#RooCon24 was a huge success! 🦘 Thanks to all attendees who came out to support the Aussie CTI community. This year went much smoother and we appreciate all the feedback. It's great to see so many people network and come back with incredible collaboration stories.

Throw this on a Hilux, call it bud light platinum

New Year New Blog Same Threat Actors 👀 cloud.google.com/blog/topics/th… cc: John with more Ivanti-related shenanigans

👀🚨Ivanti Connect Secure VPN Zero Day🚨👀 cloud.google.com/blog/topics/th…

Another year, another 0-day exploited by China-nexus actors in edge devices. cloud.google.com/blog/topics/th… Great work by my colleagues John and Josh++

John

This is Frontline Intel Operations in action #FIO

Mandiant has previously only observed the deployment of the SPAWN ecosystem of malware on Ivanti Connect Secure appliances by UNC5337, a China-nexus cluster of espionage activity | cloud.google.com/blog/topics/th… Mandiant (part of Google Cloud)

Reinforced with Frontline Intelligence Operations #FIO real world events....

🚨UNC3886 🇨🇳 Deploying Custom Malware to Juniper Junos OS Router🚨 👀 and ensure you are keeping your devices up to date!

Great work showcasing cross team collaboration from our APJ teams #APJams

🔥 new blog covering recent UNC3886 ops. Massive S/O to all the authors for dropping such a great blog.

"GTIG assesses that UNC5221 will continue pursuing zero-day exploitation of edge devices based on their consistent history of success and aggressive operational tempo." If you're not paying attention to this TA then I don't know what to tell you 🤷‍♂️ cloud.google.com/blog/topics/th…

Fresh off the press today is a new blog detailing our observations from in the wild exploitation of CVE-2025-22457 by UNC5221 that includes two newly observed malware families tracked as BRUSHFIRE and TRAILBLAZE. cloud.google.com/blog/topics/th…

Thus far we've not seen KRABDRIP in association with UNC5221 activity.

🚨🚨🚨🇨🇳 Actors leveraging BRICKSTORM🚨🚨🚨 cloud.google.com/blog/topics/th…

Earlier this year, I worked one the most interesting and complex IRs of my career. The malware and techniques from that case turned out to be key TTPs observed in multiple subsequent UNC5221 cases! cloud.google.com/blog/topics/th…