Devon Kerr @_devonkerr_

Director of Threat Research and @ElasticSecLabs team lead; custodian of secret histories. Posts are my own. elastic.co/security-labs New York State Joined October 2014

Tweets

12K
Followers

8K
Following

722
Likes

16K

Maddy 🐝 @Cyb3rMaddy

4 hours ago

In cybersecurity, skills open the door, but your brand gets you in the room. The Cyber Branding Guides were built for early-career professionals who want to: •Showcase their skills beyond a résumé •Build credibility with recruiters and hiring managers •Create a personal brand…

0 3 22 2K 16

Download Image

nickharbour @nickharbour

a day ago

#flareon12 is coming in hot and fast this year and will only run for 4 weeks this year instead of the usual 6. Don't miss it! flare-on.com

2 17 62 6K 12

Lawrence_Sec @Lawrence_Sec

a day ago

Read the full report on TAG-150 here, including our newest discovery.. #CastleRAT a new Remote Access Trojan: recordedfuture.com/research/from-…

0 2 4 284 0

Tom Hegel @TomHegel

a day ago

New research from @milenkowski and @ValidinLLC 🇰🇵 Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms Research: sentinelone.com/labs/contagiou… Reuters story: reuters.com/world/asia-pac…

1 15 44 3K 5

Florian Roth ⚡️ @cyb3rops

a day ago

I’m excited about AI. We’re building with it, using it daily, and I’ve seen the real value it can add. But after weeks with GPT-5, I also see clear limits. There are walls we won’t break just by throwing more hardware at the problem. Valuations in the AI space feel detached…

4 8 58 8K 10

spencer @techspence

2 days ago

EDR is great, a must have even, but as with all things, nothing is perfect and attackers will always be trying to evade & "bypass" it. In 2025, I don't believe it's negotiable that you've got to have other sources of telemetry for threat detection than EDR. What else? -…

21 10 111 18K 48

Elastic Security Labs @elasticseclabs

2 days ago

#ElasticSecurityLabs gets to the root cause of an Authenticode signature error, reverse-engineering an undocumented Microsoft function in the process. Learn how we solved the problem here: go.es.io/3K2vG7u

2 25 91 7K 37

hogfly 🌻 @4n6ir

6 days ago

@sec_hub93028 Team, mission, funding/cost out/financial health, remote, autonomy, trust&empowerment, org/op model, team/leader reward/accountability, how ideas get heard/actioned(lead from top/middle or outside in), who the CISO reports to/relationship, is company interesting.

1 1 6 518 0

Nasreddine Bencherchali @nas_bench

a week ago

Because I and the rest of the maintainer team we dont have infinite time. I'm going to be pretty aggressive on PRs submitted to @sigma_hq github.com/SigmaHQ/sigma/ New so called DEs copy pasting random rules and not having the capacity to read the specs will lead to an auto close…

3 5 37 3K 9

Lawrence_Sec @Lawrence_Sec

a week ago

1/ Today, @_whoisnt and I published “One Step Ahead: Stark Industries Solutions Preempts EU Sanctions,” revealing how hosting provider #StarkIndustries executed a multi-phase restructuring of its operations, beginning up to a month before #EU sanctions. recordedfuture.com/research/one-s…

1 6 15 2K 3

John Hultquist @JohnHultquist

a week ago

The contractor ecosystem at the heart of Chinese cyber espionage has been instrumental in the rapid evolution of these operations and growing them to an unprecedented scale. Contractors do everything from building infrastructure to the dirty work of carrying out intrusions. 3/x

1 3 16 1K 0

Julian-Ferdinand @JulianVoeg

a week ago

1/ We just released a new report on TAG-144 (also known as Blind Eagle), where we identified five distinct activity clusters that have been active throughout 2024 and 2025, primarily targeting the Colombian government at multiple levels. Link: recordedfuture.com/research/tag-1…

1 22 53 8K 16

Lawrence_Sec @Lawrence_Sec

a week ago

New research from the one and only @JulianVoeg on TAG-144 (aka Blind Eagle). This latest report showcases the depth of insight from Recorded Future’s Network Intelligence, especially in revealing the group’s targeted operations against the Colombian government. A must-read 👇

Julian-Ferdinand @JulianVoeg

a week ago

2 1 5 2K 0

Download Image

1 2 14 1K 3

Mandiant (part of Google Cloud) @Mandiant

a week ago

⚠️ Alert: Widespread data theft campaign by UNC6395. The threat actor is targeting Salesforce instances via Salesloft Drift, targeting sensitive data. Organizations should investigate, rotate credentials, and harden access controls. More here: bit.ly/3HviIi1

1 59 143 20K 35

Download Image

Justin Elze @HackingLZ

2 weeks ago

Bump

Justin Elze @HackingLZ

3 years ago

Bump

39 115 659 0 17

14 11 162 14K 5

T. Greer @Scholars_Stage

a month ago

The piece describes five fields of power within the PRC: 1) "The gun" (PLA) 2) "The knife" (domestic security services) 3) "The pen" (propaganda system) 4) "The paper" (Secretariat, CC Gen Office, CCDI, Org Dep) 5) "The blood" (the princeling families and social networks)

1 19 135 12K 36

State of Statecraft Conference @what_is_sos

2 weeks ago

🚨 SOS CFP CLOSES IN 7 DAYS 🚨 Technical / strategic discussions of state-sponsored operations is the focus of SOS! Advise an impact-oriented audience on actors, units, capabilities, or activities from one or more perspectives! #what_is_sos stateofstatecraft.com/cfp

0 10 28 5K 5

Dr. Wesley McGrew @McGrewSecurity

2 weeks ago

If you’ve never read a cyber insurance policy, I recommend it. They’re crazy. The only reason they ever pay out anything is to keep you on the hook for continuing the policy. They can deny pretty much anything as it is!

Marco (Marc) Ayala @ICS_SCADA

2 weeks ago

6 3 32 14K 7

6 16 110 13K 14

Andrew Thompson @ImposeCost

2 weeks ago

I highly encourage everyone to try to get to LABScon at least once. It's my favorite conference, and I sadly can't make it this year due to unanticipated reasons. But next year for sure. You should go.

LABScon @labscon_io

2 weeks ago

0 11 30 8K 4

1 3 20 2K 2

Andrew Thompson @ImposeCost

2 weeks ago

@BladeOfTheRonin @DotNetRussell @hackthebox_eu I don't do CTFs anymore either, but I encourage people who want to be on elite teams as individual contributors to do them.