Will
@BushidoToken
Followers
35K
Following
36K
Media
2K
Statuses
12K
Senior Threat Intel Advisor @TeamCymru | Co-founder @CuratedIntel | Co-author @SANSForensics FOR589 | Co-founder @BSidesBournemth | @darknetdiaries #126: REvil
🇬🇧
Joined March 2013
Pleased to share my first official Team Cymru blog that follows on from my webinar last month 🙌 . “Uncovering DPRK Remote Workers: Detecting Hidden Threats Through Internet Telemetry” 🇰🇵 🔍 .
5
49
182
Sending out vulnerability notifications is always difficult. But Friday afternoons, while the US is off on a national holiday, makes things much harder. @CuratedIntel members are doing gods work behind the scenes to stop the next wave of ransomware attacks as best we can 🫡.
2
1
40
It’s fantastic to have Julien come and Keynote for our conference! Looking forward to this talk very much. If you use on a daily basis, come and meet the creator at BSides Bournemouth!. Tickets still available here:.
🎤 Second Keynote Speaker Announcement. 🗣️ Talk Title: “Under the hood of an open-source ransomware observatory: . 🎟️ Tickets are still available! Link in first comment.
0
5
16
Anyone on the forensics side of the house who worked a Hunters International case in the past may want to look into the free decryption keys for victims who’ve saved any locked files. Several other ransomware gangs have done this before, namely Avaddon. #DFIR #IncidentResponse.
Hunters International discontinues its operations and releases a free decryption for affected companies.
1
13
39
Summary report on a lot of the surrounding miscellaneous hacktivist activity related to the 🇮🇷 🇮🇱 war 👇 .
🚨 New Analysis: Hacktivist Cyber Ops in the Iran–Israel Conflict. After Israel’s June 2025 airstrikes on Iran, hacktivist cyber operations exploded. Dozens of groups—some clearly ideological, others likely state-backed—launched attacks across energy, media, finance, and even
0
0
2
Qantas has disclosed a breach 🦘 ✈️ . “The incident occurred when a cyber criminal targeted a call centre and gained access to a third party customer servicing platform.” . Sounds like the same crew to me.
0
4
9
Check your inboxes if you submitted to the CFP!.
Ahoy! We have just sent out all speaker acceptance emails. Check your inbox and confirm to let us know you're coming. Thank you!.
0
1
10
Aeza Group sanctioned 👇 🇺🇸 🇬🇧.
Another bulletproof hoster sanctioned —Aeza Group hosted BianLian ransomware, RedLine, BlackSprut among other illicit activities
0
6
25
Interesting discovery, an 🇮🇷 hacktivist group called “APT-Iran” has shared their apparent usage of LockBit Black (the leaked version) 👇 .
A Pro-Iranian hacktivist group, APT-Iran, used RDP access to exfiltrate data and deploy LockBit Black ransomware samples to encrypt files. In a separate incident, the threat actor claimed to have compromised the Israel Ministry of Health’s network by exploiting an F5 BIG-IP
1
3
12
US law enforcement has point out a warning about Iranian adversaries targeting US organisations 👇 .
The FBI, @CISAgov, @NSAgov & DC3 released a fact sheet advising owners and operators of critical infrastructure to remain vigilant for potential Iranian hacktivist or state-sponsored cyber activity. Click for recommended mitigations to harden your systems:
1
2
6
Mandiant & PAN are sounding the alarm 🚨 that Scattered Spider style attacks are now targeting the ✈️ aviation sector: Recent airline attacks reported have been:.- Hawaiian Airlines (.- WestJet (.
3
42
112
More dumb ways cybercriminals got caught!. alpha02: left his personal email in a welcome message to new members of AlphaBay. NetWalker: logged into Gmail from a C2 IP and sent a Google home mini to his address and used his real name. ChipMixer Admin: bought BTC at KYC exchange.
Dumb ways people get caught. Sebu: Connected to IRC drunk without VPN. Pom: Looked up his personal email on HIBP and admitted it wasn’t in a posted breach. IntelBroker: Sent BTC from a buyer (FBI) to his KYC’d coinbase. Veer/Wiz: flashed his real name for his windows/microsoft.
0
14
56
Also an interesting side note here is how law enforcement tracked VPN usage between IntelBroker’s X/Twitter account and his email account 📧 . Exploiting cybercriminal infrastructure TTPs is another key method to link identities together 🔍
0
5
17
Exploiting Bitcoin opsec fails continues to be a fruitful tactic to catch cybercrims for LE, which is 100% exactly why we teach it in #FOR589 with our partners @chainalysis.
0
1
8
⚠️ IntelBroker was arrested in France 🇫🇷 in February 2025, and the US 🇺🇸 is seeking his extradition. How did Law Enforcement Deanonymize IntelBroker? 🔍 . TL;DR: He messed up on the Bitcoin opsec after an undercover officer made a controlled buy 💰 .
5
42
142
Many CTI companies create and manage Threat Actor databases, myself included in past roles. But one thing I don’t see often is Researcher profiles, which can provide context & awareness about vuln or offsec researchers and why orgs should take them seriously.
2
3
53
Three insurance firms named as victims: Erie, Philadelphia, and Aflac. “All three insurance-company hacks are consistent with the techniques of a young and rampant cybercrime group known as Scattered Spider, people familiar the investigation tell CNN.”.
0
6
11