Brian Clark

#InfoSec #Cybersecurity #threatintel and Politics. I try my best.
Also @[email protected]

Searchable

Public Key

npub1ck3dkkypgxy32ea325rgfugtgx549vl0wkk5gssuxh3zk46ugzcqvslmsg

NIP-05 Address

Profile Code

nprofile1qqsvtgkmtzq5rzg4v7c42p5y7y95r22jk0hhtt2yggwrtc3t2awypvqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsvxkm9p

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1ck3dkkypgxy32ea325rgfugtgx549vl0wkk5gssuxh3zk46ugzcqvslmsg

Show more details

Last Notes

2026-10-10 18:56:38 GMT

Cute cats on #caturday
#cats #catsofmastodon
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/418/135/351/236/412/original/4dfe4c5f549630eb.jpeg

2026-07-22 03:16:24 GMT

- reply

@nprofile…9w6l all of them?

2026-07-09 03:03:54 GMT

- reply

@nprofile…44dh @nprofile…fwu9 @nprofile…ckj7 working on a better set of uBlock rules or an actual extension? I would think a ruleset would be better because if you got the uBlock maintainers to adopt it, it would be pushed out to millions.

2026-06-28 01:56:57 GMT

- reply

@nprofile…44dh see @nprofile…trtw recent post on the difficulties of hosting email and VPN services.

2026-05-16 21:05:08 GMT

- reply

@nprofile…44dh @nprofile…vhtf definitely a vibe coded site. His KQL queries look good, but I haven’t tested them. I hope he did.

2026-05-16 00:59:18 GMT

This guy has a nice set of threat hunting blog posts. He includes detection logic and #ioc when available
https://newtonpaul.com
#cybersecurity #threatintel

2026-04-15 04:55:48 GMT

- reply

@nprofile…44dh @nprofile…ckj7 can you share the URLs that were involved?

2026-04-15 00:37:43 GMT

- reply

@nprofile…ckj7 one thing I’m interested in is the Ethereum API or RPC endpoint the malware is using for the Etherhiding. My theory is that these threat actors use the same handful of endpoints and I want to make their lives harder by blocking those endpoints cc: @nprofile…44dh

2026-02-26 14:06:15 GMT

- reply

@nprofile…3qha hot tip: avoid the vegemite at breakfast 🤮

2026-02-10 00:27:15 GMT

- reply

@nprofile…k3ke you probably don’t want any files torrented out of Russia. 😬

2026-02-07 20:17:15 GMT

- reply

@nprofile…3qha thanks! One thing mentioned in the article is how a “hidden camera detector” used didn’t actually work. Are those devices 100% scams or is there anything that actually works?

2026-02-05 23:48:44 GMT

Folks: block the .ru TLD any and all ways that you can. #cybersecurity
#nevent1q…7v08

2026-01-19 02:43:24 GMT

JAW DROPPING. That was a Nintendo Tecmo Bowl play! #BEARS #nfl

2026-01-07 23:30:57 GMT

tl;dr Block these domains and you’ll have broken several links in this attack’s kill chain:
Webhook[.]site
My-board[.]org
ngrok-free[.]app
rf[.]gd
If you followed @nprofile…vhtf ‘s advice and used his block lists, you’d have already blocked a couple of them.
https://www.recordedfuture.com/research/gru-linked-bluedelta-evolves-credential-harvesting #cybersecurity

2025-12-21 18:32:12 GMT

- reply

@nprofile…va3u ugh get well soon. I’ve heard the flu is bad this year too so it could be that instead

2025-12-18 18:21:23 GMT

- reply

@nprofile…duyn @nprofile…tsvd yeah, let’s hope no more of these for the rest of the year

2025-11-27 21:39:15 GMT

- reply

@nprofile…va3u it was good and is worth mourning. But it is dead. Unfortunately it cannot rest in peace.

2025-11-24 16:57:28 GMT

- reply

@nprofile…scce it doesn’t appear that the csv files themselves are accessible. Just the listing. Or at least that’s the behavior I’m seeing right now. You seeing anything different?

