was not a Microsoft incident …

2024-07-20
Today's CrowdStrike outage must be the most comprehensive blocking of APT activity in the company's history.
2024-07-20 View on X
Wall Street Journal

A profile of CrowdStrike, founded in 2011 and used by 300 companies in the Fortune 500; Gartner: CrowdStrike has ~15% of the global security software market

The little-known company is very popular in Corporate America, contributing to the severity of the global IT outage

Today's CrowdStrike outage must be the most comprehensive blocking of APT activity in the company's history.
2024-07-20 View on X
The Verge

BSODs hit thousands of Windows PCs due to “a defect” in an update from CrowdStrike, taking banks, airlines, and more businesses offline; Microsoft is aware

or CrowdStrike Microsoft : HELPFUL LINKS  —  Get notified of outages that impact you  —  Building reliable applications on Azure The Record : IT teams scramble to recover from Crow...

2024-07-19
Today's CrowdStrike outage must be the most comprehensive blocking of APT activity in the company's history.
2024-07-19 View on X
The Verge

BSODs hit thousands of Windows PCs due to “a defect” in an update from CrowdStrike, taking banks, airlines, and more businesses offline; Microsoft is aware

Thousands of Windows machines are experiencing a Blue Screen of Death (BSOD) issue at boot today, impacting banks …

2024-05-21
Microsoft: we got hacked by China and Russia because of our lax security posture and bad software, but we are making security a priority. Also Microsoft: Windows will now constantly record your screen, including sensitive data and passwords, and just leave it lying around.
2024-05-21 View on X
Engadget

Microsoft unveils Copilot+ PCs as a new class of AI-capable Windows PCs that have at least 40 TOPs of NPU performance, with several OEMs and chipmakers on board

The aim is to handle more AI processing locally rather than in the cloud.  —  We've been hearing rumblings for months …

2024-04-03
The xz backdoor was the final part of a campaign that spanned two years of operations. These operations were predominantly HUMINT style agent operations. There was an approach that lasted months before the Jia Tan persona was well positioned to be given a trusted role.
2024-04-03 View on X
research!rsc

A timeline of the attack on open-source project XZ Utils, which began in late 2021 and led to a backdoor with RCE in Linux distros Debian, Red Hat, and others

Over a period of over two years, an attacker using the name “Jia Tan” worked as a diligent, effective contributor to the xz compression library …

2024-04-01
If the xz maintainer wasn't burnt out then the agency would find another susceptibility, maybe he needs money, or has relationship problems, or likes to drink or gamble or collect rare books, or something. Anything. Intelligence agencies do their homework and play for keeps.
2024-04-01 View on X
Security Boulevard

Microsoft engineer Andres Freund accidentally found the malicious code in versions of the XZ Utils compression tool, likely preventing thousands of infections

Yesterday's discovery of the xz backdoor was an accident.  But what a fortunate accident it was.

The problem isn't maintainer burnout. That was just the vulnerability that was exploited this time. Intelligence agencies aren't waiting for the right opportunity to come around, they find or create opportunities when they want them. Stop blaming mental health.
2024-04-01 View on X
Security Boulevard

Microsoft engineer Andres Freund accidentally found the malicious code in versions of the XZ Utils compression tool, likely preventing thousands of infections

Yesterday's discovery of the xz backdoor was an accident.  But what a fortunate accident it was.

The xz backdoor was the final part of a campaign that spanned two years of operations. These operations were predominantly HUMINT style agent operations. There was an approach that lasted months before the Jia Tan persona was well positioned to be given a trusted role.
2024-04-01 View on X
Security Boulevard

Microsoft engineer Andres Freund accidentally found the malicious code in versions of the XZ Utils compression tool, likely preventing thousands of infections

Yesterday's discovery of the xz backdoor was an accident.  But what a fortunate accident it was.

2024-03-30
On the .xz backdoor. It is hard to see how the developer Jia Tan is innocent. The backdoor was added in 5.6.0 by his account. He contacted Fedora to push them to move to 5.6.0. There was a problem with valgrind, they worked with hi to resolve it. He commits the fix in 5.6.1.
2024-03-30 View on X
Ars Technica

Researchers find malicious code in versions of the compression tool XZ Utils that were incorporated into Linux distributions from Red Hat, Debian, and others

Malicious code planted in xz Utils has been circulating for more than a month.  —  Researchers have found a malicious backdoor …

2024-02-20
Are lockbit affiliates going to get 12 months of free credit monitoring? What is lockbit doing to make this right?!
2024-02-20 View on X
BleepingComputer

Law enforcement agencies arrest two LockBit operators in Poland and Ukraine, issue three arrest warrants, offer a decryption tool, and seize 200+ crypto wallets

Law enforcement arrested two operators of the LockBit ransomware gang in Poland and Ukraine, created a decryption tool …

Are lockbit affiliates going to get 12 months of free credit monitoring? What is lockbit doing to make this right?!
2024-02-20 View on X
Bloomberg

Law enforcement agencies from 11 countries, including the FBI and UK National Crime Agency, disrupt the LockBit group and seize 11K domains used for ransomware

- Law enforcement from 11 countries joined in cyber operation  — Extortion sites used by scammers seized to thwart attacks

2023-03-27
This makes ways more sense than selectively targeting TikTok https://twitter.com/...
2023-03-27 View on X
The Register

The French government bans TikTok and all other recreational apps from staff phones, claiming none have sufficiently robust security for government devices

Meanwhile the US contemplates drastic action  —  The government of France has banned TikTok - and all other recreational apps - from phones issued to its employees.

2022-10-13
It's 5 better than Qihoo 360 https://twitter.com/...
2022-10-13 View on X
The Verge

Microsoft plans to sunset its Microsoft Office branding after more than 30 years, rebranding the apps to Microsoft 365; new logos will roll out in January 2023

Microsoft is making a major change to its Microsoft Office branding.  After more than 30 years, Microsoft Office is being renamed …