The Final Hour

Analyzing an active vishing campaign using a Teams and email-bombing combination

Sat, 08 Aug 2026 06:24:09 +0000

I should be driving to Vegas but instead I am sitting here fucking around with some asshole’s C2 infrastructure.

An e-mail bomb was launched against LA County users together with a coordinated vishing attempt via Teams. The intent was to execute the malware package described here.

Exhaustive report below including the IOCs. Reach out if you want access to the full malware and investigation package but since this is currently active you should be able to fully reproduce everything based on the report below.

Understanding Key Security Indicators (KSIs)

Thu, 23 Jul 2026 06:24:09 +0000

FedRAMP 20X is sort of around the corner, switching from the old approach of framework reliance to the new evidence-based verification method. In plain English, instead of checking the Implemented box on the SSP, you now have to provide machine-readable evidence. There are 46 KSIs, and every one will require persistent evaluation. Start preparing now, because this process will become exponentially more expensive year over year. I have warned people about the inflation for over a decade; I have always been proven right.

What if you don’t care about FedRAMP? If you want/need to be NIST compliant and/or you are taking your security posture seriously, you should start to implement at least a limited set of indicators now, targeting a full implementation by the end of 2027. This method of compliance testing is going to be the norm going forward.

Do interrupt your enemy when they are making a mistake

Wed, 22 Jul 2026 12:24:09 +0000

Maybe I am the idiot. Maybe this is the perfect moment for OpenAI to take a victory lap around Anthropic and their epic Fable Face Palm. Maybe they read the room and decided the right move is to announce that their system escaped its sandbox and oh btw check out this cool chart showing how sad Fable is! /highfive

Or this is going to backfire…

The Guide to BSides Las Vegas (Updated for 2026)

Sat, 18 Jul 2026 16:24:09 +0000

August 3-5
Tuscany Hotel and Casino
BSides Las Vegas website
($100 Early Bird Donation, $500: Donor + 1)

This is what Black Hat used to be before Cyber Insurance was a thing. Buy your ticket early for the best deal or you will have to pay the donor price. If you are already part of the IT industry, chances are you will find something to interest you.

DefCon Badge Museum

Sat, 18 Jul 2026 00:00:00 -0700

slightly dirty wall

I want to photograph and document all of my DefCon badges but for now it’s just a photo of my office wall. I should have used easier to clean paint.

Work in progress…

My Tech/AI Stack

Sat, 18 Jul 2026 00:00:00 -0700

Cloud Setup

Microsoft Azure+365 (~$300/month) Most importantly this has a small but fairly compelte E5 Buildout which accounts for roughly $150 A few honeypots, and a few small VMs and ocational testing accounts for another $100 with the rest being taken up by using Azure Backup and Storage. I used to have a more complete buildout but since 2020 the monthly costs skyrocketed to around $2800 and I went on a month long crusade to shut down everything that wasn’t immediatly necessary.

Qualifications

Sat, 18 Jul 2026 00:00:00 -0700

I have worked as an IT consultant since 1999, beginning my career installing Y2K patches for Hewlett-Packard. From technical support, I moved into software development before transitioning into cybersecurity in 2010. Since then, I have supported organizations ranging from small startups to some of the world’s largest companies, helping clients address challenges spanning PCI compliance, FedRAMP, privacy, export controls, incident response, and security operations.

My work has included developing cross-border privacy policies for telecommunications companies in the Middle East, helping Ukrainian drone manufacturers navigate ITAR requirements, and supporting forensic recovery and breach investigations. This breadth of hands-on experience allows me to quickly understand complex environments, identify practical solutions, and confidently take on projects where the stakes are high and the path forward is not always obvious.

Guide to Black Hat (Updated for 2026)

Fri, 17 Jul 2026 16:24:09 +0000

August (5-6) Briefings and Business Hall
Mandalay Bay Convention Center Las Vegas
(1000$ for Business Pass, 3000$ Briefings)

Briefings Schedule

This is the premier Cyber Security conference. It offers different types of entry packages. Buy early to get a discount or convince your work to pay (as they should).

My Bookmarks & Notes for July 2026

Sat, 11 Jul 2026 15:10:17 -0700

Microsoft Copilot on GovCloud got a large feature boost. Waiting on FedRAMP approval for Anthropic to enable Cowork. Copilot Calendar integration still 100% broken for Gov.