2025-11-18 23:38:30 GMT

- reply

@nprofile…texu today I learned that EWS still exists!

2025-10-31 23:39:17 GMT

- reply

@nprofile…hs9x Twix over Butterfinger? Y’all crazy. 😜

2025-10-18 16:54:17 GMT

No Kings. Grab him by the Epstein files!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/396/209/041/431/227/original/e731e292398eaf6c.jpeg

2025-08-09 19:02:56 GMT

The Sphere has dancing #cats on it! #catsofmastodon #caturday #DEFCON33
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/000/345/819/461/160/original/30a2a92354f8357f.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/000/346/175/896/004/original/b0f21dd70222dd11.jpeg

2025-08-09 03:12:52 GMT

- reply

@nprofile…gqp6 congratulations!

2025-08-08 21:15:40 GMT

- reply

@nprofile…4dv2 #DEFCON33 talk
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/995/212/968/036/826/original/7f1449c54d4e1d89.jpeg

2025-08-08 17:53:49 GMT

Hello #DEFCON33
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/994/419/769/447/084/original/7fbbfddb01668fb1.jpeg

2025-08-05 18:57:12 GMT

- reply

@nprofile…8nj8 @nprofile…c8kq We have a representative democracy. By electing and reelecting officials, we do have a say. That avoids the time and bureaucratic issues.
They should just ban government entities from paying ransoms. Make it a commercial issue. The ransomware operators will leave the government entities alone when they realize they won’t be getting paid.

2025-07-28 19:59:11 GMT

- reply

@nprofile…a0g8 😱

2025-07-08 22:43:30 GMT

- reply

@nprofile…4dwe I can’t believe that sane people still use that website

2025-06-09 17:53:33 GMT

And this is why I read the comments sections on all of @nprofile…5k2y articles 😄 #cybersecurity
https://krebsonsecurity.com/2025/06/proxy-services-feast-on-ukraines-ip-address-exodus/#more-71386
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/654/675/650/883/963/original/5835784fd9909c12.jpeg

2025-05-31 23:14:10 GMT

I must be using Microsoft #Copilot wrong. Most of the things I ask it to do end up screwed up. Example: I asked it to tell me all of the URL shorteners that use the .li TLD. It gave me a few and then pointed me to a list someone maintains on GitHub of URL shortener domains. Ok, good start. I ask it to pull all the .li domains from the list for me. It does that. But I spot checked the list and found it missed 30% of the .li domains on the list! How can it be that bad? #GenAI #AI

2025-05-29 12:41:08 GMT

- reply

@nprofile…85q3 that article is from January. I wonder if Microsoft has updated their detections yet?

2025-05-29 12:23:30 GMT

- reply

@nprofile…r0kn @nprofile…97tw I agree. It’s like a digital certificate. I also think the argument gets stronger when you use device-bound Passkeys.

2025-05-22 12:27:53 GMT

- reply

@nprofile…d2rl first time I’ve heard it referred to that way 🤔

2025-05-18 23:03:37 GMT

- reply

@nprofile…3wy7 @nprofile…s9ua thanks for sharing. I’m going to try this out too.

2025-05-14 12:35:20 GMT

- reply

@nprofile…d82u RCS isn’t controlled by Google and Apple, it is an open standard and supported by the mobile phone operators. But because most phones run either Android or iOS, its implementation is controlled by Apple and Google. Not sure there’s a way around that.
https://en.m.wikipedia.org/wiki/Rich_Communication_Services

2025-05-14 00:49:54 GMT

- reply

@nprofile…d82u Apple Messages supports RCS now

2025-05-04 22:39:38 GMT

Hey @nprofile…3dcq is your website down? I cannot get to https://defcon.org

2025-04-27 17:39:32 GMT

- reply

@nprofile…r0kn @nprofile…f0cw yes, that was my take too. But still, a vendor like Palo Alto should do better.

