Mike Sec

Agreed. Salt Typhoon - espionage/successful intrusions; Russian use of Acid Rain - attack.

First repeatable attribution framework for threat intel teams since the Diamond Model as far as I know…

GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use | Google Cloud Blog Our report on adversarial misuse of AI highlights model extraction, augmented attacks, and new AI-enabled malware.

First VoidLink, now HONESTCUE. Fair to assume AI generated malware frameworks are only going to exponentially grow…

cloud.google.com/blog/topics/...

“The uncomfortable lesson of Salt Typhoon is not that Beijing has futuristic capabilities. It’s that Washington often treats major intrusions as proof of overwhelming adversary sophistication, when in reality, basic, preventable weaknesses still account for much of the vulnerability.” 🎯

Something not many are saying or those involved are considering, everyone involved will almost certainly be investigated by the next administration, whether it be for criminal or civil lawsuits against the officers involved, or the administration officials obstructing the investigation.

Spionage: BND hörte jahrelang US-Präsident Barack Obama ab Der deutsche Geheimdienst überwachte regelmäßig Telefonate des damaligen US-Präsidenten an Bord der Air Force One. Erlaubnis von Angela Merkel hatte der BND nicht.

Germany’s foreign intelligence agency (BND) intercepted phone conversations of former President Barack Obama while he was aboard Air Force One over several years. The interceptions exploited vulnerabilities in the aircraft’s encryption and known frequencies.

www.zeit.de/politik/ausl...

T-Mobile users like, “There’s no way coverage is that good.”

Scoop: The lone employee behind CISA's Pre-Ransomware Notification Initiative resigned on Friday rather than take a forced reassignment to FEMA.

CISA says PRNI will continue, but sources said David Stern's loss will be a major setback for it.

My story: www.cybersecuritydive.com/news/cisa-ra...

The US is woefully behind China in both renewable and nuclear energy production, the former because its connection with climate change, which is seen as a “hoax”, and the latter because of the waste it produced, which is more than offset by the amount of power generated compared to fossil fuels.

Trump Halts 5 Wind Farms Off the East Coast

Success in AI won’t just be because of chips and algorithms, but just as, if not more, importantly, data centers and power generation.
www.nytimes.com/2025/12/22/c...

AI security is fundamentally a cloud infrastructure problem, Palo Alto Networks says Companies should prioritize identity security and integrate cloud monitoring into the SOC, according to the security firm.

In order: data security and management, cloud security, identity management. Goes without saying, protections should follow data - but what does that mean in a world of AI? How are you ensuring only those authorized to see or know certain things, are? www.cybersecuritydive.com/news/ai-secu...

AI Malware: Hype vs. Reality A grounded look at AI malware: most threats sit at low maturity levels, with no verified autonomous BYOAI attacks. Learn what’s real, what’s hype, and how defenders should respond.

Where is the closest rooftop? There is something I would like to shout.
“AI is currently a force multiplier on existing attacker tradecraft, not a source of fundamentally new TTPs.”

www.recordedfuture.com/blog/ai-malw...

infosec.exchange/@malwaretech...

Straight up, I developed and taught — and @kikta.net now teaches — an entire course at the @alperovitch.institute that boils down to “you can shape adversary cyber activity but you can’t deter it because that’s how intelligence operations work”. Being mad at China for playing the game is ridiculous.

I explained to my class week that despite all the panic about state actor capabilities:

-The biggest threat to electricity is squirrels
-Minecraft skids have the best DDoS capabilities
-No amount of disruption could ever beat misconfiguration, with DNS at the top of the list

Acting US Cyber Command, NSA chief won’t be nominated for the job, sources say Army Lt. Gen. William Hartman, the acting leader of U.S. Cyber Command and the NSA, will not be nominated to take the job permanently, sources told Recorded Future News.

EXCLUSIVE: President Donald Trump has decided not to nominate Army Lt. Gen. William Hartman to be the next leader of U.S. Cyber Command and the National Security Agency.

