Nick Carr Profile picture
Tech Director / Threat Intelligence at Microsoft. Previously, Director of Incident Response & Intel Research at Mandiant. Former Chief Technical Analyst at CISA

Jan 17, 2020, 9 tweets

In response to increased U.S.-Iran tensions & concerns of retaliatory cyber attacks, Iranian intrusion experts @sj94356 & @QW5kcmV3 are on #StateOfTheHack for the latest on all things Iran: #APT33 #APT34 #APT35 #APT39 #MuddyWater & active UNC groups 🇮🇷👨‍💻🕵️‍♂️

@sj94356 @QW5kcmV3 Wait, did @YouTube remove the #StateOfTheHack episode? 👉feye.io/soth 👀
Are we being oppressed? Do they think this is a U.S.-Iran influence operation? ... is it? 🇺🇸🇮🇷Am I going to get a bunch of weird #MAGA replies to this tweet? I have so many questions 😅🙃

For more information on mitigations as well as our public source material supporting the discussion from the show, please check out:
• APT33 graduation: fireeye.com/blog/threat-re…
brighttalk.com/webcast/10703/…
• APT33 webinar & examples: fireeye.com/blog/threat-re…
... (more below)

• A cool TEMP.Zagros phishing campaign: fireeye.com/blog/threat-re…
• APT35 highlights in MTrends 2018: fireeye.com/content/dam/co…
• Iranian information operations: fireeye.com/blog/threat-re…
• RULER home page use by Iranian groups & mitigations: fireeye.com/blog/threat-re…
(still more...)

• APT39 graduation: fireeye.com/blog/threat-re…
• Iranian DNS Hijacking (DNSpionage): fireeye.com/blog/threat-re…
• More Iranian influence operations: fireeye.com/blog/threat-re…
• APT34 social engineering via LinkedIn: fireeye.com/blog/threat-re…
(done right? probably soon...)

• FireEye response to mounting U.S.-Iran tensions: fireeye.com/blog/products-…
• U.S.-Iran tensions webinar & mitigations overview: brighttalk.com/webcast/7451/3…
🥵

I also put all of these links into the episode show notes so you can listen on the way to work on Monday and read as you wish.
Podcast on @iTunes: feye.io/soh

I hope you consider giving the latest #StateOfTheHack episode a listen on the way into work: plinkhq.com/i/1355885314
Very curious whether our observations on the pace, scale, and advancement of Iranian intrusion activity aligns with yours. Anything we got wrong? Missed?

Tried a universal podcast link. Not sure how to link directly to an episode that way, but this works:

🍎 @iTunes: podcasts.apple.com/us/podcast/s3e…

🤖 /📱 @Android / my preferred app (@pocketcasts): pca.st/episode/c97298…

⭐️ Consider rating the show, too. Last review was 1 year ago!

Share this Scrolly Tale with your friends.

A Scrolly Tale is a new way to read Twitter threads with a more visually immersive experience.
Discover more beautiful Scrolly Tales like this.

Keep scrolling