Thread on The Congregation in the a Secular Age:

As part of our commitment to keeping our customers/community protected & informed, we are releasing a blog that shines light on transition between Stage 1 and 2 of #Solorigate/#SUNBURST campaign, custom Cobalt Strike loaders, post-exploit. artifacts, IOCs: https://t.co/b0ReHMa63u

Here are some highlights:
The missing link between the Solorigate backdoor and the custom #CobaltStrike loaders observed during the #Solorigate is an Image File Execution Options (IFEO) Debugger registry value created for the legitimate process dllhost.exe (ATT&CK ID: T1546.012).

Once the registry value is created, the attackers wait for the occasional execution of dllhost.exe, which might happen naturally on a system. This execution triggers a process launch of wscript.exe configured to run the VBScript file dropped by the SolarWinds backdoor (Stage 1).

The VBScript in turn runs rundll32.exe, activating the Cobalt Strike loader DLL using a clean parent/child process tree completely disconnected from the SolarWinds process. Finally, the VBScript removes the previously created IFEO value to clean up any traces of execution.

On the custom Cobalt Strike Loaders: we identified several second-stage malware, including TEARDROP, Raindrop, and other custom loaders for the Cobalt Strike beacon. During the lateral movement phase, the custom loader DLLs are dropped mostly in existing Windows sub-directories.

An "Aquarium" needs cleaning in my opinion, but who am I, a mere monkey, to give advice?
Astonished at what @bellingcat discovered about GRU & FSB operations
Skripal https://t.co/PzH3a7JZvy
Navalny https://t.co/eZi63UhWw1
FSB https://t.co/sViYk9RwmB
GRU https://t.co/MY5d5gw2OG

A great post by Ilya Yahin on

Every time Putin talks about “our special services,” his signature smirk appears on his face, and in his words there is poorly concealed bragging
"Of course, we knew everything in advance"
"Yes, we are looking"
"Mercader has already been sent"
“World-class professionals”

Putin clearly loves all these spy games. He is very proud of the special services and therefore endlessly increases budget funding for them.
This is his top priority.
The elderly dictator cannot understand one thing:

there are no effective special services in a state that is completely corroded by corruption. You won't have honest professionals at your fingertips if your son-in-law buys shares of a state company for $ 100, the real value of which exceeds $ 380 million.

$CCIV / LUCID MOTORS

DD Thread ⤵️

The $CCIV leadership team:

I will highlight who I believe are the key players.

Starting with Sir Jony Ive, who was the Chief Design Officer at Apple Inc for over 20 years. (Connections to Apple are never a bad thing..)

Andrew Leveris is the former CEO of The Dow Chemical company who also just happens to be a board member of, you guessed it - Lucid Motors, further supporting SPAC rumors.

As the former CEO of Ford, Mulally brings a wealth of motor industry experience to Churchill Capital and Lucid Motors.

Antares Vision $AV.IM is the world's leading Track & Trace (T&T) and Vision Inspection (VI) solutions provider for the life science sector.

With several catalysts ahead I've initiated a position in this insider-owned small cap 🔽

1/

Antares is the supplier to 10 of the 20 leading pharmaceutical companies in the world having installed +2000 serialisation lines at +200 production facilities in +60 countries.

2/

Antares offers - via software and hardware - the protection of products and brands through visual inspection systems for quality
control, Track & Trace solutions for anti-counterfeiting and supply chain transparency from the point of
production to the end consumer.

3/

All major governments have regulation rolling out in regards to prescription drug traceability.

Penetration, globally, is below 30% and is forecast to double by 2026.

4/

In regards to distribution of Covid-19 vaccines, IBM partnered with Antares to create a solution tracking raw materials and identify shortages. Monitor production yields across manufacturers, guarantee vaccine integrity and prevent counterfeits.

5/

It's endlessly fascinating how economic datapoints get interpreted.

When I was in charge of a P&L, the guy who ran Finance for us and I had what we called the 'shelf plan.'

There were maybe 3-4 of us who knew it existed.

What's a shelf plan?
1/

Well it's a plan you keep on the shelf (full FP&A model), that you hope you never have to use.

It reduces forward hires, cuts back various line items (typically ad spend, travel, that sort of thing).

Oh, it also has a big fat RIF in there.

That's why we don't talk about it.
2/

Why have a plan instead of winging it?

Because this is where companies (particularly young companies) sometimes err. They do little cuts - 2-3% here and there, preserving as much headcount as they can, that sort of thing.

This is incorrect.
3/

If you're at the point where you need to make material changes to your forward P&L, at 2-3% RIF will be followed by another.

And another.

And this series of progressive cuts will cripple morale, incrementally reducing the productivity of the staff you retain to survive.
4/

And so the shelf plan cuts deep.

Your goal is to go from being a peacetime machine to a wartime machine, so you gotta lean out quick. Can't do that without a plan, hence the need to have one.

~30% cut is what you need.

And then you need to tell everyone left they're safe.
5/