🐀 
| Works at | Sophos |
| Works as | Principal Threat Researcher |
| Non-Infosec things | birds, pottery, shoulder cats, media criticism, natsec |
| https://twitter.com/thepacketrat | |
| blog | https://fancybearfriends.org |
| Work blog | https://news.sophos.com/en-us/author/sean-gallagher/ |
An anonymous submission: Stop watering dead flowers
This post is a follow-up to an earlier anon submission --editor Stop Watering Dead Flowers I have been walking through the long dusk since the burn. Smoke still in my lungs. It has been almost a year since the last time I wrote about it. Ghosts of what should have been, scattered in the corners. I thought we were watching a slow slide.
http://thepacketrat.com/2026/06/09/an-anonymous-submission-stop-watering-dead-flowers/
It was recently pointed out to me that I had let my profile bio fester. Yes, I am at Cisco Talos now. Last week was the anniversary (roughly) of my interview for the job, precipitated by the layoff of half my team at Sophos (including Andrew Brandt, who just landed at Huntress).
In a few years maybe no one will even remember my time at Ars Technica, now 6 years in the rear view ago.
Cisco Talos research has uncovered agentic AI workflow automation platform abuse in emails. Recently, we identified an increase in the number of emails that abuse n8n, one of these platforms, from as early as October 2025 through March 2026.
burritosec 
