Chief Analyst, Google Threat Intelligence Group. @CYBERWARCON and @SLEUTHCON founder. Johns Hopkins professor. Army vet.
Joined May 2011
- Tweets23.7K
- Following1.3K
- Followers31.1K
- Likes30.7K
Pinned Tweet
What an amazing day. Thank you everyone who made #CYBERWARCON happen. I can’t express how great it was to see you after such a rough couple of years. We made it!
John Hultquist retweeted
KEY RACE ALERT: Tom Loftis projected to win reelection as mayor of Widow’s Bay
John Hultquist retweeted
Breaking News: A child in New York’s North Country died after contracting measles, officials said. Gov. Kathy Hochul called it the first such death in 30 years. nyti.ms/3WKjJtw
John Hultquist retweeted
Confirmed: Binance hacker routed stolen TRX through Bitget wallet bridge into ETH, dumping straight into a wallet previously used in the Phemex hack.
It's Lazarus, without a doubt.
Funny how an APT unit can orchestrate a $6.3B multi-chain heist, but still gets caught reusing old deposit targets from 2025.
Swapping TRX to native ETH as fast as humanly possible because they know mainnet ETH has no admin freeze button.
2024: DMM Bitcoin
2025: Phemex & Bybit
2026: Binance ($6.3B)
They don't even bother generating fresh deposit addresses anymore. Lazarus is just running an automated DevOps pipeline to turn Web3 liquidity into national treasury reserves.
Bridge TRX -> native ETH -> Tornado/privacy -> off-grid.
The industry keeps building bridges, and North Korea keeps using them as sovereign exit liquidity.
John Hultquist retweeted
I am confident this is UNC4899/TraderTraitor.
Cybersecurity research firms @trmlabs and Pangolin Intelligence said the heist appears to have been conducted by North Korea's TraderTraitor hacking group.
wsj.com/finance/currencies/b…
John Hultquist retweeted
We are actively investigating the potential exploit of Binance in coordination with industry partners. At present we are monitoring funds moving across multiple blockchains, including Bitcoin, Ethereum, Tron, and a number of L2s, and will support Binance throughout this investigation.
John Hultquist retweeted
How are compromised IP cameras supporting missile operations?
Sergey Shykevich examines Iranian targeting of IP cameras across the Middle East and Cyprus, and compares it with Russia’s use of the same technique, at #CYBERWARCON 2026.
Nov 20 | Arlington, VA + virtual
If you're a threat Intel pro that's been laid off and you want to come to @CYBERWARCON I have a ticket for you. Hit me up.
UNC1151 carrying out destructive attack.
#ESETresearch released the latest #ESETAPTActivityReport (Apr–Sep 2026): 🇧🇾 Belarus-aligned APT groups are converging with Russia'’s war priorities; for the first time, we documented a destructive cyberattack by a Belarus-aligned group in 🇺🇦 Ukraine web-assets.esetstatic.com/wl… 1/3
John Hultquist retweeted
SCOOP: Both Moonshot and DeepSeek distilled #OpenAI's Astra when developing their latest models (Kimi K3.1 & V4.1-Flash 1017), after Anthropic intensified the crackdown on distillation recently. w/ @JuroOsawa @QianerLiu via @theinformation theinformation.com/articles/…
John Hultquist retweeted
People kept asking me for “ARTEX signatures” and “Cairn indicators”, so I wrote this
We found useful fingerprints and wrote rules. But identifying the framework isn’t the same as covering the attacks it orchestrates.
I wanted to explain that distinction, why attribution gets harder, and how noisy attacks can still succeed by moving fast.
I expect these frameworks to have a much bigger impact in the coming months. It’s worth understanding the technology behind the current attack waves, because I suspect they’ll build into a flood.
#ARTEX #Cairn
nextron-systems.com/2026/10/…
🤖 Made with AI
Cloud growing at 103%!
Q3 is in the books! We’re now on a half-trillion annual revenue run rate, with Alphabet revenues growing at 25%.
- Our AI investments are driving overall Search query growth, including commercial queries - our YoY query growth rate is the highest it’s been in the last five years.
- Google Cloud revenue grew 103%, powered by extraordinary demand for our AI infrastructure and AI solutions. Our 1P model APIs now process nearly 32B tokens/min (up 40% QoQ).
- Strong momentum in model progress with Argon and Carbon leading the frontier, and Genie 4 our most advanced new world model yet.
Thanks to our partners and employees around the world. More to share on the call soon!
John Hultquist retweeted
I did say we'd be releasing our models periodically...introducing Gemini 4 Carbon, our next frontier model.
Following Argon's release just two weeks ago, Carbon shows the pace at which we’re pushing the frontier, it ranks #1 on the recently updated v5.0 of @ArtificialAnlys Intelligence Index at 59. It also leads across key cybersecurity evaluations scoring 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching.
We’re seeing significant improvements in long-horizon tasks even compared to Argon, and we’ve strengthened frontier safeguards.
As we did with Argon, we’re going to roll it out gradually + responsibly. Some trusted cyber defenders will get access starting this week. We'll be expanding it to more partners through our Fairwind Program, ahead of wider availability soon, so hang tight!
John Hultquist retweeted
LLMs are great at finding bugs, but so are fuzzers. @5aelo compared the vulnerabilities found in V8 by BigSleep, an agentic system, with those found by the Fuzzilli fuzzer.
projectzero.google/2026/10/f…
John Hultquist retweeted
So happy to see my workshop being shared,
Thanks for putting together this helpful breakdown :)
Google just dropped a free 2-hour workshop on multi-agent systems, Loops and Graphs
From your first agent to a whole team that sees, hears and runs on its own:
0% → 00:09 - What you're building: an AI agent that sees, hears and talks back
30% → 36:55 - Build your first multi-agent system from scratch
45% → 56:11 - Give every agent its own MCP tools
75% → 1:09:28 - Sequential, parallel and loop agents, wired into one graph
100% → 2:05:07 - The whole system running live, reacting in real time
Agents → Tools → Loops → Graphs → Autonomous Systems
Most people are still tweaking the prompt of their very first agent
Worth more than any $2,000 agentic engineering course
Bookmark and watch it today
Then read how to run a system like this in the harness engineering guide below ↓
John Hultquist retweeted
important reminder: "The FEC does not play a role in administering US elections and the outage should have no effect on voters' ability to cast ballots."
BREAKING: A hacker is attempting to breach the US Federal Election Commission's systems and that agency has had to 'temporarily shut down' its web-facing services as a result, according to an email seen by Reuters reut.rs/4imQyUu
John Hultquist retweeted
Behold: The US Defense Intelligence Agency has released a report on challenges to security in space, including an NEI image of China’s spaceplane from Maxar, taken in 2024.
