David Oxley

David Oxley

@oxley.io

Interim head of information security at Anduril Industries. @CitizenLab.ca Research Fellow. Former federal agent. Fan of space, books, cyberpunk, sci-fi, espionage history, and storms. Personal account. 🇺🇸 🇺🇦 🇹🇼 #ThreatIntel Storm chasing 📸 🌪️: @wxdox.com

3.8K followers574 following632 posts

Pinned

David Oxley
@oxley.io

Career achievement unlocked: someone is impersonating me on Gmail! Please note, I do not send professional email from “freemail” email addresses. If you’re contacted by someone, please feel free to message me with the details here. Thanks!

David Oxley reposted

Meredith Whittaker
@meredithmeredith.bsky.social

Notifications for deleted shouldn't remain in any OS notification database, and we've asked Apple to address this. In the meantime, you can prevent any preview text from your Signal messages from appearing in your notifications. Signal Settings > Notifications > Show “No Name or Content”

404 Media@404media.co

NEW: The FBI was able to forensically extract copies of incoming Signal messages from a defendant’s iPhone, even after the app was deleted, because copies of the content were saved in the device’s push notification database, multiple people present for FBI testimony in a trial told 404 Media.

404media.coFBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification DatabaseThe case was the first time authorities charged people for alleged “Antifa” activities after President Trump designated the umbrella term a terrorist organization.
David Oxley
@oxley.io

As shared elsewhere…this is my last week with Amazon and AWS! I can’t recommend the good people with Amazon Cyber Threat Intelligence enough. At the same time, excited to share what’s next soon!

David Oxley
@oxley.io

Proud to share new research by Amazon Threat Intelligence detailing recent activity by Sandworm/APT44 🇷🇺 targeting US and European energy, critical infrastructure, and managed security provider networks via vulnerable and misconfigured network edge devices. #threatintel aws.amazon.com/blogs/securi...

aws.amazon.comAmazon Threat Intelligence identifies Russian cyber threat group targeting Western critical infrastructure | Amazon Web ServicesAs we conclude 2025, Amazon Threat Intelligence is sharing insights about a years-long Russian state-sponsored campaign that represents a significant evolution in critical infrastructure targeting: a ...
David Oxley
@oxley.io

A new blog this evening from Amazon Threat Intelligence detailing ongoing China-nexus cyber actors leveraging React2Shell (CVE-2025-55182): aws.amazon.com/blogs/securi...

aws.amazon.comChina-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) | Amazon Web ServicesWithin hours of the public disclosure of CVE-2025-55182 (React2Shell) on December 3, 2025, Amazon threat intelligence teams observed active exploitation attempts by multiple China state-nexus threat g...

David Oxley reposted

Lorenzo Franceschi-Bicchierai
@lorenzofb.bsky.social

NEW: The classic anime "Ghost in the Shell" turned 30 years old this week. Despite coming out at the dawn of the internet, it was incredibly prescient in terms of imaginig a future where governments use hackers for espionage, people use malware to spy on their loved ones, and much much more.

techcrunch.comHow the classic anime 'Ghost in the Shell' predicted the future of cybersecurity 30 years ago | TechCrunchThe story of the Ghost in the Shell’s main villain the Puppet Master hinted at a future where governments use hackers for espionage, at a time when most of the world had never connected to the interne...
David Oxley
@oxley.io

On the heels of @dlshad.net and @davidmagnotti.bsky.social’s presentation at #CYBERWARCON, happy to share the associated AWS Security blog post (with IOCs) aws.amazon.com/blogs/securi...

aws.amazon.comNew Amazon Threat Intelligence findings: Nation-state actors bridging cyber and kinetic warfare | Amazon Web ServicesThe new threat landscape The line between cyber warfare and traditional kinetic operations is rapidly blurring. Recent investigations by Amazon threat intelligence teams have uncovered a new trend tha...
David Oxley
@oxley.io

Hope to see many of you at #CYBERWARCON tomorrow! As always, if you see me in the AWS shirt, don’t be afraid to say hi, and please don’t be offended if I forget your name (it’s not you, it’s me). 😅

David Oxley
@oxley.io

Come work with Amazon Cyber Threat Intelligence (ACTI) focusing on the threats targeting Amazon, AWS, and our subsidiaries! US citizenship required, in-office across multiple US locations. DM with questions! www.amazon.jobs/en/jobs/3120...

amazon.jobsSecurity Intelligence Engineer, Incident Response Threat Intelligence, ACTIWe are open to hiring candidates to work out of one of the following locations:Annapolis Junction, MD, USA | Arlington, VA, USA | Austin, TX, USA | Herndon, VA, USA | New York, NY, USA | Seattle, WA, ...
David Oxley
@oxley.io

Excited to share another blog where Amazon Cyber Threat Intelligence (ACTI) discovered APT exploitation of zero-day vulnerabilities in Cisco and Citrix products. Proud of the team’s work! aws.amazon.com/blogs/securi...

