Opalsec :verified:<p>I find the ShinyHunters (UNC6040/UNC6240) Salesforce Campaign really interesting, because it highlights the impact of two key threat vectors/types that - in my conversations , at least - aren't being accounted for by traditional TI teams.</p><p>1. Data Theft & Extorsion Actors<br>2. Actors capitalising on 3rd Party Platform Applications</p><p>Curious to know - do your orgs track and threat model opportunistic Data Theft and Extorsion Actors, or just focus on the APTs and ransomware groups of the world?</p><p>The largest ransom payment in history was $75 million to the Dark Angels Ransomware group in 2024, purportedly by pharma giant Cencora. With 27TB of corporate data stolen from the org and no mention of ransomware being deployed, the eye-watering payment was to prevent leaking/sale of the stolen data which included customer "names, addresses, dates of birth, diagnoses, prescriptions and medications."</p><p><a href="https://www.bloomberg.com/news/articles/2024-09-18/gang-got-75-million-for-cencora-hack-in-largest-known-ransom" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bloomberg.com/news/articles/20</span><span class="invisible">24-09-18/gang-got-75-million-for-cencora-hack-in-largest-known-ransom</span></a></p><p>The group weren't well known prior to the attack, and the absence of ransomware being deployed highlights the need to prioritise the identification and protection of sensitive data and customer PII - agnostic of whatever group might seek to target it.</p><p>Also, we're all aware of Malicious OAuth applications in o365, but are your orgs aware of; monitoring, and locking down 3rd party platform integrations?</p><p>For those unaware of the campaign, here's the AI-generated TLDR of a Google report in the activity: <a href="Https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible"></span><span class="ellipsis">Https://cloud.google.com/blog/</span><span class="invisible">topics/threat-intelligence/voice-phishing-data-extortion</span></a></p><p>Threat Summary: UNC6040/ShinyHunters Voice Phishing and Data Extortion Campaign</p><p>Key Points & Technical Summary:</p><p>A financially motivated threat cluster, tracked by Google as UNC6040, has been conducting a widespread campaign targeting organizations' Salesforce CRM instances. The campaign's primary objective is large-scale data theft for the purpose of extortion, which is carried out by a related cluster, UNC6240. This group often uses the moniker ShinyHunters in their communications with victims.</p><p>The core of the attack vector is a sophisticated voice phishing (vishing) campaign. The threat actors impersonate corporate IT support personnel in phone calls to employees of the targeted organization. </p><p>The primary technical steps of the attack are as follows:<br> * Social Engineering: The actor guides the targeted employee to Salesforce's connected app setup page.<br> * Malicious App Authorization: The employee is convinced to authorize a malicious version of the "Data Loader" application. This is done by having the employee enter a connection code provided by the attacker, which links the attacker-controlled application to the victim's Salesforce environment.<br> * Data Exfiltration: Once the malicious app is authorized, UNC6040 gains significant API access, allowing them to query and exfiltrate sensitive data from the Salesforce instance. While initially leveraging modified versions of the Salesforce Data Loader, the group has evolved its tooling to include custom Python-based scripts for data extraction.<br> * Anonymization: The attackers utilize services like Mullvad VPN and TOR exit nodes to initiate the vishing calls and for data exfiltration, complicating attribution and tracking efforts.<br> * Extortion: Following the data theft, UNC6240 initiates contact with the victim organization, demanding a ransom payment in Bitcoin, typically within a 72-hour timeframe, to prevent the public release of the stolen data. The group is also reportedly preparing to launch a dedicated data leak site to increase pressure on victims.</p><p>Additional Context & Related Activity</p><p>Activity Cluster:</p><p>The activity is attributed to the cluster pair UNC6040 (initial access and data theft) and UNC6240 (extortion). This group leverages the reputation of the well-known ShinyHunters extortion group to intimidate victims. The cluster is financially motivated and has demonstrated a growing sophistication in its social engineering tactics and technical tooling.</p><p>Other Compromises & Targets:</p><p>This campaign has impacted numerous high-profile organizations across various sectors. Besides Google, other publicly confirmed victims of this campaign include:<br> * Cisco<br> * Chanel<br> * Adidas</p><p>The targeting appears to be opportunistic, focusing on multinational corporations that are heavy users of Salesforce CRM. There has been an initial focus on English-speaking employees.</p><p>Techniques & TTPs:</p><p>Beyond the core vishing-to-malicious-app-authorization chain, other observed Tactics, Techniques, and Procedures (TTPs) include:<br> * Credential Targeting: In some cases, the actors have targeted Okta credentials, likely obtained through prior infostealer malware infections or separate phishing campaigns.<br> * Lateral Movement: Using compromised credentials, the actors have been observed moving laterally within victim networks to access and exfiltrate data from other systems, including Microsoft 365.