Tech Director / Threat Intelligence at Microsoft. Previously, Director of Incident Response & Intel Research at Mandiant. Former Chief Technical Analyst at CISA

• Pinned

  

  Russian threat actor Midnight Blizzard is conducting widespread traffic manipulation attacks at hotels worldwide. Result: delivering malware or redirecting auth flows at their discretion, globally. Since early May 2026, we saw this subcluster manipulate DNS and HTTP traffic from

  

• 

  If I’ve learned anything from ransomware threats, Google should turn around and threaten to leak the whole thing for $15M 😅

  

  Wow, seems like Google is buying Spirit Airlines' enterprise data for $10m (outbidding Mercor at $7.5m). Basically includes every internal document, email, workflow, and codebase for a once $6B company. Honestly, $10m for 34 years of operational data really seems like a steal.

  

• 

  “I do agree that the public has a negative view of AI… I think it is fundamentally a crisis of trust. I think that ordinary people don’t trust companies, governments, or the tech industry and always suspect that we are cooking up some new way to screw them over. …I think by far

  

  Replying to @DarioAmodei

  2/2 Second, on the messaging around AI.  I do not agree that my messaging has been disproportionately negative.  In fact it has been about equally balanced between risks and benefits: I’ve written one major essay about each, and even in interviews where I discuss the risks, I

• 

  

  

  

  

• 

  My biggest concern with private sector offensive action vs crime – having run the global cybercrime & ransomware intelligence team for almost 4 years – is just how difficult attribution in criminal operations is, and how few organizations can repeatably do it right (including