Animal crossing signs observed in #scotland thus far: deer, otter, red squirrel, cow, sheep, and feral goat. 🤷‍♀️

“Even when we use the same names, we don’t mean the same thing.” Pepper talking about the Elusive Rosetta Stone at #mwise

Our final talk for today is from Kimberly and Genevieve Stark, who will be discussing a common loader called SHELLSTING, also known as Bumblebee. #BRUNCHCON

Genevieve shares a few common clusters around SHELLSTING, including follow-on payloads like Vidar (which was also discussed by Christopher Glyer. #BRUNCHCON

Now Kimberly and Genevieve Stark on the SHELLSTING loader, which could be a replacement for BazarLoader

#parrot tip: feed your birds a "chop" - a healthy mix of grains and diced vegetables. This provides daily foraging activities as they pick around the vegetables as expertly as a toddler.

What new year's party would be complete without a cocktail menu? 😁 drive.google.com/file/d/1p00En9…

Mandiant cybercrime experts Kimberly and Pepper took a good look at SHELLSTING (AKA BUMBLEBEE), which appears to have replaced the use of BAZARLOADER among ransomware crews. 5/x youtu.be/pIXl79IPkLI

Registration and Call for Papers is now open for SLEUTHCON! From the folks who brought you CYBERWARCON, SLEUTHCON (formerly BRUNCHCON) is a cybercrime-focused conference coming May 12th to Arlington! Please RT! 1/x sleuthcon.com

Excited to report that our fincrime team now has a shark-uterie board. Because reasons.

The week after finalizing one of our team's biggest reports of the year.

Sometimes new evidence provides justification to merge threat clusters. Other times, geech 👽👾 be like...

7 yrs ago John Rodgers and i founded The Vertex Project with a DARPA mission to empower intelligence analysts. In the last 2 years, we have 4X'd our # of customers. Every single one is high-impact. Thanks for the amazing support and feedback! Keep it coming, we're just getting started!

"Mandiant has observed wide exploitation of a zero-day vulnerability in the MOVEit Transfer secure managed file transfer software for subsequent data theft." UNC4857 observed actively deploying the LEMURLOOT webshell post-exploitation. mandiant.com/resources/blog…

This is what happens when you put me in charge of team building. We are on point. geech 👽👾 @thinkpoison Kimberly @p1tb00l

When you want to open a restaurant but decision making isn't your thing?

Out for our anniversary dinner and I caught visi stark ogling a 24 year old.

Beach swag visi stark