David Oxley

Amazon Threat Intelligence identifies Russian cyber threat group targeting Western critical infrastructure | Amazon Web Services As we conclude 2025, Amazon Threat Intelligence is sharing insights about a years-long Russian state-sponsored campaign that represents a significant evolution in critical infrastructure targeting: a ...

Proud to share new research by Amazon Threat Intelligence detailing recent activity by Sandworm/APT44 🇷🇺 targeting US and European energy, critical infrastructure, and managed security provider networks via vulnerable and misconfigured network edge devices. #threatintel aws.amazon.com/blogs/securi...

China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) | Amazon Web Services Within hours of the public disclosure of CVE-2025-55182 (React2Shell) on December 3, 2025, Amazon threat intelligence teams observed active exploitation attempts by multiple China state-nexus threat g...

A new blog this evening from Amazon Threat Intelligence detailing ongoing China-nexus cyber actors leveraging React2Shell (CVE-2025-55182): aws.amazon.com/blogs/securi...

How the classic anime 'Ghost in the Shell' predicted the future of cybersecurity 30 years ago | TechCrunch The story of the Ghost in the Shell’s main villain the Puppet Master hinted at a future where governments use hackers for espionage, at a time when most of the world had never connected to the interne...

NEW: The classic anime "Ghost in the Shell" turned 30 years old this week.

Despite coming out at the dawn of the internet, it was incredibly prescient in terms of imaginig a future where governments use hackers for espionage, people use malware to spy on their loved ones, and much much more.

New Amazon Threat Intelligence findings: Nation-state actors bridging cyber and kinetic warfare | Amazon Web Services The new threat landscape The line between cyber warfare and traditional kinetic operations is rapidly blurring. Recent investigations by Amazon threat intelligence teams have uncovered a new trend tha...

On the heels of @dlshad.net and @davidmagnotti.bsky.social’s presentation at #CYBERWARCON, happy to share the associated AWS Security blog post (with IOCs) aws.amazon.com/blogs/securi...

And I’ll keep shamelessly plugging @dlshad.net and @davidmagnotti.bsky.social’s Lightning Talk on Iranian cyber ops in support of kinetic strikes!

Hope to see many of you at #CYBERWARCON tomorrow! As always, if you see me in the AWS shirt, don’t be afraid to say hi, and please don’t be offended if I forget your name (it’s not you, it’s me). 😅

Ref: www.2600.com/content/hope...

Security Intelligence Engineer, Incident Response Threat Intelligence, ACTI We are open to hiring candidates to work out of one of the following locations:Annapolis Junction, MD, USA | Arlington, VA, USA | Austin, TX, USA | Herndon, VA, USA | New York, NY, USA | Seattle, WA, ...

Come work with Amazon Cyber Threat Intelligence (ACTI) focusing on the threats targeting Amazon, AWS, and our subsidiaries! US citizenship required, in-office across multiple US locations. DM with questions! www.amazon.jobs/en/jobs/3120...

🫡

Also check out @dlshad.net and @davidmagnotti.bsky.social presenting on more of our work at #CYBERWARCON this week!

Listening to the #ThreeBuddyProblem podcast and, while I’m glad you’re hearing about Amazon threat intel for the first time, I can say we’ve been around doing a thing or two for a while @ryanaraine.bsky.social, @jags.bsky.social, and @craiu.bsky.social 😅 (but message received re: IOCs in the blog)

Amazon discovers APT exploiting Cisco and Citrix zero-days | Amazon Web Services The Amazon threat intelligence team has identified an advanced threat actor exploiting previously undisclosed zero-day vulnerabilities in Cisco Identity Service Engine (ISE) and Citrix systems. The ca...

Excited to share another blog where Amazon Cyber Threat Intelligence (ACTI) discovered APT exploitation of zero-day vulnerabilities in Cisco and Citrix products. Proud of the team’s work! aws.amazon.com/blogs/securi...

If I give the bully my lunch money every day eventually he will die of old age

And if you do so, Senator, all the pain that our state has endured during this shutdown was for naught. Please don’t move forward without ACA subsidy extensions.

