Prior: House of Representatives Security Operations Manager, Microsoft Forensics, Amazon Threat Intelligence, Coinbase Insider Threat, USMC Intelligence
Washington, DC
Joined April 2009
- Tweets4.1K
- Following198
- Followers1.2K
- Likes2K
Chris Harrod retweeted
If you haven't already, you will soon see Marines out collecting toys for needy kids.
The Marine Corps Reserve Toys for Tots program began in 1947 by Maj. Bill Hendricks in Los Angeles. Acting under strict orders from his wife, Diane, Maj. Hendricks, and his Marines, collected and distributed 5,000 toys in Los Angeles. The next year, the Commandant of the Marine Corps directed all reserve units to establish a program.
In 2025, thousands of active duty, reserve, retired and former Marines in all 50 states delivered 24 million toys to nearly 11 million children.
If you need a toy for your child for Christmas, or want to volunteer or donate, find your local chapter here: toysfortots.org/find-your-lo…
For those who are looking to donate: cash is king and allows the most flexibility for local chapters to meet unmet needs, but if you're looking to donate a toy, consider something for a child 8+. In my experience with the program, most donations are for kids under 8.
Chris Harrod retweeted
We caught another threat actor using zero-day exploits to compromise an edge device — in this case Ivanti Connect Secure. The used a few different exploits to facilitate RCE and then an escalation of privilege. They did some interesting anti-forensics tricks and then largely leveraged tooling they brought over to try and move laterally.
We were able to fully recreate the exploit chain from memory and core dumps! We built a custom analysis profile and analyzed the memory in @Volexity's Volcano software. Details of the exploits, the threat actor, and how we analyzed it are all up on our blog!
.@Volexity has discovered in-the-wild exploitation of a #zeroday exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). Beginning October 3, a previously unknown threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution on a fully patched device. Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool.
Using its #Volcano memory analysis platform, Volexity analyzed the compromised device’s memory to uncover the full exploit chain and the attacker’s post-exploitation activity, which focused on credential theft, Active Directory reconnaissance, and data exfiltration. Volexity reported these findings to Ivanti through coordinated disclosure.
Read the full analysis, including detection guidance and IOCs, in our blog post here: volexity.com/blog/2026/10/13…
#DFIR #threatintel #memoryforensics
Chris Harrod retweeted
.@Volexity has discovered in-the-wild exploitation of a #zeroday exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). Beginning October 3, a previously unknown threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution on a fully patched device. Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool.
Using its #Volcano memory analysis platform, Volexity analyzed the compromised device’s memory to uncover the full exploit chain and the attacker’s post-exploitation activity, which focused on credential theft, Active Directory reconnaissance, and data exfiltration. Volexity reported these findings to Ivanti through coordinated disclosure.
Read the full analysis, including detection guidance and IOCs, in our blog post here: volexity.com/blog/2026/10/13…
#DFIR #threatintel #memoryforensics
In case you missed it, #hashcat silently dropped a new beta. I think it's been about a year. Maybe I'm out of the loop
hashcat.net/beta/
7.1.0 -> 7.1.2
I'm not sure what the changes are because there isn't anything in the forums. @hashcat ?
Chris Harrod retweeted
Military families, lets have a chat...
Searching Facebook today for the USS Theodore Roosevelt will bring up a plethora of posts from family members confirming their loved one deployed today.
Let's look at this public group, setup specifically for the ship's family.
1/
I miss the days when hacking was more like “let’s see what I can do yolo”.
Now we just con AI into doing the yolo.
I’m still using AI to be a menace that can won’t publish yet.
I just miss the old times.
Chris Harrod retweeted
Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, compromising hospitality-related networks worldwide to steal credentials, access cloud environments, and deliver malware to travelers. msft.it/6010aBX6s
Since early May 2026, the threat actor has conducted widespread but targeted traffic manipulation attacks involving networks served by captive portals. In some cases, users were redirected through actor-controlled phishing infrastructure, while other activity led to the delivery of malware on impacted systems.
Microsoft assesses Storm-2945 to be an operational sub-cluster of Midnight Blizzard and details the malware, tradecraft, and cloud-focused techniques used throughout the campaign, including device code phishing and credential theft activity targeting travelers.
Get detections, mitigation, and hunting guidance from this Microsoft Threat Intelligence blog post.
Chris Harrod retweeted
‼️ Scattered Spider members Owen Flowers, 18, from Walsall, and Thalha Jubair, 20, from east London have both been sentenced to 5 years and 6 months in prison.
The video is from when both Bomb and Earth2Star/Autism were arrested.
CVEs with birthdays is a new term that has entered my vocabulary.
What do I see in this picture? Not the current crisis impacting 40,000 people.
I see someone in the future loading an RV up with explosives and storing it next to these tanks.
Hopefully someone else in a position to stop that also sees this as a problem.
These birds are obviously not from Maryland because they’re staying in their lane.
NEW: A family of geese, walking instead of flying, clogged I-66 westbound for more than an hour this afternoon. A @MetroTransitPD K-9 officer protected them by himself for about 45 minutes. After @VSPPIO and @ArlingtonVaPD joined in, there appeared to be a failed effort to guide them off at the Sycamore Street exit. A second appearance of the police K-9 apparently then spooked mom and dad. From the @VaDOTNOVA/ SafetyVid.org video it appears that, in the end, the kids and parents became separated. Not the happiest of endings, but not the worst. @ARLnowDOTcom @charlienbc @matthewyoung31 @NFTC_News @CordellTraffic @AdamTuss @HCBright10 @HillaryHowardDC @wmata @wmataGM @DCNewsNow #police #geese #birds #Virginia #vatraffic #traffic
Chris Harrod retweeted
Another quality technical blog from #MIRAGE, this time on Secret Blizzard’s beloved #Kazuar malware. This blog is an in-depth analysis of Kazuar’s progression from a single, monolithic framework into a modular bot ecosystem composed of three distinct module types, each with clearly defined roles. Together, these components distribute functionality across the P2P botnet, enabling flexible configuration, lower observability, and broad tasking while minimizing opportunities for detection.
microsoft.com/en-us/security…
Chris Harrod retweeted
YARA-X 1.16.0 is out!
This time with performance improvements that make it much faster. With this release YARA-X is faster than traditional YARA in almost every case.
github.com/VirusTotal/yara-x…
