Steve Stone
@stonepwn3000
@sentinelone | Fmr. @Mandiant, @IBM, @rubrik, USG | TV/VCR repair, views are my own. Also [email protected]/stonepwn3000.bsky
trailing hashtags are where innovators go cantstopwontstop# trendsetter# mrstealyourhashtag#
DPRK continues pressing fake employees--great rundown from Sentinel Labs (h/t to @TomHegel and Dakota Cary from PinnacleOne) on 4 diff sites covering activity across several countries and regions. The scope and scale of this thing continues to grow. sentinelone.com/labs/dprk-it-w…
Love to see this kind of action taken against these threats. Also love to see our @LabsSentinel team named several of these entities publicly seven months ago.
💜 Our December 2024 research into DPRK IT Worker operations identified key front companies and personas now named in DOJ indictments. 🔗 SentinelLabs by @DakotaInDC & @TomHegel: sentinelone.com/labs/dprk-it-w… 🔗 DOJ: justice.gov/opa/pr/justice…
Great piece from three excellent @LabsSentinel researchers with a bit of a perspective difference. Love it. Also stoked @SentinelOne let us do this-most cos don’t want to discuss a single effort against you little less nonstop pressure.
🚨New research drop: Top Tier Target | What It Takes to Defend a Cybersecurity Company from Today’s Adversaries 🌐 China-nexus APTs targeting supply chains 🔍 DPRK IT workers infiltrating hiring pipelines 🛠 Ransomware crews probing EDR platforms [1/2]
shots fired...im hit, im hit
after finishing “finalFINALv38-new.xlsx”
Im reposting their repost of me just bc im super cool and edgy
x.com/stonepwn3000/s…
Had some fun w/ @LabsSentinel predictions. We intentionally didn't discuss, went to separate corners, came up with "predicts", then came together. That exercise led to some far-ranging predictions. I hope you enjoy kicking it around as much as I have. sentinelone.com/blog/cybersecu…
Stoked to see the new research from @LabsSentinel (h/t to @milenkowski). Particularly loved the rundown of how they choose to remain practical in their craft and focused on lots of valid access. sentinelone.com/labs/operation…
We're expanding @SentinelOne 's capabilities for intelligence, hunting, & internal mechanisms to do these tasks better/faster/farther. If you don't see the perfect role for you now, check back in as this is only the beginning of our expansion. sentinelone.com/jobs/
Good blog from Jim Walter at @LabsSentinel --example for why cybercrime attrib is tricky. Shifting group members coupled w/ diff ransomware families...combined with ideology from one geoloc supporting a different one. Other than that, easy as pie. sentinelone.com/labs/cybervo...
Found the part about the TA's ability to routinely acquire valid Apple developer accounts interesting, as well as continued ability to get their malware notarized by Apple and bypass other existing security gates.
🔥 New from @philofishal , @syrion89 and @TomHegel: 🇰🇵 BlueNoroff Hidden Risk | Threat Actor Targets Macs with Fake Crypto News and Novel Persistence sentinelone.com/labs/bluenorof…
We have one eagle pair riding out fall and winter-super cool to see after all the other birds of prey migrated already.

Great primer from @LabsSentinel on cloud malware from Alex Delamotte. Esp liked the breakout of two approaches for hunting in the cloud. sentinelone.com/labs/cloud-mal…
These APTz out here just being bold and calling their shots in advance now.

Interesting to see Mac ransomware become more credible. Bad actors clearly still working through it so recommend staying ahead of this one. Nice to see from @LabsSentinel (Shoutout to Phil). sentinelone.com/blog/macos-not…
Recently turned on AI summary for all my Zoom meetings. HIGHLY recommend--its not always right, but its super informative. Also interesting to see if my recollection of a call matches the output.
Personally really excited to see how active DoJ is this election cycle against a wide range of cyber threats. There’s little Individual victims can do in this situation but governments can establish norms.
US charges 3 Iranian hackers for targeting Trump campaign: cnn.com/2024/09/27/pol…
Yo this is not ok. You shouldn’t just hurt me like that and then walk away.
This is a pretty wild start to the week
This is why handing root-level access to Kaspersky was a huge risk. Users were "migrated" - software uninstalled and a totally different product was installed automagically. They had total control of your machine. #itsabouttrust