Herder of cybercats at @google Threat Intelligence Group / TAG. Views are my own.
Montréal
Joined September 2008
- Tweets3.5K
- Following560
- Followers1.2K
- Likes2.8K
Pinned Tweet
Spyware is used against high-risk users: journalists, human rights defenders, dissidents and political opponents. I'm particularly proud of our latest work, shedding light on Commercial Surveillance Vendors who make $$$ exploiting vulnerable systems and users. 🧵
Announcing the latest report from Threat Analysis Group documents the rise of commercial surveillance vendors and the industry that threatens free speech, the free press and the open internet
blog.google/threat-analysis-…
Some highlights below. 🧵
Still Spying: even after getting hit with U.S. sanctions, spyware vendor Intellexa (Predator) is still dodging restrictions, exploiting 0days and selling digital weapons to the highest bidder. @google 🧵 #zerodayexploit #spyware cloud.google.com/blog/topics…
Since 2021, #Intellexa has been linked to 15 unique 0day exploits affecting everything from Chrome and Android to iOS and ARM. With their kit PREYHUNTER checking to see if you're a security researcher, to shut off its attack and evade detection.
1
90
Toujours un grand plaisir d'échanger tech & cybersécurité avec @Guglielminetti à ~29:17min sur l'émergence d'outils qui modifient leur propre comportement en temps réel pour éviter la détection: moncarnet.com/2025/11/27/mon…
📄 Rapport complet: lnkd.in/e8jPAr5M
1
64
In Jan'25, we published analysis of APTs attempting to use gen AI, specifically Gemini: no novel capabilities, just common usage, largely ineffective. Check out today's update on advances in threat actor usage of #AI tools: cloud.google.com/blog/topics… 🧵
1
99
New Malware Attributed to RU State-Sponsored COLDRIVER (🧵) cloud.google.com/blog/topics… ✍️ @wxs
Good to see some @Jigsaw love
"What we just conducted is the largest town hall in America."
See how our @Jigsaw team is using AI tools to help communities increase civil participation and turn constituent ideas into action in this piece from Judy Woodruff for @NewsHour. youtube.com/watch?v=3sECgmSM…
67
... which is why none of the usual VPNs are working reliably. Without starlink devices on the ground, it's impossible for Iranian citizens & reporters to link to the world 💔
NetBlocks, which monitors global internet access, reported today: live data shows that nationwide internet in #Iran has been almost completely cut off. This follows earlier partial disruptions and comes amid escalating military tensions with Israel.
1
110
Reminder to update your devices as soon as one becomes available (⚙️ > system > software updates > check for updates)
🚨 UPDATE YOUR DEVICES 🚨: Amnesty International uncovers sophisticated zero-day exploit affecting billions of Android devices.
Cellebrite's Linux USB exploit was used to unlock the phone of a Serbian youth activist, targeted in December 2024 **after** previous reports abuses
1
144
AI weaponization by threat actors? Our research shows the theoretical fears currently outpace reality. Read Google's Threat Intelligence Group's latest research: Adversarial Misuse of Generative AI @google cloud.google.com/blog/topics…
Our research found threat actors experimenting with Gen AI tools, mainly for productivity gains like research, code troubleshooting, & content creation. No novel malicious capabilities were developed, and attempts to bypass safety controls with jailbreak prompts were unsuccessful. #AIsecurity
2
72
Great article by @ksadjadpour on #iran vs. Saudi Arabia's historic + ideological grievances, and each theocracy's quest for dominance in the Middle East.
Read @ksadjadpour on Iran and Saudi Arabia’s conflicting visions for the future—the former’s based on historic grievances, and the latter’s on modern aspirations—and how these plans could shape Middle Eastern politics in the years ahead.
foreignaffairs.com/middle-ea…
3
262
@Google TAG's continued efforts to expose spyware vendors (CSVs) details campaigns delivering n-day exploits for which patches were available, but exploit would still be effective against unpatched devices. @_clem1 research blog.google/threat-analysis-… IOCs on github.com/google/threat-tea…
1
71
#IRGC #APT42 busy targeting current/former Israel & US officials, political campaigns, diplomats, think tanks, NGOs, academic institutions contributing to foreign policy etc, using phishing tactics, hosting malware/phishing pages, malicious redirects. IOCs github.com/google/threat-tea…
🆕🚨 analysis from @Google on APT42 activity against 🇺🇸 and 🇮🇱. A ton of work from folks over the past few months dedicated to protecting users disrupting campaigns, and making life hard for the actors. More to come!
blog.google/threat-analysis-…
Legal action against spyware vendors is the next step in our fight against #spyware @google (short 🧵) blog.google/outreach-initiat…
TAG is looking for a SecEng to join us in #montreal: worked in threat intelligence? know malware analysis? can hold your own in Python, C/C++ or other scripting langs? We wanna chat. Apply at t.ly/mOaC7
🆕 opening on our @Google TAG team in beautiful Montreal 🇨🇦 focused on countering criminal actors 🦹🦹targeting our users and abusing our platforms - awesome team having a huge impact!
google.com/about/careers/app…
The term 'HeliKotlet' is trending on the webs 😂 I'll let you look that up on your own. #HeliKotlet #هلیکتلت
1
199
Happy Norouz 2024 to all those who celebrate the vernal equinox, a time to shed the old & bloom anew. #نوروز_پیروز #نوروز
g.co/doodle/sdhg5jq
111
Congrats on the 'undesirable organization' label 😉. Clearly, you're doing something right 🍁 @citizenlab @munkschool
Russia just designated @munkschool @UofT (@citizenlab's home) an “undesirable organization”
A badge of honour. We stand in solidarity with our colleagues & all those working for democracy in 🇷🇺
We’ll never stop exposing Kremlin-sponsored malfeasance
rferl.org/a/russia-labels-ca…
2
156