A few days old, but what a read. A Lumma infection gave up, among others things, definitive proof of DPRK attribution for the Polyfill compromise. Also solid details on fake IT employee tradecraft.
CSIRT primarily, currently doing large-scale detection engineering. I ❤️ ISO 8601
Spent a good amount of time in intelligence, ran operations for a vulnerability database, and worked a lot on some industry standards working groups CVSS (v2, v3), CPE (2.3). Did PSIRT a few places, too.
Do a lot with OpenBSD, Python, and Oxford commas. Worked as a manager for some world-class, global teams. Use that experience as a super power now that I’m back as a senior technical IC.
| Pronouns | He/Him |
| Commas | Oxford |
| Timestamps | ISO8601 |
| Github | https://www.github.com/SethHanford |
| Website | https://trustworth.ee/SethHanford.html |
| :otter: | :otter: |






🇪🇺