BushidoUK

BushidoUK copied to clipboard

👋 Intro:

• 🔭 I’m a Security Researcher working in Cyber Threat Intelligence since 2019
• 🎓 BSc (Hons) Graduate of Computer and Information Security
• 📜 Student of SANS FOR578 and earned the GIAC GCTI certification
• 📝 Co-Author and Instructor of the SANS FOR589 Cybercrime Intelligence course
• 👉 Read about my first year in CTI here
• ⚡ Fun fact: I discovered OZH RAT and TitanStealer
• 🕵️‍♂️ I've contributed to the Mitre ATT&CK framework - TeamTNT & SEO Poisoning
• 📚 I create my own Hacker Fiction stories (with a little help from AI) here
• 💻 Previously worked for Cyjax, read my Research Blogs here
• 🌐 Currently working at the Equinix Threat Analysis Center (ETAC)

🤖 My Projects:

• Open sources tools for CTI - Collection of resources for OSINT analysis
• Exploring APT campaigns - VirusTotal Graphs and Maltego Diagrams
• 2x Insider Threat-themed CTFs - OSINT challenges
• Malware Zoo- Hashes of famous malware
• Open Source Malware- Links to OSTs on GitHub
• OSINT Search Operators- Shodan Queries and Google Dorks
• CTI Lexicon- Acronyms and Technical Jargon
• CTI Quiz - 4 Topics of Multiple Practice Questions
• Abuse Legitimate Services - List of services used for malware and phishing
• Android Banking Trojan Nexus - Centralised list of Android banking malware families
• Breach Report Collection - Collection of breach reports for case studies
• Cybercrime Police Raids - Collection of raids on cybercriminals by police for case studies
• UK Critical Infrastructure - Collection of case reports of attacks on UK CNI for case studies
• OPSEC 101 - A guide to better security for non-technical family, friends, and colleagues
• YARA Rules - Repo of my various YARA Rules that can be used for Threat Research
• Python Projects - Repo of my various Python Scripts that can be used for CTI
• The CTI Analyst Challenge - A training repository for CTI analysts to practice answering PIRs and RFIs

🌐 My Community Projects:

• EternalLiberty - APT moniker database
• Curated Intel: Log4Shell IOCs - Vetted IOCs and analysis of threats leveraging Log4Shell
• Curated Intel: Ukraine Cyber Operations - Threat Intelligence to assist Ukrainian organisations
• Curated Intel: CTI Fundamentals - A collection of essential resources related to CTI theory
• Curated Intel: MOVEit Transfer Campaign Tracking - Tracking events related to the MOVEit campaign
• Curated Intel: Threat Actor Profile Guide - A guide for CTI analysts

🎙 My Talks:

👨‍🏫 My Workshops:

🎤 Podcasts:

🏛️ My Government Features:

• CISA.gov - Link to Curated Intel resource on Log4Shell
• HHS.gov - Malicious Use of Email Marketing Services
• HHS.gov - Abuse of Legitimate Security Tools and Health Sector Cybersecurity
• CERT Ukraine - APT28 (UAC-0028)

📰 My MSM & Tech News Features:

• CNN - LockBit attack on ICBC
• Reuters - ALPHV/BlackCat Exit Scam
• The Telegraph - Royal Mail SMS phishing campaigns
• The Telegraph - NB65 leverages Conti source code
• The Telegraph - Qilin Ransomware attack on the NHS
• Vice Motherboard - Workers Unite
• TechCrunch - Israel/Hamas War Hacktivism
• WIRED - Israel/Hamas War Hacktivism
• WIRED - Jia Tan & XZ Backdoor

🏢 My Infosec Vendor & Community Features:

• 🎤 My Interview with TheSecurityNoob blog here
• 1️⃣ Top of the 'Top 10 CTI Experts & Intelligence Pioneers' in 2024 here
• 🔟 On the SOCRadar 'Top 10 Twitter Accounts to Follow for Threat Intelligence' in 2023 here
• 🏅 On the SentinelOne '23 Influential Accounts to Follow in 2023' here
• Microsoft 365 Defender Threat Intelligence Team - Franken-phish
• Microsoft 365 Defender Threat Intelligence Team - The Conti Leaks
• Maltego - How Do You Run a Cybercrime Gang?
• RISKIQ - Turkey Dog
• Rapid7 - REvil attack on Kaseya
• Splunk - REvil attack on Kaseya
• VirusTotal Blog - North Korean APT using the Amadey Trojan
• Proofpoint - Charting TA2541's Flight
• SentinelOne - Ransomware Decryption Intelligence
• CyberDefenders - L'espion OSINT CTF
• SANS Internet Storm Center - Qakbot
• SANS OSINT Summit - Discord for CTI
• Phishunt.io - Community

🗞️ My Infosec News Features:

• Bleeping Computer - Hunters International, potential Hive rebrand
• Bleeping Computer - APT Targeting Renewable Energy
• Bleeping Computer - Basecamp
• Bleeping Computer - North Koreans Targeting Researchers
• Bleeping Computer - BazarCall
• Bleeping Computer - Monzo phishing
• Bleeping Computer - Brute Ratel Cracked
• Bleeping Computer - ESXi Linux version of Royal Ransomware
• Bleeping Computer - Coinbase SMS attacks
• Bleeping Computer - Dragos Security Incident
• The Record - IcedID spam campaign
• The Record - Passwordstate
• The Record - APT31
• The Record - Trickbot
• The Record - Phorpiex
• The Record - BlackMatter
• The Record - REvil affiliate
• The Record - Log4Shell
• CyberScoop - Belarus Cyber Partisans
• CyberScoop - Aviation RATs
• CyberScoop - Exposing Ransomware Operators
• CyberScoop - Breach Forums Takedown
• CyberScoop - Genesis Market Seized
• CyberScoop - UK Electoral Commission Breach
• CyberScoop - ALPHV/BlackCat Exit Scam
• Risky Biz News - The Continuity of Conti
• Risky Biz News - Darth Maul Market
• Risky Biz News - RedZei
• Risky Biz News - Raspberry Robin
• Risky Biz News - GreenMwizi
• Risky Biz News - The DaVinci Group
• Arstechnica - APT31
• PortSwigger - North Koreans APTs
• DarkReading - RedZei
• The Register - Conti attack on HSE
• The Register - CL0P campaigns against MFTs
• Infosecurity Magazine - LockBit Claims TSMC Hack
• Infosecurity Magazine - UK Electoral Commission Breach
• Infosecurity Magazine - iSOON Leaks
• The Hacker News - TitanStealer
• The Hacker News - RedZei
• Security Affairs - Brute Ratel Cracked
• Security Affairs - CL0P claims ICS vendors
• SecurityWeek - APT campaign targeting EMEA and APAC governments
• SecurityWeek - ICS Vendors Targeted in Espionage Campaign Focusing on Renewable Energy
• Bank Info Security - iSOON Leak