<br> * Reconnaissance: The group conducts thorough reconnaissance to craft convincing narratives, identifying internal application names and IT support procedures to make their vishing calls more credible.</p><p>Timeline:<br> * June 4, 2025: Google's Threat Intelligence Group (GTIG) first publishes a warning about the rise in vishing and extortion activity targeting Salesforce customers, designating the threat actor as UNC6040.<br> * June 2025: Google becomes a victim of the same campaign, with one of its own corporate Salesforce instances being breached. The compromised data was related to small and medium-sized business contacts.<br> * July 24, 2025: Cisco identifies a similar breach of its CRM system resulting from a vishing attack.<br> * Early August 2025: Google, Cisco, and other victims publicly disclose the breaches. Google updates its original blog post to include the fact that it was also a victim. Extortion demands from UNC6240/ShinyHunters follow these disclosures.</p><p><a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/ThreatIntelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatIntelligence</span></a> <a href="https://infosec.exchange/tags/ShinyHunters" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ShinyHunters</span></a> <a href="https://infosec.exchange/tags/DataExtortion" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DataExtortion</span></a> <a href="https://infosec.exchange/tags/SalesforceSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SalesforceSecurity</span></a> <a href="https://infosec.exchange/tags/Vishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Vishing</span></a> <a href="https://infosec.exchange/tags/ThirdPartyRisk" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThirdPartyRisk</span></a> <a href="https://infosec.exchange/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatModeling</span></a> <a href="https://infosec.exchange/tags/IncidentResponse" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IncidentResponse</span></a> <a href="https://infosec.exchange/tags/UNC6040" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>UNC6040</span></a> <a href="https://infosec.exchange/tags/UNC6240" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>UNC6240</span></a> <a href="https://infosec.exchange/tags/Ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Ransomware</span></a> <a href="https://infosec.exchange/tags/Salesforce" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Salesforce</span></a> <a href="https://infosec.exchange/tags/InformationSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>InformationSecurity</span></a> <a href="https://infosec.exchange/tags/Infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Infosec</span></a> <a href="https://infosec.exchange/tags/Cybersec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cybersec</span></a> <a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatIntel</span></a><br><a href="https://infosec.exchange/tags/Cisco" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cisco</span></a> <a href="https://infosec.exchange/tags/Google" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Google</span></a> <a href="https://infosec.exchange/tags/CyberAttack" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberAttack</span></a></p>
fosstodon.org is one of the many independent Mastodon servers you can use to participate in the fediverse.
Fosstodon is an invite only Mastodon instance that is open to those who are interested in technology; particularly free & open source software.
If you wish to join, contact us for an invite.
Administered by:
Server stats:
8.6Kactive users
fosstodon.org: About · Status · Profiles directory · Privacy policy
Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.4.3
#threatmodeling
1 post · 1 participant · 0 posts today
Tanya Janca | SheHacksPurple :verified: :verified:<p>With 25+ presentations to choose from, I cover everything from <a href="https://infosec.exchange/tags/securecoding" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>securecoding</span></a> and <a href="https://infosec.exchange/tags/threatmodeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatmodeling</span></a> to AI risks and <a href="https://infosec.exchange/tags/AppSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AppSec</span></a>—always with humor, clarity, and actionable takeaways.</p><p>💡 These aren’t just talks—they’re lessons your team will remember.</p><p><a href="https://twp.ai/9PUvTW" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">twp.ai/9PUvTW</span><span class="invisible"></span></a></p><p>2/3</p>
WieErWill<p>"Security by Design" heißt: nicht nachrüsten, sondern vorplanen. Threat Modeling ist kein Extra - es gehört zum Fundament robuster Software.</p><p>📖 Gelernt aus "Threat Modeling" von Adam Shostack</p><p><a href="https://chaos.social/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Security</span></a> <a href="https://chaos.social/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatModeling</span></a> <a href="https://chaos.social/tags/SoftwareDesign" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SoftwareDesign</span></a></p>