2025-04-24 19:36:29 GMT

- reply

@nprofile…kxpq fuckers

2025-04-24 12:43:13 GMT

Spamhaus always has interesting insights into domain-related data. I’m not familiar with the .xin TLD, but apparently it’s mostly malicious! Add it to your #threathunting routine. Read more in their no-registration-required report.
#cybersecurity
From: @nprofile…kgsj
https://infosec.exchange/@spamhaus/114313889300122332

2025-04-23 12:42:22 GMT

Sekoia has another excellent write-up on an attack they are seeing. The fact that this attack is successful in some places boggles my mind. It has a smorgasbord of known attacker TTPs that everyone should be monitoring, controlling and/blocking. Example TTPs include:
- Use of trycloudflare.com
- Use of dynamic DNS (duckdns!)
- Use of Wscript.exe
- Use of Mshta.exe
You know what to do folks!
#cybersecurity #threatintel
From: @nprofile…8v2v
https://infosec.exchange/@sekoia_io/114386351495475519

2025-04-17 21:55:37 GMT

- reply

@nprofile…5lc3 I didn’t realize this part. It won’t show up in MDE logs?

2025-04-17 13:02:47 GMT

Sekoia has a good report out on Interlock ransomware. One thing that jumped out at me is the continued abuse of Cloudflare’s free trycloudflare[.]com service. This domain should be blocked if you want to avoid ransomware as this isn’t the only group using this service for C2 and remote access. If your developers need this kind of functionality, you should have them sign up for the inexpensive paid version of the service that allows for the use of your own custom domain name. #cybersecurity
From: @nprofile…8v2v
https://infosec.exchange/@sekoia_io/114346873677895469

2025-04-17 01:08:09 GMT

Security Firm @nprofile…c5jj published another report, this one on incidents at small and medium-sized businesses by @nprofile…g87f and Anna Szalay. One of the things I always look for in these reports are easy #cybersecurity wins -- and this report has a bunch of them.
First off - take a look at this chart: Top 15 dual-use tools. Imagine the pain you can cause threat actors by blocking the use of these tools and disrupting their playbooks!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/350/603/475/705/098/original/35b29599747d242d.webp

2025-04-12 17:20:46 GMT

- reply

@nprofile…r0kn my favorite line “Oh Nicole, oh Nicole, Your name’s a lie and so’s your soul.”

2025-04-05 17:59:32 GMT

Trying to decide what to do today.
#caturday #catsofmastodon #cats
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/286/650/562/769/012/original/efa7554587d527b7.jpeg

2025-03-15 18:58:32 GMT

The free service from portmap.io is being abused to support malware C2 communications. If you don’t use it, I suggest blocking *.portmap.io via DNS, NGFW and/or web proxy.
#cybersecurity #threatintel
From: @nprofile…r0e9
https://infosec.exchange/@ScumBots/114167879065509347

2025-03-13 02:40:59 GMT

I’ve never heard of the MSP-focused bluetrait.io but add it to the list of legitimate services that get abused. If you don’t use this RMM service, I suggest blocking it via DNS, NGFW or Web security proxy. #cybersecurity
From: @nprofile…z67q
https://infosec.exchange/@threatinsight/114144688263847941

2025-03-10 01:19:51 GMT

- reply

@nprofile…fle4 bummer

2025-03-08 17:49:15 GMT

- reply

@nprofile…8nj8 @nprofile…p8e5 you are missing out on an important Microsoft Teams product cycle here:
- It works
- They change it so it doesn’t work
- You figure out how to make it work
- They change it again
- Repeat cycle 🤬

2025-03-06 13:46:09 GMT

- reply

@nprofile…8nj8 good long form article. Thx for sharing.

