Security ops engineer and researcher for @DomainTools, writer, voracious reader. he/him. Opinions here mine only. Autistic/depressed/anxious/hungry.
Massachusetts
Joined January 2009
- Tweets52.5K
- Following1.3K
- Followers2.2K
- Likes15.7K
Ian Campbell retweeted
🚨 The LABScon 2026 Call for Papers is officially OPEN!
🗓️ Deadline to submit: June 19, 2026
🔗 labscon.io <- find the button here
Ian Campbell retweeted
This is a stand out part of this piece by @tqbf for me.
Prompt Engineering is kind of a fluff word at this point. But Context Engineering is where I spend most of my time.
I've been talking to @DanielMiessler about everything boiling down to context and scaffolding for a bit
Ian Campbell retweeted
Part 2 of @DomainTools research is out: Inside the Great Firewall Part 2: Technical Infrastructure
dti.domaintools.com/inside-t…
Ian Campbell retweeted
I've been watching the Vertex analysts game this out, and I have to say... It's gonna be LIT 💚
Join us the day before @CYBERWARCON (Nov 18) for a hands-on Synapse challenge! Investigate a real-world data theft scenario, eat snacks, & earn bragging rights + our first-ever custom challenge coin. vertex.link/events/cyberwarc…
My team's Great Firewall dump deep dive part 2, on the GFW technical infrastructure, is now up!
As before, not my research, but reading and editing it and going through the details left me shaken as far as capabilities go.
#geopolitics #cybersecurity
🧵DTI researchers leveraged the leaked data from China’s Great Firewall to map the core design of the censorship stack in Part 2 of Inside the Great Firewall.
Read the technical deep dive here: dti.domaintools.com/inside-t…
#Cybersecurity #ThreatIntel #China #GreatFirewall
2
165
Ian Campbell retweeted
Microsoft casually patched CVE-2025-59287 last week, which is an easy to find & exploit pre-auth RCE in the WSUS! Mind that, vulnerable versions go back to 2012 (oldest still supported OS ver.). Yeah Microsoft invented SDLC yada yada, but can someone explain that?
It's not even a complicated chain to trigger, nor a deep hidden vector to find. It's in the damn GetCookie() right at the initial SOAP from clients.
Shout out to Silobreaker for putting out *really* well-done weekly geopolitical briefs that provide substantial, timely, and relevant analysis without feeling like a chore to make time for.
#threatintel #infosec #cybersecurity
silobreaker.com/resources/re…
linkedin.com/newsletters/geo…
89
Hey folks, just a reminder I'll be at BSides NoVA this weekend, giving a talk on DNS and domain intel in investigative journalism! It's an intersection of passions for me, so I'm wicked excited.
bsidesnova-2025.sessionize.c…
67
This Phrack timeline of the Kimsuky dump is wiiiiiiild.
phrack.org/issues/72/7_md#ar…
(we did some deeper analysis of the dump, linked below, but wow...)
( dti.domaintools.com/inside-t… )
If you need something to read this morning, we published research on Friday around an activity cluster targeting 18+ interests, especially gambling and porn.
Well. Also tax websites. Which I suppose is an adult interest. Sigh.
#threatintel #infosec
dti.domaintools.com/security…
98
Prompt||GTFO events have been extremely educational for me as an AI skeptic, as well as fun and entertaining. Worth checking them out.
Google Form for getting the invite (or applying to present):
docs.google.com/forms/d/e/1F…
LinkedIn post with more info:
linkedin.com/feed/update/urn…
41
We been doin some fun stuff lately
even more fun stuff coming soon.
Feels like I've reached a place where around every corner lies a fascinating rabbit-hole, especially thanks to my teammates.
New from DTI: A financially-motivated cluster of spoofed domains disguised as age 18+ social media content, government tax sites, consumer banking, and online gambling apps targeting Windows and Android users. Learn more ⬇️ dti.domaintools.com/security…
#Cybercrime #ThreatIntel
96
Been a while, Twitter.
Everybody okay?
ALT Lloyd Bridges in Airplane! snorting an iphone, captioned with "Looks like I picked the wrong week to stop doomscrolling." If you recognize this scene, go take your ibuprofen.
44
Ian Campbell retweeted
LABScon 2025, the movie 🎥
youtube.com/watch?v=4ZF0fVRz…
Ian Campbell retweeted
The pattern is simple:
- Dev gives vague instruction
- AI has production access
- Literal interpretation
- Catastrophic damage
Your SOC won't flag it. Your SIEM won't alert.
The attack comes from inside, from tools you authorized.
Ian Campbell retweeted
Introducing a new attack vector: AI-Induced Destruction.
After a shared volume of incident responses, we can confirm: AI coding assistants are now a legitimate threat category.
Not sci-fi. Not theoretical. Happening daily.
Thread (1/4)
Ian Campbell retweeted
Looking for smart reads & listens in cyber?
@Neurovagrant shares what’s buzzing on our team’s radar this week:
🎧 @MaltegoHQ's Human Element
📚 @citizenlab
📰 @NextgovFCW
🔍 @threatinsight
Full list 👉 dti.domaintools.com/cybersec…
Ian Campbell retweeted
DTI reveals a phishing campaign targeting defense and aerospace firms linked to the Ukraine conflict. The infrastructure uses mail servers to spoof organizations and steal credentials, motivated by cyber espionage.
dti.domaintools.com/phishing…
#Ukraine #phishing #CyberEspionage
ALT DomainTools Investigations shares findings of a phishing campaign targeting defense and aerospace firms linked to Ukraine conflict
Ian Campbell retweeted
.@neurovagrant shares his top cybersecurity picks: podcasts, blogs, research papers, and more!
Starting with "To Catch a Thief: China's Rise to Cyber Supremacy" by @nicoleperlroth. Episode 1 features @DAlperovitch. Three episodes out now!
dti.domaintools.com/cybersec…
ALT DomainTools Investigations Cybersecurity Reading List Week of March 24 2025