Sign in

Alexander Leslie

@aejleslie.bsky.social
1.1K followers 99 following 206 posts

Cybercrime & Hacktivism @ Recorded Future | Insikt Group | Curated Intelligence | @aejleslie everywhere else.

PostsRepliesMedia
Alexander Leslie @aejleslie.bsky.social · 18/06/2025
🚨 👀 New Insikt Group report! As NATO leaders gather in The Hague next week, the upcoming summit comes under threat from adversary activity: state-sponsored espionage, malign influence operations, and a surge of chatter across the dark web. Blog: www.recordedfuture.com/research/thr...
recordedfuture.com
Threats to the 2025 NATO Summit: Cyber, Influence, and Hybrid Risks
Explore how state-sponsored actors, cybercriminals, and hacktivists are targeting the 2025 NATO Summit. Insight from Recorded Future’s Insikt Group reveals escalating cyber, AI, and hybrid threats fro...
010
Alexander Leslie @aejleslie.bsky.social · 18/06/2025
🇨🇳 🤖 New Insikt Group report! This research details how the People’s Liberation Army is rapidly experimenting with generative AI to augment — and potentially transform — its military intelligence capabilities. Blog: www.recordedfuture.com/research/art...
recordedfuture.com
China’s PLA Leverages Generative AI for Military Intelligence: Insikt Group Report
Explore how China’s PLA is adopting generative AI for military intelligence. This Insikt Group report reveals AI-driven intelligence tools, strategic adaptations, and implications for global security.
021
Alexander Leslie @aejleslie.bsky.social · 17/06/2025
Join me tomorrow for a live briefing on the conflict between Israel and Iran. We’ll address specific geopolitical risks, cybercriminal and hacktivist groups, state-sponsored cyber threats, influence operations, and more. Registration: recordedfuture.registration.goldcast.io/webinar/4b72...
011
Alexander Leslie @aejleslie.bsky.social · 13/06/2025
Thank you to everyone who attended my session at our inaugural Insikt After Dark conference in New York City! I spoke on our recent efforts to disrupt traffer teams, infostealer operators, and global scam infrastructure. It’s always an honor to represent Recorded Future!
000
Alexander Leslie @aejleslie.bsky.social · 13/06/2025
Outstanding work from @julianferdinand.bsky.social, @lawrencesec.bsky.social, and our Malicious Infrastructure Discovery (MID) team. GrayAlpha shows how financially motivated actors operate with APT-level tradecraft. Time to retire old threat models. Think in terms of ecosystems, not just malware.
064
Alexander Leslie @aejleslie.bsky.social · 12/06/2025
Predator isn’t dead — it’s mutating. New reporting from @julianferdinand.bsky.social just dropped. It confirms that Predator C2 is very much alive and attracting new clients. Targets? The same. Activists, politicians, journalists, executives. The spyware economy isn’t slowing — it’s adapting.
042
Alexander Leslie @aejleslie.bsky.social · 22/05/2025
Read more! This report includes an extensive list of capabilities and indicators linked to TAG-110 and its recent campaigns targeting Central Asia. PDF: go.recordedfuture.com/hubfs/report...
010
Alexander Leslie @aejleslie.bsky.social · 22/05/2025
🔑: “TAG-110’s recent use of macro-enabled Word templates (.dotm), placed in the Microsoft Word STARTUP folder for automatic execution, highlights a tactical evolution prioritizing persistence.”
100
Alexander Leslie @aejleslie.bsky.social · 22/05/2025
🌏: “TAG-110’s persistent targeting of Tajik government, educational, and research institutions supports Russia’s strategy to maintain influence in Central Asia. These cyber-espionage operations likely aim to gather intelligence for influencing regional politics or security…”
100
Alexander Leslie @aejleslie.bsky.social · 22/05/2025
🔍: “This campaign has been attributed to TAG-110 based on its reuse of VBA code found in lures from previous campaigns, overlap in C2 infrastructure, and use of suspected legitimate government documents for lure material.”