On @therecordmedia.bsky.social

therecord.media/william-hart...

Attacks on data centers: the biggest threat to the AI boom Here’s a four-step strategy for keeping data centers safe.

Data center security being the Achilles heel of AI has been the topic of concern for the last year or two. I think the biggest takeaway from this piece is the need for a business continuity plan - being ready to go back to manual processes where AI has taken over.

www.scworld.com/perspective/...

Salt Typhoon: New Joint Advisory Offers a Beacon Through the Storm but Stirs Up New Questions Analysis of newly identified Salt Typhoon-linked companies casts light on the complex ecosystem of front companies and real businesses supporting Chinese state cyber operations

open.substack.com/pub/nattotho...

Peter Kyle raised eyebrows last year when he said he was made, just hours into office, “very very aware that there was a cybersecurity challenge that our country faced that I simply wasn’t aware of before.”

We report a secret briefing by intel chiefs was responsible: therecord.media/cyberattack-...

Microsoft: Multiple subsea fiber cuts in the Red Sea impacting global communications

azure.status.microsoft/en-us/status

AI Supply Chain Attack Method Demonstrated Against Google, Microsoft Products An AI supply chain issue named Model Namespace Reuse can allow attackers to deploy malicious models and achieve code execution.

Interesting attack vector. Essentially the AI equivalent of domain squatting, except with AI model names.
www.securityweek.com/ai-supply-ch...

Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms DPRK-aligned threat actors abuse CTI platforms to detect infrastructure exposure and scout for new assets.

🚨New research drop: Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms

It was a pleasure collaborating with Sreekar Madabushi and @kennethkinion.bsky.social from Validin!

Read our blog post: s1.ai/nk-ops

With less than a month to go, House panel votes to extend popular cyber programs Ten-year extensions of a threat information sharing law and a cybersecurity grant program for states and localities won bipartisan approval in the House Homeland Security Committee.

Legislation to renew two federal cybersecurity laws has finally begun moving through Congress, but it’s unclear if lawmakers will be able to pass both bills before an end-of-the-month deadline.

On @therecordmedia.bsky.social

therecord.media/house-homela...

Citrix forgot to tell you CVE-2025–6543 has been used as a zero day since May 2025 A look into what action Netscaler customers need to take ASAP.

New by me - Citrix have forgot to tell you a zero day was under exploitation earlier this year to successfully backdoor devices at "critical" organisations, and no vendor released technical details.

More to come, including on CVE-2025-7775 too.

doublepulsar.com/citrix-forgo...

The timing of this announcement on the same day that the US and its allies called out Chinese technology companies for hacking is nothing short of ironic…

Here’s what could happen if CISA 2015 expires next month Expiration of a 2015 law could dramatically reduce cyber threat information sharing within industry, as well as between companies and the federal government, almost to the point of eliminating it.

While its expiration isn’t ideal, it isn’t the end of the world. Not all of gov use it, nor do all private orgs want to share under them due to their requirements. It makes it easier on those that don’t want to do the legwork, but it is certainly not the only solution. cyberscoop.com/cisa-2015-ex...

Full Speed Ahead: Optimizing U.S. Cyber Command for the Future Fight - War on the Rocks Think of U.S. Cyber Command as a Ferrari straining in second gear, unable to shift higher as rivals close the gap on the straightaway. As China and other

Cyber Command has the talent. Now it needs the tools, speed, and innovation to match.

“Agentic AI is really AI that can take action on your behalf, right? That will become the next insider threat, because, as organizations have these agentic AI deployed, they don’t have built-in guardrails to stop somebody from abusing it”

“True deterrence requires the capacity to continuously undermine an adversary’s capabilities and prepare to impose unacceptable costs.”
Great op-ed presenting the state of play and how the US may be able to course correct its approach to cyber policy.
www.foreignaffairs.com/china/china-...