SOARgasm = when all of your XDR automation playbooks fire off flawlessly...

That time of year again...

A CEO failed a phishing test then asked to be excluded. This sets a dangerous precedent. Leaders are prime targets and must model accountability. Cybersecurity works only when everyone—especially executives—takes part.

The enshitification of #Any.Run begins. Be aware, if you're on a "Hunter" plan, there are big changes coming Nov 1st. Manual tasks to be limited to 50/month and API access is being removed. They're pushing people to move to Enterprise subs, which doesn't make sense for small teams or individuals.

Observed an interesting attack chain today. Initially thought to be simple phishing. Turned out to be a chain of multiple RMM tools.

Started with landing page on storage.googleapis[.]com > PDQagent.msi > ScreenConnect client > SimpleHelp agent.

SimpleHelp C2 at 147[.]45[.]218[.]66

Stay safe!

Rhadamanthys info-stealer after Lumma infrastructure was taken down.....

A) Tools
B) Training
C) Staffing
D) All of the above

goal for this year = avoid meaningless meetings as much as possible. Anyone who tries to loop me in to unannounced meetings will be greeted with this