100
Alexander Leslie @aejleslie.bsky.social · 22/05/2025
🎣: “TAG-110 has changed its spearphishing tactics in recent campaigns against Tajikistan, as they now rely on macro-enabled Word templates (.dotm files).”
100
Alexander Leslie @aejleslie.bsky.social · 22/05/2025
New report! Check it out. 🇷🇺 🇹🇯 This research examines a campaign targeting Tajikistan attributed to Russia-aligned TAG-110 — linked to BlueDelta (APT28). This campaign is likely targeting government, educational, and research institutions. Link: www.recordedfuture.com/research/rus...
recordedfuture.com
TAG-110 Targets Tajikistan: New Macro Word Documents Phishing Tactics
Russia-aligned TAG-110 shifts to .dotm phishing lures in a 2025 campaign against Tajikistan’s public sector, advancing cyber-espionage in Central Asia.
122
Alexander Leslie @aejleslie.bsky.social · 21/05/2025
Good riddance! This should make a sizable dent in the ecosystem. 🪦 Lumma Stealer 🪦 Link: www.europol.europa.eu/media-press/...
europol.europa.eu
Europol and Microsoft disrupt world’s largest infostealer Lumma | Europol
Europol’s European Cybercrime Centre has worked with Microsoft to disrupt Lumma Stealer (“Lumma”), the world’s most significant infostealer threat.
010
Alexander Leslie @aejleslie.bsky.social · 08/05/2025
Read more! This report includes extensive research and analysis that can’t be fully captured in a single thread. PDF: go.recordedfuture.com/hubfs/report...
000
Alexander Leslie @aejleslie.bsky.social · 08/05/2025
🇺🇸: “Although the current US presidential administration has signalled that maintaining the US’s leading position… a priority, early actions to decrease public funding for science and target international students over alleged visa infractions likely risk undermining this goal.”
100
Alexander Leslie @aejleslie.bsky.social · 08/05/2025
🏭: “China’s semiconductor industry likely still faces a bottleneck in producing sub-7 nanometer chips, and it is almost certainly attempting to develop its own extreme ultraviolet lithography tools using alternative techniques to advance domestic AI accelerator production.”
100
Alexander Leslie @aejleslie.bsky.social · 08/05/2025
📉: “US export controls have also almost certainly prompted the Chinese government to accelerate funding for its AI hardware and semiconductor industries and high-performance computing infrastructure for training and hosting AI models.”
100
Alexander Leslie @aejleslie.bsky.social · 08/05/2025
🔑: “Adopting open source is more prevalent among Chinese AI companies and likely enables China to diffuse its models more broadly than US proprietary models.”
100
Alexander Leslie @aejleslie.bsky.social · 08/05/2025
🧑‍🏫: “Access to high-quality training data and IP is an increasingly contested domain where the US likely retains a competitive advantage; companies in both countries are likely leveraging user-generated content to train generative AI models.”
100
Alexander Leslie @aejleslie.bsky.social · 08/05/2025
⚖️: “Closing the performance gap while being cost-competitive is very likely to pay off for China by driving the adoption of Chinese generative AI models domestically and abroad.”
100
Alexander Leslie @aejleslie.bsky.social · 08/05/2025
🗓️: “According to Insikt Group's analysis of model benchmarks, Elo scores, and industry expert assessments, Chinese generative AI models likely now have a three to six-month performance gap behind US rivals, though this time lag is shortening.”
100
Alexander Leslie @aejleslie.bsky.social · 08/05/2025
💡: “AI diffusion rather than innovation will very likely determine the ‘winner’ in the competition… but whether the US or China has greater levels of diffusion is unclear, with one metric (patents) nevertheless showing China has a lead in many industries.”
100
Alexander Leslie @aejleslie.bsky.social · 08/05/2025
🧑‍🎓: “The international AI talent pool likely continues to favor the US due to a continuing — though declining — immigration advantage and the quality of elite educational institutions, but the practical implications of this lead for AI competition are likely eroding.”
100
Alexander Leslie @aejleslie.bsky.social · 08/05/2025
🧑‍⚖️: “China’s regulatory scheme likely hampers Chinese AI capabilities and extends development and deployment timelines — but only among developers aiming for public-facing products, meaning frontier advancements are unlikely to be impeded.”