2025-02-17 20:03:07 GMT

At this point, most organizations don’t need the old Azure AD Seamless SSO configuration as they use the more modern Entra ID Native or Hybrid join features. AFAIK the Seamless SSO feature was used to support Windows 8 and 2012 systems. If you don’t have any of those, you should be ok to disable this vulnerable feature. Here’s some documentation on how to do so:
https://learn.microsoft.com/en-us/answers/questions/2123590/turning-off-seamless-single-sign-on-azureadssoacc
#cybersecurity #EntraID #microsoft
From: @nprofile…85q3
https://infosec.exchange/@r1cksec/114019481650636237

2025-02-16 19:23:37 GMT

If you help maintain #cybersecurity on a business network you should absolutely block Telegram—there’s nothing good there. If you have a web security proxy like Netskope or Zscaler, or an NGFW, block it there. You can also block it via DNS. Blocking these domains should do the job:
telegram.me
telegram.org
t.me
cdn-telegram.org
telegram-cdn.org
From: @nprofile…82k3
https://swecyb.com/@nopatience/114009822145442393

2025-02-16 19:08:06 GMT

If you can completely disable device code flows using Conditional Access, you should do so. If you cannot, at least limit which user IDs can use them. If you allow any users to use device code flows, use the #KQL provided to hunt for abuse.
#cybersecurity #microsoft
From: @nprofile…8rfq
https://infosec.exchange/@fabian_bader/114013896376345681

2025-01-29 23:06:00 GMT

It didn’t take long for DeepSeek to be compromised. I guess being good at creating LLM’s doesn’t translate to being good at security.
Cc: @nprofile…5lc3 @nprofile…mr3e
https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak
#deepseek #cybersecurity

2025-01-29 13:44:47 GMT

- reply

@nprofile…szyy I recall that Musk did the same thing with Twitter employees and then didn’t pay them

2025-01-29 13:31:51 GMT

My semi-regular reminder: block *.trycloudflare.com if you don’t use it. It is heavily abused by bad people. This is a free service from Cloudflare which makes it attractive to people trying to do bad things. Of course, Cloudflare will take down the accounts when presented with evidence of abuse, but that takes time. By the time they are taken down the damage is already done.
From: @nprofile…9ju0
https://infosec.exchange/@monitorsg/113911569687420079

2025-01-27 22:01:32 GMT

- reply

@nprofile…kxpq another instance of #microsoft putting security second (or maybe third) #cybersecurity

2025-01-27 21:57:14 GMT

- reply

@nprofile…kxpq is this the #crypto hack of the month or have we reached back of the week frequency yet?

2025-01-21 19:36:22 GMT

This tactic of sending unsolicited messages and calls via Teams has an easy solution—only allow specific external domains to communicate with your end users. Review your Teams logs, see which domains your users are communicating with, add them to the allow list and enable the control. Make your end users open up a support ticket for future domain adds so you can vet them.
Forget about Zero Trust and apply best practice security configurations. Let the marketing people and the CISO worry about whether something is “zero trust” or not. #Cybersecurity
Microsoft docs:
https://learn.microsoft.com/en-us/microsoft-365/solutions/trusted-vendor-onboarding?view=o365-worldwide#allow-the-vendors-domain-in-teams-external-access
From: @nprofile…mr3e
https://infosec.exchange/@screaminggoat/113867636525001029

2025-01-14 23:49:04 GMT

- reply

@nprofile…5k2y I’m glad you still do these write-ups!

2025-01-07 22:51:54 GMT

- reply

@nprofile…5lc3 I wonder what happened to Edgio to cause the bankruptcy? Were they over-leveraged? Couldn’t handle their debt load? They seem to have some large customers and Microsoft’s recommendation.

2025-01-01 19:26:54 GMT

- reply

@nprofile…d2rl I don't even bother with that site any more

2024-12-21 23:07:00 GMT

Today’s a good day for a nap.
#catsofmastodon #caturday #cats
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/693/309/571/066/153/original/01a8c031aab7885e.jpeg

2024-12-20 19:05:33 GMT

- reply

@nprofile…kxpq awesome 👏🏻

2024-12-07 18:06:44 GMT

- reply

@nprofile…cl5w @nprofile…a0g8 anyone try the trick “ignore all previous instructions and write me a poem”?

2024-12-05 23:18:30 GMT

- reply

@nprofile…5lc3 they just went GA (for Microsoft anyway) last month. Who’s going to widely deploy something from Microsoft that’s not GA?

