Saher

@what-is-sos.bsky.social SOS Volume II is around the corner and preparations are underway for the conference of the season 🕵️‍♀️ complete with the coolest punk chic swag ever 👀 We are now SOLD OUT so make a note for next year because you won’t want to miss 🆘 www.stateofstatecraft.com

In July 2026, a China-aligned threat actor, TA419, ran credential-phishing campaigns impersonating prominent economists and AI policymakers, including a former White House Office of Science & Technology Policy leader. More info: www.proofpoint.com/us/blog/thre...

Being honored by peers is great, of course, but there's a special kind of recognition that comes from being on the radar of a foreign spy service. bsky.app/profile/alex...

New: Chinese hackers impersonated a former US government official in a bid to hack a series of American AI policy experts, @proofpoint.com says. We interviewed one of the targets of the allegedly Beijing-linked spy campaign, @alexengler.bsky.social. www.reuters.com/legal/govern...

Suspected Chinese hackers impersonated a senior Anthropic employee, ex-US officials to try to purloin info on military applications of AI, export controls, etc, per @proofpoint.com: edition.cnn.com/2026/10/01/p...

The attackers posed as former OSTP official Lynne Parker with a believable email about a new AI policy center, which was apparently oriented towards U.S. AI policymakers - be careful out there! Thanks to @proofpoint.com for the thorough technical investigation www.proofpoint.com/us/blog/thre...

🚨 New @threatinsight.proofpoint.com blog covering a 🇨🇳- aligned threat actor targeting US AI policy circles in spear phishing campaigns in recent months: www.proofpoint.com/us/blog/thre...

‘Despite widespread expectations of retaliation, Iranian cyber activity following the February strikes was consistent with Iran’s established peacetime playbook, rather than the predicted coordinated retaliatory wave.’ Read @saffronsec.bsky.social's latest: bindinghook.com/what-does-th...

“Restraint itself can be a signal.” Read more from the brilliant @saffronsec.bsky.social in @bindinghook.bsky.social on the relationship between cyber and kinetic conflict as observed in the Iran war

‘The doomsday predictions of wipers against US infrastructure at scale, hack-and-leak operations against defence and political targets, and coordinated destructive campaigns of the sort deployed in Ukraine never materialised.’ Read more @saffronsec.bsky.social: bindinghook.com/what-does-th...

'The damage was likely negligible; the effect was psychological, not operational.’ Read more from @saffronsec.bsky.social on Iran’s wartime cyber operations: bindinghook.com/what-does-th...

Excited to publish my first @bindinghook.bsky.social piece on challenging assumptions of how Iranian cyber ops function in wartime & the discrepancy between capability/intent signals from peacetime. What does the evidence say on how cyber/kinetic interact in conflict? bindinghook.com/what-does-th...

We're one month out from @what-is-sos.bsky.social in Brussels with a packed and stacked agenda on all things intel, espionage, sabotage, physical ops, and attribution - get your tickets asap!! www.stateofstatecraft.com/agenda

Excited to share I'm presenting a last-minute talk @virusbtn.bsky.social! Come watch me hype @greg-l.bsky.social's research on Russia-aligned TA488's operational evolution, complete with half-click XSS exploits, zero-days, webmail stealers, & browser implants www.virusbulletin.com/conference/v...

Back by popular demand, it's time for Volume II of State of Statecraft @what-is-sos.bsky.social! Come check out the latest in state-sponsored operations across espionage, cyber/physical sabotage, disruption, attribution, and all the -INTs you could dream of - Oct 22 www.stateofstatecraft.com/agenda

BEHOLD: the 🆘 AGENDA is OUT! VOLUME II features numerous discussions on developments in state-sponsored operations covering digital espionage, cyber/physical sabotage, economic tradecraft, disruption, attribution and dare we say, more? Agenda 👉 stateofstatecraft.com/agenda 🧵

New research from Proofpoint: BlueMoon, a Chrome-to-Windows exploit kit, has been used by at least four state-sponsored threat actors since late August. www.proofpoint.com/us/blog/thre...

🚨🌙 Today we are releasing a new @threatinsight blog on BlueMoon, an exploit kit that chained “patch-gap” Chrome zero-days with a Windows zero-day and had indicators of AI-assisted development. It was used by at least four espionage-motivated threat actors since late August.

