That’s me! Check it out!

Huge thanks to the good people at SentinelOne for working with our Mandiant (part of Google Cloud) team on this issue.

🚨 Mandiant Blog alert, check out this amazing blog post to see how Russian actors use Andromeda infections to target Ukranian entities.

check out this piece by Andy Greenberg (@agreenberg at the other places) with quotes from myself and John Hultquist talkin’ turla ⬇️

“in the past two years, Mandiant, which is part of Alphabet Inc.’s Google Cloud division, has investigated 84 breaches where EDR or other endpoint security software was tampered with or disabled” - me bloomberg.com/news/articles/…

From the whales of Lapsus & 0ktapus, to the lesser-known predators that prowl in the muddier waters of anonymity, join @nicastronaut to dive into how these turbulent “groups” present a new challenge in defining a “cluster”. To register, go to sleuthcon.com! #SLEUTHCON

An example of legendary team work from the initial findings to when we merged and graduated the UNC2452 cluster!

Looking forward to seeing everyone SLEUTHCON . There are lots of great talks including one by our very own @nicastronaut #mandiant #GoogleCloud

Great presentation by Luke Jenkins at REcon on the gru’s disruptive ops and toolkit

“There should be an industry-wide effort to enable streaming Sysmon-style” off of network security devices Who’s with me? 👇

RooCon Call for Papers is open! We are now accepting papers for RooCon 2023, Cyber Threat Intelligence and Attribution conference. This year's conference will focus on practical applications of these topics. Submit your abstract by 14th of August rsvp.withgoogle.com/events/roocon2…

#RooCon23 has officially started! Thanks ⚛️ Marcin Siedlarz @mitypk and Dan for organizing.

Apply!

Super excited to share that as part of a multi-year long effort with contributions from across Mandiant (part of Google Cloud) and Google as well as our partners in Ukraine and industry, we are graduating Sandworm into APT44 cloud.google.com/blog/topics/th…

Sandworm is now officially APT44 according to Mandiant (part of Google Cloud). They will still always be Frozen Barents to me though.

Today, Mandiant (part of Google Cloud) / Google is opening up a Can o’ Sandworms. I’m incredibly proud to have led the year+ long effort with a brilliant group of colleagues to graduate Sandworm into APT44. cloud.google.com/blog/topics/th…

Fantastic job Gabby. I’m so proud of you and thanks for leading the APT44 graduation. I know how much work goes into graduations. Especially this one!

It’s great to have md-ir-ap join the FIO-IR.

It is finally here, get your copy of Mandiant (part of Google Cloud) #MTrends2024 here cloud.google.com/security/resou…