Marco Ciappelli🎙️✨:verified: :donor:<p>🎯 FINAL Pre-Event Interview Alert! Next Stop: Las Vegas!</p><p>This is it—our last <a href="https://infosec.exchange/tags/BlackHat" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>BlackHat</span></a> USA 2025 conversation before we hit the road to Vegas (and who knows, maybe we'll broadcast from a desert pit stop along the way! 🚗)</p><p>But what a way to close out our pre-event coverage...</p><p>When Constitutional Law Meets <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cybersecurity</span></a>: A Critical Conversation We All Need to Hear</p><p>What happens when we stop seeing government surveillance as a necessary evil and start recognizing it as a primary threat to privacy?</p><p>Jennifer Granick, ACLU's Surveillance and Cybersecurity Counsel, challenges us to rethink everything we assume about digital <a href="https://infosec.exchange/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>privacy</span></a> in her upcoming <a href="https://infosec.exchange/tags/BlackHatUSA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>BlackHatUSA</span></a> 2025 keynote.</p><p>In this preview conversation with Marco Ciappelli, Jennifer makes a compelling case:</p><p>✅ The Fourth Amendment hasn't kept pace with technology <br>✅ Legal reform is too slow—so technologists must lead <br>✅ Privacy isn't just a legal problem—it's a design challenge <br>✅ We need a new <a href="https://infosec.exchange/tags/threatmodel" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatmodel</span></a> that puts unchecked surveillance at the center</p><p>From defending hackers since <a href="https://infosec.exchange/tags/DEFCON" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DEFCON</span></a> 3 to fighting surveillance overreach at the ACLU, Jennifer brings decades of frontline experience to this critical discussion.</p><p>The key takeaway? While lawmakers debate, engineers and designers hold the power to protect civil liberties through encryption, data minimization, and privacy-first architecture.</p><p>This isn't just another privacy talk—it's a call to action for every technologist, policymaker, and privacy advocate.</p><p>🎥 Watch: <a href="https://youtu.be/dPCvsBqu6Uc" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">youtu.be/dPCvsBqu6Uc</span><span class="invisible"></span></a></p><p>🎧 Listen: <a href="https://itspmagazine.simplecast.com/episodes/from-hacker-defense-to-civil-liberties-threat-modeling-meets-constitutional-law-a-black-hat-usa-2025-keynote-conversation-with-jennifer-granick-on-location-coverage-with-sean-martin-and-marco-ciappelli" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">itspmagazine.simplecast.com/ep</span><span class="invisible">isodes/from-hacker-defense-to-civil-liberties-threat-modeling-meets-constitutional-law-a-black-hat-usa-2025-keynote-conversation-with-jennifer-granick-on-location-coverage-with-sean-martin-and-marco-ciappelli</span></a></p><p>📍 Follow our complete Black Hat USA 2025 coverage: <a href="https://www.itspmagazine.com/bhusa25" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="">itspmagazine.com/bhusa25</span><span class="invisible"></span></a></p><p>See you in Vegas! 🎰 Feeling lucky, Sean Martin, CISSP?</p><p><a href="https://infosec.exchange/tags/BlackHatUSA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>BlackHatUSA</span></a> <a href="https://infosec.exchange/tags/Privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Privacy</span></a> <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cybersecurity</span></a> <a href="https://infosec.exchange/tags/CivilLiberties" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CivilLiberties</span></a> <a href="https://infosec.exchange/tags/Surveillance" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Surveillance</span></a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>InfoSec</span></a> <a href="https://infosec.exchange/tags/BHUSA25" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>BHUSA25</span></a> <a href="https://infosec.exchange/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatModeling</span></a> <a href="https://infosec.exchange/tags/ACLU" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ACLU</span></a> <a href="https://infosec.exchange/tags/PrivacyByDesign" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PrivacyByDesign</span></a></p>
Jay Thoden van Velzen ☁️🛡️:lolsob:<p>The 'R' in STRIDE threat modeling was always a bit undervalued. Important, yes, but as long as you logged all the things and had a transaction record you' were good.</p><p>But in agentic AI, (non-)repudiation becomes far more important. Not only to trace what agents do, but also to ensure that agents act according to the wishes, expectations and instructions of their human operators, and that buyers and sellers agree on what happened.</p><p>From being important, but not particularly complex, Repudiation is now a full first class citizen among Spoofing, Tampering, Information Disclosure, Denial of Service and Elevation of Privileges</p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/threatmodeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatmodeling</span></a> <a href="https://infosec.exchange/tags/agenticai" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>agenticai</span></a></p>