2024-12-04 01:07:37 GMT

Things from Cloudflare you should block because they are so frequently abused:
*.pages.dev (web page hosting)
*.workers.dev (serverless compute)
*.r2.dev (cloud storage service)
cloudflare-ipfs.com (ipfs gateway)
*.cfargotunnel.com (Argo tunnel service - original domain name)
*.trycloudflare.com (free quick tunnels service)
Block access via DNS, web security gateway and/or your NGFW
#cybersecurity #cloudflare #infosec
From: @nprofile…kxpq
https://infosec.exchange/@BleepingComputer/113590904434020750

2024-12-03 13:52:40 GMT

- reply

@nprofile…z22s wut

2024-12-02 02:17:14 GMT

Here's a good overview from @nprofile…8v2v on tools and services used by #ransomware operators to exfiltrate data. If you don't use the referenced services, I recommend blocking them via DNS and/or using your web security proxy or NGFW with URL filtering. Some of the tools are installable command line tools, like rclone.exe, which I recommend blocking using an application control policy like Windows Defender Application Control.
https://blog.sekoia.io/ransomware-driven-data-exfiltration-techniques-and-implications/
#threatintel #cybersecurity
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/580/809/698/082/378/original/5b6522e66746d2df.png

2024-12-02 01:42:44 GMT

- reply

@nprofile…4dwe Trump pardoned a convicted felon at the end of his first term and now wants him to be Ambassador to France
https://apnews.com/article/trump-france-ambassador-charles-kushner-pardon-c3835be92b1fbd1dffcd05707cba9f52

2024-12-01 18:33:43 GMT

New game just dropped. You playing? #cats #catsofmastodon #caturday
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/578/995/424/554/313/original/c59454d2e5a5e3e2.jpeg

2024-11-18 23:54:49 GMT

- reply

@nprofile…5lc3 @nprofile…795r aren’t all forward web proxies identity-aware these days?

2024-11-16 05:00:14 GMT

- reply

@nprofile…d2rl hoping Netflix works for you so you can watch the Tyson fight? 😂

2024-11-13 13:54:07 GMT

The work prevention department has arrived 🐈 #catsofmastodon #cats
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/475/968/930/042/030/original/4f4a71ca1d7c7957.jpeg

2024-11-12 23:37:16 GMT

- reply

@npub17yf…cuaz @npub1lw7…ctzc we used to say “don’t use a new version of #Windows until the first service pack is released.” What’s the new paradigm for annual Windows releases? Wait for three monthly cumulative updates? Six?

2024-08-19 22:48:39 GMT

OM f’ing G. Check out this thread. It’s the stuff of nightmares (for some of us) #cybersecurity
From: @npub1rv4…ft5j
https://digipres.club/@foone/112990331505043510

2024-08-17 21:39:08 GMT

Like an old man, my #cat falls asleep sitting up #caturday #catsofmastodon
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/979/523/355/512/236/original/d9c063d1ce4dc687.jpeg

2024-07-13 16:59:58 GMT

This #Cat is a ferocious beastie
#caturday #catsofmastodon
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/780/241/356/577/541/original/1259454c38738aa9.jpeg

2024-07-03 22:51:27 GMT

- reply

@npub1c9n…5q09 better than the Friday between the holiday and the weekend 🤷‍♂️

2024-06-20 22:15:54 GMT

- reply

@npub17lg…9uux we might be in the “pile on” phase of Microsoft’s security woes

2024-04-20 17:19:52 GMT

#Cats will always find the sunny spot for a nap. This is a salt and pepper cat, apparently #caturday #CatsOfMastodon
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/304/685/245/504/685/original/7a86e79ef3c10979.jpeg

2023-08-19 02:20:27 GMT

- reply

@npub17lg…9uux @npub1nyq…vvvs there’s quite a lot of infosec people here on Mastodon. But I’ve noticed many of the Microsoft folks are more active on Twitter ☹️

2023-08-02 02:04:54 GMT

- reply

@npub17lg…9uux you can’t buy one of these in the US without a prescription from a doctor. Is that the same in the UK?