Thread by @Mandiant

Great turn out for today’s #RSAC keynote presentation from Mandiant’s @JumpforJoyce and @DAlperovitch, titled “Global Threat Brief: Hacks and Adversaries Unveiled”

This session will be an unveiling of the most novel attacks in the current global threat landscape, diving into specific, real-time examples of threat actor activity from both nation-states and criminal groups, along with strategic advice for countering them. #RSAC

They’ll begin with a deep dive on the Ukraine cyberwarfare front, covering the top cyber defender takeaways to date. Stay tuned to find out “Resiliency is Key” #RSAC

Here we go! @JumpforJoyce & @DAlperovitch have taken the stage. We are lifting the veil on hacks and adversaries at #RSAC. Attendance is packed, so we are sharing insights here live.

First up: How as the I/O war in Ukraine played out? Digging into the efficacy of this offensive, it’s clear that the Russian I/O has floundered in the shadow of Zelenskyy’s hero cry across social media. #RSAC

"One of the biggest cyber events we've ever seen happened in the early days of the Ukraine war." - @DAlperovitch #RSAC

“What we’re looking at is that most people in the world live in countries that are neutral to Russia’s attacks or actually support it,” says @JumpforJoyce at #RSAC.

“It’s stressful enough to do an incident response, let alone do one during a war.” - @JumpforJoyce #RSAC

“Ukrainians have got so good at rebuilding networks within a few hours. We don’t practice that [resilience] often enough in this country.” - @DAlperovitch #RSAC

“The type of resistance within the cyber domain that we are seeing in the Ukrainian situation is incredible.” - @JumpforJoyce #RSAC

Defender takeaways from the attack on Ukraine include one major headline; there are learnings here, resiliency is key. Don’t be scared of I/O and finally, #SHIELDSUP by @CISAgov. #RSAC

“The attack surface can be very vast, incredibly weird, and a little bit creative,” says @JumpforJoyce during her #RSAC keynote with @DAlperovitch.

“One of the things that you are seeing from the Chinese is moving from traditional platforms to some of these more esoteric platforms … using min standard protocols like GPRS.” - @DAlperovitch during #RSAC keynote.

During her #RSAC keynote @JumpforJoyce says, “We saw more than double the number of zero-days in the last year, and China was responsible for 10% of them.”

“It’s long past time to look at other assets in your network that these actors are trying to exploit.” - @DAlperovitch of @SilveradoPolicy #RSAC

“Iran has been targeting many organizations in the Middle East. They are using social engineering and aging social media accounts to give these handles more of a backstory.” - @JumpforJoyce #RSAC

“North Koreans are back. We’re continuing to see incredible innovation because they are really pushing the envelope in terms of techniques,” explains @DAlperovitch at #RSAC.

“Is ransomware going up or down? At Mandiant we have seen a spike in the last week and a half…and we’re seeing an increase in #ransomware shaming sites,” says @JumpforJoyce. #RSAC

“Communication is the most important thing in a response exercise. The companies that do well in these situations operate with transparency,” says @DAlperovitch. #RSAC

“The other piece of the rise of hackers for hire, we’ve seen that it’s a way that actors can obfuscate and confuse attribution.” - @JumpforJoyce #RSAC

“At Mandiant we see response to over 1,000 incidents every year and we watch organizations go through a tremendously challenging situation and then we watch them resolve it and get back on their feet,” says @JumpforJoyce at the conclusion of her #RSAC keynote w/ @DAlperovitch.