DeepSec Conference ☑<p>DeepSec 2025 Training: Becoming the Godfather of Threat Modeling – Mike van der Bijl</p><p>In the world of cybersecurity, there is always a threat lurking. Waiting in the shadows for the perfect moment to strike. You can sit back and relax and hope for the best and react when it’s to</p><p><a href="https://blog.deepsec.net/deepsec-2025-training-becoming-the-godfather-of-threat-modeling-mike-van-der-bijl/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">blog.deepsec.net/deepsec-2025-</span><span class="invisible">training-becoming-the-godfather-of-threat-modeling-mike-van-der-bijl/</span></a></p><p><a href="https://social.tchncs.de/tags/Conference" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Conference</span></a> <a href="https://social.tchncs.de/tags/Agile" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Agile</span></a> <a href="https://social.tchncs.de/tags/CICDPipelines" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CICDPipelines</span></a> <a href="https://social.tchncs.de/tags/crossfunctional" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>crossfunctional</span></a> <a href="https://social.tchncs.de/tags/DeepSec2025" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DeepSec2025</span></a> <a href="https://social.tchncs.de/tags/DevOps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DevOps</span></a> <a href="https://social.tchncs.de/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatModeling</span></a> <a href="https://social.tchncs.de/tags/Training" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Training</span></a></p>
Tanya Janca | SheHacksPurple :verified: :verified:<p>I interviewed Kim Wuyts for a <a href="https://infosec.exchange/tags/Semgrep" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Semgrep</span></a> fireside chat called Privacy by Design: Making Threat Modeling Work for Data Protection, and it was super fun!</p><p>Watch us here: <a href="https://twp.ai/4ipiK6" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">twp.ai/4ipiK6</span><span class="invisible"></span></a></p><p>@KimWuyts <a href="https://infosec.exchange/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>privacy</span></a> <a href="https://infosec.exchange/tags/threatmodeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatmodeling</span></a></p>
OWASP Foundation<p>Level up your skills with one of our 2-Day Training Sessions at OWASP Global AppSec USA 2025!</p><p>🚨 REGISTER: <a href="https://owasp.glueup.com/event/131624/register/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">owasp.glueup.com/event/131624/</span><span class="invisible">register/</span></a></p><p>Choose from two powerhouse training sessions, Nov 4–5 in Washington, D.C.:</p><p>Whiteboard Hacking with Robert Hurlbut: Hands-on threat modeling led by industry pros</p><p>Attacking AI with Jason Haddix: Explore the offensive side of AI security</p><p><a href="https://infosec.exchange/tags/OWASP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OWASP</span></a> <a href="https://infosec.exchange/tags/CyberSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSec</span></a> <a href="https://infosec.exchange/tags/AppSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AppSec</span></a> <a href="https://infosec.exchange/tags/DevSecOps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DevSecOps</span></a> <a href="https://infosec.exchange/tags/Infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Infosec</span></a> <a href="https://infosec.exchange/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatModeling</span></a> <a href="https://infosec.exchange/tags/AISecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AISecurity</span></a> <a href="https://infosec.exchange/tags/WashingtonDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WashingtonDC</span></a></p>
OWASP Foundation<p>OWASP Global AppSec USA 2025 is coming to Washington, D.C. Nov 3–7!</p><p>Join 800+ security pros for hands-on trainings, top-tier keynotes, CTFs, and real-world insights across 6 dynamic tracks.</p><p>Connect, learn, and level up in the heart of AppSec innovation.</p><p>Training: Nov 3–5 | Conference: Nov 6–7</p><p>📍 Register now: <a href="https://owasp.glueup.com/event/131624/register/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">owasp.glueup.com/event/131624/</span><span class="invisible">register/</span></a></p><p><a href="https://infosec.exchange/tags/OWASP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OWASP</span></a> <a href="https://infosec.exchange/tags/CyberSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSec</span></a> <a href="https://infosec.exchange/tags/AppSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AppSec</span></a> <a href="https://infosec.exchange/tags/DevSecOps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DevSecOps</span></a> <a href="https://infosec.exchange/tags/Infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Infosec</span></a> <a href="https://infosec.exchange/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatModeling</span></a> <a href="https://infosec.exchange/tags/AISecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AISecurity</span></a> <a href="https://infosec.exchange/tags/WashingtonDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WashingtonDC</span></a></p>