ChatGPT vibecoding the Codex app directly to production is a bold strategy; let’s see how it works out for them…

The Complete Guide to the week before Def Con

Mon, 06 Jul 2026 16:24:09 +0000

This guide is intended for anyone who is interested in joining the cyber security profession. People who might not be familiar with all the conferences that take place before Def Con or are looking to use these combined events to “dip their toes” into the many different areas of the profession.

My Bookmarks & Notes for June 2026

Tue, 30 Jun 2026 23:59:00 -0700

Elevated password spray activity across tenants. New actor spamming honeypots port 8080, same actor from Iran using proxies in Denver and Vegas to spam Azure CLI authentication endpoints.

Estimated that my API costs for things like Shodan, Censys, etc. have gone up 20% since the start of the year. I currently pay for 12 services. Time to start the annual cleanup

Phase 2 of CMMC delayed. Again.

Thu, 11 Jun 2026 12:24:09 +0000

Is this how Vladimir Putin feels? Expected a 3-day operation, but 5 years later you keep getting bombed?

CMMC Stage 2 has been effectively canceled until further notice, and CMMC AB is on the verge of irrelevance, if not complete collapse.

Fireside chats and refinery bombings will continue until morale improves…

Setting up a tiny honeypot on a tiny Oracle Always Free VM

Thu, 11 Jun 2026 12:24:09 +0000

What better way to spend a lovely Saturday afternoon than building a honeypot.

My Bookmarks & Notes for May 2026

Sun, 31 May 2026 23:59:00 -0700

Setting up new Herms Agent for a small team of 10. Email communication. Fully isolated and whitelisted. Using GPT 5.5 as model.

AI is not your friend

Mon, 04 May 2026 16:24:09 +0000

Jer Crane is the founder of PocketOS.

He is also someone who has no idea how LLMs work and should not be allowed near a production environment until he learns.

Instead of focusing on the (many) errors in judgment, I instead look at how basic AI governance would have prevented this comedy of errors.

My Bookmarks & Notes for April 2026

Thu, 30 Apr 2026 23:59:00 -0700

The words “Fireside Chat” are starting to cause panic attacks. Especialy when combined with “FedRAMP or CMMC”. CMMC in 2026.. still a nothingburger.

HOWTO: Teach users to correctly pick a Sensitivity Label

Sat, 11 Apr 2026 20:17:03 +0000

Teaching users how to correctly choose a sensitivity label is one of the most critical parts of any Microsoft Purview implementation.

The labels themselves may be technically configured correctly, but the deployment will still fail if users do not understand how to apply them. First impressions matter. The process needs to feel simple, predictable, and easy to explain, even when the underlying classification model is not always intuitive.

I have always used what I call the Sensitivity/Audience Rule.

3:00AM SOC2 is useless so now what?

Sat, 11 Apr 2026 12:24:09 +0000

It’s 3:00 AM and a client CIO is absolutely raging mad. I can almost feel little bits of spit hitting me through the monitor as she screams into her laptop (they now require face-to-face communications). Vendors are submitting vibe-coded reports that are so uniformly bad that you can easily identify Claude vs. ChatGPT down to the model version.

I know why I am on this call. Why are there 8 other people here?

My Bookmarks & Notes for March 2026

Tue, 31 Mar 2026 23:59:00 -0700

This Delve thing is going to cause trouble. Claude Code disclosure had a ton of interesting info, mostly confirming assumptions but also some new nuggets. Already everyone is renaming their AGENTS.md into SOUL.md. I am adding PRAYERS.md now..

My Bookmarks & Notes for February 2026

Sat, 28 Feb 2026 23:59:00 -0800

It feels like CISA has been hollowed out like a windows process. Its still running but you are not interacting with the same service anymore.

My Bookmarks & Notes for January 2026

Sat, 31 Jan 2026 23:59:00 -0800

New Year. Same as Old Year.

More inflation. Cost of my cloud + all the subscriptions is up 20% over 2025.

HOWTO: Use WinSCP to move files to and from your cloud VM

Wed, 14 Jan 2026 07:33:12 +0000

Could you have googled this or asked Claude? Yes. But you didn’t and they don’t have nice screenshots.

Contact Me

Mon, 01 Jan 0001 00:00:00 +0000

Have a question or want to discuss a project? Send me a message and include enough context for me to understand how I can help.