Cyber scholarship-for-service students say government has pulled rug on them, potentially burdening them with debt Some CyberCorps: Scholarship for Service participants have had federal agency job and internship offers rescinded this year due to cutbacks and freezes. It’s a condition of their scholarship contract ...

cyberscoop.com/cyber-schola...

Will open my big mouth here and say as a participant in one of these programs in the great before time, this is a massive unforced error by USG and will have impacts that span probably decades on the gov cyber workforce

And @dlshad.net!

Ping First, Boom Second — CYBERWARCON

‼️ The @cyberwarcon.bsky.social agenda and presenters list is live. Proud that Amazon Cyber Threat Intelligence will be presenting for the first time on the intersection of Iranian cyber ops and kinetic strikes with Dlshad Othman and @davidmagnotti.bsky.social! www.cyberwarcon.com/ping-first-b...

The Comey Indictment Is Not Just Payback — The Atlantic It’s an advance glimpse of Trump’s next attempted seizure of power

“James Comey’s rights and liberties are not the only ones at risk today. So is your own right to participate in free and fair elections in order to render a verdict on Trump’s invasion of those rights and liberties.” From @davidfrum.bsky.social apple.news/AX8_ub4UHR0G...

Sr. Security Intelligence Engineer , European Sovereign Cloud (ESC) Threat Intelligence team We are open to hiring candidates to work out of one of the following locations:Dublin, IEThe European Sovereign Cloud (ESC) Threat Intelligence team, part of Amazon Cyber Threat Intelligence (ACTI), i...

Happy to share that Amazon Cyber Threat Intelligence (ACTI) is hiring our first role in Dublin, Ireland! 🇮🇪

This role will provide threat intel support for the AWS European Sovereign Cloud (ESC). Dublin-based, open to current EU citizens, and with relocation available.

amazon.jobs/en/jobs/3089...

Bolsonaro Sentenced to 27 Years in Prison for Plotting Coup in Brazil

Glad to see not every country is powerless to hold coup leaders to account - “Bolsonaro Sentenced to 27 Years in Prison for Plotting Coup in Brazil” www.nytimes.com/2025/09/11/w...

Amazon disrupts watering hole campaign by Russia’s APT29 | Amazon Web Services Amazon’s threat intelligence team has identified and disrupted a watering hole campaign conducted by APT29 (also known as Midnight Blizzard), a threat actor associated with Russia’s Foreign Intelligen...

This morning, Amazon Cyber Threat Intelligence published a report about a recent watering hole attack by APT29 🇷🇺 that we discovered targeting Microsoft device code authentication. Proud of the work of the team and the chance to share this with the community! aws.amazon.com/blogs/securi...

Show Us Your Face — The Atlantic The federal government should prohibit the wearing of masks by ICE agents and require them to properly identify themselves.

“The driving principle here is obvious: In a free society, people should know who is policing them.” apple.news/ATQz-Wb-hQom...

I’m so sorry you had to experience this Selena 😖

Opinion | How Trump’s ‘Big, Beautiful Bill’ Will Make China Great Again

How Trump’s ‘Big, Beautiful Bill’ Will Make China Great Again www.nytimes.com/2025/07/03/o...

Image of a screenshot of news headline, saying, "WhatsApp is getting ads using personal data from Instagram and Facebook Forced Consent & Consent Bypass / 16 June 2025 Meta announced today that it also wants to introduce ads on WhatsApp, which will be based on personal data from Facebook and Instagram. This further integrates WhatsApp into other Meta services - an originally independent app, which initially was available for just $1 per year without ads or data usage. This also means that Meta is consolidating its social networking monopoly. EU law was actually supposed to prevent this."

Use Signal. We promise, no AI clutter, and no surveillance ads, whatever the rest of the industry does. <3

😳😮😲. As the Joe Turns

Graphite Caught: First Forensic Confirmation of Paragon’s iOS Mercenary Spyware Finds Journalists Targeted - The Citizen Lab On April 29, 2025, a select group of iOS users were notified by Apple that they were targeted with advanced spyware. Among the group were two journalists who consented to the technical analysis of the...

Well-done by @billmarczak.org and @jsrailton.bsky.social at @citizenlab.ca! citizenlab.ca/2025/06/firs...