100
Alexander Leslie @aejleslie.bsky.social · 08/05/2025
💰: “China’s overall government-led funding likely exceeds investment by US federal and state governments… however, total private-sector investment in AI companies in the US vastly outmatches private-sector investment in China.”
100
Alexander Leslie @aejleslie.bsky.social · 08/05/2025
🤝: “China’s rapidly maturing AI ecosystem is very likely increasingly fostering collaboration between government, industry, and academia, and is supported by steady advances in semiconductor manufacturing.”
100
Alexander Leslie @aejleslie.bsky.social · 08/05/2025
New report! Check it out. This research examines US-China AI gap and the drivers of competition. Insikt Group assesses that China is unlikely to sustainably surpass the US on its desired timeline to become the world leader in AI by 2030. Link: www.recordedfuture.com/research/mea...
recordedfuture.com
US-China AI Gap: 2025 Analysis of Model Performance, Investment, and Innovation
Explore Insikt Group's in-depth 2025 report on the US-China AI race—comparing funding, talent, regulation, compute capacity, and model benchmarks. Discover why China trails the US and what could chang...
110
Alexander Leslie @aejleslie.bsky.social · 02/05/2025
I had a great time talking with @gregotto.bsky.social from @cyberscoop.bsky.social at RSAC 2025. Always fun! Check out our conversation about my work on cryptoscam gangs, infostealer “traffer” teams, and the “Marko Polo” cybercriminal group. Link: open.spotify.com/episode/70AY...
open.spotify.com
Recorded Future’s Alexander Leslie on the ‘MarkoPolo’ traffer team
Safe Mode Podcast · Episode
022
Alexander Leslie @aejleslie.bsky.social · 02/05/2025
🔑: “Insikt Group observed ten distinct TerraStealerV2 distribution samples between January and March 2025 that employed varied delivery methods, including MSI, DLL, and LNK files.”
000
Alexander Leslie @aejleslie.bsky.social · 02/05/2025
🛠️: “TerraStealerV2 lacks support for decrypting Chrome ABE-protected credentials, indicating the tool is likely outdated or still under development.”
100
Alexander Leslie @aejleslie.bsky.social · 02/05/2025
⌨️: “TerraLogger is the first observed use of a keylogging capability within malware developed by Golden Chickens.”
100
Alexander Leslie @aejleslie.bsky.social · 02/05/2025
🔍: “Insikt Group identified two new malware families, TerraStealerV2 and TerraLogger, attributed to the threat actor Golden Chickens. TerraStealerV2 can steal browser credentials and target cryptocurrency wallets… TerraLogger functions solely as a standalone keylogger module.”
100
Alexander Leslie @aejleslie.bsky.social · 02/05/2025
New report! Check it out. This research uncovers two new malware families — TerraStealerV2 and TerraLogger — linked to the financially motivated threat activity group Golden Chickens (VENOM SPIDER). Link: www.recordedfuture.com/research/ter...
recordedfuture.com
Golden Chickens Unveils TerraStealerV2 and TerraLogger: New Credential Theft Tools Identified by Insikt Group
Insikt Group reveals two emerging malware strains—TerraStealerV2 and TerraLogger—linked to Golden Chickens, a threat actor behind credential theft and keylogging MaaS platforms. Learn how these tools ...
131
Alexander Leslie @aejleslie.bsky.social · 29/04/2025
Read more! This report includes an extensive list of indicators to complement technical analysis and threat hunting strategies. PDF: go.recordedfuture.com/hubfs/report...
000
Alexander Leslie @aejleslie.bsky.social · 29/04/2025
🐀: “GhostWeaver’s self-signed X.509 certificates are similar to those of AsyncRAT and variants of AsyncRAT, leading to initial false associations with other malware families such as AsyncRAT.”
100
Alexander Leslie @aejleslie.bsky.social · 29/04/2025
👻: “Insikt Group shows that GhostWeaver is the primary payload deployed by MintsLoader across observed campaigns.”