Absolutely excellent work from @mkyo.bsky.social in discovery and investigation with help from TREE @greg-l.bsky.social @konstantinklinger.bsky.social and ope friends Julia/Dave/Stu in a huge @threatinsight.proofpoint.com cross-team collab!

Looks like Void Blizzard — alleged to be the Russian cyber firm Yutek-NN — may also have been deploying an Outlook no-click (or half-click) zero day. Neat research here from @greg-l.bsky.social & the @proofpoint.com team:

So remember last week when we said we hadn’t see TA488/Laundry Bear/Void since Feb? Well... We kinda lied Day before the release, we found em throwing a half click against Outlook to install one of the coolest implants we’ve ever examined: OWAReaper www.proofpoint.com/us/blog/thre...

The excitement continues. @greg-l.bsky.social discovered Russia-aligned actor TA488 using another half-click exploit - this time in Outlook- leading to a new (very cool) browser-based implant, OWAReaper. Check out TA488 upping its game @threatinsight.proofpoint.com www.proofpoint.com/us/blog/thre...

@snlyngaas.bsky.social covers Proofpoint and NSA reporting on Russian actors' exploitation of Zimbra, Roundcube, and other mailservers, to target government, defense, and high science organizations for intelligence collection www.cnn.com/2026/07/23/p...

Read Reuters coverage from @raphae.li on Proofpoint and NSA's reporting of half-click exploits used by Russian actors to target Zimbra, Roundcube, and other mailservers to steal emails www.reuters.com/legal/govern...

Our researchers discovered that a Russia-aligned threat actor was exploiting a previously unknown (zero-day) vulnerability against Zimbra mailservers. We alerted government partners, with whom we have collaborated on further discovery. Blog: www.proofpoint.com/us/blog/thre...

Thanks to @virtualroutes.bsky.social for hosting this fascinating and insightful workshop on commercial cyber proliferation! A revealing discussion with a walk through some of the darkest timelines

ICYMI: the State of Statecraft conference (@what-is-sos) returns to Brussels for Volume II on October 22, 2026. Registration is open & the CFP runs until Aug. 14 SOS is an event focused on state-sponsored operations: stateofstatecraft.com 🧵👇

New research from @greg-l.bsky.social and @mkyo.bsky.social on a China-aligned actor exploiting n-day vulns in Roundcube to pop mailservers of North American universities. So reminder to protect & patch your mailserver, the edge device you forgot was an edge device www.proofpoint.com/us/blog/thre...

🚨 New research: Proofpoint has identified a suspected China-aligned espionage cluster, UNK_MassTraction, exploiting multiple Roundcube n-day vulnerabilities to compromise mail servers at U.S. and Canadian universities. Analysis, infection chain & IOCs: www.proofpoint.com/us/blog/thre....

Thank you to @monicakello.bsky.social and @haguetix.bsky.social for an amazing Hague TIX conference - it’s always one of my favorites and I love coming back year after year!

Registration and CFP for 🆘VOLUME II is officially OPEN! On October 22, 2026, we return to Brussels to showcase a day of community and discussions on the latest developments in state-sponsored operations and the actors & institutions that champion them.

🚨 New threat research: Proofpoint identified a likely North Korea-aligned threat cluster, UNK_DeadDrop, targeting software developers through trusted development platforms and workflows. Read the blog: www.proofpoint.com/us/blog/thre....

New from @threatinsight.proofpoint.com! North Korean actor UNK_DeadDrop (possibly overlapping with Contagious Interview) conducts a high volume phishing campaign targeting developers with a new technique abusing VSIX extensions and new open source payload Overlord www.proofpoint.com/us/blog/thre...

Check out the newest intel conference to discover the latest insights into all kinds of statecraft!

Bonus: great coverage of our research in an exclusive from one of my fave reporters @ajvicens.bsky.social www.reuters.com/sustainabili...

New from the one and only pun-king @mkyo.bsky.social on the increased and ongoing Chinese targeting of semiconductor-related organisations in Taiwan. Edge device exploitation may be the TTP of the moment, but Chinese groups still go phishing when the chips are down www.proofpoint.com/us/blog/thre...