OWASP Foundation<p>We’re thrilled to welcome two of the industry’s most respected voices to the keynote lineup this November in Washington, D.C.:</p><p>📍 Daniel Miessler – AI & Security Researcher, Entrepreneur, and Founder of Unsupervised Learning.</p><p>📍 Adam Shostack – Renowned threat modeling expert, consultant, and author at Shostack & Associates.</p><p>🎟️ Register now: <a href="https://owasp.glueup.com/event/131624/register/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">owasp.glueup.com/event/131624/</span><span class="invisible">register/</span></a></p><p><a href="https://infosec.exchange/tags/OWASP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OWASP</span></a> <a href="https://infosec.exchange/tags/CyberSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSec</span></a> <a href="https://infosec.exchange/tags/AppSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AppSec</span></a> <a href="https://infosec.exchange/tags/DevSecOps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DevSecOps</span></a> <a href="https://infosec.exchange/tags/Infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Infosec</span></a> <a href="https://infosec.exchange/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatModeling</span></a> <a href="https://infosec.exchange/tags/AISecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AISecurity</span></a> <a href="https://infosec.exchange/tags/WashingtonDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WashingtonDC</span></a></p>
DCNTTM<p>DC's Next Top Threat Model is back for <span class="h-card" translate="no"><a href="https://defcon.social/@defcon" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>defcon</span></a></span> 33!! Visit <a href="https://threatmodel.us" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">threatmodel.us</span><span class="invisible"></span></a> for more details.</p><p><a href="https://defcon.social/tags/DEFCON" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DEFCON</span></a> <a href="https://defcon.social/tags/DEFCON33" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DEFCON33</span></a> <a href="https://defcon.social/tags/appsec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>appsec</span></a> <a href="https://defcon.social/tags/threatmodeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatmodeling</span></a> <a href="https://defcon.social/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a></p>
OWASP Foundation<p>🚨 Only have one day to train? Make it count.</p><p>Join us on at OWASP Global AppSec USA 2025 in Washington, D.C. for a full day of expert-led, hands-on security training.</p><p>🎯 Whether you're a builder, breaker, defender, or manager, there's a course to help you go deeper.</p><p>🔗 Register: <a href="https://owasp.glueup.com/event/131624/register/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">owasp.glueup.com/event/131624/</span><span class="invisible">register/</span></a></p><p><a href="https://infosec.exchange/tags/OWASP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OWASP</span></a> <a href="https://infosec.exchange/tags/AppSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AppSec</span></a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/InfosecTraining" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>InfosecTraining</span></a> <a href="https://infosec.exchange/tags/AIsecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AIsecurity</span></a> <a href="https://infosec.exchange/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatModeling</span></a> <a href="https://infosec.exchange/tags/DevSecOps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DevSecOps</span></a> <a href="https://infosec.exchange/tags/OWASP2025" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OWASP2025</span></a> <a href="https://infosec.exchange/tags/WashingtonDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WashingtonDC</span></a> <a href="https://infosec.exchange/tags/SecurityTraining" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecurityTraining</span></a> <a href="https://infosec.exchange/tags/PrivacySecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PrivacySecurity</span></a></p>
Tanya Janca | SheHacksPurple :verified: :verified:<p>With 25+ presentations to choose from, I cover everything from <a href="https://infosec.exchange/tags/securecoding" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>securecoding</span></a> and <a href="https://infosec.exchange/tags/threatmodeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatmodeling</span></a> to AI risks and <a href="https://infosec.exchange/tags/AppSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AppSec</span></a>—always with humor, clarity, and actionable takeaways.</p><p>💡 These aren’t just talks—they’re lessons your team will remember.</p><p><a href="https://twp.ai/9PTSLx" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">twp.ai/9PTSLx</span><span class="invisible"></span></a></p><p>2/3</p>
Tanya Janca | SheHacksPurple :verified: :verified:<p>I interviewed Kim Wuyts for a <a href="https://infosec.exchange/tags/Semgrep" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Semgrep</span></a> fireside chat called Privacy by Design: Making Threat Modeling Work for Data Protection, and it was super fun!</p><p>Watch us here: <a href="https://twp.ai/4inxqU" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">twp.ai/4inxqU</span><span class="invisible"></span></a></p><p>@KimWuyts <a href="https://infosec.exchange/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>privacy</span></a> <a href="https://infosec.exchange/tags/threatmodeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatmodeling</span></a></p>