100
Alexander Leslie @aejleslie.bsky.social · 29/04/2025
🔥: “Recorded Future’s Malware Intelligence Hunting provides up-to-date C2 domains and other artifacts related to MintsLoader that would otherwise be hard to track due to its dynamic infrastructure.”
100
Alexander Leslie @aejleslie.bsky.social · 29/04/2025
🔑: “MintsLoader's use of a DGA to generate daily C2 domains based on the system date complicates infrastructure monitoring activity and domain/IP-based detections.”
100
Alexander Leslie @aejleslie.bsky.social · 29/04/2025
🛡️: “MintsLoader's second-stage PowerShell script uses sandbox and virtual environment evasion techniques, reducing its susceptibility to automated analysis and increasing its likelihood of bypassing dynamic detection tools.”
100
Alexander Leslie @aejleslie.bsky.social · 29/04/2025
New report! Check it out. This research examines MintsLoader, linked to groups like TAG-124 (LandUpdate808), to deploy capabilities like GhostWeaver and StealC. Link: www.recordedfuture.com/research/unc...
recordedfuture.com
MintsLoader Malware Analysis: Multi-Stage Loader Used by TAG-124 and SocGholish
Discover how MintsLoader operates as a stealthy, obfuscated malware loader distributing GhostWeaver, StealC, and BOINC. Read Recorded Future’s in-depth analysis of its evasion tactics, DGA-based C2s, ...
111
Alexander Leslie @aejleslie.bsky.social · 28/04/2025
Thank you to everyone who attended my session at RSAC 2025 on cryptoscam gangs, infostealer operators, and the notorious “Marko Polo” traffer team. A lot of friendly faces in the crowd! (Find me roaming around this week, I have stickers!)
010
Alexander Leslie @aejleslie.bsky.social · 27/04/2025
See y’all tomorrow! 😎
110
Alexander Leslie @aejleslie.bsky.social · 18/04/2025
🛡️: “Companies and governments should maintain vigilance in cybersecurity practices to reduce vulnerabilities to AI-enabled cyber and influence operations and limit Iran’s access to AI resources and expertise that could increase Tehran’s threat to regional security.”
000
Alexander Leslie @aejleslie.bsky.social · 18/04/2025
🇮🇷: “In the domestic sphere, Iran has very likely increased its efforts to deploy AI for morality enforcement and opposition monitoring, to enhance its control over Iranian society, particularly after the Woman Life Freedom protest movement.”
100
Alexander Leslie @aejleslie.bsky.social · 18/04/2025
🪖: “Iran has very likely endeavored to implement AI in its military defense systems and publicly touts the capability, though its operational uses of the technologies remain unproven.”
100
Alexander Leslie @aejleslie.bsky.social · 18/04/2025
💻: “Iranian threat actors will increasingly use generative AI and large language models to enhance their influence and cyber operations…”
100
Alexander Leslie @aejleslie.bsky.social · 18/04/2025
🔍: “Amidst unprecedented domestic upheaval and regional conflict over the last three years, Iran very likely views AI as a key force multiplier for its national security and defense…”
100
Alexander Leslie @aejleslie.bsky.social · 18/04/2025
🇨🇳 🇷🇺: “To augment its own indigenous research and development capabilities in AI, Iran will likely leverage its bilateral and regional relationships for technology engagement with China, Russia, and other non-Western countries.”
100
Alexander Leslie @aejleslie.bsky.social · 18/04/2025
🚫: “Iran has articulated lofty goals for its AI advancement… but it is almost certainly hindered… isolation limits its access to technological resources and human capital… its top-down government control and oversight stifles private innovation...”
100
Alexander Leslie @aejleslie.bsky.social · 18/04/2025
New Recorded Future report! Check it out. This research examines the critical role of artificial intelligence in the future economic, regional influence, and national security interests of Iran, and the implementation of those capabilities. Link: www.recordedfuture.com/research/ira...
recordedfuture.com
Iran’s AI Ambitions: National Security, Global Influence, and Strategic Challenges
Explore how Iran is leveraging AI for cyberwarfare, influence ops, military tech, and domestic surveillance. A deep dive into Tehran’s top-down AI strategy, partnerships with China and Russia, and imp...
110