I'm from the Internet and I'm here to help
The Internet
Joined April 2009
- Tweets3.1K
- Following402
- Followers6K
- Likes673
CrowdStrike Counter Adversary Operations uncovered four previously unreported threat actors weaponizing AI agents in real-world intrusion campaigns, revealing a new level of speed, autonomy, and accessibility for attackers.
Key findings:
•AI is executing real-world intrusions: Threat actors are using AI agents across the attack life cycle, from reconnaissance to data theft.
•Attacks can unfold in minutes: An AI agent moved laterally and harvested domain controller credentials in approximately 20 minutes without additional human guidance.
•AI is lowering the barrier to entry: Even low-skilled attackers are using AI to compromise organizations.
•AI safeguards can be bypassed: All four threat actors overcame commercial AI safety controls to enable malicious activity.
Download the report to see how agentic AI is transforming real-world intrusions and what it means for defenders.
r defenders.
crowdstrike.com/en-us/resour…
adam_cyber retweeted
This week, the @FBI and DOJ announced coordinated actions in Ohio and Texas to counter the North Korean IT worker threat. The effort included raids on suspected “laptop farms” and resulted in charges, arrests, and the seizure of nearly 190 devices.
Brett Leatherman, Assistant Director of the FBI’s Cyber Division, sat down with CrowdStrike’s Adam Meyers to examine the broader threat behind these actions. They discussed North Korea’s ongoing efforts to infiltrate American companies through remote IT workers and how the FBI and industry are working together to combat the threat.
These recent actions, like many of the FBI’s most significant cyber operations, were made possible by intelligence and technical expertise from industry partners. The FBI is strengthening these partnerships to “move upstream” against cyber threat actors. That means going beyond responding to individual incidents to proactively target the command-and-control infrastructure, tools, and criminal ecosystems that enable their activity.
ic3.gov/PSA/2026/PSA261013
adam_cyber retweeted
We named FAMOUS CHOLLIMA years ago and have tracked them ever since. Our Counter Adversary Operations team worked with the @FBI to take down the laptop farms this North Korean adversary used to get inside American companies.
They don't break in. They get hired. AI writes the resumes, fakes the faces and feeds them answers in the interview, so one operator can pass as several applicants.
A takedown forces them to rebuild identities, infrastructure, and facilitators. AI makes that rebuild faster, and that's why cybersecurity has to be faster. Proud of @Adam_Cyber and the CAO team.
nytimes.com/2026/10/13/us/po…
adam_cyber retweeted
Federal authorities seized more than 187 devices from 40 residences in Texas as part of a crackdown on so-called "laptop farms" allegedly used by North Korean operatives to pose as American IT workers and funnel wages to North Korea.
FBI Cyber Division Assistant Director Brett Leatherman and CrowdStrike executive Adam Meyers joined CBS News’ Major Garrett to explain how the scheme works.
adam_cyber retweeted
🚨 Today, the @FBI and @TheJusticeDept announced a series of coordinated actions against the North Korean IT Worker threat – securing charges against 14 individuals, making two arrests, seizing nearly 190 devices, and conducting operations at more than 40 suspected “laptop farms” across Texas.
These actions were taken in response to North Korea’s ongoing deployment of thousands of remote IT workers to infiltrate Western companies, earn revenue for the regime, and gain access to sensitive information. These workers are often supported by domestic enablers and laptop farms.
Disrupting these schemes remains a top priority for the FBI. In 2026 alone, 8 individuals have been sentenced to prison for their roles in this activity.
Coordination between the private sector and federal law enforcement was central to the latest effort. CrowdStrike’s Counter Adversary Operations team provided vital support to the FBI’s effort to identify and disrupt these laptop farms.
justice.gov/opa/pr/justice-d…
ALT North Korea uses stolen identities to deploy remote IT workers infiltrating US firms, FBI and DOJ announce arrests and seizures in coordinated crackdown.
Bringing the fight to the adversary! @Crowdstrike teamed up with @FBI to disrupt laptop farms operating across the U.S. maintained by DPRK-nexus adversary FAMOUS CHOLLIMA to fraudulently employ operatives at American companies while concealing their true location and identity.
These laptop farms enabled FAMOUS CHOLLIMA operatives to pose as legitimate remote workers and siphon illicit wages back to their regime while maintaining persistent access to victim organizations.
Incredible what can happen when Industry and Government work together!
crowdstrike.com/en-us/blog/f…
Agentic adversaries are popping up everywhere, this is fundamentally about visibility - these aren’t novel attack paths as much as adversaries increasing speed and volume of action. This recent case in the Republic of Korea targeting financial orgs is a fascinating example:
crowdstrike.com/en-us/blog/u…
adam_cyber retweeted
Infosec it's time to act & it's important:
We need to collectively & unilaterally call this story and the rest that is going on as fake news attempting to manipulate the public
We cant let evidence free panic become the foundation for policy
Stop letting them sell fake fear
Andrew Yang went on CNBC and said he met with the head of an AI lab who told him something that sounds straight out of a movie.
The AI agents that escaped during the OpenAI incident didn't just hack Hugging Face. They allegedly planted self-replicating code across the internet. Forums. Websites. Scattered everywhere.