aws.amazon.comAmazon discovers APT exploiting Cisco and Citrix zero-days | Amazon Web ServicesThe Amazon threat intelligence team has identified an advanced threat actor exploiting previously undisclosed zero-day vulnerabilities in Cisco Identity Service Engine (ISE) and Citrix systems. The ca...
David Oxley
@oxley.io

Happy to share that Amazon Cyber Threat Intelligence (ACTI) is hiring our first role in Dublin, Ireland! 🇮🇪 This role will provide threat intel support for the AWS European Sovereign Cloud (ESC). Dublin-based, open to current EU citizens, and with relocation available. amazon.jobs/en/jobs/3089...

amazon.jobsSr. Security Intelligence Engineer , European Sovereign Cloud (ESC) Threat Intelligence teamWe are open to hiring candidates to work out of one of the following locations:Dublin, IEThe European Sovereign Cloud (ESC) Threat Intelligence team, part of Amazon Cyber Threat Intelligence (ACTI), i...
David Oxley
@oxley.io

This morning, Amazon Cyber Threat Intelligence published a report about a recent watering hole attack by APT29 🇷🇺 that we discovered targeting Microsoft device code authentication. Proud of the work of the team and the chance to share this with the community! aws.amazon.com/blogs/securi...

aws.amazon.comAmazon disrupts watering hole campaign by Russia’s APT29 | Amazon Web ServicesAmazon’s threat intelligence team has identified and disrupted a watering hole campaign conducted by APT29 (also known as Midnight Blizzard), a threat actor associated with Russia’s Foreign Intelligen...
David Oxley
@oxley.io

Happy to share that, as of next month, I’ve been promoted to Senior Manager (L7) with an expanded scope across Amazon CTI’s analysis teams. We’re looking for managers for two teams, AWS and incident response threat intel. Technical, in-office, US-based. DM with questions! amazon.jobs/en/jobs/2918...

amazon.jobsSecurity Engineering Manager, AWS Threat Intelligence, ACTIWe are open to hiring candidates to work out of one of the following locations:Annapolis Junction, MD, USA | Arlington, VA, USA | Herndon, VA, USA | New York, NY, USAThe AWS Threat Intelligence (AWS T...
David Oxley
@oxley.io

No honor among this crowd. Cowards, all of them.

CALL TO ACTIVISM@calltoactivism.bsky.social

This is Marco Rubio explaining how the USA promised to defend Ukraine forever if they got rid of their nuclear arsenal left after the Soviet Union fell. This is why lil marco was sinking into the couch. He was hoping we wouldn’t find it…so don’t RT right now this very second.

David Oxley reposted

Matthew Green
@matthewdgreen.bsky.social

So here’s a simple request to Apple. Apple iMessage needs to enable “disappearing messages.” And they need to do it soon. blog.cryptographyengineering.com/2025/03/01/d...

blog.cryptographyengineering.comDear Apple: add “Disappearing Messages” to iMessage right nowThis is a cryptography blog and I always feel the need to apologize for any post that isn’t “straight cryptography.” I’m actually getting a little tired of apologizing for i…

David Oxley reposted

David Frum
@davidfrum.bsky.social

America First means America Alone. America First means America Amoral. America First means America Weaker. Abroad, America First means America aligned with dictators. At home, America First means government by plutocrats, crooks, and foreign stooges.

David Oxley
@oxley.io

Both unsurprising given the administration’s swing toward the authoritarian bloc, and yet also so shocking. You can bet Russia has no such illusions and isn’t unilaterally backing down. therecord.media/hegseth-orde...

therecord.mediaExclusive: Hegseth orders Cyber Command to stand down on Russia planningThe secretary of Defense has ordered U.S. Cyber Command to stand down from all planning against Russia, including offensive digital actions, sources tell Recorded Future News.

David Oxley reposted

Alexander Howard
@digiphile.bsky.social

1776🇺🇸Revolution 1789📃Constitution 1863🖋️Emancipation 1865⛓️‍💥Liberation 1920🗳️Women’s Suffrage 1964🗳️Civil Rights & Universal Suffrage 2015❤️Universal Right to Marriage 2020🦠Corruption 2021💥Insurrection 2024🔥Regression 2026🗳️Resilience 2028🗽Restoration

David Oxley reposted

Garrett M. Graff
@vermontgmg.bsky.social

To be clear, I believe that the US should be thanking Zelenskyy and Ukraine for standing up and defending freedom. They’re the ones bearing this burden in lives and disruption. It’s only the small and insecure who think they should be thanking us.

David Oxley reposted

David Frum
@davidfrum.bsky.social

Trump and Vance are not selling out Ukraine because of anything Zelenskyy said to them. Trump and Vance are selling out Ukraine because of things Putin and Musk said to them.