Profile avatar
hultquist.bsky.social
Mandiant Intelligence at Google. CYBERWARCON and SLEUTHCON founder. Johns Hopkins professor. Army vet.
163 posts 8,808 followers 307 following
Prolific Poster

Last day to get your @sleuthcon.bsky.social tickets!!!

access handoffs

Researchers at Google said a prolific cybercrime group is tricking companies into giving them access to a Salesforce tool, allowing them to steal data and extort the organizations therecord.media/google-warns...

RED ALERT THIS IS NOT A DRILL REPEAT RED ALERT, SNACK WRAP COMING BACK IN JUST OVER 1 MONTH *MCDONALD'S SAYS SNACK WRAP TO RETURN TO US ON JULY 10

We’re hunting spies.

Last week to get your @SLEUTHCON tickets!

Sorry I’m not home right now I’m launchining the spiderweb

Is that five airbases?

NEW | Pictures are emerging of the preparation of the operation Ukraine carried out today, using drones inside trucks. Ukrainian sources suggest the attack has been in the works for the past year and a half.

The asymmetry here is staggering. Not my area here, but not sure how any exposed airframe is gonna be able to survive an attack by swarm. The cost of destroying them is just too relatively low. A milllion dollar op vs a billion dollar airframe is a smart investment.

SBU officials now say this was a coordinate attack on four Russian airfields: Belaya, Dyagilevo, Olenya and Ivanovo.

This is Olenya airbase - one of Russia’s key strategic aviation facilities, hosting aircraft capable of carrying nuclear weapon

Our latest investigation…

Finnish DM: Best way to counter hybrid action is to lay a red line somewhere. Threat will grow & grow. Doesn’t specify where red lines should lie or what consequences that crossing them should trigger. But Fr DM contests cyber attacks on a hospital v 300-400 hospitals (“act of war”) #sld25

Honest review of SLEUTHCON:

Next week it's CRIME TIME!

Honest review of SLEUTHCON:

If you’ve been laid off from a cyber intel position, please reach out if you’d like to come to @sleuthcon.bsky.social.

From breach simulations to fantasy adventures, Skylar Simmons knows how to build a great scenario. Hear from Walmart’s deception and purple team lead at #SLEUTHCON 2025 www.sleuthcon.com #Cybersecurity #SLEUTHCON2025

Interlock ransomware hits network of over a dozen medical centers in Ohio, according to a ransom note reviewed by CNN. Elective inpatient and outpatient procedures have been canceled today: www.cnn.com/2025/05/20/p...

If you’ve been laid off from a cyber intel position, please reach out if you’d like to come to @sleuthcon.bsky.social.

If there aren’t t shirts with this art on it, what are we even doing. Best con art ever

See you there! 💕🐍

The @sleuthcon.bsky.social socks are in!

"US Navy 35mm presentation slides," slide 1 of 20 [gallery]

In light of the recent high-profile attacks on US and UK retail, we’re hosting a webinar next Wednesday on UNC3944, aka Scattered Spider. Get insight on the actor and expert advice on hardening the enterprise. www.brighttalk.com/webcast/7451...

John Mancuso is joining #SLEUTHCON 2025! Threat hunting. Malware reversing. Adversary tracking. He brings nearly 20 years of experience to the stage. Check out the other speakers + lineup! >>> www.sleuthcon.com #ThreatIntel #CyberDefense #MalwareAnalysis

Quoted in this @kevincollier.bsky.social piece on #cyber threats to US retailers, which highlights the reporting yesterday from @hultquist.bsky.social and the Google threat intel team on the UK attackers potentially shifting their focus across the pond: www.nbcnews.com/tech/securit...

BREAKING: Polish Prime Minister Tusk announced full certainty that the massive fire at Marywilska 44, a major wholesale center in Warsaw, was arson ordered by Russian intelligence.

From AMOS to full-on eCrime ecosystem player, macOS stealers have entered the chat. 🍎 Charlie Cullen + Maddie Stewart walk us through the evolution at #SLEUTHCON 2025! 🔗 www.sleuthcon.com #ThreatIntel #Cybercrime #macOSSecurity

Catch Charlie Cullen at #SLEUTHCON 2025 From macOS malware to ransomware ecosystems, his research spans platforms and languages. 🎟️ Save your spot >>> www.sleuthcon.com #Cybercrime #ThreatIntel #SLEUTHCON2025

Surprised to find out the Bojinka plot was 30 years ago. I hope we’re considering those lessons now when we review these sabotage incidents. www.theguardian.com/uk-news/2024...

If they’ll do it in meatspace, they’ll do it in cyberspace. therecord.media/uk-spies-see...

Don’t confuse the Ransomware-as-a-Service provider with the intrusion crew behind these incidents in the UK. The real driving force is probably the crew, who many have connnected to Scattered Spider. Those guys love to tear through a sector, so shields up if you’re UK retail.

Alarm bells going off for sabotage in Europe. If they’ll do it in meatspace they’ll do it in cyberspace.

Meet Jon DiMaggio, Chief Security Strategist at Analyst1! Author of The Art of Cyberwarfare + The Ransomware Diaries, Jon’s undercover work infiltrating ransomware gangs has been featured on 60 Minutes, CNN, + more. Catch him at #SLEUTHCON2025! 🔗 sleuthcon.com

The French government confirms Olympics related activity tied to APT28 in lead up to Paris games. The era of Russian Olympics shenanigans has not yet ended. www.diplomatie.gouv.fr/fr/dossiers-...

I’m the last person to say Europe shouldn’t worry about cyberattacks on critical infrastructure, but we should approach individual incidents carefully and skeptically. Psychological impact is probably the chief motive of this activity. Let’s not do the adversary any favors.

TRBs are back! t.co/XArCSEHDYE

My daughter asked me what I use to play on the iPad as a kid. I told her, I use to talk into a fan to sound like a robot.