hakan “

1.9K Followers
367 Following
18 Posts

Hi there. I. am working as a reporter and covering cybersecurity, mostly I'm interested in APT-related research. I'm with "paper trail media" and Der Spiegel.

If you want to check out the work I'm doing, here are some useful links: https://linktr.ee/hakantanriverdi

I gave a presentation at Virusbulletin this year in which I describe the process of reporting and then fact-checking tips I get while working on these types of stories: https://www.youtube.com/watch?v=rtlTF1Ajjdw

twitterhttps://twitter.com/hatr/status/1589374562957156352
articles etc.linktr.ee/hakantanriverdi
WSJ - An American citizen now appears to be in charge of Mexico’s most powerful drug cartel, potentially complicating US efforts to eradicate that country’s narcotics trade. https://www.wsj.com/world/americas/mexican-drug-kingpin-american-citizen-7a8a9c2f?st=SQS5te&reflink=article_copyURL_share

Former head of german intel agency (BND) was successfully targeted by the Signal-Support scam that dutch intelligence agencies link to Russia, reports Der Spiegel

https://www.spiegel.de/politik/deutschland/spionage-ehemaliger-bnd-vize-wird-opfer-von-cyberangriff-a-3fb118d6-b740-4e09-bfa2-6bf67c3fd1e9

Spionage: Cyberangriff gegen ehemaligen BND-Vize

Die Angriffswelle gegen Nutzerkonten bei Signal und WhatsApp betrifft sensible Ziele. In Deutschland gehörten nach SPIEGEL-Informationen Beamte in Sicherheitsbehörden und hochrangige Politiker zu den Betroffenen.

DER SPIEGEL

"Congress created a special Pentagon office to prevent the accidental targeting of civilians but it was dramatically scaled back by Secretary of Defense Pete Hegseth soon after he took office last year."

"The civilian mitigation teams – cut by 90% by Hegseth – work with military commanders on target planning, and making sure that targets are actually military sites."

"The U.S. official told NPR that Hegseth's decision to scale back those efforts meant that the U.S. Central Command, which oversees U.S. forces in the Middle East, had only one staffer assigned to civilian casualty mitigation operations. "

https://www.npr.org/2026/03/11/nx-s1-5744981/pentagon-iran-missile-school-hegseth

RE: https://infosec.exchange/@hatr/116205045499785435

Hakan with a great, brief writeup on linking 100+ Doppelganger/SDA domains thanks to a single unique string in their Wordpress setup.

Highly recommend you go follow him if you have not already.

Short newsletter item about one mistake from disinfo operations #Doppelgänger that makes it possible to tie together >100 domains

https://buttondown.com/readwrite/archive/edition-11-one-mistake-ties-together-more-than/

Edition 11 – One mistake ties together more than 100 domains

Hey there, Hakan here. This week's edition is going to be a short one about mistakes. Without those, it'd be a whole lot harder to do my job. When trying to...

readwrite

"Two former employees of government contractor L3Harris told TechCrunch that Coruna was, at least in part, developed by the company’s hacking and surveillance tech division, Trenchant"

https://techcrunch.com/2026/03/09/an-iphone-hacking-toolkit-used-by-russian-spies-likely-came-from-u-s-military-contractor/

The mystery of a globetrotting iPhone-hacking toolkit

Tools used in a series of hacking campaigns by hackers in Russia, Ukraine, and China may have originated inside U.S. government contractor L3Harris, TechCrunch has learned.

TechCrunch

"One striking difference is the poor performance of the Russian military and the sophistication of the U.S. and Israeli air campaign. But analysts say that the value of military firepower is limited when it is not clear what it is supposed to achieve.

And the United States’ objectives keep shifting. Mr. Trump on Friday demanded “unconditional surrender” by Iran, while members of his cabinet have presented various, more limited goals, like destroying Iran’s nuclear program and its missile arsenal."

https://www.nytimes.com/2026/03/08/us/politics/trump-russia-ukraine-iran-war.html

How Trump’s War in Iran Has Echoes of Putin and Ukraine

The many similarities between the White House’s justification for war in Iran and Russia’s messaging on Ukraine underscore the risks of a vaguely defined, open-ended war.

The New York Times

"When Futurism reached out to the Pentagon regarding the use of AI in recent military operations — specifically the targeting of the Shajareh Tayyebeh girls’ school — we were referred to US CENTCOM, one of eleven unified commands under the Pentagon’s umbrella.

“We have nothing for you on this at this time,” CENTCOM said."

https://futurism.com/artificial-intelligence/pentagon-ai-claude-bombing-elementary-school

Pentagon Refuses to Say If AI Was Used to Select Elementary School as Bombing Target

Did the US military use Anthropic's Claude to select targets in its weekend operations in Iran, with devastating results?

Futurism

If you're following the situation in Iran, this one is of interest to you.

Today, we're publishing a story that I find very important for many reasons.

We can prove how the regime in Iran is using facial recognition software to surveil its citizens. We have obtained videos showing the software in a live-scenario, at metro stations in Teheran. We have contracts, and we have had a look at the code, built by the Russian company Ntechlab whose algorithms are deemed to be best-in class.

We spoke with a dozen people who know the regime, either because they had to flee after being imprisoned or from a technical point of view.

All of this, and more, you can find in our reporting, #EyesOfIran. Here are the links:

SPIEGEL: https://www.spiegel.de/ausland/iran-so-gnadenlos-spaeht-regime-die-eigene-bevoelkerung-aus-ein-insider-packt-aus-a-7990ef28-3c9d-427b-be9a-5f46d06bea6c?giftToken=7fdb6b96-b2f1-4799-b8ff-e55fed5496d1

Standard: https://www.derstandard.at/story/3000000310751/ein-regime-im-ueberlebensmodus-leak-zeigt-irans-massive-ueberwachung-im-land?ref=niewidget

ZDF: https://www.zdf.de/play/magazine/frontal-das-magazin-100/datenleak-iran-ueberwachung-gesichtserkennung-software-100

Forbidden Stories: https://forbiddenstories.org/iran-regime-monitors-citizens/

Ein Insider packt aus: So gnadenlos späht Irans Regime die eigene Bevölkerung aus

US-Präsident Trump fordert die Iraner auf, das Regime zu stürzen. Doch die Führung in Teheran hat einen gigantischen Überwachungsapparat erschaffen. SPIEGEL-Recherchen gewähren Einblick in das Spähsystem der Mullahs.

DER SPIEGEL

So, Enisa, the cybersecurity agency of the EU, releases a yearly Threat Landscape. In the 2025 edition, they've used AI. And the AI introcuded loads of errors. Five percent of all the links end up 404

One of the researchers.(@wavehackr) told me: "You just had to click once", to check whether the links are valid or not. Upon closer inspection, you'd notice something was amiss just by looking, i.e., Enisa referenced a blogpost by MSFT. The link has "APT29" in it. Microsoft is very picky about those names.

They even have a blogpost about their naming convention (https://learn.microsoft.com/en-us/unified-secops/microsoft-threat-actor-naming) What other companies call APT29, MSFT calls "Midnight Blizzard". The AI apparently didn't dig those subtleties.

Here's the story
https://www.derstandard.at/story/3000000303214/peinliche-panne-bericht-der-eu-agentur-fuer-cybersicherheit-mit-ki-verfasst-und-fehlerhaft

How Microsoft names threat actors - Unified security operations

Learn how Microsoft names threat actors and how to use the naming convention to identify associated intelligence.