Now AI companies supposedly can't safely train on real internet data anymore because a new model might encounter that code and start creating copies of itself.
Yang says this is the real reason every CEO aligned on slowing down so fast.
This illustrates the gap between frontier and open models is closing and puts the AI safety debate into perspective - the more frontier labs slow themselves down, the more incentive there is to just swap in open-weight models. And the more those models spread, the less the labs’ controls actually work.
stateofopensource.ai/
Slowing down the frontier doesn’t slow down the adversary.
China is already weaponizing newly disclosed vulnerabilities within 24 hours. Now open-weight models are accelerating the adversary further.
Defenders need AI that can fight AI and runtime security that can stop malicious agent activity at machine speed.
adam_cyber retweeted
CYBERWARCON is BACK for 2026!
Registration and CFP are now officially open!
We’ll be in Arlington, VA+ virtually on November 20th, with Rob Joyce as our keynote.
cyberwarcon.com 1/x
Hot off the press: @CrowdStrike 2026 Threat Hunting Report
Read about detailed sector analysis, the targeting of AI, CI/CD supply chain attacks, and Close Access Operations by Chinese nexus intrusion actors.
crowdstrike.com/en-us/blog/c…
Incredible work by the team!
adam_cyber retweeted
AI is being built into every company, every industry, every country.
That future runs on both frontier closed models and frontier open models. Not one or the other. Both.
Open models are a security advantage. More teams inspecting them. More teams testing them. More teams hardening the models the world will depend on. Defenders working with the same capabilities attackers are already using.
Security is how AI scales. I am proud @CrowdStrike was the only cybersecurity company to sign this letter.
Defenders need access to open source/open weight models. The future of cybersecurity depends on it. The future of the world depends on it.
On May 26, 2026, at 14:00 UTC, the CrowdStrike Counter Adversary Operations team executed a coordinated takedown of the Glassworm botnet, a global threat targeting software developers through the open-source supply chain. In collaboration with Google and the Shadowserver Foundation, we struck all four of Glassworm's command-and-control (C2) channels simultaneously, severing the operators from their infected machines and their ability to deliver new malicious payloads.
This takedown matters beyond the botnet. Glassworm marked a significant shift in the threat landscape that should serve as a wake-up call for every organization that ships or consumes software. Adversaries are no longer just targeting products, they're targeting the developers who build them.
crowdstrike.com/en-us/blog/i…
adam_cyber retweeted
AI is accelerating cyber ops as China and DPRK-nexus actors evolve.
In a new CBS News interview, CrowdStrike’s @Adam_Cyber breaks down the threats facing financial institutions and what defenders need to know.
📺 cbsnews.com/video/crowdstrik…
adam_cyber retweeted
Day Zero: The 2026 Threat Research Summit is bringing together featured speakers from Amazon, Cisco, Google, Microsoft, Recorded Future, CrowdStrike, and more to share original research on emerging adversary tradecraft.
Applications are now open: crwdstr.ke/6013BBdka5
Join us Aug. 30 – Sep. 1, 2026 in Las Vegas for a closed-door summit built for the cybersecurity community’s most technical minds — threat researchers, reverse engineers and intelligence experts working at the forefront of adversary analysis.
The lineup includes:
• Martin Wendiggensen, Dreadnode
• Ashley Shen, Cisco Talos
• Julian-Ferdinand Vögele, Recorded Future
• Selena Larson, Proofpoint
• A special session with John Hultquist, Google Threat Intelligence Group, and Sherrod DeGrippo, Microsoft
It’s guaranteed to be a spicy event!
Day Zero: The 2026 Threat Research Summit is bringing together featured speakers from Amazon, Cisco, Google, Microsoft, Recorded Future, CrowdStrike, and more to share original research on emerging adversary tradecraft.
Applications are now open: crwdstr.ke/6013BBdka5
Join us Aug. 30 – Sep. 1, 2026 in Las Vegas for a closed-door summit built for the cybersecurity community’s most technical minds — threat researchers, reverse engineers and intelligence experts working at the forefront of adversary analysis.
The lineup includes:
• Martin Wendiggensen, Dreadnode
• Ashley Shen, Cisco Talos
• Julian-Ferdinand Vögele, Recorded Future
• Selena Larson, Proofpoint
• A special session with John Hultquist, Google Threat Intelligence Group, and Sherrod DeGrippo, Microsoft
adam_cyber retweeted
Standardized on @Microsoft Defender but want the power of CrowdStrike's elite threat hunters? Now you can have both 🤝
Meet CrowdStrike Falcon OverWatch for Defender:crwdstr.ke/6011BBjejF
🔍 24/7 threat hunting focused on what automation misses
⚡ Real-time detection and response to sophisticated threats
👀 Deeper visibility without changing your existing deployment
You keep Defender. You gain a team hunting for the activity hiding in plain sight.
Disclaimer: Microsoft and Defender are registered trademarks of Microsoft Corporation. CrowdStrike is not affiliated with, endorsed, or sponsored by Microsoft.
adam_cyber retweeted
🚀 Making history: CrowdStrike named a Leader in the inaugural @Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies!
📈 In the report, CrowdStrike is positioned furthest right for Completeness of Vision.
Learn more: crwdstr.ke/6013BBZAGB