OWASP Foundation<p>Join renowned expert Adam Shostack for a 3-day Threat Modeling Intensive, Nov 3–5, at OWASP Global AppSec USA 2025.</p><p>You’ll sharpen core threat modeling skills, then dive into how AI can support (and sometimes confuse) the process. Learn to evaluate what AI tools get right—and wrong—and how to integrate them responsibly into your security workflows.</p><p>👉 REGISTER: <a href="https://owasp.glueup.com/event/131624/register/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">owasp.glueup.com/event/131624/</span><span class="invisible">register/</span></a></p><p><a href="https://infosec.exchange/tags/OWASPAppSecUSA2025" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OWASPAppSecUSA2025</span></a> <a href="https://infosec.exchange/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatModeling</span></a> <a href="https://infosec.exchange/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AI</span></a> <a href="https://infosec.exchange/tags/CyberSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSec</span></a> <a href="https://infosec.exchange/tags/AppSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AppSec</span></a> <a href="https://infosec.exchange/tags/WashingtonDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WashingtonDC</span></a></p>
OWASP Foundation<p>Join Robert Hurlbut for AI Whiteboard Hacking, a 2-day hands-on threat modeling training, happening Nov 4–5 at OWASP Global AppSec USA 2025.</p><p>📍 Register: <a href="https://owasp.glueup.com/event/131624/register/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">owasp.glueup.com/event/131624/</span><span class="invisible">register/</span></a></p><p>Explore real-world AI threats like prompt injection and data poisoning and learn how to design secure AI systems using the proven DICE methodology.</p><p><a href="https://infosec.exchange/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatModeling</span></a> <a href="https://infosec.exchange/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AI</span></a> <a href="https://infosec.exchange/tags/AppSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AppSec</span></a> <a href="https://infosec.exchange/tags/CyberSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSec</span></a> <a href="https://infosec.exchange/tags/AIsecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AIsecurity</span></a> <a href="https://infosec.exchange/tags/WashingtonDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WashingtonDC</span></a></p>
Tanya Janca | SheHacksPurple :verified: :verified:<p>With 25+ presentations to choose from, I cover everything from <a href="https://infosec.exchange/tags/securecoding" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>securecoding</span></a> and <a href="https://infosec.exchange/tags/threatmodeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatmodeling</span></a> to AI risks and <a href="https://infosec.exchange/tags/AppSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AppSec</span></a>—always with humor, clarity, and actionable takeaways.</p><p>💡 These aren’t just talks—they’re lessons your team will remember.</p><p><a href="https://twp.ai/9PTsIv" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">twp.ai/9PTsIv</span><span class="invisible"></span></a></p><p>2/3</p>
Tanya Janca | SheHacksPurple :verified: :verified:<p>I interviewed Kim Wuyts for a <a href="https://infosec.exchange/tags/Semgrep" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Semgrep</span></a> fireside chat called Privacy by Design: Making Threat Modeling Work for Data Protection, and it was super fun!</p><p>Watch us here: <a href="https://twp.ai/4io15f" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">twp.ai/4io15f</span><span class="invisible"></span></a></p><p>@KimWuyts <a href="https://infosec.exchange/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>privacy</span></a> <a href="https://infosec.exchange/tags/threatmodeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatmodeling</span></a></p>
OWASP Germany Chapter :verified:<p>OWASP <a href="https://infosec.exchange/tags/Hamburg" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Hamburg</span></a> sports a double <a href="https://infosec.exchange/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AI</span></a> Feature for its 15 year anniversary 🎂🎉 on July 16th</p><p>* Niklas Bunzel: AI Security & Privacy: From Prompt Injection to Multimodal Evasion (on site)<br>*: Susanna Cox: Threat Modeling AI: Beyond the Hype and Theater to Proactive Security (remote)</p><p>Details: <br><a href="https://www.meetup.com/owasp-hamburg-stammtisch/events/308558262/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">meetup.com/owasp-hamburg-stamm</span><span class="invisible">tisch/events/308558262/</span></a></p><p><a href="https://infosec.exchange/tags/AiResearch" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AiResearch</span></a> <a href="https://infosec.exchange/tags/threatmodeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatmodeling</span></a></p>
Michael Jenkins<p>We should probably all think about the intersection of <a href="https://floss.social/tags/facialrecognition" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>facialrecognition</span></a>, <a href="https://floss.social/tags/datingapps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>datingapps</span></a>, and our current <a href="https://floss.social/tags/threatmodeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatmodeling</span></a> and make some hard choices. </p><p>Serious question, are there <a href="https://floss.social/tags/fediverse" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>fediverse</span></a> dating apps?</p><p><a href="https://www.cbsnews.com/news/california-tinder-dating-app-facial-recognition/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">cbsnews.com/news/california-ti</span><span class="invisible">nder-dating-app-facial-recognition/</span></a></p>
TrendingLive feeds
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
LoginDrag & drop to upload